DOE-HDBK-1224-2024, Hazard and Accident Analysis Handbook

DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. DOE-HDBK-1224-2024 February 2024 DOE HANDBOOK HAZARD AND ACCIDENT ANALYSIS U.S. Department of Energy Washington, D.C. 20585 DOE-HDBK-1224-2024 ii FOREWORD This U.S. Department of Energy (DOE) Handbook is approved for use by all DOE elements and their contractors. It may be applied to upgrading existing Documented Safety Analyses (DSAs) to the requirements of DOE-Standard (STD)-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, or to revising DSAs for existing facilities based on their current safe harbor methodology. The Handbook may also be used to prepare and document hazard and accident analyses during facility design. This Handbook is intended to assist DOE and its contractors in preparing and reviewing DSAs that are cost-effective and consistent in quality and content. To this end, the Handbook provides information on applicable scientific theories, analysis techniques, practical examples, and lessons learned from DOE applications and experience. The Handbook addresses these subjects: • Process for preparing a safety analysis, specifically the Chapter 3 portion of the DSA; • Hazard analysis; • Accident analysis; • Major accident types, such as fires, explosions, spills, chemical reactions, natural phenomena hazard events, man-made external events, and wildland fires; • Source term analysis; • Atmospheric and aquatic dispersion; • Radiological consequence assessment; • Chemical dispersion and consequence analysis; • Hazard control selection and classification; and • Criticality accident analysis. DOE Order 252.1A, Admin. Chg. 1, Technical Standards Program, states that DOE handbooks provide “a compilation of good practices, lessons-learned, or reference information that serve as resources on specific topics.” The guidance provided in this Handbook is not mandatory and may be used at the discretion of DOE contractors and field offices. This Handbook was issued for a two-year “Interim Use” period in July 2018 because it was the first publication of a very large and technically complex document. The interim use period has concluded, and appropriate comments and new material have been incorporated into this version. Comments (recommendations, additions, and deletions), as well as any pertinent data that may be of use in improving this document, should be emailed to: nuclearsafety@hq.doe.gov or sent to: Office of Nuclear Safety (EHSS-30) Office of Environment, Health, Safety and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 Phone (301) 903-2996 DOE-HDBK-1224-2024 iii ACKNOWLEDGMENTS This Handbook represents a multidisciplinary product of multiple authors and contributors who have worked in some capacity in the DOE nuclear weapons complex. In the table below, DOE acknowledges the contributions of the many professionals who authored or reviewed various sections of this document.

Contributor DOE or Contractor Affiliation DOE Nuclear Sites Ron Beaulieu National Security Technologies Nevada National Security Site Sandra Brereton Lawrence Livermore National Laboratory Lawrence Livermore National Laboratory R.T. Brock DOE Amarillo Area Office Pantex Plant Kevin Carroll Lawrence Livermore National Laboratory Lawrence Livermore National Laboratory Roger Casteel DOE Office of Science Oak Ridge National Laboratory Chris Chaves DOE Office of Nuclear Safety DOE Headquarters Doug Clark Consolidated Nuclear Security Y-12 National Security Complex David Compton Project Enhancement Corporation DOE Headquarters Carlos Corredor DOE Office of Public Radiation Protection DOE Headquarters Allan Coutts AECOM Savannah River Site Doug Craig Advanced Technologies & Laboratories Savannah River Site Dick Englehart DOE Office of Nuclear Safety and PEC DOE Headquarters Brad Evans Pacific Northwest National Laboratory Hanford Site Derek Favret DOE Office of Public Radiation Protection DOE Headquarters Terry Foppe Link Technologies/Foppe & Associates Rocky Flats and other DOE sites Lyndsey Fyffe DOE Office of Nuclear Safety DOE Headquarters Caroline Garzon DOE Office of Nuclear Safety DOE Headquarters Chuck Grigsby Los Alamos National Laboratory Los Alamos National Laboratory Brent Gutierrez Savannah River Site Savannah River Site Mukesh Gupta Amentum Savannah River and other DOE sites David Hesse Battelle Columbus Laboratories Multiple DOE sites Jerry Hicks DOE Criticality Safety Support Group NNSA Albuquerque Service Center Quazi Hossain Lawrence Livermore National Laboratory Lawrence Livermore National Laboratory Roy Hunt Consolidated Nuclear Security Y-12 National Security Complex Lee Hyder Savannah River Nuclear Solutions Savannah River Site Kamiar Jamali DOE Office of Nuclear Safety DOE Headquarters Sharon Jasim-Hanif DOE Office of Nuclear Safety DOE Headquarters Adam Jivelekas Washington River Protection Solutions Hanford Site Hans Jordan Innovative Technology Solutions Rocky Flats Kevin Kimball Consolidated Nuclear Security Y-12 National Security Complex and Pantex Plant Craig Kullberg NNSA Los Alamos Field Office Los Alamos National Laboratory Roger Lanning Bechtel National Hanford Site Bob Marusich Fluor Daniel Hanford Site Carl Mazzola Project Enhancement Corporation Multiple DOE sites John McAllister Amentum Hanford and Savannah River Sites Patrick McClure Los Alamos National Laboratory Los Alamos National Laboratory DOE-HDBK-1224-2024 iv Contributor DOE or Contractor Affiliation DOE Nuclear Sites Steven McDuffie DOE EM Chief of Nuclear Safety staff DOE Headquarters Tom McLaughlin DOE Criticality Safety Support Group Supporting NNSA Headquarters Jofu Mishima SAIC Multiple DOE sites Rich Miller Sonalysts Los Alamos National Laboratory and other DOE sites Jim Morman DOE Criticality Safety Support Group Argonne National Laboratory Bob Nelson DOE Richland Hanford and other DOE sites James O’Brien DOE DOE Headquarters Kevin O’Kula Amentum Savannah River Site Shirley Olinger DOE Rocky Flats Project Office Rocky Flats Ingle Paik Westinghouse Safety Management Solutions Savannah River Site Jane Peel Westinghouse Safety Management Solutions Savannah River Site Vern Peterson Link Technologies/AB Consulting Rocky Flats and other DOE sites David Pinkston Lawrence Livermore National Laboratory Lawrence Livermore National Laboratory Marty Plys Fauske & Associates Oak Ridge National Laboratory and other

DOE sites Louis Restrepo Project Enhancement Corporation Multiple DOE sites Sam Rosenbloom DOE Office of Nuclear Safety DOE Headquarters Rama Sastry DOE Office of Nuclear Safety DOE Headquarters Daniel Schmitt Hukari Technical Services Los Alamos National Laboratory Jim Schornhorst Westinghouse Safety Management Solutions Savannah River Site Garrett Smith DOE Office of Nuclear Safety Director DOE Headquarters Chris Steele DOE Los Alamos Field Office Los Alamos National Laboratory Don Swanson Triad Safety Engineering Rocky Flats Dave Thoman Amentum Savannah River Site Ivan Trujillo NNSA Albuquerque Service Center NNSA Headquarters Joe Vera Bechtel National Hanford Site Doug Wenzel Lockheed Martin Idaho Technologies Idaho National Laboratory Site Bob Wilson DOE Environmental Management DOE Headquarters Jeff Woody Link Technologies Oak Ridge National Laboratory and other DOE sites Al Wooten Amentum Savannah River Site Ray Yeung Amentum Savannah River Site Bruce Zimmerman Washington River Protection Solutions Hanford Site DOE-HDBK-1224-2024 v TABLE OF CONTENTS FOREWORD .......................................................................................................................... ii ACKNOWLEDGEMENTS...................................................................................................... iii LIST OF FIGURES................................................................................................................ xii LIST OF TABLES...................................................................................................................xv ACRONYMS AND ABBREVIATIONS...................................................................................xvii 1 INTRODUCTION ........................................................................................................... 1 1.1 Purpose.............................................................................................................................1 1.2 Outline .............................................................................................................................2 2 HAZARD ANALYSIS ...................................................................................................... 3 2.1 Elements of Hazard Analysis................................................................................................3 2.2 Hazard Identification and Characterization .............................................................................3 2.2.1 Hazard Data Gathering ................................................................................................. 4 2.2.2 Hazard Data Recording ................................................................................................ 4 2.2.3 Hazard Summary Development ....................................................................................10 2.2.4 Exclusion of Standard Industrial Hazards and Other Hazardous Materials ........................... 11 2.3 Initial Hazard Evaluation Development................................................................................ 14 2.3.1 Overview ..................................................................................................................14 2.3.2 Nuclear Criticality Hazard Evaluation............................................................................16 2.3.3 Chemical Hazard Evaluation ........................................................................................17

2.4 Hazard Evaluation Methods ............................................................................................... 17 2.4.1 Commercial Industry Methods and DSA Hazard Evaluations ............................................17 2.4.2 Method 1: What-If? ....................................................................................................18 2.4.3 Method 2: HAZOP Analysis .........................................................................................19 2.4.4 Method 3: Failure Modes and Effects Analysis ................................................................23 2.4.5 Method 4: Event Trees and Fault Trees ..........................................................................24 2.5 Initial Development of a DSA Hazard Evaluation Table ......................................................... 25 2.6 Likelihood, Consequence, and Risk Methods ........................................................................ 26 2.6.1 Qualitative Consequences ............................................................................................26 2.6.1.1 Receptor Consequence Levels .................................................................................26 2.6.1.2 Facility Worker Consequences ................................................................................28 2.6.1.3 Standard Industrial Hazard Consequences to Facility Worker .......................................32 2.6.2 Qualitative Likelihood.................................................................................................34 2.6.3 Qualitative Risk .........................................................................................................36 2.7 Unmitigated and Mitigated Hazard Evaluations..................................................................... 36 2.8 Hazard Evaluation Presentation in DSA ............................................................................... 37 3 ACCIDENT ANALYSIS..................................................................................................41 3.1 Accident Type Selection .................................................................................................... 41 3.2 Accident Analysis Process ................................................................................................. 42 3.3 Analysis Inputs and Assumptions........................................................................................ 43 3.4 Beyond Design Basis/Beyond Evaluation Basis Accidents ...................................................... 45 3.5 Software Quality Assurance (SQA) ..................................................................................... 48 4 EVALUATION OF EFFECTS OF MAJOR ACCIDENT TYPES .......................................50 4.1 Introduction..................................................................................................................... 50 4.1.1 Information from Accident Analysis to Include in the DSA ...............................................50 4.2 Fire Scenario Analysis....................................................................................................... 51 4.2.1 Fire Scenarios ............................................................................................................52 DOE-HDBK-1224-2024 vi 4.2.2 Fire Analysis..............................................................................................................53 4.2.2.1 Example Analytical Methods ..................................................................................54

4.2.2.1.1 Heat Release Rate............................................................................................55 4.2.2.1.2 Pool Fire Heat Release Rate ..............................................................................55 4.2.2.1.3 Pallet Fire Heat Release Rate.............................................................................56 4.2.2.1.4 Flame Height ..................................................................................................57 4.2.2.1.5 Enclosure Fire Dynamics ..................................................................................57 4.2.2.1.5.1 Pre-flashover............................................................................................. 58 4.2.2.1.5.2 Flashover.................................................................................................. 59 4.2.2.1.6 Solid Fuel Ignition and Radiant Heating ..............................................................60 4.2.3 Source Term Calculation for Fire Scenarios ....................................................................62 4.2.3.1 Effect on Hazardous Material..................................................................................63 4.2.3.1.1 Determining MAR for the Fire Event..................................................................63 4.2.3.1.2 Determining DR and ARF/RF for the Fire Event ..................................................63 4.2.3.2 Thermal Effects ....................................................................................................64 4.2.3.3 Smoke Damage.....................................................................................................65 4.3 Explosion Scenario Analysis .............................................................................................. 66 4.3.1 Explosion Event Types and Scenarios ............................................................................67 4.3.2 Explosions Analysis ....................................................................................................72 4.3.2.1 Pressure Vessel Burst .............................................................................................72 4.3.2.1.1 Overpressure and Impulse Associated with Pressure Vessel Burst............................73 4.3.2.1.2 Fragmentation from Pressure Vessel Burst ...........................................................81 4.3.2.1.3 Thermal Effects from Pressure Vessel Burst .........................................................87 4.3.2.2 Boiling Liquid Expanding Vapor Explosion (BLEVE) ................................................87 4.3.2.2.1 Blast Effect from BLEVE .................................................................................88 4.3.2.2.2 Fragmentation from BLEVE .............................................................................88 4.3.2.2.3 Thermal Effects from BLEVE ...........................................................................88 4.3.2.3 Vapor Cloud Explosion ..........................................................................................90 4.3.2.3.1 Vapor Cloud Deflagration .................................................................................90 4.3.2.3.2 Vapor Cloud Detonation ...................................................................................90 4.3.2.3.3 Vapor Cloud Deflagration and Detonation Practical Differences..............................90 4.3.2.3.4 Blast Effect from Vapor Cloud Explosion ............................................................91 4.3.2.3.5 Fragmentation from Vapor Cloud Explosion ........................................................99 4.3.2.3.6 Thermal Effect from Vapor Cloud Explosion .......................................................99

4.3.2.4 Flash Fire.............................................................................................................99 4.3.3 Consequences of Explosions Beyond Releases Of Hazardous Materials ..............................99 4.3.3.1 Damage Caused by Overpressure (Detonations and Deflagrations) ...............................99 4.3.3.2 Damage Caused by Fragmentation......................................................................... 101 4.3.3.3 Damage Caused by Thermal Effects to Facility Workers ........................................... 101 4.3.3.4 Damage Caused by Thermal Effects to SSCs ........................................................... 104 4.3.4 DOSE Calculation for Explosion Scenarios .................................................................. 104 4.3.4.1 Explosion MAR.................................................................................................. 104 4.3.4.2 Explosion Damage Ratio (DR) .............................................................................. 105 4.3.4.3 Explosion ARF/RF .............................................................................................. 105 4.3.4.4 Explosion Release Duration .................................................................................. 106 4.3.5 Source Term (ST) Calculation for Hydrogen Explosion .................................................. 106 4.3.5.1 Gas Explosion ST ............................................................................................... 109 4.3.5.2 Gas Deflagration ST ............................................................................................ 110 4.4 Spills ............................................................................................................................ 112 4.4.1 Types of Loss of Confinement/Spills and Scenarios ....................................................... 112 DOE-HDBK-1224-2024 vii 4.4.2 Analysis of Spills ..................................................................................................... 113 4.4.2.1 Glovebox Spills .................................................................................................. 113 4.4.2.2 Material Handling and Waste Container Accidents ................................................... 114 4.4.2.3 Over-pressurizations ............................................................................................ 114 4.4.2.3.1 Pressurized Powder Releases ........................................................................... 114 4.4.2.3.2 Pressurized Liquid Releases ............................................................................ 115 4.4.2.4 Aerodynamic Entrainment .................................................................................... 115 4.5 Analysis of Chemical Reactions ....................................................................................... 116 4.5.1 Organic-based Ion Exchange Resin Reaction ................................................................ 116 4.5.1.1 Reactions of Nitric Acid with Organic Materials ...................................................... 117 4.5.1.2 Composition and Reactions of Ion Exchange Resins ................................................. 117 4.5.1.3 Chemical Degradation of Ion Exchange Resins ........................................................ 118 4.5.1.4 Radiation Effects on Ion Exchange Resins .............................................................. 118 4.5.1.5 Incidents Involving Chemical Reactions of Resins ................................................... 118 4.5.1.6 Discussion of Accident Conditions......................................................................... 119

4.5.2 Red Oil Reaction ...................................................................................................... 119 4.5.2.1 Background and Prior Red Oil Incidents ................................................................. 119 4.5.2.2 Discussion of Red Oil Accident Conditions ............................................................. 122 4.5.2.3 Approach to Preventing Red Oil Accidents ............................................................. 123 4.5.2.4 Preventive Controls ............................................................................................. 124 4.5.3 Organic Reaction Event ............................................................................................. 124 4.5.3.1 Background and Discussion .................................................................................. 124 4.5.3.2 Analytical and Test Methods ................................................................................. 125 4.5.3.3 Prevention and Mitigation .................................................................................... 126 4.5.4 Hydroxylamine Nitrate Reaction ................................................................................. 126 4.5.4.1 Prevention and Mitigation .................................................................................... 127 4.5.5 Chemical Reactions Accident Analysis......................................................................... 127 4.6 Natural Phenomena Hazard (NPH) Events ......................................................................... 128 4.6.1 NPH Event Types ..................................................................................................... 128 4.6.2 NPH Event Analysis Overview ................................................................................... 128 4.6.2.1 Accident Analysis for a New Nuclear Facility or Major Modification .......................... 128 4.6.2.2 Accident Analysis for Existing Nuclear Facility DSA ............................................... 129 4.6.2.3 General Methodology .......................................................................................... 131 4.6.3 Seismic Events ......................................................................................................... 132 4.6.4 Extreme Wind Events................................................................................................ 133 4.6.5 Flood and Precipitation Events ................................................................................... 133 4.6.6 Lightning Events ...................................................................................................... 134 4.6.7 Volcanic Eruption and Ashfall Events .......................................................................... 137 4.6.8 Wildland Fires ......................................................................................................... 138 4.6.8.1 Wildland Fire Event Description and Analysis ......................................................... 138 4.6.8.2 Example: Wildland Fire Facility/Structure Hazard Assessment ................................... 140 4.7 Man-Made External Events.............................................................................................. 145 4.7.1 Aircraft Crashes ....................................................................................................... 145

4.7.1.1 Screening Analysis .............................................................................................. 146 4.7.1.2 Aircraft Crash Damage Assessment ....................................................................... 148 4.7.2 Vehicle Crashes ........................................................................................................ 148 4.7.2.1 Vehicle Crash into Facility.................................................................................... 148 4.7.2.2 Onsite Transportation Accident ............................................................................. 149 4.7.3 Loss of Power to Safety-related SSCs .......................................................................... 150 5 SOURCE TERM ANALYSIS ........................................................................................ 152 DOE-HDBK-1224-2024 viii 5.1 Introduction................................................................................................................... 152 5.2 Radiological Source Term Components ............................................................................. 152 5.2.1 Material at Risk........................................................................................................ 153 5.2.1.1 Overview of Requirements, Guidance, and Practices for Identifying MAR................... 153 5.2.1.2 Examples for Identifying MAR ............................................................................. 155 5.2.2 Determining the Damage Ratio (DR) ........................................................................... 158 5.2.2.1 Overview of Requirements, Guidance, and Practices ................................................ 158 5.2.2.2 Examples ........................................................................................................... 159 5.2.3 Airborne Release Fraction and Respirable Fraction (ARF/RF) ......................................... 164 5.2.3.1 Overview of Requirements, Guidance, and Practices for Determining ARF/RF............. 164 5.2.3.2 Examples for Determining ARF/RF ....................................................................... 175 5.2.4 Airborne Release Rate (ARR)..................................................................................... 176 5.2.5 Leak path Factor (LPF).............................................................................................. 177 5.2.5.1 Filtration LPF ..................................................................................................... 178 5.2.5.2 LPF Modeling .................................................................................................... 179 5.3 Chemical Release ST ...................................................................................................... 181 5.4 Appropriateness of ST..................................................................................................... 183 5.4.1 Adequate Technical Basis to Depart from Default or Bounding Values.............................. 184 6 ATMOSPHERIC DISPERSION .................................................................................... 187 6.1 Introduction................................................................................................................... 187 6.2 Key Receptors ............................................................................................................... 188 6.3 Meteorological Parameters Affecting Dispersion ................................................................. 189

