DOE-HDBK-6004-99, Supplementary Guidance and Design Experience for the Fusion Safety Standards DOE-STD-6002-96 and DOE-STD-6003-96

TS NOT MEASUREMENT SENSITIVE DOE-HDBK-6004-99 January 1999 DOE HANDBOOK SUPPLEMENTARY GUIDANCE AND DESIGN EXPERIENCE FOR THE FUSION SAFETY STANDARDS DOE-STD-6002-96 AND DOE-STD-6003-96 U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. This document has been reproduced from the best available copy. Available to DOE and DOE contractors from ES&H Technical Information Services, U.S. Department of Energy, (800) 473-4375, fax: (301) 903-9823. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 605-6000. DOE-HDBK-6004-99 FOREWORD Two standards have been developed that pertain to the safety of fusion facilities. These are DOE­ STD-6002-96, Safety of Magnetic Fusion Facilities: Requirements, and DOE-STD-6003-96, Safety of Magnetic Fusion Facilities: Guidance. The first of these standards identifies requirements that subscribers to that standard must meet to achieve safety in fusion facilities. The second standard contains guidance to assist in meeting the requirements identified in the first. This handbook provides additional documentation on good operations and design practices as well as lessons learned from the experiences of designers and operators of previous fusion facilities and related systems. It is intended to capture the experience gained in the various fields and pass it on to designers of future fusion facilities as a means of enhancing success and safety. The sections of this document are presented according to the physical location of the major systems of a fusion facility, beginning with the vacuum vessel and proceeding to those systems and components outside the vacuum vessel (the “Ex-vessel Systems”). The last section describes administrative procedures that cannot be localized to specific components. It has been tacitly assumed that the general structure of the fusion facilities addressed is that of a tokamak, though the same principles would apply to other magnetic confinement options. In what follows, use of the term “shall” has been avoided because this document is intended as advice and guidance only. It is not to be construed as regulatory in any way. In a similar vein, references to: safety-class or safety-significant structures, subsystems, and components should be viewed with the understanding that use of these designations, though not mandatory in the Requirements standard (DOE-STD-6002-96), are recommended in the Guidance standard (DOE-STD-6003-96). Again, the content of this document represents accumulated conventional wisdom of those who have experience building such systems and facilities. The material here is collected from a wide variety of sources. With the intent of capturing the information rather than making the product a polished document, there will be some variations in style and approach evident in the various sections. The authors felt allowing these variations would be a good stewardship of resources in the times of fiscal restraint and uncertainty in which this document was prepared. iii DOE-HDBK-6004-99 INTENTIONALLY BLANK iv DOE-HDBK-6004-99 CONTENTS FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii ACRONYMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

SECTION I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 VACUUM VESSEL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 GENERAL SAFETY DESIGN CRITERION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 POTENTIAL SYSTEM SAFETY FUNCTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 DESIGN CONSIDERATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Structural Design Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Hydrogen Detonation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 SAFETY-RELATED DESIGN STANDARDS AND CRITERIA . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Individual Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Static Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Normal Operating Pressure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Normal Operating Thermal Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Electromagnetic Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Interaction Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Natural Phenomena Hazard Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Loss-of-coolant Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Hydrogen Detonation Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Site-generated Missile Impact Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Combined Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Cyclic Loading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Structural Acceptance Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Vacuum vessel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Piping, Pumps and Valves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Other . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Deflection Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Weld Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Pressure Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Computer Code Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Instrumentation and Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Vacuum Vessel Penetrations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Ventilation and Exhaust System Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Containment Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 RECOMMENDED DESIGN PRACTICE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Bellows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Ceramic Breaks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 SECTION I REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 SECTION II . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 v DOE-HDBK-6004-99 EX-VESSEL SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 MAGNET SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Recommended Design Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 CRYOSTAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

General Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 CONFINEMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Ventilation/HVAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Ventilation systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Structural Design Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 General Safety Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Safety-Class Design Standards and Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 HVAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Potential Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Safety-Related Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 System Boundary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Structural Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 INSTRUMENTATION AND CONTROL SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 General Safety Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 I&C System Analysis and Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Safety System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Potential System Safety Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Safety Related Design Standards and Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Graded Approach to Defense In Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Response Time Requirements and Margins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Qualification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Human Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Testability and Maintainability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Control Room Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Safety Actuation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 TRITIUM SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 General Safety Design Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Generic System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Tritium Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Tritium Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Tritium Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Tritium Purification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 System Cleaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 vi DOE-HDBK-6004-99 Normal Operation: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Maintenance: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Design Basis Accidents: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Internal Initiators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 External Initiators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Beyond Design Basis Accidents: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Safety-Class Design Standards and Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Structural Acceptance Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Deflection Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Testing and Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Computational Methods Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Radiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Thermal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Tritium Embrittlement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Penetrations of Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Instrumentation and Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Primary Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Secondary and Higher Order Confinement Barriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Segmented Tritium Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Protection For Natural Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Protection from Environmental Conditions and Missiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Fire Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Conversion of Elemental Tritium to Tritium Oxide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Heat Removal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 System Cleaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Tests and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Radiation Shielding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Confinement Barriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Structural Design Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Hydrogen Fire and Detonation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Hydrogen Fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Hydrogen Detonations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Metal Embrittlement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Exchange with Hydrogen, Hydrogenated Compounds, and Hazardous Wastes . . . . . . . . . . . . . 46 Components of Primary Confinement System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Recommended Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Materials of Construction for Primary Confinement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Recommended Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Materials Not Recommended . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Piping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Pumps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Valves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Pressure Relief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 vii DOE-HDBK-6004-99 Heating and Ventilation - Personnel Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Primary System Cleaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Past Design Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Tritium Confinement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Metal Hydride Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Tritium Storage Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Purification Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Tritium Purification, Stripping and Recovery Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Purification Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Stripping and Recovery Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Tritium Control, Accountability and Physical Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Legal Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Nuclear Safety Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 DOE Orders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Good Practices - Nuclear Material Locations at a Fusion Facility . . . . . . . . . . . . . . . . . . . . . 56 Tritium Measurement Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Composition Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Thermal Methods of Inventory Measurement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Tritium Concentration Measurement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Facility Measurement Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Measurement of tritium input / output to facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 In Process tritium measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Tritium in Waste Streams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Stack emission measurements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 COOLING SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 General Safety Design Criterion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Normal Operation, Shutdowns and Anticipated Off-normal Events . . . . . . . . . . . . . . . . . . . . . . 62 Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Design Basis Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Internal Initiators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 External Initiators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Potential Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Beyond Design Basis Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Safety Design Standards and Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Structural Acceptance Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Deflection Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Testing and Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Computational Methods Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Instruments and Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Passive Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Recommended Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Generic System Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 viii DOE-HDBK-6004-99 Past Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 ELECTRICAL POWER SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 General Safety Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Safety-Class Design Criteria and Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 General Design Safety Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 General Design Criteria/Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Radiation/Contamination and Equipment Life . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Control and Instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Safety-class Diesel Generators and/or Combustion Turbine Generators . . . . . . . . . . . . . . . . . . . 77

Switchgear and Load Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Motor Control Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 AC Motor Control Centers: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 DC Motor Control Centers: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Direct Current Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Vital Instrumentation and Control Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Motors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Power, Control, and Instrumentation Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Raceways and Trays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Electrical Penetrations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Separation of Facility Safety Systems/Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Redundant Channel Separation: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Non-redundant Separation: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Cable Tray Separation: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Cable Color Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Reliability Design Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Independent Design Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Electrical Power Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Combustion turbine-generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Grounding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 System and Equipment Grounding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Cathodic Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Lightning Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Fire Detection and Fire Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 REMOTE MAINTENANCE SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 System Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