6.3.1 Wind Speed, Wind Direction, and Wind Direction Standard Deviations ............................ 190 6.3.1.1 Wind Speed........................................................................................................ 190 6.3.1.2 Wind Direction ................................................................................................... 191 6.3.1.3 Wind Direction Standard Deviations ...................................................................... 191 6.3.2 Wind Speed Profile with Height.................................................................................. 191 6.3.3 Mixing Layer Height................................................................................................. 192 6.3.4 Vertical Temperature Profiles...................................................................................... 193 6.3.5 Precipitation ............................................................................................................ 194 6.3.6 Temperature and Relative Humidity ............................................................................ 194 6.4 Gaussian Plume Model for Neutrally Buoyant Plumes ......................................................... 194 6.4.1 Basic Gaussian Equations .......................................................................................... 194 6.4.2 Gaussian Plume Widths and Depths............................................................................. 197 6.4.2.1 Atmospheric Stability Classes ............................................................................... 198 6.4.2.2 Methods of Calculating Stability Classes ................................................................ 199 6.4.2.3 Methods of Calculating Plume Width and Plume Thickness ....................................... 202 6.5 Characterization of Meteorological and Site Data ................................................................ 206 6.5.1 Default Meteorological Conditions and Persistence........................................................ 208 6.5.2 Joint Frequency Distribution ...................................................................................... 209 6.5.3 Full Data Set Sampling.............................................................................................. 209 6.5.4 Treatment of Calm and Variable Winds ........................................................................ 210 6.6 Meteorological Data Adequacy for Safety Analysis ............................................................. 212 6.7 Typical and Unfavorable Dispersion Conditions .................................................................. 213 6.8 Special Gaussian Modeling Considerations ........................................................................ 214 6.8.1 Averaging-Time and Large-Eddy Plume Meander.......................................................... 214 6.8.2 Mechanical Turbulence Due to Surface Roughness ........................................................ 217 6.8.3 Aerodynamic Effects of Buildings............................................................................... 220 6.8.4 Plume Modifications Through Decay, Daughter In-Growth, and Deposition Processes ........ 223 6.8.5 Elevated Plumes, Including Plume Rise ....................................................................... 227 DOE-HDBK-1224-2024 ix

6.8.5.1 Momentum Plume Rise........................................................................................ 228 6.8.5.2 Buoyancy Plume Rise .......................................................................................... 230 6.8.6 Plume Impaction ...................................................................................................... 232 6.9 DOE Central Registry of Radiological Dispersion and Consequence Analysis Codes ................ 232 6.9.1 MACCS2 ................................................................................................................ 239 6.9.2 GENII..................................................................................................................... 240 6.9.3 HOTSPOT .............................................................................................................. 241 6.10 Atmospheric Dispersion Options In DOE-STD-3009-2014 ................................................... 241 6.11 Atmospheric Dispersion Modeling Protocol ....................................................................... 242 6.12 Non-Gaussian Dispersion Modeling .................................................................................. 249 6.12.1 Dispersion under Extreme Wind or Tornado Event......................................................... 249 6.12.2 Finite Plume External Dose Modeling.......................................................................... 250 6.12.3 Plumes from Energetic Events .................................................................................... 251 6.13 Co-located Worker Dispersion Factor ................................................................................ 253 6.13.1 Technical Report for CW x/Q value ............................................................................. 253 6.13.2 Alternate χ/Q Value Justification ................................................................................. 254 6.13.2.1 Hand Calculations for a χ/Q Value where the Default Value is Not Appropriate ............ 254 6.13.2.2 Computer Modeling for a χ/Q Value where the Default Value is Not Appropriate .......... 255 7 AQUATIC DISPERSION AND GROUNDWATER TRANSPORT ................................... 257 7.1 Overview ...................................................................................................................... 257 7.2 NRC Regulatory Guidance on Aquatic Disperation and Dose Calculation ............................... 258 7.3 Documented Safety Analysis Approach ............................................................................. 258 7.4 Liquid Effluent Release Key Receptors.............................................................................. 259 7.5 Liquid Effluent Release Redistribution Mechanisms and Uptake ........................................... 259 7.5.1 Initial Mixing........................................................................................................... 259 7.5.2 Far-Field Mixing ...................................................................................................... 259 7.5.3 Deposition And Resuspension In Sediments.................................................................. 260 7.5.4 Uptake Mechanisms.................................................................................................. 261

7.6 Aquatic Dispersion Models and Comparisons ..................................................................... 261 7.6.1 Classes of Aquatic Dispersion Models ......................................................................... 261 7.6.2 Aquatic Dispersion Model Attributes and Characteristics ................................................ 262 7.6.3 Comparison of Aquatic Dispersion Models ................................................................... 262 7.6.3.1 LADTAP2 ......................................................................................................... 262 7.6.3.2 STREAM II ....................................................................................................... 263 7.6.3.3 GENII 2.10.1...................................................................................................... 263 7.6.3.4 RIVER-RAD...................................................................................................... 263 7.6.3.5 DISPERS........................................................................................................... 263 7.7 Groundwater Transport ................................................................................................... 264 7.7.1 Overview ................................................................................................................ 264 7.7.2 Groundwater Flow and Contaminant Transport ............................................................. 264 7.7.3 Tritium in Sediments ................................................................................................. 265 7.7.4 Groundwater Transport Model Considerations .............................................................. 265 8 RADIOLOGICAL CONSEQUENCE ASSESSMENT ..................................................... 266 8.1 Fundamentals ................................................................................................................ 266 8.1.1 Types of Radiation .................................................................................................... 267 8.1.2 Nuclear Fission ........................................................................................................ 268 8.1.3 Radioactivity ........................................................................................................... 269 8.2 Effects of Radiation on the Body ...................................................................................... 270 8.2.1 Dose Evaluations...................................................................................................... 270 DOE-HDBK-1224-2024 x 8.2.2 Inhalation (Plume) Dose ............................................................................................ 274 8.2.3 Cloudshine Dose ...................................................................................................... 277 8.2.4 Groundshine Dose .................................................................................................... 277 8.2.5 Prompt (Direct) Dose ................................................................................................ 278 8.2.6 Plutonium Equivalent Curies ...................................................................................... 279 8.3 Health Risks .................................................................................................................. 280 8.3.1 High- Linear Energy Transfer Radiation ....................................................................... 280 8.3.2 Low- Linear Energy Transfer Radiation and Acute Health Risks ...................................... 282

9 CHEMICAL DISPERSION AND CONSEQUENCE ANALYSIS ..................................... 284 9.1 Introduction................................................................................................................... 284 9.2 Chemical Consequence Assessment Fundamentals .............................................................. 285 9.3 Chemical Screening Criteria ............................................................................................ 286 9.4 Chemical Health Effects on the Human Body ..................................................................... 288 9.4.1 Chemical Concentrations and Exposure Time ............................................................... 288 9.4.1.1 Chemical Exposure Time ..................................................................................... 288 9.4.1.2 Protective Action Criteria for Releases of a Single Chemical...................................... 290 9.4.1.3 Protective Action Criteria for Releases of Multiple Chemicals.................................... 291 9.4.2 Modes of Exposure and Routes of Entry of Toxic Chemicals ........................................... 291 9.4.3 Toxic Chemical Acute Exposure Limits........................................................................ 292 9.4.3.1 EPA Acute Exposure Guideline Levels ................................................................... 292 9.4.3.2 AIHA Emergency Response Planning Guidelines..................................................... 292 9.4.3.3 DOE PAC/TEELs ............................................................................................... 293 9.4.4 Chemical Mixture Methodology ................................................................................. 296 9.4.5 Chronic Health Effects of Toxic Chemicals on the Human Body ...................................... 297 9.5 Toxic Chemical Release Phenomenology, Atmospheric Transport and Diffusion ...................... 297 9.5.1 Pressurized Liquids: Two-Phase Flow Toxic Chemical Release........................................ 298 9.5.1.1 Flashing Fraction and Aerosol Formation................................................................ 299 9.5.1.2 Two-Phase Release of Chlorine from a Pipe ............................................................ 302 9.5.2 Pressurized Gases: Choked Flow Toxic Chemical Release .............................................. 303 9.5.2.1 Time-Dependent Vessel Gas Blow Down Model ...................................................... 304 9.5.2.2 Vapor Outflow from Breach of a Pipeline ............................................................... 306 9.5.2.3 Outflow from a Cylindrical Tank ........................................................................... 307 9.5.2.4 Outflow from a Spherical Tank.............................................................................. 309 9.5.2.5 Outflow from Process Vessels of Other Various Shapes ............................................. 310 9.5.3 Dense Gas Toxic Chemical Release And Dispersion....................................................... 310 9.5.4 Non-Pressurized Liquid Release ................................................................................. 312 9.5.4.1 Convective Boiling.............................................................................................. 313 9.5.4.2 Conductive Boiling ............................................................................................. 313 9.5.4.3 Nitric Acid and Carbon Tetrachloride Pool Evaporation Rates .................................... 314

9.5.4.3.1 Nitric Acid Pool Evaporation........................................................................... 314 9.5.4.3.2 Carbon Tetrachloride Pool Evaporation ............................................................. 318 9.5.5 Energetic Events....................................................................................................... 321 9.6 Meteorological Parameters Affecting Toxic Chemical Consequence Analysis .......................... 323 9.6.1 Temperature Effects .................................................................................................. 323 9.6.2 Relative Humidity Effects .......................................................................................... 324 9.7 Toxic Chemical Atmospheric Transport and Diffusion Models .............................................. 324 9.7.1 Neutrally Buoyant Gaussian Models ............................................................................ 325 9.7.1.1 ALOHA ............................................................................................................ 326 9.7.1.2 EPIcode............................................................................................................. 327 9.7.1.3 Chemical Dispersion Analysis with ALOHA and EPIcode ......................................... 328 DOE-HDBK-1224-2024 xi 9.7.2 Dense Gas Dispersion Models .................................................................................... 330 9.7.2.1 ALOHA ............................................................................................................ 330 9.7.2.2 DEGADIS ......................................................................................................... 331 9.7.2.3 HGSYSTEM ...................................................................................................... 332 9.7.2.4 SLAB................................................................................................................ 332 9.7.3 Variable Trajectory Dispersion Models......................................................................... 332 9.7.4 Research-Grade Dispersion Models ............................................................................. 333 9.8 Toxic Chemical Consequence Scoping Methodology to Exceed PAC/TEEL Values .................. 333 9.8.1 Gas, Powder, and Solid Release Model ........................................................................ 334 9.8.2 Liquid Evaporation Scoping Calculation Model ............................................................ 335 9.8.3 Screening Method for MOI High Consequence ............................................................. 337 9.9 Example Toxic Chemical Calculations ............................................................................... 338 9.9.1 Example 1: Ammonia Gas Exceeding PAC/TEEL-3 at the CW ........................................ 339 9.9.2 Example 2: Aluminum Oxide Powder Exceeding PAC/TEEL-3 at the CW ........................ 339 9.9.3 Example 3: Liquid 70 percent Nitric Acid Exceeding PAC/TEEL Values at 100 M and 1 Km Site Boundary .......................................................................................................... 339 9.9.4 Example 4: Liquid 55 percent Hydrofluoric Acid Exceeding PAC/TEEL Values at 100 M and 1 Km Site Boundary .................................................................................................... 341 10 HAZARD CONTROL SELECTION AND CLASSIFICATION....................................... 343 10.1 Hazard Control Selection ................................................................................................ 343

10.1.1 Hazard Control Selection Process............................................................................... 343 10.1.1.1 Hazard and Accident Analysis Input to Control Selection ........................................ 344 10.1.1.2 Hazard Control Types ........................................................................................ 345 10.1.1.3 Use of Risk Matrices for Control Selection............................................................ 347 10.1.2 Hazard Control Selection Considerations ..................................................................... 349 10.2 Safety Classifications of Controls ..................................................................................... 351 10.2.1 Safety Class Designation ........................................................................................... 351 10.2.2 Safety Significant Designation.................................................................................... 351 10.2.3 Classification of Other Hazard Controls ....................................................................... 351 10.3 Evaluation of Mitigated Offsite Estimates Exceeding Evaluation Guidelines ........................... 352 11 REFERENCES............................................................................................................. 357 APPENDIX A: HAZARD ANALYSIS TABLE DEVELOPMENT.............................................A-1 A.1 Scenario Description....................................................................................................... A-1 A.2 Initiating Event Frequency ............................................................................................... A-1 A.3 Unmitigated Consequence Evaluation................................................................................ A-2 A.4 Safety Functions ............................................................................................................ A-2 A.5 Preventive Features (Design and Administrative) ................................................................ A-3 A.6 Method of Detection ....................................................................................................... A-3 A.7 Mitigative Features (Design and Administrative) ................................................................. A-3 A.8 SSC Safety Control Suite and Safety Functions................................................................... A-4 A.9 Mitigated Consequences.................................................................................................. A-4 A.10 Planned Analyses, Assumptions and Risk/Opportunity Identification...................................... A-4 A.11 Hazards Evaluation Table ................................................................................................ A-5 APPENDIX B: CRITICALITY ACCIDENTS ......................................................................... B-1 B.1 Introduction................................................................................................................... B-1 B.2 Regulatory Requirements, Recommendations and Guidance ................................................. B-2 B.2.1 Unmitigated Analysis ................................................................................................ B-2 B.3 Accident Fission Yields ................................................................................................... B-3

B.3.1 Fission Yields of Solution and Solution-Like Systems .................................................... B-4 DOE-HDBK-1224-2024 xii B.3.2 Fission Yields of Non-Solution-Like Systems ............................................................... B-6 B.3.2.1 Metals/Solids – One or a Few Large Pieces ............................................................. B-6 B.3.2.2 Dry, Unmoderated Solids – Numerous Small Pieces, and Large Arrays........................ B-7 B.3.3 Fission Yields of Autocatalytic Accidents ..................................................................... B-7 B.4 Evaluation of Direct Radiation Doses ................................................................................ B-7 B.5 Criticality Accident Source Terms ..................................................................................... B-7 B.5.1 Fission Product Inventories ........................................................................................ B-7 B.5.2 Particulate Release and Health Related Parameters ........................................................ B-8 B.6 Criticality Accident Example............................................................................................ B-9 DOE-HDBK-1224-2024 xiii LIST OF FIGURES Figure 2- 1. HAZOP Method Overview ....................................................................................... 20 Figure 2-2. HAZOP Deviation Matrix ........................................................................................ 20 Figure 4-1. Fire Growth Model.................................................................................................. 53 Figure 4-2. Adaptation of View Factor Geometry for a Fire Model.................................................. 61 Figure 4-3. Simplified Explosion Categorization .......................................................................... 68 Figure 4-4. A Methodology Example for Calculations of Overpressure Effects ................................. 73 Figure 4-5. Temperature vs. Pressure Ratio for γ = 1.4 .................................................................. 75 Figure 4-6. Temperature vs. Pressure Ratio for γ = 1.66................................................................. 75 Figure 4-7. Ps vs. Rs for Overpressure Calculations....................................................................... 76 Figure 4-8. Ps vs. Rs for Pentolite .............................................................................................. 77 Figure 4-9. Is vs. Rs for Gas Vessel Bursts and Pentolite ................................................................ 78 Figure 4-10. Is vs. Rs for Gas Vessel Bursts (Small Rs) .................................................................... 79 Figure 4-11. A Methodology Example for Calculations of Fragmentation Effects ................................ 82 Figure 4-12. Scale Curves for Fragment Range Predictions ............................................................. 83 Figure 4-13. Fragment Range Distribution for Event Groups 1 and 2 ................................................ 85 Figure 4-14. Fragment Range Distribution for Event Groups 3, 4, 5 and 6 ......................................... 85 Figure 4-15. Fragment Mass Distribution for Event Groups 2 and 3 .................................................. 86 Figure 4-16. Fragment Mass Distribution for Group 6 .................................................................... 86 Figure 4-17. Hopkinson-Scaled TNT Charge Blast ......................................................................... 95 Figure 4-18. Multi-Energy Calculation Method Steps ..................................................................... 96 Figure 4-19. Sachs-Scaled Side-on Peak Overpressure of Blast from a Hemispherical Fuel-Air Charge .. 98 Figure 4-20. Sachs-Scaled Positive-Phase Duration of Blast from a Hemispherical Fuel-Air Charge ...... 98 Figure 4-21. Injury and Fatality Levels of Thermal Radiation ........................................................ 103 Figure 5-1. Five Factor Formula .............................................................................................. 153 Figure 5-2. Example Nuclear Materials Handling Facility ........................................................... 155 Figure 5-3. Seismic Collapse Zone........................................................................................... 162 Figure 6-1. Atmospheric and Terrestrial Processes Involved in Determining the Ultimate Fate of a

Radionuclide or Chemical Pollutant ......................................................................... 190 Figure 6-2. Logarithmic Wind Profile ....................................................................................... 192 Figure 6-3. Coordinate System of Gaussian Plume ..................................................................... 195 Figure 6-4. Variations of Horizontal and Vertical Plume Dimensions with Distance ......................... 197 Figure 6-5. Ratios of Predicted Concentrations in Wakes by a Model without Wake Correction to Observed Concentrations as a Function of Wind Speed ............................................... 211 Figure 6-6. Time-Averaging Effect on Plume Boundaries ............................................................ 215 Figure 6-7. Correction Factors for σy Values by Stability Class..................................................... 217 Figure 6-8. Schematic of Turbulent Air Flow Around a Sharp-Edged Building................................ 222 Figure 6-9. Maximum Time-Integrated Ground-Level Centerline Air Concentration (s/m3) Versus Downwind Distance (km) for Different Mean Translational Speeds from 7.5 m/s to 22.5 m/s............................................................................................................... 250 Figure 6-10. Virtual Source Terms Used in HotSpot for Explosion.................................................. 252 Figure 9-1. Comparison of Evaporation Rate Predictions for 60 Percent Solution of Nitric Acid with a 1 m2 Pool Surface Area ................................................................................. 320 Figure 9-2. Comparison of Evaporation Rate Predictions for Carbon Tetrachloride with a 1 m2 Pool Surface Area......................................................................................................... 321 Figure 9-3. Example of ALOHA Concentration Output from an Evaporative Pool of Hydrogen Chloride .............................................................................................................. 330 Figure 9-4. Comparison of Vapor Pressure Data vs. EPIcode Fit for 70 wt percent Nitric Acid .......... 336 Figure B-1. Specific Fissions in First Spike as A Function of Reactor Period ................................... B-5 Figure B-2. Maximum Specific Fission Yield Resulting from Criticality Solution Excursions in CRAC and Silene ................................................................................................. B-5 DOE-HDBK-1224-2024 xiv LIST OF TABLES

Table 2-1. Hazard Identification Checklist Example .......................................................................5 Table 2-2. Hazard Identification Summary Table ......................................................................... 10 Table 2-3. Correlation of Hazardous Energy and Material Sources to Accident Types/ Categories ....... 16 Table 2-4. What-If Hazard Analysis Example H-7 Production Support Lab...................................... 19 Table 2-5. HAZOP Example..................................................................................................... 22 Table 2-6. FMEA Example....................................................................................................... 24 Table 2-7. Initial Development of Hazard Evaluation Table ........................................................... 26 Table 2-8. Consequence Thresholds........................................................................................... 27 Table 2-9. Qualitative Likelihood Classification .......................................................................... 34 Table 2-10. Qualitative Risk Ranking Bins.................................................................................... 36 Table 2-11. DSA Hazard Evaluation Table Example ...................................................................... 39 Table 4-1. Types of Explosions Descriptions ............................................................................... 70 Table 4-2. Adjustment Factors for Ps and Is for Cylindrical and Spherical ........................................ 79 Table 4-3. Groups of Like Events—Fragments from Explosions .................................................... 84 Table 4-4. Deflagration Overpressures in Closed Vessels .............................................................. 91 Table 4-5. Sources for TNT Equivalency Factor Estimations ......................................................... 94 Table 4-6. Estimated Damage Attributable to Explosive Overpressure .......................................... 100 Table 4-7. Approximate Rate of Radiant Flux ........................................................................... 102 Table 4-8. Exposure Time tc to Reach the Pain Threshold............................................................ 103 Table 4-9. Spill Sizes for Handling Accidents............................................................................ 114 Table 4-10. Example Application of Wildland Fire Facility/Structure Hazard Assessment.................. 142 Table 4-11. Example of Transport Vehicle Package Capacities....................................................... 150 Table 5-1. Summary of Bounding ARF and RF Values ............................................................... 166 Table 6-1. Classification of Atmospheric Stability Based on Vertical Temperature Difference ........... 200 Table 6-2. Initial Estimates of Stability Class, EPA Method ......................................................... 200 Table 6-3. Final Estimates of Stability Class, EPA Method .......................................................... 201 Table 6-4. Classification of Atmospheric Stability Based on Solar Radiation Delta Temperature

Method ................................................................................................................ 202 Table 6-5. Fitting Constants for σy and σz from Tadmor-Gur ........................................................ 203 Table 6-6. Fitting Constants for σy and σz ................................................................................. 204 Table 6-7. Fitting Constants for σy and σz from Briggs................................................................ 205 Table 6-8. Surface Roughness Adjustments Recommended by PNNL-led Review Team .................. 219 Table 6-9. General Roughness Lengths for Various Terrain Types................................................. 219 Table 6-10. Summary of Deposition Velocity Models of Interest.................................................... 226 Table 6-11. Computer Models in DOE Safety Software CR for Radiological ................................... 233 Table 6-12. Summary Guidance on the Use of Computer Models in DOE CR for Radiological Dispersion Analysis................................................................................................ 235 Table 7-1. Aquatic Dispersion Model Classes ............................................................................ 261 Table 7-2. Attributes and Characteristics of Aquatic Dispersion Models ......................................... 262 Table 7-3. Comparison of Aquatic Dispersion Models................................................................. 263 Table 8-1. Radiation Weighting Factors .................................................................................... 271 Table 8-2. Organ Weighting Factors ......................................................................................... 273 Table 8-3. Reference Man Breathing Rates for Various Levels of Activity ...................................... 274 Table 8-4. Stochastic Risk Factors for Alpha-Emitters................................................................. 281 Table 8-5. Stochastic Risk Factors for Pu-239............................................................................ 281 Table 8-6. Acute Radiation Effects for Gamma Radiation ............................................................ 282 Table 9-1. Identification of Chemicals in the Prescreening Process: Baseline Criteria ...................... 287 Table 9-2. TEEL Data Selection Hierarchy ................................................................................ 294 DOE-HDBK-1224-2024 xv Table 9-3. Uranium Compound PAC/TEELs ............................................................................. 295 Table 9-4. Calculated Variation of Chlorine Jet Release Parameters as a Function of Upstream Gas Mass Fraction........................................................................................................ 303 Table 9-5. Comparison of Results for Three Evaporation Models as Applied to HNO3 and CCl4 ........ 320 Table 9-6. ALOHA Results for Evaporative Releases of Four Selected Chemicals ........................... 329 Table 10-1. Typical Risk Class Matrix ........................................................................................ 348 Table 10-2. Over the EG Evaluation........................................................................................... 352 DOE-HDBK-1224-2024 xvi ACRONYMS AND ABBREVIATIONS

AC Administrative Control AED Aerodynamic Equivalent Diameter AEGL Acute Exposure Guideline Level AIHA American Industrial Hygiene Association ALOHA Areal Locations of Hazardous Atmospheres AMAD Activity Median Aerodynamic Diameter ANS American Nuclear Society ANSI American National Standards Institute APAC Accident Phenomenology and Consequence ARF Airborne Release Fraction ANL Argonne National Laboratory ARR Airborne Release Rate ASME American Society of Mechanical Engineers BDBA Beyond Design Basis Accident BDBE Beyond Design Basis Event BEBA Beyond Evaluation Basis Accident BLEVE Boiling Liquid Expanding Vapor Explosion BR Breathing Rate CASRN Chemical Abstract Service Registry Number CCPS Center for Chemical Process Safety CFAST Consolidated Model of Fire and Smoke Transport CFR Code of Federal Regulations CLFL Composite Lower Flammability Limit CMM Chemical Mixture Methodology CN Change Notice CR Central Registry CR-xxxx (Nuclear Regulatory Commission) Contractor Reports CW Co-located Worker DBA Design Basis Accident DCF Dose Conversion Factor DOE Department of Energy DR Damage Ratio DSA Documented Safety Analysis EBA Evaluation Basis Accident EG Evaluation Guideline EHSS Environment, Health, Safety and Security EPA Environmental Protection Agency ERAD Explosive Release Atmospheric Dispersion ERPG Emergency Response Planning Guideline FGR Federal Guidance Report FHA Fire Hazards Analysis FMEA Failure Modes and Effects Analysis FW Facility Worker DOE-HDBK-1224-2024 xvii G (DOE) Guide GB Glove Box GEP Good Engineering Practice HAN hydroxylamine nitrate HAZOP Hazard and Operability HCN Health Code Number HDBK Handbook HEPA High Efficiency Particulate Air HRR Heat Release Rate IC Initial Condition ICRP International Council on Radiation Protection ILA Immediate Landscaped Area JFD Joint Frequency Distribution LANL Los Alamos National Laboratory LCF Latent Cancer Fatality LEL Lower Explosive Limit LET Linear Energy Transfer LFL Lower Flammability Limit LLNL Lawrence Livermore National Laboratory LPF Leak Path Factor MACCS MELCOR Accident Consequence Code System MAR Material at Risk MELCOR Methods for Estimation of Leakages and Consequences of Releases MOI Maximally Exposed Offsite Individual MW Molecular Weight NA Not Applicable NARAC National Atmospheric Release Advisory Center NASA National Aeronautics and Space Administration NDC Natural Phenomena Hazard Design Category NEPA National Environmental Policy Act NFPA National Fire Protection Association NNSA National Nuclear Security Administration NOAA National Oceanic and Atmospheric Administration NPH Natural Phenomena Hazard NQA Nuclear Quality Assurance NRC Nuclear Regulatory Commission NSRD Nuclear Safety Research and Development O Order ORNL Oak Ridge National Laboratory OSHA Occupational Safety and Health Administration P Policy PAC Protective Action Criterion PBL Planetary Boundary Layer DOE-HDBK-1224-2024 xviii PE Plutonium Equivalent PHA Preliminary Hazard Analysis PNNL Pacific Northwest National Laboratory PUREX Plutonium Uranium Reduction Extraction RF Respirable Fraction RG Regulatory Guide SAC Specific Administrative Control SBAA Safety Basis Approval Authority SC Safety Class SCAPA Subcommittee for Consequence Assessment and Protective Actions SFPE Society of Fire Protection Engineers SIH Standard Industrial Hazard SIZ Structure Ignition Zone SME Subject Matter Expert SMP Safety Management Program SQA Software Quality Assurance SRNL Savannah River National Laboratory SRS Savannah River Site SS Safety Significant SSC Structures, Systems, and Components ST Source Term STD Standard

TBP Tri-Butyl Phosphate TED Total Effective Dose TEEL Temporary Emergency Exposure Limit TNO The Netherlands Organization for Applied Scientific Research TNT Trinitrotoluene TRU Transuranic TSR Technical Safety Requirement TWA Time Weighted Average USQ Unreviewed Safety Question VP Vapor Pressure Note: Definitions related to the DOE hazard and accident analysis process can be found in Title 10 of the U.S. Code of Federal Regulations Part 830.3 (10 CFR 830.3), DOE-Standard-3009-2014 (or other 10 CFR Part 830 safe harbor), or DOE-Handbook-3010-94, Airborne Release Fractions/Rates and Respirable Fractions for Nonreactor Nuclear Facilities. Other definitions related to accident phenomenology for evaluation of potential consequences, such as physical and chemical effects, are provided in references cited in the text. DOE-HDBK-1224-2024 1 1 INTRODUCTION This Handbook (HDBK) contains methodology, data sources, and subject matter references for performing and reviewing hazard analysis and accident analysis for Department of Energy (DOE) nonreactor nuclear facilities. The guidance offered supports development of a Documented Safety Analysis (DSA) required by Title 10 of the United States Code of Federal Regulations Part 830 (10 CFR 830), Nuclear Safety Management, Subpart B, Safety Basis Requirements. The Handbook uses as a starting point, drafts of a report prepared by the Energy Facility Contractors Group Safety Analysis Working Group. This early effort was sponsored by DOE’s Office of Defense Programs, predecessor of the National Nuclear Security Administration (NNSA), in the early 2000s. Although that report was not completed, some of its technical content has been incorporated into this Handbook. The Handbook describes best practices gleaned from development of DSAs throughout the DOE complex and from insights acquired in the development of DOE-Standard (STD)-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis. The Handbook provides many application examples that will be helpful to the analyst and is geared to mid-level and advanced-level safety analysts. 1.1 PURPOSE The principal purpose of this Handbook is to guide development of the DSA for reactor and non-reactor nuclear facilities in order to satisfy the requirements of a safe harbor method set out in 10 CFR 830, Subpart B. The safety analysis process consists of three main steps: • Hazard analysis (including hazard identification and evaluation), • Accident analysis (including accident scenario definition and consequence analysis), and • Preventive and mitigative control selection. DOE-STD-3009-2014 provides criteria and guidance organized in the above manner. Furthermore, it includes lessons learned from use of DOE-STD-3009-94, Change Notice 3 (CN3), Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analysis, and other safe harbor methods. As such, this Handbook uses DOE-STD-3009-20141 as the starting point for the amplifying guidance and good practices, but the scope of the Handbook is not limited to that standard. The information in this Handbook is also relevant to other safe harbor methods for developing a safety basis document, such as DOE-STD-3011-2016, Preparation of Documented Safety Analysis for Interim Operations at DOE Nuclear Facilities, and DOE-STD-1120-2016, Preparation of Documented Safety Analysis for Decommissioning and Environmental Restoration Activities. The Handbook may also be used for upgrading existing DSAs to the new requirements of DOE-STD-3009-2014, or for updating DSAs for existing facilities based on their current safe harbor methodology. Although DOE-STD-3009-2014 is referenced throughout this Handbook, older versions of DOE-STD-3009 (e.g., DOE-STD-3009-94 CN3 [2006]) are used at some DOE sites due to contractual requirements.

1 When used without a 2-digit or 4-digit year number after “DOE-STD-3009,” the term refers to both the 1994 and 2014 versions. If a specific version is meant to the exclusion of the other, the year will be stated. DOE-HDBK-1224-2024 2 1.2 OUTLINE This Handbook is organized as follows: • Chapter 2, Hazard Analysis, addresses hazard identification and evaluation, including hazard evaluation methods and safety control identification. • Chapter 3, Accident Analysis, provides a high-level overview of the events that were identified in the hazard evaluation table to be evaluated for further accident analysis, provides an overview of the accident analysis process, and discusses two key topics: (1) assumptions and initial conditions; and (2) conservatism in analysis. • Chapter 4, Evaluation of Effects of Major Accident Types, addresses the analysis of accident scenarios. The various topics covered provide information for evaluating the magnitude of the accidents and the resulting accident environments, so that the amount of radioactive or other hazardous material affected is defined. Toxic chemicals are a subset of hazardous materials that require additional dispersion and consequence assessment. In addition to evaluation of potential consequences to facility workers (FWs), this information is necessary to determine the source term (ST) available for release from the facility, and to evaluate the capability of safety structures, systems, and components (SSCs) to survive the accident environments and provide required safety functions when called upon. • Chapter 5, Source Term Analysis, addresses development of the amount of radioactive material or toxic chemical released from a given confinement volume under the stress posed by insults from a hypothetical accident. Source term estimations include quantifying radioactive or toxic chemical material at risk (MAR), damage ratio (DR), airborne release fraction (ARF) or airborne release rate (ARR), respirable fraction (RF) (for radioactive materials only), and leak path factor (LPF). • Chapter 6, Atmospheric Dispersion, addresses atmospheric transport and diffusion, meteorological data, and the models available for consequence assessment of radioactive releases to the atmosphere. • Chapter 7, Aquatic Dispersion and Groundwater Transport, addresses surface water and groundwater pathways, and the models available for consequence assessment of radioactive releases to aquatic water bodies and groundwater. • Chapter 8, Radiological Consequence Assessment, addresses the different types of radiation and the health effects they can have on the human body, its organs, and its tissues, and how radiological doses to receptors of interest may be estimated. • Chapter 9, Chemical Dispersion and Consequence Analysis, addresses toxic chemical releases, their potential health effects and methods for estimating concentration at various distances. • Chapter 10, Hazard Control Selection and Classification, addresses selection of safety significant and safety class controls that are credited in the hazard evaluation or accident analysis. • Chapter 11, References, provides a complete list of references cited in the text. • Appendix A, Hazard Analysis Table Development, provides guidance on constructing this table which is discussed in Chapter 2. • Appendix B, Criticality Accidents, addresses this type of accident in greater detail. DOE-HDBK-1224-2024 3 2 HAZARD ANALYSIS

This chapter addresses hazard analysis techniques for the identification and evaluation of hazards, and the identification of controls to prevent or mitigate accidents. Hazard control selection is addressed in Chapter 10. 2.1 ELEMENTS OF HAZARD ANALYSIS DOE-STD-30092 states that a hazard analysis consists of (a) hazard identification, (b) hazard categorization, 3 and (c) hazard evaluation. Hazard evaluation includes identification and safety classification of controls to prevent or mitigate potential hazard or accident scenarios. 4 2.2 HAZARD IDENTIFICATION AND CHARACTERIZATION The objective of hazard identification and characterization is to systematically and comprehensively identify radioactive and other hazardous materials within the facility, as well as natural phenomena hazards (NPHs) and man-made external events that may impact the facility and result in the release of these materials within the facility and to the environment. The hazard identification process includes characterizing radiological and non-radiological hazardous materials and energy sources, in terms of quantity, form, and location. Examples of energy sources are charged electrical systems, falling objects, NPH-driven missiles, and other kinetic energy sources. Nuclear criticality hazard evaluations are addressed in Section 2.3.2. For DSAs prepared in accordance with 10 CFR 830, Subpart B, the key to successful hazard identification is ensuring comprehensive identification of the hazards associated with the full scope of facility processes; associated operations, such as handling of fissionable materials, radioactive or hazardous wastes; and work activities covered by the DSA. Hazard identification does not yield specific hazard scenarios to analyze. Rather, it yields initial data from which hazard scenarios are subsequently developed. The overall quality of hazard scenario definition will be in direct proportion to the accuracy and completeness of the initial hazard information gathered. The hazard identification process involves: • Hazard data gathering. • Summarizing hazard data in tables or data sheets. • Identifying standard industrial hazards (SIHs) needing further evaluation.5 Comprehensive identification of hazards is best accomplished by a team comprised of safety analysts, system/process engineers, operational and support staff, industrial hygienists, and various subject matter experts (SMEs), as needed. 2 As discussed in Section 1.1, when used without a 2-digit or 4-digit year number after DOE-STD-3009, it refers to both the 1994 CN 3 and 2014 versions of the DOE Standard. Otherwise, specific versions of DOE-STD-3009 are referenced throughout this Handbook. 3 This Handbook does not address hazard categorization. Requirements and guidance for performing hazard categorization are provided in DOE-STD-1027-2018, CN 1. 4 DOE-STD-3009-2014 defines a hazard scenario as “An event or sequence of events associated with a specific hazard, having the potential to result in undesired consequences identified in the hazard evaluation” and defines an accident as “A specific event or progression of a sequence of events resulting from an initiating event that is followed by any number of subsequent events that may lead to a release of radioactive or other hazardous material and/or exposure to a predefined receptor.” The term hazardous condition has often been used in previous safety basis hazard evaluations instead of hazard scenario. For the purposes of this Handbook, both terms are used interchangeably in Chapters 2, 3, 4, and 10, and in Appendix A when referring to the hazard evaluation. 5 Such hazards might include electrical faults that could lead to a fire, or explosions harmful to nearby workers.