General Safety Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Normal Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Design Basis Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Beyond Design Basis Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Normal Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Natural Phenomena and Accident Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Instrumentation and Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 ix DOE-HDBK-6004-99 Electrical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Function Protection for Natural Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Tests and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Mechanical Test Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Special Test Capability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Radiation Shielding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Structural Design Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Hydrogen Fires and Detonation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Expected Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 General Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 High Power Equipment in Confined Spaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Plasma Energy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Cryogenic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Radiological Fields. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Radiological Contamination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Magnetic Fields. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Radio Frequency Fields. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Hydrogen Isotopes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Materials Of Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Material Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Material Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Wiring Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Maintenance of Remote Handling Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Contamination Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Assembly and Disassembly Techniques. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Special Handling Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Past Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Activation Control Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Contamination Control Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Electronics Protection Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Internal Wiring Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Operational Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Mode of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Collision Avoidance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Multiple Remote Device Coordination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Swing Free Crane Technology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Retrieval Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Redundancy of Critical Controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Remote Release. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Safe Return of Equipment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Recommended Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Potential Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Safety Related-Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Structural Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Electrical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Tests and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Assembly and Disassembly Techniques. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 x DOE-HDBK-6004-99 Special Handling Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Design Guidance for Typical Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Closed Circuit Television (CCTV) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Electro Mechanical Manipulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Cranes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Remote Manipulators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Hoists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Remote Connector Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Specialized Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Robots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 SECTION II REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 SECTION III . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 ADMINISTRATIVE AND OPERATIONAL TECHNIQUES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 CONCEPT OF OPERATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Supplemental Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Operations Organization and Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Shift Routines and Operating Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Control Area Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Control of On-Shift Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Investigation of Abnormal Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Control of Equipment and System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Lockouts and Tagouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Independent Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Logkeeping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Operations Turnover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Operations Aspects of Facility Chemistry and Unique Processes . . . . . . . . . . . . . . . . . . . . . . . 123 Required Reading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Timely Orders to Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Operations Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Operator Aid Postings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Equipment and Pipe Labeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 EMERGENCY PREPAREDNESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Supplemental Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Concept of Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Operational Emergency Event Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Site Emergency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 General Emergency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Emergency Plans and Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Hazards Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Emergency Response Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Offsite Response Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Consequence Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 xi DOE-HDBK-6004-99 Protective Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Medical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Recovery and Reentry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Public Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Emergency Facilities and Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Drills and Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Drills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 TRAINING AND QUALIFICATION REQUIREMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Supplemental Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Administrative Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 General Facility Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Training Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Contracted Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Facility Training Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Personnel Selection and Staffing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Personnel Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Personnel Staffing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Training Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Training Matrices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Qualification and Certification Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Management Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Training Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Training Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Training Required for Facility Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Initial Training Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Continuing Training Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Maintenance of Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Qualification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Qualified Operators and Supervisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Education and Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Specific Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Medical Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Written Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Operational Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Maintenance of Proficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Requalification Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Other Qualified Positions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Certification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Certified Operators and Supervisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Education and Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Specific Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Medical Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Written Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Oral Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Operational Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Independent Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Maintenance of Proficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Recertification and Certification Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 xii DOE-HDBK-6004-99 Other Certified Positions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Written Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Oral Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Operational Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 APPENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 CONDUCT OF OPERATIONS SUPPLEMENTAL GUIDANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 APPENDIX B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 EMERGENCY PREPAREDNESS SUPPLEMENTAL GUIDANCE . . . . . . . . . . . . . . . . . . . . . . . . 141 APPENDIX C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 EMERGENCY PREPAREDNESS DEFINITIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 APPENDIX D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 TRAINING AND QUALIFICATION REQUIREMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 TERMS AND DEFINITIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 GUIDANCE DOCUMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 EDUCATION AND EXPERIENCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Minimums . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Alternatives Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Education Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 High School Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 College Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Experience Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Substitution of Course Work and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Training And Qualification Requirements - Basis and Rationale . . . . . . . . . . . . . . . . . . . . . . . 151 xiii DOE-HDBK-6004-99 INTENTIONALLY BLANK xiv DOE-HDBK-6004-99 ACRONYMS ACI American Concrete Institute AFOSH Air Force Occupational Safety and Health AISC American Institute of Steel Construction ANSI American National Standards Institute API American Petroleum Institute ASCE American Society of Civil Engineers ASHRAE American Society of Heating, Refrigerating and Air-Conditioning Engineers ASME American Society of Mechanical Engineers ASTM American Society for Testing and Materials AWWA American Water Works Association BIL Basic Impulse Level BSR Bureau of Standards Review CFR Code of Federal Regulations CMMA Crane Manufacturers Association of America EIA Electronic Industries Association EJMA Expansion Joint Manufacturers Association ESF Engineered Safety Features H&V heating and ventilating HEI Heat Exchanger Institute HIS Hydraulic Institute Standards HMI Hoist Manufacturers Institute HVAC heating, ventilating, and air conditioning I&C instrumentation and controls IEC Institute of Electrical Contractors xv DOE-HDBK-6004-99 IEEE Institute of Electrical and Electronics Engineers IPCEA Insulated Power Cable Engineers Association ISA Instrument Society of America ITER International Thermonuclear Experimental Reactor JIC Joint Industrial Council MCC motor control center NEMA National Electrical Manufacturers Association NFPA National Fire Protection Association NIOSH National Institute of Occupational Safety and Health NPH Natural Phenomena Hazards, (DOE 5480.11) NUREG Nuclear Regulatory Commission document OSHA Occupational Safety and Health Administration PIE postulated initiating events PPE personal protective equipment PVTC pressure-volume-temperature-composition RG Regulatory Guide RIA Robotics Industrial Association SAR Safety Analysis Report, (DOE 5480.28) SSC Structures, subsystems, and components TEMA Tubular Exchanger Manufacturers Association UHMWPE Ultra high molecular weight polyethylene xvi DOE-HDBK-6004-99 SECTION I VACUUM VESSEL Many of the components within and part of the vacuum vessel vacuum are unique to fusion systems. Thus, there is little precedence in the established codes and standards and little experience in the design of those components. Much of the design experience is taken from the design of plasma experiments where the power levels and radiation fluxes are much lower. The vacuum vessel is assumed to be a torus-shaped container usually made of a metal or metallic alloy, and its volume can be several times the plasma volume. It can be thin-walled or thick-walled. It may be double-walled with coolant passages between the walls. The perimeter of the vacuum vessel is outfitted with a number of ports for mounting hardware for plasma fueling and heating, plasma conditioning and for vacuum pumping. These ports can vary in size and shape and are usually located above, below, and on the horizontal plane as well as on top and bottom of the vacuum vessel. It may be of all-welded, continuous construction or use bolts between toroidal segments with vacuum seal welds at the joint.

GENERAL SAFETY DESIGN CRITERION If required by the facility safety analysis, the vacuum vessel will be a confinement or containment barrier for tritium and tritiated compounds, radioactive impurities and activated dust. The requirement for robustness of the barrier will be defined in the safety analysis and implemented in the design. In performing this function, the vacuum vessel will be classified as a safety-class system. If the vacuum vessel is not considered a confinement or containment barrier in the safety analysis, those vacuum vessel components whose single failure results in loss of capability of another safety-class system to perform its safety function should be designated as safety-class components. The vacuum vessel may also be a physical barrier between different fluid streams (such as liquid metal and water) whose interconnection could potentially produce large energy release events which could compromise nearby safety-class systems. POTENTIAL SYSTEM SAFETY FUNCTIONS If the safety analysis requires that the vacuum vessel be a confinement or containment barrier, the following safety functions are specified: 1. Normal operation including anticipated operational likely and unlikely events - to act as the first barrier for tritium and tritiated compounds, radioactive impurities and activated dust. 2. Maintenance a) To act as the first barrier for tritium and tritiated compounds, radioactive impurities and activated dust during maintenance external to vacuum vessel. b) To act as a partial confinement barrier as defined in the safety analysis for tritium and tritiated compounds, radioactive impurities and activated dust during maintenance inside the vacuum vessel. 1 DOE-HDBK-6004-99 3. Design Basis Accidents - To act as the first barrier for tritium and tritiated compounds, radioactive impurities, activated dust, or any other coolant or material located in the vacuum vessel during design basis accidents. Design basis accidents will be specified in the safety analysis and mitigated in the system design requirements. A accident probability, P, for defining a design basis accident is typically 10-4/year>P>10-6/year; the actual probability will be specified in the facility safety analysis. The following are potential design basis accidents for fusion DT facilities: burn excursion, loss of vacuum pumping, loss of vacuum, loss of flow or coolant pressure to actively-cooled components inside the vacuum vessel, chemical reactions including hydrogen detonation, site-generated missile impact, and design basis natural phenomenon: earthquake, flooding, and severe winds. However, any of these may be categorized as likely or unlikely events depending on the probability as assessed in the safety analysis. 4. Beyond Design Basis Accidents - There are no system safety functions required for beyond design basis accidents. DESIGN CONSIDERATIONS General The primary confinement or containment should normally be provided by the pressure boundary of the fusion machine, its associated vacuum system, and the various tritium systems (DOE 6430.1A (c)). If this barrier is deemed a safety-class system, then other hardware with pressure containing surfaces on the vacuum boundary are safety-class components and must be designed to function as confinement or containment as appropriate in the same operational and accident modes for which the vacuum vessel is designed. Structural Design Codes

DOE Order 6430.1A, General Design Criteria, required that safety-class components be designed, fabricated, inspected, and tested in accordance with the ASME Boiler and Pressure Vessel Code, Section III, Class 3 or to a comparable safety-related code. The following discussion modifies this requirement for fusion safety-class items to provide more flexibility in design and manufacturing without compromising the safety function of the item. The complex nature of many fusion components may require specific analysis under the alternate design rules of Section III, Class 1 or 2 or the comparable elements of Section VIII, Division 2 for pressure vessels. In defining a comparable code to ASME Section III, the use of ASME Section VIII is acceptable if additional standards are provided in areas such as attached valves, pumps, piping and supports, enhanced quality assurance and radiation effects which are comparable to relevant parts of Section III. In general, a detailed comparison should be made between ASME, Section III and the comparable code to be used to design safety-class items to demonstrate actual comparability. This code comparison should be performed early in the design phase and should be endorsed by the licensing or regulatory authority to ensure the design product will be acceptable for construction. Finally, the actual stamping of a vessel designed, fabricated, inspected, and tested to Section III or VIII is not addressed by this document nor in the Fusion Safety Standards and is considered to be a decision between the owner, fabricator, and the cognizant regulatory agency. 2 DOE-HDBK-6004-99 Hydrogen Detonation A hydrogen detonation is a potential hazard which may occur as part of a design basis accident (typical probability > 10-6 per year). If it does occur and the vacuum vessel is a confinement or containment barrier, then the required integrity of the barrier must be maintained during and after this event, although the non-safety-related functions of the vacuum vessel (such as ability to maintain high vacuum) can be compromised. If the vacuum vessel is not a confinement or containment barrier and a hydrogen detonation is credible, it must be shown that no failure of a vacuum vessel component due to this event can degrade the function of an adjacent safety-class system or item.

To determine if a potential hydrogen detonation can occur in a design basis accident, it is necessary to evaluate the likelihood of having the three ingredients for detonation at the same time: hydrogen and oxygen in the appropriate mixtures and an ignition source (NUREG/CR-4961). Generally, direct initiation of hydrogen-air mixtures is possible with about 1 gram of high explosive (NUREG/CR­ 4961) (this is equivalent to about 4 kJ of energy). Since the plasma typically contains much higher levels of stored energy, it should be assumed that a point ignition source is always present during normal operations and wall conditioning. The factors determining the likelihood of a detonation are then the availability of hydrogen isotopes and air. Hydrogen isotopes are present in the solid matrix of the plasma facing components at substantial levels. This is not ordinarily available for combustion or detonation although a portion (including tritium) may be released if a detonation occurs. If hot plasma facing components or the vacuum vessel are cooled with water, a leak could result in the generation of hydrogen from water (steam)-Be (or C or W) reactions (Smolik 92, Smolik 91). The precise amount of hydrogen generated depends on the first wall material and temperature and the size and duration of the water leak but typical conditions in a D-T fusion plasma can generate sufficient quantities of hydrogen for a detonation. Air (oxygen) also has to be present for a detonation. If air is adjacent to the vacuum vessel, the in-leakage of air is possible due to the same event which generated the hydrogen. For example, Be-steam reactions from a water leak during wall conditioning can result in internal pressures of several bar or more (NET 93), which may be beyond the design value of the vacuum vessel. This air source can be eliminated in the device design by incorporating an inert gas volume in the region between the vacuum vessel and its ducts, and the next confinement barrier. To determine the probability of a hydrogen detonation, a conservative analysis of the above factors must be performed for a particular design. The likelihood of an in-vessel loss-of-coolant accident cannot be generally excluded given performance of such actively-cooled systems to date and the anticipated service conditions in a D-T fusion vacuum vessel. To preclude a hydrogen detonation for consideration as a design basis accident, it will typically be necessary to demonstrate a low event probability by: 1. Material selection in the plasma facing components or the fluids used for active in-vessel component cooling, or 2. Use of an inert gas boundary as discussed above. 3 DOE-HDBK-6004-99 SAFETY-RELATED DESIGN STANDARDS AND CRITERIA If the vacuum vessel system or individual components are designated safety-class the following design standards should apply to the system or components: Structural The vacuum vessel system boundary should be defined as the vacuum vessel proper including attached windows, flanges, and ports and all penetrations up to and including the first isolation valve in system piping which penetrates the vacuum vessel. Loads Individual Loads The vacuum vessel should be designed to withstand the static load, normal operating pressure, normal operating thermal load, electromagnetic loads (normal operating and fault), disruption/vertical displacement (VDE) loads, interaction loads from adjacent systems, and transient loads due to design basis accidents such as natural phenomena, loss-of-coolant into the vessel and subsequent chemical reactions, site-generated missile impacts, and hydrogen detonation. (These design basis accidents are for example only, since some of them may not be credible for a particular facility.)