DOE-HDBK-1224-2024 4 2.2.1 HAZARD DATA GATHERING Gathering of hazard data commences with review of existing documentation, which includes the following: • Facility and process descriptions (including available drawings and flow sheets). • Historical radioactive and hazardous material inventory records. • Existing safety documentation. 6 • Operating and support procedures. • Previous occurrence reports for the facility and relevant reports from general industry. • Facility design reports setting out the scope of new operations. Once documented sources of hazards have been reviewed, a physical walkdown of the facility is undertaken to verify the hazards and their locations. Such walkdowns are conducted with a floor plan noting the most significant details. Useful details may include information such as gloveboxes or containers, inventories and energy sources, system interconnections, and piping routes. Other details can be recorded during the walkdown in checklists and notebooks for completeness. If the facility is being designed, the floor plan can still be conceptually walked down using process and instrumentation drawings and process engineering drawings at whatever stage of development they are available. Hazard analysis is performed early in the project justification phase and during development of the safety design strategy, continues during development of safety design basis documents as the design progresses, and is updated during development of the final DSA to authorize operations. If process and instrumentation drawings are based on evolving design of a new facility, the hazard identification will need to be reverified against the final design and as-built construction to support authorizing operations. The overall hazard identification and analysis is an iterative process during the design and construction phase of the project. 2.2.2 HAZARD DATA RECORDING Checklists are used to ensure the hazard identification process is comprehensive and thorough. Checklists provide a generic list of hazards to look for in terms of radioactive and hazardous material types, energy sources, moving components, and the potential for falling objects. Hazard identification preparers use such checklists to systematically identify the presence or absence of hazards for a given area, from individual components/operations (e.g., gloveboxes) to entire rooms. The raw data of a hazard identification can be recorded in a variety of ways. The critical information to be specifically noted in any recording mechanism is the hazard itself, its type, its magnitude and location, and sufficient descriptive notes to allow the hazard analysis team to place individual hazards in an appropriate context. Materials of concern for release, or potential hazards in direct contact with materials of concern, are identified separately. Bounding inventory values of radioactive or hazardous materials are needed for the development of scenario-specific MAR for the hazard evaluation and accident analysis, consistent with the maximum quantities of material that are stored and used in facility processes. Inventory data may be obtained from flowsheets, vessel sizes, contamination analyses, maximum historical inventories, and similar sources. 6 Safety data sheets; waste data sheets; health and safety plans; procurement and inventory records; and annual reports, such as the Emergency Planning and Community Right-to-Know Act), Tier II Chemical, and Environmental Protection Agency (EPA) Toxic Release Inventory.

DOE-HDBK-1224-2024 5 An example of a checklist for a DOE nuclear facility is shown in Table 2-1. The Disposition column is optional and is discussed in Sections 2.2.3 and 2.2.4. Other types of checklists have been developed in DOE which may reflect site-specific and facility-specific hazards. These checklists can be used to identify hazards and energy sources. Commercial industry practices for hazard identification, such as those described in the Center for Chemical Process Safety (CCPS) Guidelines for Hazard Evaluation Procedures (CCPS, 2008), provide guidance for the development of a comprehensive identification of hazards. Table 2-1. Hazard Identification Checklist Example Facility, Location, or Process: No. Item Hazard present (Y/N) Description (quantity, form, location) Disposition (SIH, accident initiator/contributor) 1.0 Electrical 1.1 Battery banks 1.2 Cable runs 1.3 Diesel generators 1.4 Electrical equipment 1.5 Heaters 1.6 High voltage (> 600V) 1.7 Locomotive, electrical 1.8 Motors 1.9 Power tools 1.10 Pumps 1.11 Service outlets, fittings 1.12 Switchgear 1.13 Transformers 1.14 Transmission lines 1.15 Wiring/underground wiring 1.16 Other 2.0 Thermal 2.1 Boilers 2.2 Bunsen burners/hot plates 2.3 Electrical equipment 2.4 Electrical wiring 2.5 Engine exhaust 2.6 Furnaces 2.7 Heaters 2.8 Lasers 2.9 Steam lines 2.10 Welding surfaces 2.11 Welding torches 2.12 Other 3.0 Pyrophoric Material 3.1 Pu and U metal 3.2 Other (e.g., Zr) 4.0 Spontaneous Combustion DOE-HDBK-1224-2024 6 Facility, Location, or Process: No. Item Hazard present (Y/N) Description (quantity, form, location) Disposition (SIH, accident initiator/contributor) 4.1 Cleaning/decontamination solvents 4.2 Fuels (gasoline, diesel) 4.3 Grease 4.4 Nitric acid and organics 4.5 Paint solvents 4.6 Other 5.0 Open Flame 5.1 Bunsen burners 5.2 Welding/cutting torches 5.3 Other 6.0 Flammables 6.1 Cleaning/decontamination solvents 6.2 Flammable gases 6.3 Flammable liquids 6.4 Gasoline 6.5 Natural gas 6.6 Paint/paint solvent 6.7 Propane 6.8 Spray paint 6.9 Other 7.0 Combustibles 7.1 Paper/wood products 7.2 Petroleum-based products 7.3 Plastics 7.4 Other 8.0 Chemical Reactions 8.1 Concentration 8.2 Disassociation 8.3 Exothermic 8.4 Incompatible chemical mixing 8.5 Uncontrolled chemical reactions 8.6 Other 9.0 Explosive Material 9.1 Caps 9.2 Dusts 9.3 Dynamite 9.4 Electric squibs 9.5 Explosive chemicals 9.6 Explosive gases 9.7 Hydrogen 9.8 Hydrogen (batteries) 9.9 Nitrates DOE-HDBK-1224-2024 7 Facility, Location, or Process: No. Item Hazard present (Y/N) Description (quantity, form, location) Disposition (SIH, accident initiator/contributor) 9.10 Peroxides 9.11 Primer cord 9.12 Propane 9.13 Other (e.g., NiCd batteries) 10.0 Kinetic (Linear and Rotational) 10.1 Acceleration/deceleration 10.2 Bearings 10.3 Belts 10.4 Carts/dollies 10.5 Centrifuges 10.6 Crane loads (in motion) 10.7 Drills 10.8 Fans 10.9 Firearm discharge 10.10 Forklifts 10.11 Gears 10.12 Grinders 10.13 Motors 10.14 Power tools 10.15 Presses/shears 10.16 Rail cars 10.17 Saws 10.18 Vehicles 10.19 Vibration 10.20 Other 11.0 Potential (Pressure) 11.1 Autoclaves 11.2 Boilers 11.3 Coiled springs 11.4 Furnaces 11.5 Gas bottles 11.6 Gas receivers 11.7 Pressure vessels 11.8 Pressurized system (e.g., air) 11.9 Steam headers and lines 11.10 Stressed members 11.11 Other 12.0 Potential (Height/Mass) 12.1 Cranes/hoists 12.2 Elevated doors 12.3 Elevated work surfaces 12.4 Elevators

DOE-HDBK-1224-2024 8 Facility, Location, or Process: No. Item Hazard present (Y/N) Description (quantity, form, location) Disposition (SIH, accident initiator/contributor) 12.5 Lifts 12.6 Loading docks 12.7 Mezzanines 12.8 Floor pits 12.9 Scaffolds and ladders 12.10 Stacked material 12.11 Stairs 12.12 Other 13.0 Internal Flooding Sources 13.1 Domestic water piping 13.2 Fire suppression piping 13.3 Process water piping 13.4 Other 14.0 Physical 14.1 Sharp edges or points 14.2 Pinch points 14.3 Confined spaces 14.4 Tripping 14.5 Other 15.0 Radioactive Material 15.1 Radioactive material 16.0 Hazardous Material (Toxicological, Chemical, Biological) 16.1 Asphyxiants 16.2 Bacteria/viruses 16.3 Beryllium and compounds 16.4 Biologicals/Biotoxins 16.5 Carcinogens 16.6 Chlorine and compounds 16.7 Corrosives 16.8 Decontamination solutions 16.9 Dusts and particles 16.10 Fluorides 16.11 Hydrides 16.12 Lead 16.13 Oxidizers 16.14 Poisons (herbicides, insecticides, fungicides) 16.15 Other 17.0 Direct Radiation Exposures 17.1 Contamination 17.2 Electron beams 17.3 Radioactive material DOE-HDBK-1224-2024 9 Facility, Location, or Process: No. Item Hazard present (Y/N) Description (quantity, form, location) Disposition (SIH, accident initiator/contributor) 17.4 Radioactive sources 17.5 Radiography equipment 17.6 X-ray machines 17.7 Other 18.0 Non-ionizing Radiation 18.1 Lasers 18.2 Other 19.0 Criticality 19.1 Fissile material 20.0 External Man-made Events 20.1 Aircraft crash 20.2 Explosion 20.3 Fire 20.4 Power outage 20.5 Transportation accident 20.6 Other 21.0 Vehicles in Motion 21.1 Airplane 21.2 Crane/hoist 21.3 Forklift 21.4 Heavy construction equipment 21.5 Helicopter 21.6 Train 21.7 Truck/car 21.8 Waterborne Vehicle 21.9 Other 22.0 Natural Phenomena Hazards 22.1 Earthquake 22.2 Flood 22.3 Lightning 22.4 Extreme rainfall/hail 22.5 Snowfall/freezing weather 22.6 Extreme straight-line wind, seiche 22.7 Tornado 22.8 Hurricane 22.9 Tsunami 22.10 Volcanic ashfall 22.11 Wildland fires 22.12 Other DOE-HDBK-1224-2024 10 A hazard analysis team safety analyst should work one-on-one with an individual SME and operations representatives to complete those items related to the SME’s area of expertise and portions of the facility that have been segmented into process or area nodes for analysis as discussed later in this chapter. The multiple checklists from all the process or area nodes can be integrated into a complete draft of a hazard identification table and presented to the hazard analysis team for review, or the checklist for each node can be presented separately. Past experience has shown that this is a much more efficient way to complete the exercise than to have the entire hazard analysis team meet to discuss every item for every process or area node. 2.2.3 HAZARD SUMMARY DEVELOPMENT DOE-STD-3009-2014, Section 4.0, DSA Section [3.3.2.1], states that the hazard identification data sheets (checklists) may be included in the DSA, or referenced as needed, and that a summary table that identifies hazards by form, type, location, and total quantity be presented, as well as a summary of major accidents or hazardous situations (e.g., fires, explosions, loss of confinement) that have occurred in the facility’s operating history. The integrated checklist for the facility can be included in the DSA hazard identification results section. The process or area node checklists can also be used to develop a summary table to be included in the DSA. The range of information captured in the DSA hazard identification table is designed to ensure that minimum hazard identification results are established, appropriate screening of hazards is performed, and information needed to perform an effective and efficient hazards evaluation is established. Table 2-2 presents an example Hazard Identification Summary Table template.

Table 2-2. Hazard Identification Summary Table Facility: Hazard Type Location Form Quantity Remarks / Screening References Radioactive materials Direct radiation exposure Criticality accidents Hazardous chemicals (corrosives, toxics, reactions) Flammable/ combustible materials Explosive materials Electrical energy Kinetic and potential energy Pressure-volume energy Thermal energy NPHs Man-Made External Events Other These compilations of information reviews and facility walkdowns constitute initial information. Iterations between the hazard identification and hazard evaluation phases are likely necessary in order to ensure completeness. DOE-HDBK-1224-2024 11 2.2.4 EXCLUSION OF STANDARD INDUSTRIAL HAZARDS AND OTHER HAZARDOUS MATERIALS The comprehensive hazard identification process in Sections 2.2.1 through 2.2.3 addresses all radiological and non-radiological hazards and energy sources. However, SIHs are not normally analyzed in a DSA hazard evaluation except in special circumstances. DOE-STD-3009-2014, Section 3.1.1 states: “Although the hazard identification process is comprehensive of all radiological and non- radiological hazards, DSAs are not intended to analyze and provide controls for standard industrial hazards such as burns from hot surfaces, electrocution, and falling objects. These hazards are adequately analyzed and controlled in accordance with 10 C.F.R. Part 851, Worker Safety and Health Program, and are analyzed in a DSA only if they can be an accident initiator, a contributor to a significant uncontrolled release of radioactive or other hazardous material (for example, 115- volt wiring as initiator of a fire) or considered a unique worker hazard such as explosive energy. The basis for any identified hazards excluded from further evaluation shall be provided. See Appendix A, Section A.1 of this Standard for further discussion on screening of standard industrial hazards and Section A.2 for a discussion on screening out certain chemicals based on low quantities or low hazard.” DOE-STD-3009-2014, Section A.1, provides the following SIH guidance: “The Department of Energy (DOE) recognizes, via Title 10 of the Code of Federal Regulations (CFR) Part 830, the importance of including worker safety in safety analyses by specifically noting the worker as a population of concern. Developing a conceptual basis for the methodology used in this Standard requires answering the fundamental question of how worker safety is most appropriately addressed in the DSA. DSAs include hazard analyses and hazard controls for worker safety, unless the hazards and their potential consequences are due to standard industrial hazards. Standard industrial hazards are hazards that are routinely encountered in general industry and construction. These workplace hazards are addressed by provisions of 10 CFR Part 851, Worker Safety and Health Program, which requires identification and assessment of worker hazards and compliance with safety and health standards that provide specific safe practices and controls. Based on these provisions, evaluation of standard industrial hazards within DSAs is needed to the extent that these hazards act as initiators or contributors to accidents or result from chemical or radiological hazards (for example, when an explosion is caused by radiolysis inside a tank). When standard industrial hazards are excluded from further evaluation, Section 3.1.1 of this Standard requires such conclusions to be included in the hazard identification, along with the basis used for exclusion. Standard industrial hazards that may be considered for exclusion from the DSA hazard evaluation include those in which a national consensus code and/or standard … defines and regulates appropriate worker safety practices. Specifically, the codes and standards required by 10 CFR 851.23, Safety and Health Standards, may be considered. Examples of hazards addressed by these requirements include confined spaces, electrocution, falling objects, non-ionizing radiation, hot work, and lasers. Toxicity of hazardous chemicals is addressed in Section A.2 rather than this subsection.”

DOE-HDBK-1224-2024 12 DOE-STD-3009-2014, Section A.1, describes situations that should not be screened out when considering other unique hazards: “Unique hazards may be present in facilities that are not specifically addressed by the above exclusion criteria, either because of quantities larger than typically used in general industry or because of unique DOE applications or operations. Such hazards may represent a potential hazard to an entire work area affecting multiple workers or have the ability to impact the safe operation of the facility (e.g., inability to perform a specific administrative control (SAC)). An example of such hazards could be an explosion hazard created by radiolysis in tanks, piping, or containers. Significant quantities of cryogenic material or compressed gases/liquids may also warrant consideration because of asphyxiation hazards that might affect the ability of facility operators to safely manage the facility. Such unique hazards are not treated as standard industrial hazards and are evaluated in the DSA. Standard industrial hazards that have the potential to be an accident initiator involving chemical or radioactive material releases are retained as part of the DSA hazard evaluation. For example, the existence of 440-volt alternating current cabling in a glovebox could be identified as a potential accident initiator of a fire involving radioactive or other hazardous materials.” The evaluation of hazards associated with other hazardous materials, and especially a subset involving hazardous chemicals (i.e., non-radioactive), warrants further discussion regarding which hazards can be screened out or screened in. Some of these non-radiological hazards may be determined to be SIHs, while others may require further evaluation in the DSA per 10 CFR 830.204(b)(3) “that might contribute to the generation or uncontrolled release of radioactive and other hazardous material.” One aspect of the “generation or uncontrolled release of … other hazardous material” consideration is recognized in DOE- STD-3009-2014, Section A.1, which states: “Toxicity of hazardous chemicals is addressed in Section A.2 rather than this subsection.” and is therefore not treated as a SIH. In addition to toxicity, other chemical hazards may require further evaluation. The introduction of DOE-STD-3009-2014, Section A.2 clarifies that not all chemical hazards need to be evaluated in the DSA hazard evaluation: “The DSA is not intended to deal extensively with chemicals that can be safely handled by implementation of a hazardous material protection program. Therefore, a screening process is established to select for DSA evaluation only those chemicals of concern (i.e., type and quantity that have the potential for significant health effect on the facility worker, co-located worker, or public) that are present in the facility or activity and present hazard potentials outside the routine scope of the hazardous material protection program.” The DSA hazard evaluation scope covers analysis of (a) hazardous chemicals affecting nuclear safety, (b) significant chemical process-related hazards, and (c) in some cases, chemical hazards that are outside the scope of the facility’s hazardous material protection program. The scope of the scenarios that require DSA hazard evaluation to meet DOE-STD-3009-2014 includes: • Chemical hazards with the potential for significant off-site consequences to the public (e.g., greater than or equal to Protective Action Criterion-2 (PAC-2).

• Chemical hazards that initiate or worsen a significant radiological release. • Chemical hazards that adversely affect a credited nuclear safety function (e.g., incapacitating a worker relied upon to perform a SAC, or affecting the ability of safety SSCs to perform their safety functions). • Extraordinary chemical hazards that have a high acute toxicity and dispersibility (e.g., greater than or equal to a PAC-3 for 3 ppm or less, and highly dispersible such as compressed gases). DOE-HDBK-1224-2024 13 • Uncontrolled chemical releases with the potential for significant on-site consequences to co-located workers (CWs) (e.g., >= PAC-3). • Any additional chemical hazards that are not adequately identified and controlled by an adequate chemical safety management program (SMP) and could cause significant harm to FWs or CWs. There are different types of scenarios where chemical hazards could initiate or worsen a significant radiological release. In such cases, the hazard evaluation would recognize the impact of the chemical on the radiological consequences. Examples include: • Cases where the physical hazards of a chemical (e.g., fire, explosion, over-pressurization, corrosion) lead to a radiological release, or increase the amount of radiological material released. • Cases where an operation could result in a radiological release if left unsupervised or if not properly shut down, and workers are unable to safely manage that operation because the release of a hazardous chemical incapacitates them or forces their evacuation. • Cases where a common cause (e.g., fire, NPH event) results in the release of both radioactive material and other hazardous chemicals, and the presence of chemicals increases the magnitude or duration of workers’ radiological exposures. Examples of chemical hazards that should be addressed in the DSA include: (1) significant chemical toxicity of radioactive materials (e.g., uranium toxicity), (2) significant chemical toxicity from chemicals directly generated from radioactive materials (e.g., hydrogen fluoride generated from chemical reactions with uranium hexafluoride), and (3) significant amounts of decomposition products (e.g., NOx generation) that are part of a facility process (e.g., incinerator, steam reformer). As an example of a chemical hazard that could potentially be screened out of the DSA hazard evaluation, consider a chemical supply tank that is not in proximity to radioactive material. Suppose that an analyst considered the criteria in this section (e.g., the six bullet points above on scope of scenarios that require DSA hazard evaluation) and found that the chemical hazard in the tank did not meet any of the criteria. In this case, the tank can be screened out of the DSA hazard evaluation, and safety class or safety significant controls would not be identified in the DSA. For additional guidance on chemical hazard assessment, see Sections 4.3.3 and Appendix F of DOE-HDBK-1163-2020, Integration of Hazard Analyses. Section 4.3.3 of DOE-HDBK-1163-2020 describes the attributes of an adequate chemical SMP such as: “DSA descriptions of an adequate chemical SMP7 should address the following: (1) process for identification of hazardous chemical materials, (2) process for identification of controls for hazardous chemical materials, (3) industry standards used to identify and control hazardous chemical materials, (4) how the hazardous inventories are maintained accurate and up-to-date, and (5) how the integrity of hazardous material controls is assured. Such descriptions should also include a summary of primary chemical hazards in the facility. Key elements of chemical SMPs should be identified and protected in the facility DSA.”

Section A.1 of DOE-STD-3009-2014 describes situations that should not be screened out when considering other unique hazards: “Unique hazards may be present in facilities that are not specifically addressed by the above exclusion criteria, either because of quantities larger than typically used in general industry or because of unique DOE applications or operations. Such hazards may represent a potential hazard to an entire work area affecting multiple workers or have the ability to impact the safe operation of the facility (e.g., inability to perform an SAC).” 7 Another name used for a chemical SMP is a Hazardous Material Protection Program. Chapter 8 of DOE-STD-3009-94, Chg. 3, provides guidance on this program, using that name. DOE-HDBK-1224-2024 14 If unique hazards could impair or disable control room operators, such hazards should be evaluated in the DSA. Situations involving radioactive material co-mingled with chemicals do not necessarily involve a hazard that needs to be evaluated in the DSA. The screening criteria above should be used to evaluate such situations. DOE-STD-3009-2014 requires that: “The basis for any identified hazards excluded from further evaluation shall be provided.” Excluding a specific hazard or class of hazards should be accompanied by recording the applicable code or standard and the relevant site safety management program for implementing the code or standard. This basis may be included on the hazard identification table (see the References column in Table 2-2), or for more complicated justifications, in the DSA Hazard Identification results section. Either approach is suitable, as long as there is clear documentation of hazards screened out from the hazard evaluation. 8 2.3 INITIAL HAZARD EVALUATION DEVELOPMENT 2.3.1 OVERVIEW Hazard evaluation is the starting point for control set selection to prevent or mitigate potentially hazardous conditions, or hazard scenarios as defined in DOE-STD-3009-2014, that could result in undesirable consequences, and for the subsequent quantitative accident analysis. The definitions section of DOE-STD-3009 states that the hazard evaluation portion of a hazard analysis includes an examination of “The complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to radioactive and other hazardous materials”. The DSA hazard evaluation provides (a) an assessment of the facility hazards associated with the full scope of planned operations covered by the DSA, and (b) the identification of engineered and administrative controls that can prevent or mitigate these hazards or hazardous conditions. It analyzes normal operations (startup, facility activities, shutdown, and testing and maintenance configurations) as well as abnormal and accident conditions. In addition to the process-related hazards identified during the hazard identification process, the hazard evaluation also addresses NPHs and man-made external events that can affect the integrity of an SSC. DOE-STD-3009-2014, Section 3.1.3 provides requirements and guidance on how hazard evaluations are to be performed for DOE nuclear facilities. The initial hazard evaluation is accomplished by the following steps:

1. Define the scope of the hazard analysis. This scope can vary from a single process in a single room to an entire facility with multiple processes. Evaluation of the entire facility may be more efficiently performed by dividing it into smaller process or area nodes. The scope of activities to be evaluated by the analysis includes any activities that can occur when significant quantities of hazardous materials are present. These activities include (a) DSA-authorized processes and experiments in the facility, (b) off-shift activities, and (c) any hazard associated with maintenance and support activities that can occur when significant quantities of hazardous materials are present. Quantities are significant if they can cause injury, for example, as related to asphyxiation in DOE-STD-3009-2014. Physical boundaries, process/support system interfaces, and interfaces with other facilities need to be defined. 2. From the hazard identification accident initiator, evaluate hazards associated with authorized activities, man-made external events, or NPHs. Develop a comprehensive list of postulated hazard scenarios. 8 Many SIHs are evaluated in the hazard evaluation as an initiator or contributor to a radioactive or other hazardous material release, which should be acknowledged somewhere in the hazard identification results section. DOE-HDBK-1224-2024 15 3. From the hazard identification results, evaluate radioactive and other hazardous materials and energy sources to determine possible interactions that could lead to accident conditions. 4. Evaluate circumstances such as equipment failures, process material hazards and failure of barriers, and mission activities that could affect the initiation and progression of the accident conditions. 5. Review applicable safety documentation, process history, occurrence reports, and other information sources to identify postulated or historical hazardous conditions and accidents associated with the facility. All activities within the facility boundaries are considered in the analysis. The hazard analysis team defines where these boundaries, or process or area nodes, start and stop. Considerations include: 1. Do activities start at the door of the facility, at the loading dock, or at an outside staging or storage area? 2. If two facilities share common space, at what point does one facility analysis start and the other stop? 3. Do immediately adjacent facilities pose hazards such as toxic materials? 4. Are there any hazards associated with the process or area nodes or facility boundaries that may warrant consideration of controls? 5. Are there any hazards associated with operations or facility support activities, such as maintenance, that may warrant consideration of controls? 6. Can the loss of utilities, such as loss of offsite power, onsite power to the facility, or the facility’s backup power, cause or contribute to a radiological or hazardous material release (e.g., loss of primary confinement ventilation system causing radiological releases from plutonium oxide handling gloveboxes)? Following this initial evaluation, the process continues with the documentation of hazardous conditions and selection of unmitigated hazard scenarios based on potential interactions between hazardous materials and energy sources.

Typical hazards commonly associated with DOE nonreactor nuclear facilities are identified in Table 2-3 which provides a suggested causal correlation between hazardous energy and material sources and potential accident types or categories. 9 Hazards identified in Table 2-3 do not always result in an accidental release of radioactive or other hazardous material required to be evaluated by DOE-STD-3009. 9 A similar correlation is provided in DOE-STD-5506-2021, Preparation of Safety Basis Documents for Transuranic (TRU) Waste Facilities, Table 3-1, Hazard Sources and Potential Events. DOE-HDBK-1224-2024 16 Table 2-3. Correlation of Hazardous Energy and Material Sources to Accident Types/ Categories Accident Category* Hazard Energy and Material Source Groups FR-1: Fire Electrical Open Flame Thermal Flammables Friction Combustibles Pyrophoric Material Chemical Reactions Spontaneous Combustion EX-2: Explosion Potential (Pressure) Explosive Materials Chemical Reactions LC-3: Loss of Confinement/Spills Radioactive Material Toxic Chemical Other Hazardous Material Chemical Reactions DE-4: Direct Radiological Exposure Ionizing Radiation Sources CR-5: Nuclear Criticality Fissile Materials EE-6: Man-made External Events Non-Facility Events (e.g., aircraft crashes) Vehicles in Motion Cranes NPH-7: Natural Phenomena Hazards NPH Events - Seismic, Extreme Wind, Flood, Lightning, Extreme Precipitation, Volcanic Ashfall, Wildland Fires, Extreme Temperature *The number assigned to the accident categories is for ease of data management, and any numbering scheme could be used if deemed necessary. A graded approach as defined in 10 CFR 830.3 and DOE-STD-3009 should be applied to the selection of hazard evaluation techniques and developing the HEs. The selection of techniques is based on several factors, including the complexity and size of the operation being analyzed, the type of operation, and the inherent nature of hazards being evaluated. A discussion of hazard evaluation techniques and recommendations can be found in Part I of CCPS, 2008, especially Chapters 4 and 5. 2.3.2 NUCLEAR CRITICALITY HAZARD EVALUATION A criticality accident represents a special case for hazard evaluation. The criticality safety program requirements10 are derived from the hazard analysis process established in the American National Standards Institute/American Nuclear Society (ANSI/ANS)-8 series of national standards (e.g., ANSI/ANS-8.1, Nuclear Criticality Safety in Operations with Fissionable Material Outside Reactors). These standards require a documented nuclear criticality safety evaluation demonstrating that operations with fissionable material remain subcritical under both normal and credible abnormal conditions. Criticality safety evaluations provide the technical basis for controls to prevent or mitigate criticality accidents. The ANSI/ANS-8 series requirements do not apply to critical assemblies or similar operations. Section 3.1.3.2 of DOE-STD-3009-2014 provides requirements on what to include in the DSA hazard evaluation of criticality accidents, while Section 3.3.4 provides requirements on safety classification of criticality safety controls. Experience shows that only a few evaluations of criticality accident scenarios for a facility may need to be included in the qualitative hazard evaluation. Appendix B of this Handbook provides guidance on the magnitude and consequence analysis of criticality accidents and the estimation of fission product yield and particulate STs.

10 Criticality safety program requirements are established in DOE O 420.1C Chg 3. This Order states that DOE- STD-3007-2007, Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Nonreactor Nuclear Facilities, is the required method for performing criticality safety evaluations, unless DOE approves an alternate method. An update to that Standard has been issued in DOE-STD-3007-2017, Preparing Criticality Safety Evaluations at Department of Energy Nonreactor Nuclear Facilities, which will be invoked in a revision to DOE O 420.1C Chg 3. DOE-HDBK-1224-2024 17 2.3.3 CHEMICAL HAZARD EVALUATION As discussed in Section 2.2.4, chemical hazards are screened to determine the need for further hazard evaluation. However, per DOE-STD-3009-2014, Section A.2, chemicals “That could otherwise be screened out but have the potential to be an accident initiator involving radioactive or hazardous material releases or could compromise the ability of the facility operators to safely manage the facility, are retained as part of the DSA hazard evaluation.” Chemical properties such as reactivity, toxicity, and incompatibility with other chemicals are thus included in the hazard evaluation. Qualitative evaluation of toxic chemical consequences using any of the hazard evaluation techniques discussed later in this chapter is generally sufficient to provide a basis (i.e., serious injuries, fatalities, or significant chemical exposure) for comparison to consequence thresholds of interest for the selection of safety significant (SS) controls. However, for some situations, further quantitative analysis of consequences is necessary for control selection. 11 Later sections of this Handbook will provide guidance on quantifying chemical STs (Sections 5.3) and chemical dispersion analyses (Section 9.5) to estimate concentrations to receptors (Chapters 6, 7 and Section 9.7). However, selection and application of appropriate ST and dispersion modeling methods for evaluation of chemical hazards will need to consider special situations such as chemical reactions, chemical transformations in the plume, or heavier-than-air plume modeling. 2.4 HAZARD EVALUATION METHODS 2.4.1 COMMERCIAL INDUSTRY METHODS AND DSA HAZARD EVALUATIONS Chapter 4 of CCPS, 2008 describes twelve methods that can be used in a hazard evaluation. The discussion is oriented toward the chemical industry, but the basic strengths and weaknesses of each method are generally applicable for the DSA hazard evaluation. The following sections discuss four of these methods as applied to several facilities described in DOE-HDBK-3010-94, Airborne Release Fractions/Rates and Respirable Fractions for Nonreactor Nuclear Facilities, Appendix B. None of these industry hazard evaluation methods were designed to generate a DSA hazard evaluation and do not yield hazard scenarios, nor were they designed to identify SS and safety class (SC) SSCs or SACs. Those results are uniquely defined for DOE usage to develop a DSA. Thus, one does not normally see the raw information generated from the industry hazard evaluation in a DSA; however, it is a necessary step to developing hazard scenarios. The hazard evaluation is performed to understand facility vulnerabilities and potential hazard scenarios. Those insights are then distilled into DSA hazard evaluation tables and are used for safety classification of controls and derivation of Technical Safety Requirements (TSRs).

The common methods utilized vary in both complexity and focus. Each method has strengths and weaknesses, and depending on the scope of the hazard analysis, multiple hazard analysis methods may be used. For example, the hazard and operability (HAZOP) analysis or methodology is effective for analyzing a chemical process within a facility, but the “What-If” methodology is better suited for evaluating NPH and man-made external events with the potential to affect the entire facility. 11 For example, see DOE-STD-3009-2014, Section 3.2.3.3 and Section A.2 for further information for evaluation of the toxicity hazard and determination of concentrations for the CW at 100 m and maximally exposed offsite individual (MOI). DOE-HDBK-1224-2024 18 2.4.2 METHOD 1: WHAT-IF? The What-If method is a loosely structured, brainstorming technique commonly used in the DOE complex by itself or in combination with other hazard analysis techniques. As with any other hazard analysis method, the analysis typically is organized by facility operations, processes, or activity location (e.g., a production support laboratory). Analysts utilizing this method formulate a series of questions, each beginning with the phrase “What if…?” for each process or activity. An example might be “What if the liquid tank in the support laboratory overflows?” The hazard evaluation would discuss ways in which the tank might overflow (e.g., initiators and overall event progression sequences), the potential consequences of overflow, what preventive and mitigative control responses are available, and what additional measures may be recommended for consideration. The extent of the discussion is based on increasing potential consequences. If the liquid in question is simply water with trace contamination or less harmful chemicals, the discussion will reach resolution much more rapidly than if the liquid is radioactive or a highly volatile, toxic substance. To provide the proper structure for comprehensive results, the examination progresses in an organized manner, from the beginning of the activity/operation to the end. Well-designed checklists can provide additional structure that limits the potential for important events to be missed. This What-If/Checklist method combines the What-If method with the checklist, which is the simplest method for hazard evaluation that identifies already-known or understood hazards such as fires and explosions and can be augmented with specific design information. Furthermore, while a variety of potential outcomes can be identified, it is important to identify the ultimate consequence that is physically plausible. Analysts should not stop with the assumption that a given control will function. To do so can result in failure to identify vulnerabilities and is also inconsistent with DOE’s stated intent for unmitigated analyses. The strengths of the What-If method include broad applicability, ease of use, and its adherence to natural thought processes. Weaknesses include a greater potential for neglecting interaction issues and for missing some events altogether. Another weakness of the What-If analysis is that many scenarios identified may result in no or insignificant consequences; thus, creating a large number of scenarios of no interest to the DSA process. A modified What-If analysis has also been used to identify scenarios with significant consequence potential for further analysis. Further analysis may include the DSA-required evaluation of the frequency, consequence, and risk for such scenarios of interest, or combining the results of the What-If analysis with other hazard analysis techniques. The quality of What-If results can vary significantly based on the experience of the individual leading the team effort. Generally, What-If analysis is most suited to simple operations and activities where the potential end states of each step are discrete and easy to identify. Manual operations/activities are often ideal for What-If analysis.

The H-21 Transuranic (TRU) Waste Facility and the H-7 Production Support Lab discussed in DOE-HDBK-3010-94; Appendix B illustrates examples of facilities amenable to a What-If analysis. The common feature of these facilities is that they do not have complex processes. They consist of discrete, manual operations with well-defined interaction boundaries. Consider the liquid sampling glovebox in the H-7 Production Support Lab. It is a non-complex operation where a laboratory operator analyzes 20 ml sample vials. A simple walkdown of the process generates obvious What-If questions as shown on Table 2-4. DOE-HDBK-1224-2024 19 Table 2-4. What-If Hazard Analysis Example H-7 Production Support Lab What if…? Possible Consequences 1 …a collection of vials is dropped while being entered into the glovebox? Broken vials, small Pu airborne release, minor worker exposure. 2 …the sample recycle bottle is dropped while coming out of the glovebox? Spill, small Pu airborne release, minor worker exposure. 3 …liquid is spilled within the glovebox? See #1 and #2 above, without direct worker exposure potential. 4 …the sample recycle bottle is overfilled (i.e., double batch of high concentration of fissile solution)? a. Criticality Safety Evaluation shows large margin = no issue or b. Criticality Safety Evaluation shows limited margin = potential criticality event 5 …the glovebox inventory of hexane solvent ignites? a. Potential glovebox confinement breach and/or b. Pu airborne release (larger release potential than spill) 6 …more samples are brought into the glovebox than its allowable storage spaces? No specific consequence (potential deviation in operational practice that should be evaluated). 7 …planchettes are dropped outside of glovebox No significant consequence (quantities of material are too small) The above list is not exhaustive but demonstrates the basic concept. This questioning process would be repeated for each of the specific operations and general activities authorized in the facility. The resulting complete set of questions and answers would then be combined and amplified as necessary to generate specific hazard scenarios in the DSA Hazard Evaluation table. For example, if the potential exposure consequences are sufficiently limited, all liquid spills might be combined into one representative hazard scenario; or, if only one or two of the liquid spill scenarios could pose significant exposure potential, those would be documented as individual events. Care should be exercised when combining scenarios. There should be no attempt to combine scenarios until potential controls are identified. The considerations to determine if scenarios should be combined include identifying that proposed controls are either bounded or are the same for all bundled scenarios. In the hypothetical case presented in the previous paragraph, suppose one distinct spill with significant consequences is combined with all other spills. The Hazard Evaluation would then identify any credited controls for one scenario as applying to all glovebox liquid handling operations.

Dissimilar scenarios cannot be combined. For example, fires and spills should not be artificially combined into one event because they have differing consequences, separate initiators, and unlike controls. The required clarity of the analysis of the most important preventive and mitigative controls will be lost if these dissimilar scenarios are combined. Bounding scenarios is primarily a function of their controls. The example above only illustrates the identification of “what if” questions (which may help define initiating events or scenarios) for a single operation, and the associated possible consequences. It may not define a complete set of initiated events or define completely an accident scenario, nor include the controls to prevent or mitigate such scenarios. 2.4.3 METHOD 2: HAZOP ANALYSIS The HAZOP Analysis method is designed to investigate chemical process and complex system performance requiring a more methodical approach to ensure completeness, which cannot be effectively accomplished with the “What-If” technique. It requires a significantly greater investment of time and resources than a “What-If?” analysis because team members are required to identify and assess the significance of system malfunctions or improper operations at each step of a process using a highly formal, systematic approach. DOE-HDBK-1224-2024 20 The HAZOP method first divides a process or system into discrete sections (defined as process or system nodes), with the intent or function of each section being well-defined. Figure 2-1 illustrates the complete HAZOP method, after defining the process or system nodes. Figure 2- 1. HAZOP Method Overview The method then examines deviations in the process conditions from design conditions by systematically combining each parameter of interest for the process or system with guide words. These deviations can be caused by many initiating events, including but not limited to hardware issues, human interactions, process upsets, and external events. Examples of parameters include flow, pressure, temperature, composition, and even more conceptual items such as containment. Examples of guide words include none, more of, less of, high, low, as well as, part of, reverse, wrong type, sooner than, later than, breach. A HAZOP deviation matrix can be built to describe the evaluation criteria corresponding to a guide word for a given process or system parameter as illustrated in Figure 2-2. Figure 2-2. HAZOP Deviation Matrix For example, the HAZOP team might start examining a process or system section by first identifying a parameter, such as flow and the guide word “None” and postulating a deviation of “no flow.” They would then identify the causes of no flow, qualitatively define the consequences of no flow, and what safeguards or controls are available or may be recommended for consideration, or other action items that may require further investigation. When significant consequence potential is identified, it is important to trace causality back to previous sections examined if the deviation of interest originates there. For additional perspective, consequence, likelihood, and risk rankings may be assigned to each of these significant deviations/cause conditions, or those that may be accomplished in a subsequent DSA hazard evaluation. The team subsequently proceeds to other guide words for the selected parameter, such as “low flow,” followed by “high flow” and so on. This procedure yields an understanding of the integrated process or system behavior, as opposed to simply focusing on the discrete behavior of isolated components.