Static Load The static load should include the weight of the vacuum vessel and all supported hardware. Normal Operating Pressure The normal operating pressure of the vacuum vessel may be one of the following: 1. 1 atmosphere internal pressure, 2. 1 atmosphere external pressure, 3. No net pressure. If the vacuum vessel is double-walled with a coolant in the annulus, the maximum coolant pressure should be the normal operating pressure in the annulus. Normal Operating Thermal Load The normal operating thermal load should include transient thermal loads during pulsed operation as well as the temperature distribution during bakeout and wall conditioning. 4 DOE-HDBK-6004-99 Electromagnetic Loads Electromagnetic loads induced during normal pulsed operation of the device are experienced as a result of eddy currents in the vessel interacting with the magnetic fields crossing them. Loads should include the electromagnetic effects of discharge cleaning. 1. Electromagnetic Loads During Faults - Electromagnetic loads induced during abnormal operating events such as control failures, power supply failures, bus opens or shorts, or magnet faults should be included in the design. 2. Disruption/VDE Loads - Disruption/VDE loads are any thermal or electromagnetic loads induced in the vessel due to loss of control of the plasma. A range of plasma motions and current behaviors should be considered to determine the worst case events. Analysis should include conservative assumptions for event amplitude, time scale, and event frequency. Interaction Loads Interaction loads are loads imposed on the vacuum vessel by other components during normal or fault conditions. Natural Phenomena Hazard Loads Natural phenomena hazard loads are site-specific loads due to earthquakes, wind, and floods. Guidelines for methods of establishing load levels on facilities from natural phenomena hazards and for methods of evaluating the behavior of structures and equipment to these load levels are contained in DOE 1020. Loss-of-coolant Loads The confinement or containment should be designed to remain functional after a potential loss-of­ coolant to the interior of the vessel including subsequent chemical reactions if this is evaluated as a design basis accident. Hydrogen Detonation Loads The confinement or containment should be designed to remain functional after a potential hydrogen detonation if this is evaluated as a design basis accident. For guidance on determining if this is a design basis accident, see Section IV “Design Considerations” within this Vacuum Vessel section. Site-generated Missile Impact Load The confinement or containment should be designed to remain functional after a potential missile impact if this is evaluated as a design basis accident. 5 DOE-HDBK-6004-99 Combined Loads Considerations for combined loads are indicated in Table I-1. Table I-1 Combined Loads Hydraulic Thermal Electro­ magnetic Plant Condition Static Norm. Trans. Norm. Trans. Norm. Fault Nat. Phen. Miss. Imp. Cyc Normal Operation X X X X X Maintenance X X1 X1 Design Basis Accidents Internal Initiators 1. Coolant Leak in Vacuum Vessel. X X X X 2. In-cryostat Leak X X X X 3. Out-of-cryostat Leak X X X X 4. Loss of Pumping X X X X 5. Loss of Flow X X X X 6. Loss of Heat Sink X X X 7. Missile or Pipe Whip X X X X X X X X 8. Increase in Fusion Power X X X 9. Human Error or Control Fault X X X X X X External Initiators 1. Natural Phenomena

X X X X X X X X X 2. Fires X X X X X X X 3. Aircraft or Missile Impact X X X X X X X X Beyond Design Basis Accidents2 1. Pressure and thermal loads are applicable for portions of system which remain pressurized during maintenance. 2. There are no load combinations for beyond-design-basis accidents. 6 DOE-HDBK-6004-99 Cyclic Loading The vacuum vessel and its supports are subject to cyclic loading during normal operations. Thermal cycling and unavoidable plasma disruption loads are expected. The necessity of a fatigue analysis should be evaluated based on the criteria of ASME 93 or comparable safety-related code using conservative values for variables such as number of pulses, percentage of pulses that have disruptions, and service life including expected changes in material properties with time. Cyclic loading must be defined on load/time diagrams so that a fatigue analysis, if necessary, can be performed. Structural Acceptance Criteria Vacuum vessel The vacuum vessel and its appendages should be designed, fabricated, inspected, and tested in accordance with a recognized safety-related code such as the ASME Boiler and Pressure Vessel Code. The design of the fusion facility components which is outside the scope of conventional codes or standards due to design temperature, materials selection and/or any other design feature, should meet the safety design criteria of this Fusion Safety Standard and should employ a design and analysis methodology which is consistent with requirements of a recognized safety-related code. Piping, Pumps and Valves Piping, pumps and valves should be designed in accordance with relevant criteria in ASME 93 or a comparable safety-related code. Other Hardware internal or adjacent to the vacuum vessel whose credible failure could impact the safety function of the vacuum vessel should be classified as safety-class components or items. Deflection Analysis Vacuum vessel deflections should be calculated and analyzed to determine potential interferences and to verify seal integrity. Testing Weld Inspection Non-destructive examination should be performed in accordance with Section V of the ASME Boiler and Pressure Vessel Code as modified by Section III, Article NC-5111 or approved equal. Non­ destructive test personnel qualification and weld acceptance criteria are found in Article NC-5000 of the ASME Boiler and Pressure Vessel Code or approved equal. Pressure Test 1. Vacuum Vessel - All vacuum vessels that provide a containment barrier should be leak checked before initial operations and periodically thereafter and meet the requirements specified in the 7 DOE-HDBK-6004-99 safety analysis (guidance on leak testing is provided in 10CFR50(J). All vacuum vessels that provide a confinement barrier should be leak checked before initial operations and periodically thereafter against the leakage criteria in the facility safety analysis. The vacuum vessel chamber should be pneumatically tested in accordance with ASME 93 or comparable safety-related code. A double-walled vacuum vessel should be hydrostatically tested in accordance with ASME 93 or comparable safety-related code. 2. Valves - System isolation valves should be hydrostatically tested in accordance with the ASME 93 or a comparable safety-related code. Computer Code Verification Computer codes used for design analysis of the vacuum vessel for normal operating and design basis accident conditions should have validation and/or verification as described in DOE Standard 6003-96. This validation and verification should support the use of the code in each intended application.

Materials Material properties used in the structural analysis of safety-class structures, systems, and components must be appropriate for the operating environment and compensated for the degradation of the material with time due to radiation, fatigue, corrosion, or any other harsh treatment. 1. Radiation - Materials selected should be qualified for the anticipated lifetime in the radiation environment. With irradiation, yield strength usually increases as ductility decreases. Conservative end-of-life properties should be used in the structural design analysis. 2. Thermal - Material properties used in analysis should always be those appropriate at the given temperature. If no published property data for a particular temperature exists, then materials should be tested for properties at the operating temperature. For those items to be designed in accordance with the ASME Boiler and Pressure Vessel Code, temperature limits are imposed within the Code. If the item will be subjected to temperatures higher or lower than the limit, material properties, such as allowable stress and creep, used in the analysis should be justified by testing the material at the anticipated temperature. 3. Swelling - The energetic neutron flux on the first wall, diverter and other plasma facing components results in displacement cascades and helium-producing nuclear reactions. During long-term irradiations vacancies coalesce to form helium-filled voids within the material. Dimensional changes are most severe at about half the melting point of the material. Allowance must be made for irradiation-induced swelling in the design of any components exposed to the high-energy neutron flux. 4. Hydrogen Embrittlement - Hydrogen reacts to some degree with almost all metals. When a metal comes in contact with hydrogen, its surface adsorbs the gas. Surface or physical adsorption is followed by activated adsorption, a preliminary stage of the diffusion of hydrogen into metals. With continued exposure, materials can become embrittled. The material properties based on end-of-life hydrogen embrittlement should be used in the structural design analysis. The actual 8 DOE-HDBK-6004-99 embrittlement of the vacuum vessel in the hydrogen environment should be determined by placing coupons in the vessel to be periodically removed and inspected for embrittlement. An inspection schedule should be developed and implemented. Instrumentation and Controls Instrumentation and controls, where appropriate, should be provided to monitor system parameters important to the safety function of the vacuum vessel over their anticipated ranges for normal operation and design basis accidents to ensure continuity of the required safety function. The design should incorporate sufficient instrument independence, redundancy and/or diversity to ensure that a single failure will not result in a loss of monitoring capability for safety-class systems. The different designs and operating characteristics of fusion facilities limit the amount of specific guidance that can be provided. However, helpful general guidance for implementing this criteria at a particular fusion facility may be obtained by reviewing the existing DOE and NRC design requirements and guidance documents (IEEE 603, DOE 6430.1A (a), NUREG-0800, 10CFR50(A), RG 1.47). The power to operate safety-class instrumentation should meet the requirements of Class 1E Electric Power Systems (IEEE 308). Vacuum Vessel Penetrations

For vacuum vessel containment penetrations, each line that is part of the vacuum vessel pressure boundary and that penetrates the vacuum vessel should be provided with isolation valves, unless it can be demonstrated that the containment isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other defined basis. A simple check valve should not be used as the automatic isolation valve outside containment. Isolation valves outside containment should be located as close to containment as practical and upon loss of actuating power, automatic isolation valves should be designed to take the position that provides greater safety. The power to operate isolation valves should meet the requirements of Class 1E Electric Power Systems (IEEE 308). Ventilation and Exhaust System Criteria Confinement Systems The design of a vacuum vessel confinement ventilation system should ensure the ability to maintain desired airflow characteristics when personnel access ports or hatches are open. When necessary, air locks or enclosed vestibules should be used to minimize the impact of this air flow on the ventilation system and to prevent the spread of airborne contamination within the facility. The ventilation system design should provide the required confinement capability under all normal operations and design basis accidents with the assumption of a single failure in the system. If the maintenance of a controlled continuous confinement airflow is required, electrical equipment and components required to provide this airflow should be supplied with safety-class electrical power and provided with a backup power source. Air cleanup systems should be provided in confinement ventilation exhaust systems to limit the release of radioactive or other hazardous material to the environment and to minimize the spread of contamination within the facility as determined by the safety analysis. Guidance for confinement systems is included in DOE 6430.1A (b). 9 DOE-HDBK-6004-99 Containment Systems For containment systems, RG 1.140 presents guidance for design testing and maintenance for exhaust systems air filtration that is acceptable to the DOE. As with the confinement systems the basic criteria are based on the As Low As Reasonably Achievable (ALARA)As Low As Reasonably Achievable (ALARA) concept given the present state of technology. 10CFR50(I) presents specific methods and evaluation criteria that are acceptable to DOE in implementing ALARA with respect to exhaust systems from a containment system. Inspection Components should be designed to permit periodic inspection and testing of important areas related to the intended safety function to assess their structural and leak tight integrity. There should be an appropriate material surveillance program. RECOMMENDED DESIGN PRACTICE Windows In the analysis of the windows, the condition of the edge restraint is important. It is recommended that it be assumed that the window is simply supported at the edges, since this is a more conservative approach (Robinson). However, the weak point in the window may be the edge glass-to-metal braze. The braze must be analyzed for stress with the fixed-edge assumption. All calculations should be based on the modulus of rupture which is equal to the ultimate tensile strength/1.75. Factors of safety lose meaning for glass, because subsurface imperfections can cause failure below the expected tensile strength. Therefore, a factor of safety of 10 on the modulus of rupture is recommended. Windows should be designed to minimize the risk of cracking due to a water leak onto the hot disc. This can be accomplished by providing an inner sacrificial disc with the main sealed disc on the outside. The connecting inner space is vented to the vacuum by a small hole. This hole would allow vacuum pump down but would prevent a water leak from reaching the outer window. (Caldwell 89)

Bellows Double bellows with a vacuum-tight inner space are recommended. See the Standards of the Expansion Joint Manufacturers Association, 6th Edition, 1885. Ceramic Breaks Ceramic breaks are used to insulate electrical lines that penetrate the vacuum boundary or to insulate attached piping that is connected to external equipment at a different potential or ground. Where possible, ceramic breaks should be designed to be shielded from direct line-of-sight with the plasma or potential spray from rupture of coolant lines. Ceramic breaks are used on radio frequency (RF) antennas to isolate inner and outer coaxial conductors at the vacuum boundary. The volume outside of the vacuum boundary contains a pressurized gas. These RF ceramic breaks are subject to voltage breakdown which could cause local 10 http:strength/1.75 DOE-HDBK-6004-99 melting of the coax and could lead to a breach of confinement or even a water leak. Ceramic breaks should be located away from where the coax is cooled. A breach in the ceramic break would allow pressurized gas into the vacuum vessel and tritium into the coax and through the transmission lines all the way back to the power supply. If the vacuum boundary is defined as a confinement system, then the use of redundant ceramic breaks is recommended which reduces the possible leak rate to what is determined acceptable by the facility safety analysis. If a vacuum vessel functions as a containment, which is a more stringent requirement, then containment of the RF/vacuum vessel interface could extend along the transmission line back to the power supply. 11 DOE-HDBK-6004-99 INTENTIONALLY BLANK 12 DOE-HDBK-6004-99 10CFR50 (A) 10CFR50 (I) 10CFR50 (J) ASME 93 Caldwell 89 DOE-STD-1020-94 DOE 6430.1A (a) DOE 6430.1A (b) DOE 6430.1A (c) IEEE 308 IEEE 603 NET 93 NUREG-0800 NUREG/CR-4961 RG 1.140 RG 1.47 SECTION I REFERENCES 10 CFR Part 50, Appendix A, “General Design Criteria for Nuclear Power Plants,” specifically: GDC 1, 13, 19, 20, 22, 23, 24, and 64. 10 CFR Part 50, Appendix I. 10 CFR Part 50, Appendix J, “Primary Reactor Containment Leakage Testing for Water-cooled Reactors.” ASME Boiler and Pressure Vessel Code, 1992 Edition with 1993 Addenda. Design Features of the JET Vacuum Enclosure for Safe Operation with Tritium, C. J. Caldwell-Nichols, E. Usselmann; IEEE Thirteenth Symposium on Fusion Engineering, October 1989, Knoxville, TN, p.716. DOE-STD-1020-94 DOE Standard, “Natural Phenomena Hazards Design and Evaluation Criteria for Department of Energy Facilities,” April, 1994. Division 13 of DOE Order 6430.1A, “General Design Criteria,” 1989. DOE 6430.1A, Section 1550.99, “Special Facilities,” 1989. DOE Order 6430.1A Section 1328-7.1, “Fusion Test Facilities,” 1989. IEEE Std 308 “Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Equipment,” 1991. IEEE-603, “Criteria for Safety Systems for Nuclear Power Generating Stations,” 1991. Next European Torus Predesign Report, Fusion Engr. and Design 21, pp. 335-338 (1993). Chapter 7.1 of NUREG-0800, “Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants,” July 1981. Summary of Hydrogen-Air Detonation Experiments, NUREG/CR­ 4961, May 1989. USNRC Regulatory Guide (Reg. Guide): 1.140. USNRC Regulatory Guides (Reg. Guides): 1.47, “Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems,” May 1973 . 13 DOE-HDBK-6004-99

RG 1.75 USNRC Regulatory Guides (Reg. Guides): 1.75 Rev. 2, “Physical Independence of Electric Systems,” September 1978. RG 1.97 USNRC Regulatory Guides (Reg. Guides): 1.97, Rev. 3 Instrumentation for Light Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident,” May 1983. Robinson 80 James Robinson, “Design of Viewing Windows for Controlled- atmosphere Chambers,” ORNL/TM-6864, 1980. Smolik 91 G. R. Smolik, B. J. Merrill, S. J. Piet and D. F. Holland, “Evaluation of Graphite/Steam Interactions for ITER Accident Scenarios,” Fusion Technol. 19, pp. 1342-1348 (1991). Smolik 92 G. R. Smolik, B. J. Merrill and R. S. Wallace, “Implications of Beryllium: Steam Interactions in Fusion Reactors,” J. Nuclear Material 191-194, pp. 153-157 (1992). 14 DOE-HDBK-6004-99 SECTION II EX-VESSEL SYSTEMS MAGNET SYSTEMS Description The magnet system, for a tokamak device, consists of the toroidal field coils, the poloidal field coils and the central solenoid. Toroidal field (TF) coils are superconducting cables cooled with liquid helium which are wound into D shapes. Each coil circumscribes the vacuum vessel cross-section, and the set of toroidal field coils make a complete circle around the torus. The poloidal field (PF) coils are also typically superconducting cables cooled with liquid helium and wound into horizontal rings which are located above and below the vacuum vessel with typically some coil sets inside and outside the toroidal field coils. The TF and PF coils provide the basic magnetic field geometry for plasma confinement and position control. The central solenoid conductors are typically superconducting cables wound horizontally and situated at the center of the vacuum vessel torus supported by, for example, a bucking cylinder. The central solenoid set provides the transient field to induce all or part of the plasma current. Recommended Design Practice The dielectric strength of the insulation should be provided either by materials with an intrinsic dielectric strength, or by materials tested before assembly onto the magnet. The mechanical integrity of the magnets should not depend on the shear strength of the insulating materials or the shear bond between insulation and structural materials. Since leaks at coolant connections are a common cause of magnet faults, such connections should be kept away from mechanical load paths, placed outside the winding pack and, as far as possible, in regions where some access is, in principle, possible for inspection or repair. Manufacturing can allow many faults to occur. Machining chips left in the coil slowly abrade insulation and then cause a failure after some years of machine operation. Very strict tests to determine the cleanliness of finished units should be performed. CRYOSTAT Description The cryostat is a metal chamber surrounding the fusion device which provides a thermal barrier to conduction and thermal radiation between the superconducting coils and other cold structures and the rest of the facility. It may also serve as the biological shield for radiation from the tokamak. The chamber is usually cylindrical with a top and bottom. There are usually large penetrations in the top, bottom, and sides of the cryostat, primarily for access to the vacuum vessel and magnets for maintenance and inspection. The cryostat may be double-walled with an evacuated or filled annulus. The cryostat itself is usually evacuated and it may be lined with cryogenic panels or insulating material to reduce radiant heat transfer.

15 DOE-HDBK-6004-99 General Recommendations For large DT fusion facilities the cryostat volume may be of order 10,000-30,000 m3. This volume is a significant fraction of the internal volume of a fission reactor containment vessel and it may be appropriate to design the fusion cryostat under the rules for metal containment structures rather than designing it as a pressure vessel. Double bellows with a vacuum tight interspace are recommended. CONFINEMENT General Confinement/HVAC systems include structures, systems, and components designed to serve as barriers against the spread or uncontrolled release of radioactive or other hazardous materials throughout the facility or to the environs. The facility confinement strategy may consist of successive confinement barriers based on the hazards present. The successive barriers are generally referred to as primary, secondary, tertiary, etc. and are defined by the facility safety analysis. Primary confinement is often the function of the vacuum vessel, cryostat, or system piping, but may be the function of ex-vessel structural barriers and process enclosures such as gloveboxes, piping, tanks, and ductwork. Secondary confinement consists of building structural elements and associated ventilation systems that confine any potential release of hazardous materials from the primary confinement system. This system includes the operating area boundary and the ventilation system and associated air cleaning systems serving the operating area. Penetrations of the secondary confinement barrier are generally provided with positive seals to prevent migration of contamination out of the secondary confinement area. Tertiary confinement consists of building elements and associated exhaust system of the process facility. This is often the final barrier to release of hazardous material to the environment. Tertiary confinement surrounds the secondary confinement with space which is controlled but not expected to become contaminated. Ventilation/HVAC Ventilation systems should be designed to operate in conjunction with their associated physical barriers to limit the release of radioactive or other hazardous material to the environment. The ventilation system capabilities should be sufficient to allow for any intentional breaches of the confinement system that are required during maintenance on any portion of the facility. Leak-tightness of the confinement pressure boundary should be considered in the design. Air locks to achieve the required leak-tightness between confinement/containment zone boundary interfaces should be considered. Appropriate filtration may be accomplished by multistage HEPA filtration of the exhaust or by an equivalent filtering capability. The exhaust ventilation system must be sized to ensure adequate inflow of air in the event of the largest credible breach of confinement. 16 DOE-HDBK-6004-99 Safety-class systems and components should be designed per ASME AG-1 (ASME 93c) or a comparable code or standard which considers the safety function(s) of the particular system or component (ASME 89a, ASME 89b). Non-safety-class systems and components should be designed per codes and standards used for industrial and commercial grade applications. Design Considerations Ventilation systems 1. The ventilation systems should be designed so that air flows from the cleaner areas with less potential for contamination to the potentially more contaminated areas.