DOE-HDBK-1224-2024 21 The HAZOP method brings to bear considerable structural rigor. It breaks down the entire process or system into a large number of discrete sections (pipe runs from Point A to Point B and individual vessels) and goes through a repetitive exercise to examine deviations in significant detail. Most deviations will not, in fact, involve any significant vulnerabilities. The HAZOP process is a time intensive process. HAZOPs for large processes or systems are conducted over multiple days. Attempting to move swiftly through the HAZOP tends to create an overload effect that defeats the purpose of this method. The strengths of the HAZOP method are thoroughness enforced by structural rigor, focus on small details, adaptability to almost any process or activity, and generation of an organized evaluation record as an intrinsic part of the method. HAZOP also forces participants to properly define the process or activity at a detailed level prior to beginning. Weaknesses include the fact that HAZOP is much more time and resource intensive than other methods. It is also vulnerable to poor initial organization. HAZOPs generally represent overkill for simple processes and predominantly manual activities, but are ideal for more complex processes, where the sheer magnitude of the potential deviations can overwhelm a “What- If” examination. Another weakness of the HAZOP method is that since it is focused on processes or systems, and their deviations, it often can miss more generic hazard scenarios such as external and natural phenomena events, or those not associated with process or facility systems. Table 2-5 presents a HAZOP example for the Metal Dissolution Process described in DOE-HDBK-3010-94, Appendix B for the Plutonium Recovery Facility. This portion of the HAZOP evaluates a node defined by piping from the heat exchanger to the spray chamber as shown in Figure B.8 of DOE-HDBK-3010-94. The parameter examined is “Flow.” Compared to the previous “What-If” examples, the rigorous and repetitive nature of the method is clear. “What-If” relies on the ability and experience of the analysts to ensure completeness; HAZOP relies more on the method’s formal structure DOE-HDBK-1224-YR 22 Table 2-5. HAZOP Example Parameter Deviation (guide word) Cause Consequence Safeguards or Controls Likelihood Consequence Risk Comments/ Actions Flow No 1. Pump not working 2. Heat exchanger outlet valve incorrectly positioned 3. In-line filter clogged Operational Return line flow meter, Temperature sensors Safe Condition: Dissolution reaction ceases without fresh acid flow Unsafe Condition: Potential to pressurize heat exchanger Flow No 1. Piping rupture Plutonium solution spill Glovebox, Glovebox ventilation, critically safe drainage basin, Room air monitor, Room ventilation Flow Low 1. Piping leak Plutonium solution spill Glovebox, Glovebox ventilation, critically safe drainage basin, Room air monitor, Room ventilation Flow High 1. Pump output excessive 2. Heat exchanger outlet valve incorrectly positioned Temperature transient (more flow is heated less) Temperature sensor on slab tank, Steam inlet control, Return line flow meter, Hydrogen detector, Shutdown interlocks, Air sparge Unsafe Condition: More flow maximizes reaction Unsafe Condition: Low acid temperature can yield undesired hydride sludge Flow Wrong 1. Steam inlet off with heat exchanger leak Plutonium solution enters heat exchanger condensate

Condensate collected in Raschig ring tank, Condensate samples Action: Verify sampling frequency Note: Piping from Heat Exchanger to Spray Chamber (as shown in DOE-HDBK-3010-94, Figure B.6). DOE-HDBK-1224-YR 23 As noted previously, the traditional HAZOP table is not an example of the Hazard Evaluation table expected in an actual DSA, but with modifications as suggested in Table 2-5, it may be suitable. The HAZOP identifies process vulnerabilities and interactions from which a set of hazard scenarios are usually derived for the DSA Hazard Evaluation table. For example, a runaway exothermic reaction generating hydrogen is an event that would be expected in the DSA Hazard Evaluation table. Depending on the HAZOP results, there could be multiple entries for the same event to identify different progression paths, some of which would be of concern, while others may not. Alternatively, one entry could cover all potential progression paths; however, all paths should still be assessed to determine which, if any, warrant specific control. Example outcomes include: • The hydrogen detector and shutdown interlock are adequate to credit for all scenarios; or, • An individual control in a specific progression path may require crediting as well, either due to the high likelihood of that progression path or its ability to minimize the effect of the hydrogen detector and associated interlocks. These methods were not developed to credit SSCs. They are intended to address problems that may arise when deviations from design conditions occur. This method, or any hazard analysis method, may uncover safety issues to be further evaluated. 2.4.4 METHOD 3: FAILURE MODES AND EFFECTS ANALYSIS The Failure Modes and Effects Analysis (FMEA) is a flexible tool for examining equipment, a process, or system failures (in this section, “system” also includes equipment or a process). It is particularly suitable for characterizing the performance spectrum associated with individual component failures within the system. Thus, it is ideal for identifying all potential failure modes for systems of interest typically of moderate complexity. In some cases, the impact may not just be the failure of the system to perform its intended function, but could result in an accident condition of interest, such as an explosion in a process line. The analysis proceeds as follows: • Identify the major components (example: detectors). • Identify the systems using these components (example: ventilation). • Identify all failure modes for each component (high, low, loss of signal). • Identify the effects of component failures on the systems. Finally, for system consequences of interest, such as failure of the system to perform its function or an accident of concern, the controls or safeguards to prevent or mitigate such failures are identified. FMEA equipment failures. As indicated, FMEAs are ideal for evaluating system failure modes, but are not well-suited to supporting the identification of process hazard scenarios. FMEAs also lack the structure to examine process upsets (e.g., reverse flow, process chemistry deviations) as initiators. Inexperience with using the method can also lead to an excessively narrow focus on individual failures as opposed to integrated process behavior. Therefore, because the FMEA is narrowly focused, it is usually applied in combination with other techniques, such as fault tree analysis, to provide a more detailed understanding on how a system could fail.

DOE-HDBK-1224-2024 24 Table 2-6 shows an application of the FMEA method to the same example discussed in Section 2.4.3 (i.e., the Metal Dissolution Process for flow from the heat exchanger to the spray chamber through the pipe). The component and the failure modes of interest within this process are those associated with the hydrogen detector. Table 2-6. FMEA Example Process: Metal Dissolution Line Component: Hydrogen Detector Failure Mode Effect Safeguards Comments/Actions Fails high Generates premature process shutdown for low H2 concentration. Fails safe. Indication on operational console, Shutdown interlock. Fail safe: None. Fails low Failure to generate process shutdown, when required, leading to unsafe conditions (e.g., a potential for exothermic reaction and hydrogen explosion). Indication on operational console, Spray chamber temperature sensor (also feeds shutdown interlock), Temperature indications on operational console. Potential accident of concern. Increased hydrogen concentrations are generally accompanied by higher temperatures. A runaway exothermic reaction would still yield a shutdown. However, conditions short of that could yield H2 concentrations in excess of the shutdown limit. Fails as is Failure to generate process shutdown when required. See Low Failure Mode See Low Failure Mode. Potential accident of concern. See Low Failure Mode comments/actions. Loss of Power Triggers shutdown interlock. Indication on operational console, Shutdown interlock. Fail safe: None. Signal to Interlock, Mode A Triggers shutdown interlock. Indication on operational console, Shutdown interlock. Fail safe: None. Signal to Interlock, Mode B Failure to generate process shutdown when required. See Low Failure Mode Effects See Low Failure Mode safeguards. Potential accident of concern. See Low Failure Mode comments/actions 2.4.5 METHOD 4: EVENT TREES AND FAULT TREES Event trees and fault trees are formal logic constructs designed to document progression paths for an event. Event trees utilize inductive reasoning while fault trees utilize deductive reasoning. These two tools can be combined in a formal quantitative or probabilistic risk assessment, but such an assessment for an entire facility or process is not typical when evaluating DOE nonreactor nuclear facilities. Event trees and fault trees are normally used in DSAs as support tools to illuminate a specific issue of interest. Inductive reasoning is often characterized as a bottom-up analysis since it starts with a specific premise and moves toward a general conclusion. An event tree correspondingly starts with a specific initiating event and moves toward a broad collection of potential outcomes. The DSA hazard analysis approach results in event sequences with varying consequences in terms of radiological release potentials, based on the success and failure of any preventive controls that may terminate the event, or mitigative controls that may reduce the consequences of the event. A simple example of an initiating event might be loss of cooling water to a furnace. Every action that can result from that event then forms a decision point from which multiple possible outcomes branch. For example, suppose Alarm A is supposed to sound to DOE-HDBK-1224-2024 25

generate an operator response if cooling flow is lost. The first decision point is therefore Alarm A functions. Two branches stem from that point: (a) if Alarm A functions, the progression moves to a decision point labeled Operator responds, (b) if Alarm A does not function, operator response is initially bypassed, and the resulting branch moves to a different decision point. The end result is a complete spectrum of outcomes, from successful to unsuccessful to catastrophic, which are characterized in terms of actions and controls associated with their progression. Each individual path through this event tree represents a separate event sequence. In this way, the sets of event sequences that yield failure of the safety system or its safety function can be defined. Event trees graphically depict the relationship between an initiating event and controls; thus, defining ranges of potential scenarios, their frequencies, and potential consequences based on the response of credited controls. Event trees, as well as fault trees, are typically used to support accident analyses and are not necessarily elevated to the DSA. Deductive reasoning is often characterized as a top-down analysis since it uses general premises to arrive at a specific conclusion. A fault tree thus begins with the undesired end state as the top event such as a specified consequence of a potential accident and analyzes equipment failures and human errors that cause the top event. Such end states have often been identified by application of other hazard evaluation methods. For demonstration purposes, a simple example of an undesired end state is “the car does not start.” The next step down in the fault tree lists the immediate causes such as starter motor failure, spark plug failure, and lack of gas in the cylinder. The next step-down lists all the potential causes for each immediate cause: no gas in supply tank, failure of the fuel pump, fuel line leak. These potential failure mechanisms are joined by “AND” or “OR” gates depending on whether multiple mechanisms (A “AND” B) are needed to cause the failure above or if a single mechanism (A “OR” B) suffices. This process ends either in basic occurrences that cannot be subdivided further or at a predetermined evaluation boundary. Again, the minimum cut sets that yield failure of the system or its safety function can be defined. The strengths of this approach include logical rigor, recording of results in a branch structure as the evaluation occurs, and direct support of numerical estimation of likelihood of the postulated significant consequences. Weaknesses include a tendency toward tunnel vision if the failure mode or safety function of interest is not precisely defined, as well as a significant resource and time investment to generate integrated results. 2.5 INITIAL DEVELOPMENT OF A DSA HAZARD EVALUATION TABLE The commercial industry Hazard Evaluation methods previously discussed evaluated process upsets, equipment failures, human errors, and potential safety features. Table 2-7 shows how similar hazard studies can be used to start development of Hazard Evaluation tables for the DSA, based on an example of a vehicle collision plus fire involving TRU waste containers which has often been evaluated using the “What-If” method. DOE-HDBK-1224-2024 26 Table 2-7. Initial Development of Hazard Evaluation Table Event No. Event Description Initiators Preventive Features Mitigative Features

FR-1 A fuel powered vehicle suffers a fuel leak due to an impact with TRU waste drums in the Shipping/Receiving Area and is ignited. A forklift carrying a single pallet with four drums impacts a stack (two high) of palletized drums with moderate to severe stress causing breach with material spill of 12 drums and ensuing pool fire that involves 88 additional drums in the Shipping/ Receiving Area. MAR: 698 Plutonium Equivalent (PE)-curies (Ci) in 100 drums (assumes 300 PE- Ci in the maximum drum). (DOE-STD-5506-2021 statistical MAR distribution for Waste Isolation Pilot Plant-complaint containers applied, see Table 4-1). INITIAL CONDITIONS: Staging area inventory limit. TRU waste in metal containers. Metal pallets. • Operator error • Equipment malfunction • Vehicle impact with fuel spill • Ignition of combustible and/or flammable materials • Lightning • Wildland fire SSCs: Concrete vehicle barriers. Waste staging building foundation. ADMINISTRATIVE: Procedures and Training Program (Forklift Operator training). Vehicle maintenance program. Fire Protection Program: • Combustible controls Waste handling operations curtailed outdoors during inclement weather. Movement of waste is to be accomplished using electric or manual powered equipment. Fuel exclusion zone in the Shipping/Receiving Area. SSCs: None ADMINISTRATIVE Procedures and Training Program (workers trained to evacuate). Emergency Preparedness Program (emergency response activities). Control identification occurs as part of the initial hazard evaluation development and is recorded in the Hazard Evaluation tables as shown in Table 2-7. At this stage of developing the Hazard Evaluation table, all preventive and mitigative controls are listed that are available, or can be readily implemented, to demonstrate defense-in-depth as described in DOE-STD-3009. 2.6 LIKELIHOOD, CONSEQUENCE, AND RISK METHODS The next step of the DSA Hazard Evaluation is to perform a qualitative estimate of the unmitigated consequences, likelihood, and optionally, risk ranking of the hazard scenarios. The following subsections present methods for these evaluations. 2.6.1 QUALITATIVE CONSEQUENCES 2.6.1.1 Receptor Consequence Levels Table 2-8, reproduced from DOE-STD-3009-2014, Table 1, provides three qualitative consequence thresholds (bins) to estimate potential effects on FWs, CWs, and the public [(i.e., maximally exposed offsite individual (MOI)]. 12 High, moderate, and low consequence levels are quantitatively defined for the offsite public and CWs. High consequence levels are qualitatively established for FWs consistent with 12 These bins are similar to consequence level thresholds defined in DOE-STD-3009-94, CN3. DOE-HDBK-1224-2024 27 DOE-STD-3009 guidelines for a significant worker consequence. Moderate and low consequence levels are not defined for FWs, because qualitative analysis would not yield results that provide a meaningful comparison to a distinguishable threshold. 13 Table 2-8. Consequence Thresholds Consequence Level Public1,4 CW2,4 FW3 High ≥ 25 rem TED5 or ≥ PAC/TEEL-26 ≥ 100 rem TED or ≥ PAC/TEEL-3 Prompt death, serious injury, or significant radiological and chemical exposure Moderate ≥ 5 rem TED or ≥PAC/TEEL-1 ≥ 25 rem TED or ≥ PAC/TEEL-2 No distinguishable threshold Low < 5 rem TED or < PAC/TEEL-1 < 25 rem TED or < PAC/TEEL-2 No distinguishable threshold

1 MOI - A hypothetical individual defined to allow dose or dosage comparison with numerical criteria for the public. This individual is located at the point of maximum exposure on the DOE site boundary nearest to the facility in question (ground level release) or may be located at some farther distance where an elevated or buoyant radioactive plume is expected to cause the highest exposure (elevated release). 2 A CW at a distance of 100 m from a facility (building perimeter) or estimated release point. 3 A worker within the facility boundary and located less than 100 m from the estimated release point. 4 Although quantitative thresholds are provided for the MOI and CW consequences, the consequences may be estimated using qualitative and/or semi-quantitative techniques. 5 Total effective dose (TED), 50-yr commitment - see Chapter 8. 6 PAC/Temporary emergency exposure limits (TEELs) - see Chapter 9. High consequence thresholds identified in Table 2-8 do not represent acceptable exposure levels to the public or workers; they are merely criteria used to identify SC and SS controls. Qualitative judgment is inevitable in a hazard evaluation. It is routinely utilized in industries outside DOE. Guidelines for Hazard Evaluation Procedures (CCPS, 2008, Pg. 22), notes the following: “The subjective nature of these deliberations may trouble some people who use the results of these studies because this subjectivity creates a lack of confidence in the results. Some people incorrectly believe that if the analyst uses quantitative methods to express the significance of a problem, then the limitation of subjectivity will simply fade away. However, this is not the case. The apparent numerical precision of a QRA [quantitative risk analysis or quantitative risk assessment] can mask (1) a great deal of the judgment that influenced the selection of accident models and (2) large uncertainties associated with the data used to estimate risk.” Estimating consequences qualitatively requires consistent assignments of the high, moderate, and low consequence levels for similar scenarios. This may require “normalizing” hazard scenarios by comparing against one another for consistent assignment of a severity level and to verify no outliers exist absent a sound explanation. In addition, for those hazard scenarios that were selected as representative or unique design basis accidents/evaluation basis accidents (DBA/EBAs) for further quantitative accident analysis, insights from that quantitative analysis should be used to verify the qualitative consequence assignments for the hazard evaluation (i.e., an iterative process between the hazard evaluation and the accident analysis). 13 Mitigated analysis that credits controls to reduce unmitigated high consequences to the facility worker generally show mitigated low consequences on the DSA hazard evaluation table. DOE-HDBK-1224-2024 28 Assigning qualitative consequence levels may be informed by use of quantitative scoping estimates of effects on FWs, CWs, and the MOI. Consequence estimation is performed differently for FWs that may be near the source of the event or other areas within the facility where exposure may occur, as opposed to CWs or the public located at a distance from the facility. The latter often has a simplified quantitative basis. That is, it is a straightforward exercise to identify radioactive materials of greatest concern downwind using specific activity and dose equivalents that also incorporate the dispersion analysis. Likewise, chemicals that combine significant volatility and toxicity are easily identified. The analyst therefore starts with a short list of materials and release scenarios that are bounding. Bounding is intended to refer to the accident with the highest consequences among a group of similar accidents.

It is a simple matter to calculate “unit release” consequences at any distance of concern within the capabilities of atmospheric dispersion tools being used to yield “rules of thumb” for screening calculations such as rem/ Ci released, or concentration/mass released. These in turn are used to qualitatively scale given events into qualitative consequence bins or levels of severity (high, moderate, low) for the CW and MOI. The CW scoping calculations may also provide the technical basis to meet the following requirement from DOE-STD-3009-2014, Section 3.1.3.1: “Consequence determinations used for co-located workers in the hazard evaluation shall be supported by an adequate technical basis such as scoping calculations consistent with Section 3.2.4. Alternately, the quantitative evaluation of co-located worker consequences used to compare to Table 1 thresholds may be performed in the accident analysis and reported in the DSA Section [3.4].” 2.6.1.2 Facility Worker Consequences Given the qualitative nature of the consequence thresholds for FWs in Table 2-8; the designation of FW consequences is based on first understanding how these type of consequence thresholds can be triggered by common hazards found in the DOE complex, or what these consequence thresholds mean in relation to radiological or hazardous chemical worker exposures. That is, FW consequences in many cases are based on accepted past-experience or consensus judgments from previous hazard evaluations throughout the DOE Complex, and not on quantitative calculations with their associated hard-to-defend assumptions and uncertainties. Thus, the following are recommendations and best practices to determine FW consequences. Past experience and consensus judgments indicate that prompt death may occur by a limited set of hazards and scenarios. Examples include: • Nuclear criticalities, • Exposures at levels over 400 rads to penetrating radiation such as gamma or X-rays, and • Energetic releases of extremely hazardous chemicals. Exposure to airborne (non-penetrating) radioactive material such as plutonium and uranium due to a wide range of accident scenarios such as fires or spills are unlikely to result in prompt death. However, these could result in significant radiological exposures depending on several factors associated with the hazard (e.g., inventory, form of material) and the scenario itself as discussed in more detail below. DOE has no simple numerical consequence metric to assess threshold consequences for FWs. Because of the location of the postulated FWs inside a facility or very near the source of a release, downwind DOE-HDBK-1224-2024 29 considerations such as χ/Q are not applicable. Therefore, the determination of FW consequences is usually based on qualitative judgment, and not on quantitative calculations. In order to use a quantitative metric, one would have to equate a “serious injury or significant exposure” to a mutually accepted quantitative exposure level (either radiation dose or toxic concentration) to define a threshold numerical value that is equivalent to a high consequence as defined on Table 2-8. This has been accomplished in DOE-STD-3009-2014 for the co-located worker and public, but not for the facility worker. Some previous DSAs have been based on a metric that radiation exposures due to accident conditions that could lead to exceeding emergency planning threshold or process safety management levels may be considered significant, since the selected level implies the onset for potential long-term health effects. Nevertheless, if a quantitative approach is desired, agreement on what constitutes a significant exposure should be reached with the DOE Safety Basis Approval Authority (SBAA) before any quantification is performed in support of determining the FW consequences.