2. The ventilation system should be designed so that the system parameters which are important to operational and nuclear safety can be monitored and if necessary tested. This includes but is not limited to pressure, temperature, air flow, filtering efficiency, environmental releases, etc. 3. The design of the ventilation system should ensure that each of the following design parameters can be met: a) Required differential pressures between confinement barriers b) Required air change rate to maintain concentrations of airborne radioactivity and other hazardous substances at or below acceptable levels. c) Required temperature and humidity conditions 4. The ventilation system should be capable of isolating released tritium gas (or other radiologically hazardous gas) in the event of a breach of the confinement system. In addition the system should be designed to limit potential releases during normal and accident conditions. The ventilation system should be designed to control the concentrations of other radiological, toxic and explosive substances below unacceptable levels. 5. The ventilation system should be capable of monitoring routine as well as accident releases to the environment through all possible discharge paths. 6. The resultant leak-tightness of the confinement zone pressure boundary should be considered in the design. Utilization of air locks to achieve the required leak-tightness between confinement/containment zone boundary interfaces should be considered. The pressure boundary of any confinement zone should have sufficient leak-tightness so that contamination control is achieved without excessive in-leakage. Structural Design Codes General design criteria for all DOE facilities is given in the DOE Order 1020. Requirements for the environmental, safety and health protection are given in the DOE Order 5480.4. Requirements for natural phenomena hazards (NPH) mitigation are given in the DOE Order 5480.28 with the accompanying DOE Standards 1020 and 1021. Although DOE 5480.28, DOE 1020 and DOE 1021 are for NPH they provide a baseline to be extended to fusion related SSCs. 17 DOE-HDBK-6004-99 General Safety Design Guidance The confinement system design should establish the features which minimize the spread of both gaseous and particulate contamination throughout the facility. The confinement systems discussed here are those that are beyond the boundary of the vacuum vessel and its ancillary systems. In order to establish the confinement areas for the facility outside the vacuum vessel, a safety analysis considering normal and accident conditions should be performed. The resultant safety classification of confinement zones from the safety analysis should be the basis for determining the ventilation system design requirements as well as the architectural/structural requirements for the respective confinement areas. (Burchsted 76) The confinement systems should be divided into the following confinement systems as necessary to support the safety analysis: 1. The ex-vessel primary confinement system should consist of structural barriers and process enclosures such as gloveboxes, piping, tanks and any associated ductwork and their associated ventilation and air cleaning systems that are required to prevent the release of hazardous material to areas beyond the confinement boundary. In addition, credible breaches in the primary confinement barrier should be compensated for by provision of adequate inflow of air or safe collection of hazardous material that escapes the confinement. This is accomplished by multistage HEPA filtration of the exhaust or by an equivalent filtering capability. The exhaust ventilation system must be sized to ensure adequate inflow of air in the event of the largest credible breach of confinement.

2. The secondary confinement system should consist of the walls, roofs and associated ventilation systems that confine any potential release of hazardous materials from the primary confinement system. This system includes the operating area boundary and the ventilation system and any associated air cleaning systems serving the operating area. The ventilation system should be designed to ensure proper airflow direction and velocity to counteract the largest credible breach in secondary confinement barrier. Penetrations of the secondary confinement barrier should be provided with positive seals to prevent migration of contamination out of the secondary confinement area. 3. The tertiary confinement system should consist of the walls, floor, roof and associated exhaust system of the process facility. It is the final barrier to release of hazardous material to the environment. This level of confinement should be provided for the space bounding the secondary confinement which is not expected to become contaminated. Potential System Safety Functions The confinement systems along with their associated HVAC systems should be designed to provide the following functions for the facility: 1. Normal Operation: a) Prevent and control the spread of gaseous and particulate contamination. This is accomplished by controlling confinement zone differential pressures as well as 18 DOE-HDBK-6004-99 providing sufficient air exchange rate within the confinement zones. (ASHRAE, ASHRAE 91, DOE 6430.1A) b) Monitor the contamination levels in the zones to ensure personnel radiological safety is maintained. (ASHRAE 91, DOE 5480.11, DOE 6430.1A) In addition, any potential for airborne toxic and corrosive products in the atmosphere that may compromise personnel safety or equipment operability should be monitored and controlled. c) Monitor the radiological releases to the environment to ensure the continued effectiveness of the confinement system to capture and retain radioactive contaminants before they are exhausted to the environment. (ASHRAE 91, DOE 5480.11, DOE 6430.1A) d) Maintain the required temperature and humidity conditions in the zone. (ASHRAE 91) 2. Maintenance: Provide the necessary ventilation system functional capabilities to allow for any intentional breaches of the confinement system that are required to perform maintenance on any portion of the system. (ASHRAE 91) 3. Design Basis Accidents: a) Prevent and control the spread of gaseous and radioactive contamination during and following all credible design basis accidents. (ASHRAE, ASHRAE 91, DOE 6430.1A) b) Monitor the radiological releases to the environment during and following any credible design basis accident. (ASHRAE 91, DOE 5480.11, DOE 6430.1A) c) Maintain temperature, pressure and humidity conditions for the equipment required to operate during and following a DBA. This includes the ability to rapidly remove heat in worst case loss of coolant accident condition. Safety-Class Design Standards and Criteria

The safety analysis to determine the safety system classification of the confinement systems and their associated HVAC systems should be based on the requirements given in DOE-STD-1027-92 or equivalent. Ventilation systems that are classified as “safety class” should be designed to operate in conjunction with their associated physical barriers to limit the release of radioactive or other hazardous material to the environment. In addition they should be subject to appropriately higher quality design, fabrication and test standards and codes to increase the reliability of the system and allow credit to be taken for their functional capability in a safety analysis. In addition the safety analysis should determine the appropriate level of redundancy, diversity, independence and the need for emergency power to ensure safety system function capability during and following all credible postulated design basis accidents. 19 DOE-HDBK-6004-99 Structural 1. Design Approach The structural design philosophy should be similar to that given for the design and evaluation of DOE facilities for NPH in DOE Order 6430.1A, (DOE 6430.1A), with its supplemental Standards, (DOE 1020, DOE 1021). The design procedure combines probabilistic and deterministic approaches and is summarized below: a) Establish performance category based on the desired target probabilistic performance goal, expressed as mean annual probability of exceeding the acceptable behavior limits. b) Develop loads from hazards assessment by specifying mean annual probabilities of exceeding the acceptable limits. c) Use deterministic design and evaluation procedures for the resulting load combinations, to achieve performance goals and to provide a consistent and appropriate level of conservatism. The design procedures conform closely to industry practices using national consensus codes and standards. The procedures extend to methods of analyses and to criteria to assess whether or not the computed response is within acceptable behavior limits. d) Implement design detailing provisions e) Maintain appropriate quality assurance and peer review. Detailing, quality control and peer review are emphasized because: a) Inelastic energy absorption capacity depends explicitly upon ductility in the structural behavior. b) New technology may involve judgments beyond routine engineering. The structural design should be based on a graded approach. A graded approach is one in which various levels of design, evaluation and construction requirements of varying conservatism and rigor are established ranging from common practice for conventional facilities to very rigorous practices used for more hazardous facilities. The motivation for the graded approach is that it enables design or evaluation to be performed in a manner consistent with their importance to safety, importance to mission, and cost. 2. Design Basis Loads Design basis loads are derived from the internal and external events identified as the PIE (Postulated Initiating Events) in the safety analysis. Loads and the combinations thereof should envelop loads considered in structures per ANSI 83. Design basis loads arise from different categories: normal operations, unlikely events, and extremely unlikely events. The performance classification incorporates the probabilities of these events. Loading combinations should be generated from the bounding sets of these events identified in the safety analysis. 20

DOE-HDBK-6004-99 3. Methods of Analysis The method of analysis should depend on the performance category and loads being considered. Some of the methods are described in (ASCE 80). Elastic system analysis methods may be adequate for lower performance categories whereas for higher performance categories inelastic analysis methods nay be required. Guidelines to seismic analysis are available in (DOD 86). Dynamic seismic structural analysis may be performed for predicted ground motions based on geotechnical site specific information including variability using response spectra or time history. For large embedded structures, soil structure analysis may be considered. 4. Acceptance Criteria For lower performance categories, and for normal operations damage should be limited so that hazardous materials can be controlled and confined, occupants are protected, and functions are not interrupted. Thus damage should typically be limited in confinement barriers, ventilation systems and filtering, and monitoring and control equipment. For the higher performance categories, and for unlikely events, structures should be permitted to undergo limited inelastic deformations without unacceptable damage when subjected to transient loads. Energy absorption factors may be used to achieve appropriate conservatism in the design or evaluation process. Stability and other post yield behavior criteria should be met. For extremely unlikely events risk analysis should be performed to determine the extent of permissible damage. In design approaches where ductility and inelastic energy absorption are taken benefit of, attention should be paid to the design details and quality assurance. For all performance categories deformations expected from design load combinations should be able to be withstood. If concrete is used as a pressure boundary, inelastic energy absorption should not be considered. 5. System Interaction Effects Any SSC whose structural failure could impact the function of SSC of a higher performance category SSC are evaluated for interactions. To account for adverse interactions, a determination of failure probability of an SSC given a postulated failure in the lower performance category is required. HVAC The application of design criteria from codes and standards for systems and components should be applied in a graded approach relative to the significance of the safety function. For safety-class systems and components, the design requirements of ASME AG-1 (ASME 93b) or a comparable code or standard which considers the safety function(s) of the particular system or component should be applied (ASME 89a and ASME 89b). For non safety-class systems and components, codes and standards for industrial and commercial grade application should be applied. Some of the major HVAC components that should have a graded approach application of codes and standards are fans, dampers, ductwork, filters and filter housings and instrumentation and controls. 21 DOE-HDBK-6004-99 Potential Safety Functions The potential safety functions for confinement systems and their associated HVAC systems are: 1. Provide barriers against the release or spread of gaseous and particulate contamination during normal and off-normal conditions (ASHRAE , ASHRAE 91 and DOE 6430.1A) 2. Provide the necessary ventilation system functional capabilities to control differential pressures such that air flows from cleaner areas to potentially more contaminated areas during normal and off-normal conditions. (ASHRAE 91)

3. Provide filters or other means to remove contaminants before exhausting to the environs. 4. Maintain the required ambient conditions within confinement, e.g. temperature, pressure, humidity, and concentrations of radiological, toxic, corrosive or explosive substances, to protect personnel and ensure the capability of personnel or equipment to perform safety functions. (ASHRAE 91) 5. Provide the capability to isolate and control tritium or any other contaminant released within confinement. 6. Provide instrumentation and/or testing and surveillance to monitor the condition and capabilities of the confinement system, the ambient conditions within confinement, and the effluents from confinement to the environs. Applicable items should be monitored during normal and off-normal conditions as required to ensure and verify safety function. In addition potential airborne contaminants or corrosive agents that may compromise the ability of personnel or equipment to perform safety functions should be monitored and controlled. (ASHRAE 91, DOE 5480.11 and DOE 6430.1A) Safety-Related Design Guidance System Boundary The confinement/HVAC system boundary is defined for each confinement barrier and includes the contiguous structural barrier and its associated ventilation and filtration equipment. Structural Design Design basis loads are derived from the internal and external events identified as the PIE (Postulated Initiating Events) in the safety analysis. Loads and the combinations thereof should envelope loads considered in structures per ASCE 93. The methods of analysis depend on the performance category and loads being considered. Some of the methods are described in ASCE 80. Elastic system analysis methods may be adequate for lower performance categories whereas for higher performance categories inelastic analysis methods may be required. Guidelines to seismic analysis are available in DOD 86. Dynamic seismic structural analysis may be performed for predicted ground motions based on geotechnical site specific 22 DOE-HDBK-6004-99 information including variability using response spectra or time history. For large embedded structures, soil structure analysis may be considered. Capacity calculations, DOE 1994a, depend primarily on the national consensus code, UBC 94. For reinforced concrete structures DOE 1984 and ACI 318 provide the criteria for safety-class and other building structures, respectively. For steel structures AISC Codes, ANSI 84 and AISC 86a provide the criteria for safety-class and other building structures. AISC 86b is an alternate for AISC 86a if load and resistance factor design procedure is used. ASME Code (ASME 93a) should be used for equipment and components, and ASME Code (ASME 93b) for piping. Deformation may be allowed and inelastic energy absorption credited for ductile structural materials, especially for lower performance categories. Inelastic absorption capacity should not be credited if concrete is used as a pressure boundary. For lower performance categories, and for normal operations, damage may be permitted but should be limited so that hazardous materials can be controlled and confined, occupants are protected, and safety functions are maintained. For the higher performance categories, and for unlikely events, structures should be permitted to undergo limited inelastic deformations. Energy absorption factors may be used to achieve appropriate conservatism in the design or evaluation process. Stability and other post yield behavior criteria should be met.

For extremely unlikely events risk analysis should be performed to determine the extent of permissible damage. INSTRUMENTATION AND CONTROL SYSTEMS Instrumentation and Control (I&C) systems include equipment and components that monitor and display facility parameters, indicate parameter value changes, actuate equipment to maintain the parameters within specified limits, return the facility to operation within these limits, and mitigate conditions resulting from operation outside limits. Specific equipment includes sensors, signal transfer media, signal processors, control circuits and actuation devices. General Safety Design Guidance The purpose of this section is to present the principal design criteria for the Instrumentation and Control (I&C)Instrumentation and Control systems and components. The I&C system design should be separated into the basic control system and the safety system. The separation of these I&C system functions is necessary to ensure that once a safety system is called upon the control function will not stop or impede the proper safety system function execution. Conversely, the safety system must not interfere with the operation of the control function, when the facility or system is operating within the normal design envelope. The basic control and the safety systems analysis and design should ensure independence of system functions and displays with sufficient analytical margin, physical separation, and electrical isolation to enable each system to support the others function without interference under failure, accident, or normal operating conditions. To ensure that these basic principles are properly addressed, the I&C analysis and design efforts must be properly integrated between control and safety system design and with the design and analysis of the facility systems (FS) they are intended to service. 23 DOE-HDBK-6004-99 I&C System Analysis and Design The design of the I&C systems should be integrated with the design of the facility systems (FS) to account for both normal and off normal operation and to prevent or mitigate postulated accidents. The integration of the facility systems and I&C system design functions should address: 1. the capability of I&C system to provide the proper measuring, detection, and control functions, including adequate control and safety margins, 2. the necessary taps, ports, and penetrations to obtain the most desirable measurement parameters for control and safety function actions, 3. a central control room with sufficient displays and command features to allow monitoring and response to all accident Postulated Initiating Events (PIE), except those that are highly unlikely, 4. automatic initiation of all safety function actuations which are not assigned to the operator, 5. feedback from control function actions to determine the effect on the process, 6. a system of interlocks and permissives to reduce the likelihood of erroneous operator action, 7. a system of controlled by-passes to permit deliberate operator action in abnormal unanticipated situations, 8. manual initiation and control for safety function actions not appropriate for automatic initiation or for chosen automatic action interruption or adjustment capabilities. Control System Basic Control systems should be designed with sufficient margin to ensure that the design conditions are not exceeded, during any condition of normal operation including anticipated operational occurrences and transients.

The Basic Control System should be capable of maintaining the normal operating parameters and should provide all operator interface (indication, alarm, and data collection), during normal operation and anticipated operational occurrences and transients that may be created by postulated initiating events. A Task Analysis should be conducted to determine which control functions are to be assigned to the operator and which functions are to be machine (automatic action) assigned. The control system design should provide for operator control and monitoring of essential facility systems in a central control room. The control room, as well as supporting I&C system local control and monitoring panels, should be designed for man/machine interface and local area or room habitability considerations. This design should consider control and monitoring functions for conduct of operations under both normal operation and postulated accident scenarios. 24 DOE-HDBK-6004-99 Safety System The Safety System should be capable of maintaining the facility within the design basis safety analysis limits and provide operator interface (indication, alarm, data collection, and any necessary manual interaction), during accident or off normal conditions that may be created by any PIE. A safety system task analysis should be conducted to determine which safety functions are to be assigned to the operator and which safety functions are to be machine (automatic action) assigned. The operator should be provided with manual safety action initiating capability for all safety functions and with feedback information to confirm the occurrence of the proper actuation and completion of the selected safety function. Safety Systems should be designed to fail safe on loss of motive force or power. In addition, safety systems should be designed to meet single failure criteria. The system should be designed to preclude failure of a component or subsystem from preventing completion of the required safety function. Diversity in the monitoring of the parameters and actuation of the control systems should be a basic principle of the safety system design. To prevent a failure in the basic control system from degrading the operation of the safety system, isolation should be provided between any interface of the basic control and safety systems and separation should be provided and maintained between these systems. Instrumentation The process variables (parameters) that are selected to provide inputs to the I&C system should be those which characterize the relevant safety and operational status of the monitored systems and barriers. This selected set of variables must be analyzed to determine their adequacy to measure and provide for the necessary control and safety functions. The analysis should include the measurability, variability, and response action time capability of the process parameter variables and the operational demands and limitations placed upon the control or safety system design by these parameter variable properties. The instrumentation selected to measure a process variable should directly measure the variable, instead of some secondary parameter. Instrumentation should be analyzed to determine if its reliability, accuracy, and response time characteristics satisfy the control or safety system needs for all required operating conditions.

Instrumentation should be provided to monitor variables of the facility systems over their anticipated ranges for normal operation, anticipated operational transients and occurrences, and for postulated accident conditions to ensure adequate safety and design margins are maintained. Potential System Safety Function The potential safety functions for the I&C Systems are: 1. Monitor and indicate by alarm off normal facility systems operating parameters or transient conditions. 25 DOE-HDBK-6004-99 2. Display parameter values necessary for operator response to off normal systems operating parameters or transient conditions. 3. Operate permissive or interlock functions designed to prevent facility systems from: a) entering into off normal operating parameter or transient conditions, or b) allowing an existing transient condition to continue its off normal excursion. 4. Operate automatically to: a) respond to off normal or accident conditions, b) move the facility toward or attain a safe operational state, or c) mitigate the consequences of the off normal or accident conditions. 5. Enable operator manual initiation of safety related control actions or bypasses. 6. Detect and indicate parameters necessary to ensure the integrity of designated defense in depth barriers. These parameters may include but are not limited to: a) indicators of radioactive, toxic, or other material leakage or migration to detect breach of a barrier, b) temperature conditions indicative of trends toward undesired material conditions (e.g., nil ductility considerations or high-temperature loss of strength), c) over or under pressurization detection for facility systems, or d) chemical or gas mixture potential flammability or deflagration detection. 7. Monitor safety barriers and provide for response or mitigation action designed to prevent the breach of a barrier or to control the effect of barrier breach. 8. Post accident monitoring or control functions necessary for indication, data logging or required continued systems operations. 9. Measure, display, and alarm conditions approaching or exceeding parameter limits defined by Technical Specification Requirements or Technical Standards. Safety Related Design Standards and Criteria The following listed standards and criteria provide a cohesive philosophy and set of principles appropriate for application to the analysis and design of I&C Systems and components for fusion devices. The concepts and principles contained in these documents, including referenced standards, should be applied, using the necessary adjustments required to account for any specific fusion technology special considerations. 26 DOE-HDBK-6004-99 These standards and criteria cover both component level and system level design feature considerations for safety systems. Component design features necessary for safety systems include attributes such as equipment qualification, maintainability, failure criteria and testability. In addition to these attributes, the system level design features should include but not be limited to reliability, independence, redundancy, human factors and separation. Each of the standards listed below form a portion of the overall design philosophy for I&C safety systems. As such, the design intent of all of these standards should be taken as a whole for the analysis and design of I&C systems. IEC 964 (1989-03) Design for control rooms of nuclear power plants.