A quantitative analysis may not be necessary where insights from past industrial accidents are available, as may be the case for large-scale releases of toxic substances such as hydrogen fluoride. The analyst should consider the differences between past accidents and a hypothetical unmitigated event (e.g., the past accident may not have involved bounding levels of MAR, some mitigative controls may have been effective, airborne monitors may have provided notification, chelation may have been administered). Local facility worker consequences should be evaluated with some sense of perspective and historical experience, as it is possible to conceive extreme events immune to any possible set of controls. The analyst should focus on the work areas in which accidents may result in a release of radioactive or hazardous material. If quantitative or semi-quantitative analyses are to be performed to support FW consequences, the airborne concentrations associated with such releases should be evaluated without assuming that the release instantly mixes into the volume of the room or work area. However, a conservative but reasonable period of exposure could be assumed. Further guidance on these issues is provided later in this section. The unmitigated consequence potential should not be underestimated, nor should unmitigated consequences be exaggerated relative to historical experience to a point where every exposure to the local FW is a high consequence event. DOE-STD-3009-2014 states: “To ensure an informed and defensible qualitative evaluation, the determination of facility worker consequences should be based on a combination of the following: • Magnitude, type, and form of radioactive and hazardous materials involved in a hazard scenario. • Type and magnitude of energy sources involved in a hazard scenario. • Characteristics of the hazard scenario such as duration and the location where it may occur (e.g., in unmanned areas such as tank vaults); and • Potential for a hazard to impact workers’ mobility or ability to react to hazardous conditions.” Some additional discussion of the fourth bullet is warranted. DOE-STD-3009-2014, Section 3.1.3.1 states that “The facility worker’s mobility or ability to react to hazardous conditions should not be used as the sole or primary basis for determining facility worker impacts.” This means that all four of the factors listed above ought to be considered collectively, not individually. A “see and flee” approach that results in unmitigated low consequences should not be used without due consideration of the accident characteristics. The last bullet, therefore, injects some realism into the event scenario for a “reasonable” unmitigated estimate of potential consequences to the facility worker. As an DOE-HDBK-1224-2024 30 example, an assumption that a worker within a building experiences lower consequences by a release from a building fire based on hazard recognition and timely evacuation would have to be justified by considering the location and characteristics of the fire relative to radioactive or hazardous material. Although unmitigated analysis may not take credit for administrative controls or active engineered features, it is reasonable to assume that facility workers have some knowledge of the facility hazards and adequate training to react to hazardous situations. This assumption, however, is valid only when the accident is not disabling, provides obvious warning signs, and is slow developing. However, care should be taken not to rely excessively on crediting this type of condition as defaults for unmitigated analysis. Any credit of this nature needs to be justified in the evaluation of the unmitigated consequences for facility workers, based on the contributing elements discussed in this section.

In evaluating the unmitigated consequences associated with a postulated hazard scenario, the following considerations may be important in assigning facility worker consequences: 1. Timing of radiological release: Hazard scenarios involving fires can develop quickly, but not so rapidly as to preclude evacuation in a reasonable period of time. Other scenarios, such as criticality accident, explosion, and instantaneous release from confinement enclosures or containers can entail significantly more rapid radiological exposure. Another example is a long duration release, such as during a spill of a radioactive or hazardous chemical liquid where a worker in the vicinity of the spill would not be expected to stand in the spilled liquid for an extended period of time. Therefore, though some exposure might occur, a conservative but reasonable time of exposure should be assumed, again considering the location and characteristics of the fire relative to radioactive or hazardous material. For events such as a criticality or an undetected leak of material, personnel evacuation is not assumed absent credited alarms (i.e., criticality alarms, air monitors) in the mitigated case. Explosions of any significant size are inherently more noticeable, but worker location relative to the point of release, as well as the associated potential for injury, may result in significant initial exposures before evacuation can occur. If this would not be the case, a clear explanation should be documented. For worker errors such as dropping or puncturing a container, worker awareness of the error can be assumed, with exposure estimates based on the elapsed time between the release and the decision to leave the area. As part of this analysis, there should be consideration of whether the worker would be aware that a release had taken place (e.g., would there be a visually obvious spill that would lead to evacuation, as opposed to an undetected leak of airborne material). In the case of fire, the key question is: how much release effect will a given form of material experience in the time it takes for the fire to become obviously noticeable and associated evacuation to occur? Analysts should not assume instantaneous evacuation, but it is also not meaningful to assume continued personnel occupancy at a time when there are obvious hazard indications or warnings (as discussed further in the following section). 2. Hazard warning: The availability of an obvious hazard warning and its timing relative to significant radiological or toxic chemical exposure may impact facility worker consequences. Warning may be provided by the event itself, as in smoke from a fire. However, engineered detection and notification systems such as air monitors are not credited for the unmitigated analysis. It is not reasonable to assume that an able-bodied worker would remain in a room during a major fire with readily perceived indications (e.g., smoke) while receiving significant DOE-HDBK-1224-2024 31 radiological or toxic chemical exposure. A conservative but reasonable period of exposure should be assumed, including whether the workers may choose to respond to the event. 14 These points should also be considered: • If the FW would reasonably be aware of the event’s occurrence and could take self- protective actions after the event occurs to protect themselves from a fatality or serious injuries from the non-radiological or non-hazardous material consequences, assume that the facility worker will be exposed for a conservative, but reasonable period of time even when warning is provided by the event itself.

• In cases where the FW would not be reasonably aware of the event’s occurrence (e.g., characteristics of the release such as no odors, no visibility of plumes/smoke, occurrence in areas that could mask the release), there is no specified period of exposure, such as two hours. Consider the reasonable lengths of time the FW would normally be present based on the nature of planned activities. • While FWs in the immediate vicinity may in some cases be aware of the event, other FWs could lack that awareness and therefore not evacuate as quickly (or at all) in the unmitigated scenario. In that case, consideration of consequences to those other FWs is also appropriate. They could potentially have a higher exposure potential due to longer exposure times (or egress routes that take them near the event), though qualitatively, the airborne concentration of hazardous material will usually decrease with distance away from the release site. In the mitigated analysis, detectors and alarms can be credited to prompt evacuation of workers who otherwise lack awareness of the event. 3. Scenario effect on protective action capability: Hazard scenarios involving explosions and NPH-initiated failure of buildings or equipment can cause damage to structures or injury to personnel impeding egress, thus increasing potential radiological or toxic chemical consequences. The potential for human errors or equipment malfunctions, in response to mitigating or evacuation actions following the accident, should be considered. Such an error might be putting the ventilation system in an operational mode that will worsen the consequences due to smoke generation. Also of importance is the impact of a toxic chemical release on potential workers’ ability to take protective actions. 4. Potential exposure magnitude: The severity of radiological or chemical exposures is a function of the magnitude of the energy associated with the accident scenario, the quantity estimated to be released, the radiological dose coefficient or toxicity of the released material, and the pathways for transport to and intake by workers. Inhalation is most often the dominant exposure pathway for airborne radioactive material releases, though skin exposures to small quantities of some chemicals such as aqueous hydrofluoric acid can be fatal. DOE-STD-3009-2014 also says the “type” and “form” of the hazardous material should be considered. For instance, some material forms (e.g., powders, liquids) will result in airborne material more readily than others (e.g., grouted monoliths). Even for a qualitative evaluation, the bounding ARFs in DOE-HDBK-3010-94 may be used to provide perspective on how much material could become airborne. Considering the dose potentials of different radionuclides is also an important part of the evaluation. A fire involving depleted uranium might have low radiological consequences, while a similar fire involving the same mass of plutonium would have relatively higher consequences. Careful consideration is needed for highly hazardous materials like plutonium. 14 Workers may respond to incipient stage fires only with portable fire extinguishers, if they have been trained to use the extinguishers and feel safe in doing so. DOE-HDBK-1224-2024 32

5. Location: The impact on FWs could be affected by the location of the worker with respect to the location of the postulated scenario; or whether the accident being evaluated occurs inside or outside of structures. For releases outside of structures, consider the qualitative impacts on dose of the plume moving past the FW. For releases inside a nuclear facility, consider whether the release is being mixed within a relatively small work area volume, such as with glovebox operations or into a large open area such as waste container staging buildings. However, it is not appropriate to assume that the released material immediately becomes well-mixed in a large room. Such an assumption would lead to underestimates of the airborne concentration, because mixing is not an instantaneous process. Also, for releases within the facility, consider facility layout and unique non-ideal conditions such as mining operations or areas of limited visibility that can make evacuation difficult to achieve quickly. As a general rule-of-thumb application of the above considerations, examples of high unmitigated radiological or toxic chemical consequences to the facility worker are: (1) energetic events (such as explosions, pressurized release of powders, and liquid sprays) that rapidly release material of significant dose potential or toxicity such that the worker receives significant exposure before the worker can take protective action (or is incapacitated and cannot evacuate) and, (2) the prompt dose received from a criticality accident. Other types of events such as fires, spills, or dropping of a container require more careful evaluation of the characteristics of the actual accident event (e.g., time to develop) before credit can be given for the elements identified in this section. Any credit taken in the potential unmitigated consequences for facility workers needs to be justified. The preceding discussion focuses on radiological or toxicological consequences. However, there are also cases where physical injuries are evaluated in the DSA. Section A.1 of DOE-STD-3009-2014 states that: “Evaluation of standard industrial hazards within DSAs is needed to the extent that these hazards…result from chemical or radiological hazards (for example, when an explosion is caused by radiolysis inside a tank).” In the case of such explosions, the hazard evaluation would consider the physical injury caused by flying debris. Note: The preceding discussion of evacuation only applies to the FW. Where Section 3.1.3.1 of DOE-STD-3009-2014 allows consideration of evacuation in the unmitigated analysis, the context is for the FW, not the CW. 2.6.1.3 Standard Industrial Hazard Consequences to Facility Worker Consequences to FWs due to SIHs are included in the DSA when radiological or hazardous materials are involved and the SIHs are not screened out. These consequences are addressed in DOE-STD-3009-2014, Section 3.1.3.1 as follows: “Facility worker consequences, due solely to a standard industrial hazard, do not need to be categorized in the hazard evaluation if screened out per Section 3.1.1. However, the evaluation of radiological or chemical hazards that result in a prompt death or serious injury should be assigned a high consequence per Table 1. Examples of such hazards might include the generation of flammable/explosive hydrogen gas by electrolysis of uranium in water or a spill of sodium hydroxide used in radioactive waste processing.”15

15 The above reference to Section 3.1.1 of DOE-STD-3009-2014 is located in Section 2.2.4 of this Handbook. Table 1 of the Standard is reproduced as Table 2-8 in this Handbook. DOE-HDBK-1224-2024 33 For potentially serious injuries or fatalities, the event is assessed to determine whether the physical hazard associated with initiating or worsening a radiological or other hazardous material accident is an SIH or if it should be assigned a high consequence level. The primary consideration in determining whether the physical hazard is an SIH is if the regulated material (i.e., radioactive or other hazardous material) is not a primary cause or major contributor to the hazardous event, and that it is adequately addressed by 10 CFR 851, Worker Safety and Health Program, and its adoption of Occupational Safety and Health Administration (OSHA) and industry standards, 10 CFR 835, Occupational Radiation Protection, and Integrated Safety Management System hazard analysis requirements. These regulations and safety management programs are committed to in the DSA TSRs. Examples of SIH accident initiators of a radioactive or other hazardous material release that may also cause physical injuries/fatalities are provided below to clarify that the unmitigated consequences do not include those SIH physical considerations, unless these could potentially affect their ability to safely manage the facility or respond to an accident condition. In that situation, the SIH should be considered for further analysis: • Thermal hazards to the FW are due to welding equipment and combustible or flammable material fires ignited by typical ignition sources (e.g., electrical or thermal). The welding torch is a common SIH throughout various industries. The fires with typical ignition sources are also SIHs because the hazard and potential physical consequences are due to common types of equipment found throughout various industries. Both of these events are adequately regulated by 10 CFR 851, OSHA, National Fire Protection Association (NFPA), and national consensus standards. • Explosions may involve ignition of flammable gases used with welding equipment; battery and fuel vapors; or off-gassing from waste containers. The welding and equipment explosion and potential physical consequences are considered a SIH because these events commonly occur in general industry and are adequately regulated by 10 CFR 851, OSHA, and national consensus standards. • Missiles are caused by an equipment explosion, failure of pressurized or mechanical system (e.g., air compressor or gas bottle), compressed gas cylinder failures, over-pressurization or deflagration of a hazardous (i.e., non-TRU) waste container, or from extreme straight-line winds, hurricanes and tornadoes. Missiles are considered an SIH because these events commonly occur in general industry and are adequately regulated by 10 CFR 851, OSHA, and national consensus standards, or by the DOE NPH directives (i.e., DOE-STD-1020-2016). However, if the missile physical consequence to the worker is due to the primary hazard being the regulated material, then those physical hazards are considered along with the radiological or other hazardous material consequences in assigning unmitigated consequences. For example, if flammable gas is generated by radiolysis, or by chemical reactions involving a radiological material or process, and a drum or vessel explodes, the physical impact of the fragmented vessel is evaluated.

• Equipment-related events including vehicle/equipment load drops are SIHs because the hazards are presented by the equipment used in the work process, and the events are not caused by the regulated material. These events are adequately regulated by 10 CFR 851, OSHA, and national consensus standards. • Material and equipment movement is a hazard presented by moving, lifting, dropping, vehicle- impact-induced movement, collapse due to corrosion/degradation, or movement due to a seismic event. The hazard is due to the size and mass of the object being moved and is not a hazard presented by the regulated material. The same hazard exists in various industries, such as construction. These events are adequately regulated by 10 CFR 851, OSHA, and national consensus standards, or by the DOE NPH directives (i.e., DOE-STD-1020-2016). • Asphyxiant hazards are presented by the use of small quantities of nitrogen and P-10 gas associated with loading or unloading shipping casks; acetylene or other compressed gases for maintenance activities and liquid nitrogen dewars for assaying waste containers; and exhaust buildup from material handling vehicles inside a facility. These hazards are common in various DOE-HDBK-1224-2024 34 industries, and are adequately regulated by 10 CFR 851, OSHA, and national consensus standards. Smaller amounts of gases (i.e., nitrogen or argon) present for equipment calibration are in quantities that do not present an asphyxiation hazard. However, a large, rapid release of a nitrogen or argon from glovebox inerting systems for a nuclear process into a small confined occupied area that has an asphyxiation potential should be considered in assigning unmitigated consequences if the system has unique hazards requiring special design and controls that are not addressed by industry codes and standards. • Other impacts encompass collisions from vehicles such as trucks traveling on the site, vehicles external to the site, and potential site aircraft crashes. These hazards exist in everyday life and are accepted by the public. Although no specific controls may be identified for these SIHs, the safety management programs, as committed to by the DSA TSRs, which govern the conduct of activities involving various industrial hazards, will provide protection to the worker for these occupational hazards and man-made external events. The qualitative evaluation for the FW may be supported by conservative quantitative scoping calculations, engineering judgment, and acquired knowledge. This qualitative approach is used because quantitative estimates are sensitive to a variety of possible assumptions such as facility worker position, circumstance, and close proximity to the point of release. Consequence estimates can rely on historical accident data or can be determined from: (1) simple bounding ST calculations, (2) existing safety documentation, and/or (3) qualitative assessment supported by calculations. 2.6.2 QUALITATIVE LIKELIHOOD The likelihood of a hazard or accident scenario is assigned to qualitative bins defined by guidelines, which offer numerical ranges of two orders of magnitude or more. Table 2-9, reproduced from DOE-STD-3009-2014, Table 2, defines the qualitative likelihood bins. Table 2-9. Qualitative Likelihood Classification Description Likelihood Range (per year) Definition Anticipated Likelihood > 10-2 Events that may occur several times during the lifetime of the facility (incidents that commonly occur).

Unlikely 10-2 > Likelihood > 10-4 Events that are not anticipated to occur during the lifetime of the facility. Natural phenomena of this likelihood class include International Building Code (IBC)-level earthquake, 100-year flood, maximum wind gust. Extremely Unlikely 10-4 > Likelihood > 10-6 Events that will probably not occur during the lifetime of the facility. Beyond Extremely Unlikely Likelihood < 10-6 All other accidents. A facility’s DSA addresses normal, abnormal, and accident conditions as required by 10 CFR 830. DOE-STD-5506-2021, Preparation of Safety Basis Documents for Transuranic (TRU) Waste Facilities, includes a consideration of “Expected Operational Events.” These are a subset of the anticipated events evaluated in the DSA that includes certain operational events that are expected to occur during the lifetime of a given TRU waste operation even with preventive controls in place. Expected events are defined as planned occurrences encountered during normal operations that result from hazards inherent to the material and activities. They involve known hazards that are described in the DSA, and which do not result in significant consequences to workers or the public with preventive and mitigative controls in place. The protective features provided to perform operational processes ensure consequences are within DOE-HDBK-1224-2024 35 the operational standards that apply to the work. A primary benefit of identifying expected operational events is to provide DOE with the means of pre-approving actions for continued operation should certain events that meet the conditions of an expected event occur. Because these events are expected, appropriate protective measures and actions to ensure continuation of operations are identified and in place prior to beginning the operation. See DOE-STD-5506-2021 Section 3.4, “Expected Operational Events,” for further discussion and what needs to be addressed in the DSA. Although the exercise of determining accident likelihood is qualitative, analysts often develop a numerical basis for judgments to provide consistency. An example is provided in DOE-STD-3009 that a simple methodology for unmitigated likelihood assignment could be to assign a probability of “1” to non- independent events, “0.1” to human errors, and “0.01” to genuinely independent active SSC failures, and “0.001” to genuinely independent passive SSC failures, that would be used to establish the initiating event likelihood as described in Table 2-9. For the unmitigated analysis, these human errors and equipment failures cannot represent the failure probability of a preventive control that would otherwise provide a SC or SS safety function. To determine the likelihood of an accident scenario, only initiating events are expressed as rate of occurrence with the units of inverse time (i.e., per year), and other enabling events are expressed in terms of dimensionless failure probabilities. Another methodology for unmitigated initiating event likelihood classification would be to use a summary of historical data. Historical accident data may be used as long as this data represents the frequency of initiating events for such type of scenarios, and not the frequency of the entire scenario. Thus, caution is necessary in using historical data to support unmitigated frequency estimates for hazard scenarios, since it may not result in conservative frequency estimates for such scenarios.