IEEE 603 Standard Criteria for Safety Systems for Nuclear Power Generating Stations IEEE 323 Qualifying Class IE Equipment for Nuclear Power Generating Stations IEEE 352 IEEE Guide for General Principles for Reliability Analysis for Nuclear Power Generating Station Safety Systems IEEE 577 IEEE Standard Requirements for Reliability Analysis in the Design and Operation of Safety Systems IEEE 420 IEEE Standard for the Design and Qualification of Class IE Control Boards, Panels, and Racks used in Nuclear Power Generating Stations. IEEE 379 IEEE Standard Application of the Single Failure Criterion to Nuclear Power Generating Station Safety Systems IEEE 384 IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits IEEE 338 IEEE Standard Criteria for Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems ISA 67.02 S67.02.01: Nuclear Safety-Related Instrument Sensing Line Piping and Tubing Standard for Use in Nuclear Power Plants ISA 67.04 S67.04--Part I: Setpoints for Nuclear Safety-Related Instrumentation-- ANSI/ISA­ 1994 RP67.04--Part II: Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation-1994 ISA 67.06 S67.06: Response Time Testing of Nuclear Safety-Related Instrument Channels in Nuclear Power Plants-- ANSI/ISA-1984 27 http:S67.02.01 DOE-HDBK-6004-99 ANSI/ANS 3.8.5-1992 Criteria for Emergency Radiological Field Monitoring, Sampling, and Analysis ANSI/ANS 3.8.6-1995 Criteria for Conduct of Offsite Radiological Assessment for Emergency Response for Nuclear Power Plants IEEE 730 Software Quality Assurance Plans IEEE 829 Standard for Software Test Documentation IEEE 830 Guide for Software Requirements Specifications IEEE1012 Standard Software Verification and Validation Plans IEEE 1016 Recommended Practice for Software Design Descriptions IEEE 1042 Guide to Software Configuration Management IEEE 1063 Standard for Software User Documentation Design Considerations Diversity In the selection of the sensors and measuring systems for the in-vessel and near vessel parameters, multiple diverse technologies should be implemented since these instrument components will be exposed to harsh environments (potential radiation exposure, magnetic fields, temperature gradients, ion pulses, etc.) Unexpected failure mechanisms within a single measurement technology could lead to erroneous control or safety actions. Provision for the use of diverse measurement technologies in the design would provide alternative sensing capabilities and reduce the possibility of failure to detect and initiate a safety function due to common mode or common cause failures. Graded Approach to Defense In Depth The failure consequence and frequency of the PIE should be considered in the determining the degree of the redundancy and diversity required in the I&C system. Anticipated operational events of high consequence should require an analyzed probability of successful action. This analysis should include the presence of an undetected failure in the safety related I&C system equipment necessary to accomplish the required safety function. Events of lower frequency and/or consequence may be shown to be mitigated by less rigorous analysis and subsequently less rigorous I&C equipment requirements. 28 DOE-HDBK-6004-99 Response Time Requirements and Margins

Facility system designs should be sufficiently robust, to withstand a process perturbation, without damage or degradation, until the I&C system can detect the change in the monitored parameter, command a change in the controlled variable and have that system return to the safe or process normal state. The margin (allowed variation of the process parameter for the allowed time) should be sufficient for the I&C system to detect the change in the process and respond within some defined degree of internal delay or failure. The Basic Control System should be reliable and exhibit adequate response time to maintain normal fusion operations without unnecessary challenges to or actuation of the safety system. These necessary attributes should be addressed by performance of sufficient setpoint and instrumentation uncertainty and response time analysis to ensure adequate margins exist between normal control and safety system setpoints and limits. Qualification Safety related I&C components should be qualified to perform their intended safety function for the life of the component. Qualification should address operational requirements and environmental requirements. Qualification for operational conditions should consider maintenance, testing, and operation during all operational modes, such as, normal, off normal shutdown, and postulated accidents. Qualification for environmental conditions should be limited to normal operational environments, except for those components and systems that must remain operable during and/or after an accident. Those I&C systems and components required to remain operable during and/or after an accident should be environmentally qualified for the conditions they are subjected to during the time it takes to complete their safety functions. Seismic qualification of I&C systems and components should be considered for those items that are required to maintain their structural integrity and operability during and after a design basis earthquake. Qualification requirements (if any) for systems credited in Design Basis Events should be explicitly stated in the overall functional requirements. Additional Graded Approach guidance should be provided to ensure consistency across Facility System Boundaries. This is important to I&C since the I&C System crosses these boundaries. Human Factors A human factors analysis of the control room or local I&C panel operator interfaces with console or panel controls, displays, indications and alarms should be performed. This includes the interface of control room functions with local panel operations capability and the interface with digital system displays and control and response capabilities. Testability and Maintainability The I&C system and components should be designed to provide the capability for performance of periodic testing of all instruments, logic, interlocks, permissive features, bypasses, and other facility systems. The safety system portion of the I&C system should be capable of confirming the required calibration, setpoint and time responses with test frequencies that meet the uncertainty analysis 29 DOE-HDBK-6004-99 requirements. Test features of the safety system I&C should be able to detect failures of the system that could degrade or prevent a safety function from occurring in the presence of a single failure.

The I&C system should include maintainability considerations in the design process. These considerations should include ease of replacement of components, modules, or subsystems, the access availability of the equipment with consideration for personnel hazard conditions (radiation, magnetic fields, temperature, proximity to steam piping or other stored energy conditions, etc.), and the provision for sufficient bypass or disable capability and test point access to allow for the valid performance of necessary and adequate testing. Power The I&C power system design should provide for the necessary redundant power sources to ensure that the system will be capable of performing its required function under all normal and postulated accident scenarios. Power sources that should be considered for the I&C system include uninterruptible power sources, critical instrument busses capable of being powered from diesel generator back up power, and battery back up systems. Control Room Design The design of the control room should be implemented in accordance with IEC 964 standard guidelines, with the appropriate modifications for fusion versus fission technologies and hazards. The underlying principles of the man/machine interface and functional analysis presented in IEC 964 are appropriate to the design of fusion control facilities. Adequate radiation and environmental protection should be provided to permit access and occupancy of the control room under accident conditions where the operator monitoring, mitigative or response actions are required during or following an accident. Equipment at locations outside the control room should be provided to achieve and/or maintain the facility systems in a safe or shutdown condition in the absence of the control functions designated for that purpose. Safety Actuation Safety function actuation should be sealed in, so that the safety function actuation is maintained even if the logic that initiates the actuation is lost. Monitoring Monitoring of after-heat removal after-heat removal (and normal operating heat removal) should include sufficient information processing and displays to present the heat balance and energy transport and verify parameters are within the expected ranges. Higher order logical processing and display may be required to present operators with an integrated picture of the fusion heat removal system. The input sensors, algorithms, software and hardware required for this safety-significant activity should meet appropriate reliability standards. The inherent robustness of the facility confinement systems should be analyzed (and demonstrated) to show survivability during PIE with the worst case performance of the I&C System. The design 30 DOE-HDBK-6004-99 basis (or Graded Approach) should specifically describe the requirements for coupling PIE and internal transients; the influence of PIE on parameter measurements, uncertainties and response times should be evaluated for those scenarios requiring coupling of events. Monitoring of the inventory levels and barrier integrity should address the Postulated Initiating Event of concern. Active detection and venting to expansion volumes must meet the response times assumed in the analysis criteria. Passive designs for channeling coolant to the expansion volume should be considered. TRITIUM SYSTEMS General Safety Design Criteria

Tritium system tritium system design should include features which minimize the environmental release of tritium and exposure of personnel, minimize quantities of tritium available for release during accidents or off-normal events, and minimize the unintended conversion of elemental tritium to an oxide form. Consistent with facility safety analysis, design features should include: 1. Segmentation of the tritium inventory such that release of all tritium from the single largest segmented volume has acceptable consequences, 2. Confinement barriers1 to reduce tritium environmental release to an acceptable level, 3. Materials and equipment which are tritium compatible and minimize exposure of tritium to oxygen, and 4. Cleanup systems to recover gaseous tritium released within any confinement barrier or to process streams exhausting to atmosphere. Tritium system functions should be designated safety functions if they are credited in the facility safety analysis in order to meet prescribed safety criteria. Systems or components needed to perform safety functions should be designated safety-class systems or components. Components which do not perform safety functions but whose single failure causes the failure of a safety function should be designated safety-class components. Generic System Description The following sketch illustrates the tritium system consisting of five major functional areas within multiple confinement barriers: Primary confinement, a sealed system rated for design maximum pressure and low leak rate, is the 1 This document considers the tritium containment system to be a type of confinement. Sealed high- integrity process equipment and piping provide the containment system, for vacuum and pressure conditions, and constitute the primary confinement barrier. The secondary confinement barrier consists of gloveboxes and cabinets which house the primary confinement (containment) system. To complete the secondary confinement, process piping between glove boxes or cabinets are within a jacket enclosure which seals to the glovebox or cabinet. Additional sealed cabinets or rooms may extend the concept to tertiary, quaternary or higher orders of confinement in accordance with the facility’s safety analysis. 31 DOE-HDBK-6004-99 primary barrier for tritium. Although primary confinement is sealed and leak tight, tritium is an elusive molecule and small tritium leaks will occur inevitably. Secondary confinement, a system with controlled outflow, collects the leaked tritium in a recirculating nitrogen (or inert) gas stream for subsequent recovery of the tritium. Secondary confinement operates at a subatmospheric pressure, by virtue of a small purge stream to the exhaust stack, and thus is unlikely to leak tritium to the tertiary or higher order confinements. Personnel may not enter primary confinement or secondary confinement zones during normal operation. They may enter for maintenance activities, and only after tritium removal is complete for the affected systems. Personnel may routinely occupy the tertiary or higher order confinement zones without wearing protective clothing and respiratory equipment. But personal protective equipment (PPE) is available for rapid donning if the safety analysis reveals a credible event wherein tritium enters tertiary or a higher order confinement zone.