Conservative values are chosen to accommodate uncertainties in frequency levels used in Table 2-9. A conservative choice is particularly important when an event frequency is at the borderline, just below the next highest frequency level. For example, 9.7E-3/year is at the upper limit of the unlikely frequency level. Thus, considering the sources, methods, and uncertainty associated with this value, this event may be better assigned to a higher frequency level of anticipated. For initiating events at the borderline of frequency ranges, the general rule is to assign to the next bin unless it can be justified based on the conservatism of the analysis. For example, an event just below a frequency of 10-2/year may be conservatively assigned to the anticipated frequency level. The same applies for scenarios with frequencies slightly less than 10-4/year and 10-6/year (i.e., may be assigned to the next higher frequency level of Unlikely and Extremely Unlikely, respectively). Likelihood estimates for NPH events generally have a lower initiating event likelihood and are based on design and evaluation criteria provided in DOE’s NPH design requirements such as DOE Order (O) 420.1C Chg 3 and DOE-STD-1020-2016. This unmitigated estimate should not consider the likelihood that the NPH events will lead to fires or explosions. For example, the likelihood of fire caused by an earthquake would be set equal to the likelihood of the initiating NPH event. The mitigated frequency of occurrence when crediting preventive controls could also apply simple numerical estimates to assign a lower frequency bin. For example, a 0.01 failure probability could be assigned to a preventive engineered control, or a SAC based on the technical justification in DSA Chapter 4. Estimating likelihoods qualitatively requires consistent assignments of the likelihood bins for similar scenarios. To achieve consistency, hazard scenarios should be “normalized” by comparison to one another. DOE-HDBK-1224-2024 36 2.6.3 QUALITATIVE RISK The primary purpose of risk ranking is to support the selection of bounding DBA/EBAs for further quantitative accident analysis and determination of SC controls that are based on consequences, not risk rankings. However, risk rankings may also be used to support the hazard evaluation and SS control selection. Combining a likelihood and a consequence level leads to defining a qualitative risk level, sometimes called Risk Category or Risk Class. Table 2-10, reproduced from DOE-STD-3009-2014 Table A-1, provides an example of a risk ranking table that combines likelihood and consequence, which is based on using the consequence and likelihood thresholds in Table 2-8 and Table 2-9, respectively. Table 2-10. Qualitative Risk Ranking Bins Consequence Level Beyond16 Extremely Unlikely Below 10-6/year Extremely Unlikely 10-4 to 10-6/year Unlikely 10-2 to 10-4/year Anticipated Above 10-2/year High Consequence III II I I Moderate Consequence IV III II II Low Consequence IV IV III III Risk Category I = Combination of conclusions from risk analysis that identify situations of major concern Risk Category II = Combination of conclusions from risk analysis that identify situations of concern Risk Category III = Combination of conclusions from risk analysis that identify situations of minor concern Risk Category IV = Combination of conclusions from risk analysis that identify situations of minimal concern

Beyond the qualitative application of consequences and likelihoods or supplemented with quantitative perspectives for the hazard evaluation, risk ranking serves the broader purpose of highlighting accident scenarios whose mitigated risk is binned into the appropriate risk profile. Risk ranking can also serve to provide risk insight for the DOE SBAA and can also highlight a given scenario whose mitigated risk remains significant. Additional guidance on use of unmitigated risk estimates for control selection is provided in Chapter 10. 2.7 UNMITIGATED AND MITIGATED HAZARD EVALUATIONS The DSA hazard evaluation is based on unmitigated and mitigated analyses that result in the selection of hazard controls. The guidance from Section 2.6 is applied to assign qualitative estimates of the unmitigated and mitigated consequences, likelihood, and optionally, risk rankings of the hazard scenarios. An unmitigated hazard scenario is evaluated for each initiating event by assuming the absence of preventive and mitigative controls. Unmitigated likelihood and consequence estimates assume that active engineered and administrative controls are not available to reduce either the consequence or likelihood of the hazard scenario. However, the unmitigated analysis does assume that passive design features exist and provide their safety function if these features are not affected by the accident scenario, or these features are affected by the accident scenario and a separate assessment determines that they will survive accident conditions. Passive features assumed to perform their safety functions are evaluated per DOE-STD-3009 for potential designation as SC or SS SSCs and protection as TSR Design Features. In addition, the unmitigated analysis considers facility geometry and physical plausibility, and evaluates the unmitigated likelihood and consequence accordingly. For example, in an explosion scenario, the unmitigated likelihood would not be reduced by an engineered control, such as a vessel purge. However, the unmitigated likelihood of 16 For external events, likelihood below 10-6/year conservatively calculated is beyond extremely unlikely. DOE-HDBK-1224-2024 37 the explosion could be reduced based on physical realities of the facility, activity, or operation that will cause the explosion-initiating condition to occur (accumulation of minimum explosive concentration); no credit is allowed in the reduction of the likelihood for subsequent enabling conditions that will result in the explosion itself (e.g., presence of an ignition source and/or oxygen). Thus, the likelihood of the scenarios should be based only on the likelihood of the conditions leading to a physically meaningful initiating event, and not on the subsequent engineering or administrative controls that may be available to prevent the explosion. Additional requirements and guidance on unmitigated analysis is provided in DOE-STD-3009-2014, Section 3.2.2. Initial conditions (ICs) may be necessary to define the unmitigated evaluation and are identified in Table 2-7. Another example is provided later in Table 2-11. Credit for the ICs is factored into the unmitigated likelihood or consequence assignments. ICs are evaluated per DOE-STD-3009 for potential designation as a TSR control (e.g., MAR inventory SAC). Additional guidance is provided in DOE-STD-3009-2014, Section A.3, and is further discussed in Section 3.3 of this Handbook.

A mitigated analysis is performed to determine the effectiveness of SS and SC controls. This analysis should be the same as the unmitigated analysis except that event likelihood is estimated with preventive controls available, and consequences are estimated with mitigative controls available. The selection of preventive and mitigative controls is a judgment-based iterative process to credit sufficient controls that provide confidence that the accident or release is prevented, or if not prevented, the consequences will be reduced to below thresholds of concern. Additional requirements and guidance on mitigated analysis are provided in DOE-STD-3009-2014, Section 3.2.3. The selection and classification of the hazard controls for the mitigated analysis are discussed in Chapter 10 of this Handbook. 2.8 HAZARD EVALUATION PRESENTATION IN DSA Results for the unmitigated and mitigated hazard analyses are presented in the DSA hazard evaluation section as discussed in a DSA Section [3.3.2.3], Hazard Evaluation Results (see DOE-STD-3009-2014, Section 4.0). The DSA hazard evaluation table, or alternate hazard evaluation data sheet as described in DOE-STD-3009-2014, has certain essential characteristics: • If multiple types of operations are being analyzed, the table is broken into separate sections where each section presents results for one specific type of operation. • Specific hazard scenarios are described in terms of well-defined events. For example, a HAZOP may have dozens of entries for parameter-guide word combinations. These need to be turned into discrete events. A HAZOP may note that low flow caused by incorrect positioning of valves upstream has no major effect on a process other than operational disruption, while low flow due to a large leak represents a significant operator hazard. Those are two entirely different events. • ICs and assumptions are identified. • Potential preventive or mitigative controls are identified. • Unmitigated and mitigated consequences and likelihoods, and optionally, risk estimates, are identified to support control selection and classification. Source term parameters such as MAR, DR, ARF, and RF may optionally be listed. DOE-HDBK-1224-2024 38 Table 2-11 presents example hazard evaluation tables for presentation in the DSA, which builds upon the example provided in Table 2-7. This table includes both the unmitigated and mitigated analysis. There are many different formats that can be used to present this data, bearing in mind that the purpose is to achieve a comprehensive hazard evaluation and an unmitigated analysis of hazard scenarios in terms of potential consequences, their likelihoods, and identification of preventive and mitigative controls. The hazard evaluation table, in whatever format is chosen, should also present the mitigated analysis that credits safety controls, or this could be described in the DSA hazard evaluation results section. The mitigated hazard evaluation can be included as additional columns as shown on Table 2-11, or another convention is to use separate rows for the unmitigated and mitigated evaluations. The controls identified for each event should be relevant for preventing or mitigating that event.

Appendix A provides another example of a hazard evaluation table for safety design basis documents, as part of the process to perform a preliminary hazard analysis required by DOE-STD-1189-2016, Integration of Safety into the Design Process. Some additional data are included such as methods of detection and more emphasis on further planned improvements and investigations as the design matures. Note also that key bases for consequence, frequency, or credited control selection should be provided in a comments section on the hazard evaluation table, other annotations in the table, in the associated DSA text, or in a separate document referenced in the DSA. DOE-HDBK-1224-2024 39 Table 2-11. DSA Hazard Evaluation Table Example Event No. Event Description Event Causes Unmitigated Analysis Preventive Features Mitigative Features Mitigated Analysis Freq. Level Consequence Level Risk Cat. Freq. Level Consequence Level Risk Cat. x Fuel-powered vehicles suffer a fuel leak due to an impact with TRU waste drums in the Shipping/Receiving Area and is ignited. A forklift carrying a single pallet with four drums impacts a stack (two high) of palletized drums with moderate to severe stress causing breach with material spill of 12 drums and ensuing pool fire that involves 88 additional drums in the Shipping/ Receiving Area. MAR: 698 PE-Ci in 100 drums (assumes 300 PE- Ci in maximum drum) (DOE-STD-5506-2021, Section 4.3 example, statistical MAR distribution for Waste Isolation Pilot Plant compliant containers applied, see Table 4-1) INITIAL CONDITIONS: Staging area inventory limit. TRU waste in metal containers. Metal pallets. • Operator error • Equipment malfunction • Vehicle impact with fuel spill • Ignition of combustible and/or flammable materials U Radiological FW – High CW – Moderate MOI – Low Hazardous Chemical FW – Low CW – Low MOI – Low RELEASE MECHANISM: Impact + fire – 12 drums, 0.1 DR, 1E-3/0.1 spill ARF/RF plus unconfined burning 1E-2 ARF/RF and 90 percent confined burning 5E-4 ARF/RF. Pool fire – Conservatively modeled in a single layer of drums with no stacking. Unconfined burning 1E- 2/0.1 ARF/RF of 25 percent of drums that experience lid loss (22 drums) that eject 33 percent contents and have confined burning 5E-4 ARF/RF of remaining contents in those drums, plus confined burning of 66 drums that experience seal failures (0.5 DR). I II III III III III SSCs: Concrete vehicle barriers. Waste staging building foundation. ADMINISTRATIVE: Procedures and Training Program (Forklift Operator training). Vehicle maintenance program. Fire Protection Program: • Combustible controls Waste handling operations curtailed outdoors during inclement weather. Movement of waste is to be accomplished using electric or manual powered equipment (SAC) Fuel exclusion zone in the Shipping/Receiving Area (SAC) SSCs: None ADMINIS- TRATIVE: Procedures and Training Program (workers trained to evacuate). Emergency Preparedne ss Program (emergenc y response activities). BEU Radiological FW – High CW – Moderate MOI – Low Chemical FW – Low CW – Low MOI – Low III IV IV IV IV IV DOE-HDBK-1224-2024 40 Notes: 1. Likelihood: A = Anticipated U = Unlikely EU = Extremely Unlikely BEU = Beyond Extremely Unlikely 2. Consequences: H = High M = Moderate L = Low 3. FW = Facility worker CW= Co-located Worker at 100 m MOI = Maximally exposed offsite individual at 2.9 km 4. Risk Classes: I = Combination of conclusions from risk analysis that identify situations of major concern

II = Combination of conclusions from risk analysis that identify situations of concern III = Combination of conclusions from risk analysis that identify situations of minor concern IV = Combination of conclusions from risk analysis that identify situations of minimal concern Bold/Underlined controls are credited in the mitigated analysis to reduce frequency, consequences, and Risk Class, or as Initial Condition DOE-HDBK-1224-2024 41 3 ACCIDENT ANALYSIS This chapter provides an introduction to the accident analysis process. The starting point is a review of the hazard scenarios that were identified in the hazard evaluation tables as discussed in Chapter 2 of this Handbook. Specific events are selected for further quantitative accident analysis. This particular chapter also addresses assumptions and ICs, beyond DBAs/EBAs, and software quality assurance (SQA). In general, formal accident analysis is performed for Hazard Category-2 facilities and may or may not be necessary for Hazard Category -3 facilities. Accident analysis is the formal quantification of a subset of accidents, termed DBAs or EBAs by DOE-STD-3009. These accidents represent a complete set of bounding conditions. The basic components of accident analysis are accident type selection, accident scenario development, ST analysis, consequence analysis and control selection. This process is highly iterative to ensure accident scenarios are adequately developed, ST and consequence analysis is bounding, the suite of controls are comprehensive and tailored to reflect accident conditions, and all identified facility hazards are understood and properly controlled. 3.1 ACCIDENT TYPE SELECTION It is expected that only a subsect of the total hazard scenarios identified in the hazard analysis will be evaluated as potential DBAs or EBAs in the accident analysis. The predominant purpose of accident analysis is to evaluate the need for SC controls to protect the public from radiological accidents. However, it may also be used to evaluate the need for defense-in-depth SS controls for protection of the public from radiological or toxic chemical accidents, or for protection of the CWs. The FW is not included in the scope of the DSA accident analysis and instead is addressed by the qualitative hazard evaluation, as discussed in Chapter 2 of this Handbook. DBAs are accidents to be analyzed in a DSA for the design of a new nuclear facility and major modifications to an existing facility. The DSA will also include accident scenarios established during the design of an existing facility. DOE-STD-1189-2016 provides guidance for selecting and analyzing facility-level radiological and/or toxic chemical release events in the DBAs. EBAs are postulated for existing facilities where DBAs were not identified as part of the design. The term EBA recognizes that an existing facility was not designed to DBAs to prevent or mitigate the accident, but rather is evaluated to ensure that it could do so with existing systems or added systems/controls. When an adequate set of DBAs does not exist, EBAs are selected from the following types of events where the hazard evaluation has the potential for unmitigated consequences that may exceed thresholds for selecting safety-related preventive or mitigative controls: • Operational accidents — process deviations (high temperatures and high pressures) and initiating events internal to the facility (fires, explosions, and loss of power that initiates or worsens a release of radioactive or hazardous materials such as loss of primary confinement ventilation system causing radiological releases from plutonium oxide handling gloveboxes);

• NPH events (e.g., earthquakes, floods, tornadoes, and wildland fires); and, • Man-made external events (e.g., an aircraft crash, external vehicular accident, or gas pipeline break). Two types of EBAs, representative and unique, are defined in DOE-STD-3009-2014 for further quantitative accident analysis. DOE-HDBK-1224-2024 42 DBAs/EBAs are derived from the spectrum of hazard evaluation scenarios. Three screening steps convert the spectrum of HE scenarios into the selected DBAs/EBAs: • The first screening identifies potential consequences by population in relative bins of increasing severity. This step will discard scenarios whose higher consequence potential relates only to FW workers, because accident analysis focuses on consequences at a distance from the facility. • The second screening looks at accident types. It is necessary for DSA documentation purposes to include at least one hazard and its consequence of each major accident type (e.g., fire, explosion, spill, NPH), unless the scoping calculations for the hazard evaluation demonstrate low consequences that do not have the potential to challenge the offsite Evaluation Guideline (EG). These are called representative scenarios with similar preventive and mitigative control sets that bound the collective scenarios for that type. • The final screening consists of looking at the remaining scenarios within a selected accident type to see if any would warrant safety SSC designation to protect the public and CW if included in the DSA accident analysis, as mentioned above, but involve a different control set than the representative accident already chosen for that type. These are called unique accidents. As an aid in screening the many hazard scenarios identified in the hazard evaluation, representative or unique EBAs may be selected based on organization by accident category (operational, NPH, man-made external event), accident type, and magnitude. Other means of grouping accidents may also be used, especially for complex facilities that may require a broad suite of hazard controls. The selected representative and unique scenarios are designed to bound all other postulated hazard scenarios, including high risk scenarios that still may challenge the EG (as determined during the hazard analysis process using the qualitative risk matrix in Section 2.6.3), or that may have high risk to the CW if that is being evaluated in the accident analysis. An example of an aid to screen hazard scenarios is provided in DOE-STD-5506-2021, Table 3-2, Minimum TRU Waste Activity/Hazard Evaluation Event Matrix. This table correlates 25 hazard scenarios or accidents by TRU waste processing activities for use in the hazard evaluation, or as EBAs. The minimum set of events addresses those with the potential for consequences that could be significant enough to warrant crediting preventive or mitigative controls, safety classifications of those controls, and explicit TSRs. Another example aid in screening hazard scenarios for EBA selection is NUREG/Contractor Reports (CR)-6410, Nuclear Fuel Cycle Facility Accident Analysis Handbook, Table 2-2, Methods of Release of Radioactive Materials Anticipated for Nuclear Process Facilities. 3.2 ACCIDENT ANALYSIS PROCESS The accident analysis process consists of the following sequence of steps intended to document numerical estimates of radiological and toxic chemical consequences to the public (or CW as needed for the DSA hazard evaluation):

1. Define the postulated accident scenario that releases radioactive material or toxic chemicals from the facility. 2. Estimate the damage to the facility to the extent it affects the potential MAR and ST released from the facility (e.g., loss of confinement areas). 3. Identify types and quantities of material involved in the accident MAR. 4. Determine the accident ST. 5. Conduct a dispersion analysis to determine the potential radiological dose or toxic chemical consequences. DOE-HDBK-1224-2024 43 Chapter 4 addresses steps 1-3 for potential accidents at DOE nuclear facilities. Chapter 5 addresses step 4. Chapters 6, 7, and 8 address step 5 for radiological releases, while Chapter 9 addresses step 5 for toxic chemical releases. The potential controls identified in the hazard evaluation is further evaluated in the mitigated accident analysis, using the control selection and classification process described in Chapter 10. 3.3 ANALYSIS INPUTS AND ASSUMPTIONS For most DOE accident analyses, the phenomena being examined have aleatory and epist