The tritium facility’s heating and ventilation system (H&V) promotes the confinement concept by maintaining pressure differentials such that air flow is always towards zones with greater contamination potential. In the above sketch, fresh air enters the quaternary zone then flows to the tertiary zone from which it discharges to a stack. 32 DOE-HDBK-6004-99 H&V Supply Tritium Transfer Tritium Purification Tritium Recovery Tritium Storage System Cleaning S T A C K Tertiary Confinement Quaternary Confinement H&V Exhaust H&V Transfer Recirculating Gas Primary Confinement Secondary Confinement Fresh Air Inlet Figure II-1. Tritium confinement scheme. The function of each major tritium area within primary confinement is as follows: Tritium Storage The tritium inventory resides in the storage medium unless it is undergoing transfer, recovery, purification or burning in the fusion machine. The storage medium can be tankage or hydride beds. Tritium Transfer The transfer function moves tritium from one part of the primary confinement to another or to the fusion machine vacuum vessel or a pellet process. The transfer motive force can be either residual differential pressure, or active pumping, or thermal cycling of a hydride bed, or all three. 33 DOE-HDBK-6004-99 Tritium Recovery The recovery function recovers the small amounts of tritium that invariably escape from the primary confinement during operations and maintenance. Recovery involves removing tritium and any deuterium or protium isotopes from the secondary confinement volume and holding the isotopes for subsequent processing in the purification function. The recovery process can use zeolite beds or metal hydride beds. ! A primary recovery system operates continuously, and recovers tritium from small leaks occurring during normal operation. ! A secondary recovery operates on demand and provides a greater tritium recovery capacity necessary for large leaks or maintenance operations. ! A purge recovery system maintains the secondary confinement at a subatmospheric pressure by exhausting continuously some of the secondary confinement atmosphere to the environment. The purge system recovers tritium from these exhaust flows. Tritium Purification The purification function removes the hydrogen isotopes protium, deuterium and tritium from other gases and then separates the tritium isotopes from protium and deuterium. The purification process can use thermal diffusion columns or cryogenic distillation or a chromatographic process or (preferred) a thermal cycling absorption process. The thermal cycling absorption process uses a palladium-coated kieselguhr2 hydride bed which, upon temperature cycling, separates tritium from protium and deuterium. System Cleaning The cleaning function operates on demand and cleans impurities (suspended solids, oils, moisture, halides, etc.) from the tritium systems. Cleaning uses various detergents, chlorinated fluorocarbons, solvents and water, followed by vacuum drying to <10-2 torr. Removal of impurities is important to prevent stress corrosion cracking of stainless steel and contamination of the fusion machine’s vacuum vessel. Potential System Safety Functions The potential safety functions for the tritium systems are: Normal Operation:

1. Provide for primary and secondary confinement barriers that separate tritium from onsite and offsite personnel and the environment. If the safety analysis requires tertiary or higher levels of confinement, the tritium systems should provide the additional barriers. This safety function includes the structures, systems and components necessary to establish the barriers and the power sources necessary to maintain the barrier operation within prescribed safety limits. 2 loose or porous diatomite 34 DOE-HDBK-6004-99 2. Provide for monitors and signals or alarms dictating a need to isolate or otherwise control a tritium system to prevent monitored system variables exceeding a safety limit. The safety analysis should identify the system variables requiring monitoring, which will normally include system pressure, oxygen inleakage and tritium out leakage from a confinement barrier. 3. Provide for recovery from anticipated off-normal events by providing systems that remove tritium from secondary and greater confinements and from any air stream exhausting a confinement to the environment. Maintenance: 1. Provide for primary confinement of tritium during maintenance within secondary, tertiary or any greater levels of confinement barriers. 2. Provide for tritium removal, evacuation and cleansing of primary confinement systems prior to breaking the primary confinement barrier for maintenance. This preparation for maintenance will minimize the resultant tritium losses. Design Basis Accidents: The safety analysis should specify design basis accidents. Tritium systems design should implement requirements and provide for corresponding safety functions to make the accident consequences acceptable. A typical frequency for design basis accidents is P>10-6/year. The safety analysis will specify the actual frequency. The quantity and form of tritium released during a design basis accident will determine the consequences of the accident. Probability and consequence are the parameters determining risk. The following are potential design basis accidents for tritium systems: Internal Initiators 1. Tritium fire or detonation 2. Missile or pipe whip resulting from sudden failure of high energy system. This accident has potential for causing a release of tritium and simultaneously disrupting multiple confinement barriers. 3. Human errors External Initiators 1. Natural phenomena, including earthquakes, hurricanes, tornadoes, floods, tsunami, etc. 2. Aircraft and other missile impact (excluding sabotage). Beyond Design Basis Accidents: There are no system safety functions required for beyond design basis accidents. 35 DOE-HDBK-6004-99 Beyond design basis accidents include internal and external initiators whose frequency is lower than the design basis frequency limit specified in the safety analysis. Safety-Class Design Standards and Criteria For safety-class tritium systems, the following design standards and criteria should apply to the system, structures or components: Structural General The tritium systems boundary is the pressure (or vacuum) confinement barrier afforded by the piping, fittings, vessels, valves, and instrumentation that are wetted on their interior surfaces by tritium. The boundary extends to the first or second isolation valve in system piping to the fusion device’s vacuum vessel. Loads 1. Individual Loads

Tritium systems should withstand the static load, vacuum, normal operating pressure, normal operating thermal load, electromagnetic loads (normal operating and fault), interaction loads from adjacent systems, natural phenomena hazard loads and loads due to missile impact and hydrogen detonation (if these are design basis accidents, see Section IV). a) Static Load - The static load should include the weight of the equipment identified as constituting the system (or component), and any supported hardware. b) Vacuum Load - The vacuum load should include forces arising from complete vacuum within the primary confinement barrier. A vacuum of <10-2 torr within the primary confinement system is customary for cleansing prior to and following maintenance, inspections, etc. c) Normal Operating Pressure - Normal operating pressure loads should range up to and include the design pressure of the system or components. d) Normal Operating Thermal Load - The normal operating thermal load should include temperatures associated with routine processing operations, both cryogenic and elevated, and elevated bakeout conditions required for cleansing prior to equipment removal. e) Electromagnetic Loads - Electromagnetic loads should include the forces induced as a result of power, instrument and control and eddy currents in the tritium system interacting with magnetic fields of the fusion machine’s normal operation. f) Electromagnetic Loads During Faults - Electromagnetic loads should include the loads induced during abnormal operating events such as control failures, power supply failures, bus opens or shorts, or magnet faults. 36 DOE-HDBK-6004-99 g) Interaction Loads - Interaction loads should include the loads imposed on the tritium systems by adjacent systems during normal or fault conditions. h) Natural Phenomena Loads - Natural phenomena hazard loads should include loads resulting from earthquake, wind, flood, tsunami and seiche. UCRL-15910 provides guideline methods for establishing load levels and for evaluating the response of structures, systems and components to the load levels. i) Hydrogen Detonation Loads - Hydrogen detonation loads should include the mechanical and thermal effects of tritium, deuterium and protium ignition or detonation, if the safety analysis includes such failure as a design basis accident. j) Missile Impact Loads - Missile impact loads should include missiles and pipe whip resulting from failure of high energy systems, if the safety analysis includes such failure as a design basis accident. 2. Combined Loads Table I-1 lists the load combination which the design should consider for normal and anticipated off- normal operations. Because maintenance involves isolating, depressurizing and evacuating a system, the load during maintenance is the static load only. 3. Cyclic Loads Tritium systems are subject to thermal and pressure cyclic loadings during normal and anticipated off- normal operation and maintenance. An evaluation should determine if a formal fatigue analysis is necessary. ASME 93a or comparable computational methods provide criteria for the evaluation which should use a conservative analysis for the number of cycles and service life including the expected changes in material properties with time. Structural Acceptance Criteria

Tritium systems that are safety-class should have design, fabrication, inspection and testing in accordance with a recognized safety-class code such as the ASME Boiler and Pressure Vessel Code. The specific codes and criteria selected should be commensurate with the level of safety required and should have a technical justification. Tritium systems that are NOT safety-class should have design, fabrication, inspection and testing in accordance with a recognized national consensus code such as the ANSI/ASME Standard B31.3 “Chemical Plant and Petroleum Refinery Piping” (ANSI 93). Structures, systems and components near a tritium system should be safety-class if their credible failure could impact the safety function of a tritium system. 37 DOE-HDBK-6004-99 Deflection Analysis An analysis of tritium system deflections over the full range of temperatures, vacuums and pressures should confirm no interferences or loss of confinement integrity. Testing and Inspection Non-destructive testing and inspection of safety-class welds, vessels, piping and valves should be in accordance with the ASME Boiler and Pressure Vessel Code (ASME 93a). Personnel qualification and weld acceptance criteria should also be in accordance with ASME 93a. Testing and inspection should occur before initial operations. The hazards associated with testing of contaminated systems, processing of the contaminated test medium, and increased potential for environmental losses of tritium, may impede subsequent periodic testing and inspection. Any system, subsystem, or component, that is determined to require periodic testing and inspection should be identified during the design of that system so that the test requirements are incorporated into the design. Computational Methods Validation Computer codes or other computational methods supporting the design of tritium systems should have validation and verification for the range of normal and off-normal operations including design basis accidents. This validation and verification should support the use of the computational method in each intended application. Materials Radiation Materials of construction should be qualified for the lifetime radiation environment. The structural design analyses should use conservative end-of-life properties. If a component’s expected lifetime is less than the system’s lifetime, design should provide for component replacement. Radiation environment refers principally to external sources of radioactive energy, but it includes the beta energy of tritium decay also. Thermal The structural design analyses should use material properties appropriate for the operating conditions. If no published materials property data exist for a particular operating temperature, tests should establish the material properties at the temperature. The ASME Boiler and Pressure Vessel Code (ASME 93a) imposes temperature limits for structural designs. For items whose design complies with the Code and whose temperature could exceed the Code’s limit, the design analyses should reduce allowable stress to an acceptable value determined by testing the material at the elevated temperature. 38 DOE-HDBK-6004-99 Tritium Embrittlement The structural design analysis should use material properties based on tritium and helium embrittlement for the projected end-of-life. Penetrations of Confinement Systems Penetrations should meet the same materials requirements as the penetrated confinement system.

Instrumentation and Controls Tritium systems design should provide for instrumentation and control to monitor parameters important to the safety function for normal operation and design basis accidents. The safety analysis should identify and the design should implement: 1. Instruments to monitor safety-related variables. Primary confinement will typically provide monitoring for pressure, vacuum, temperature, and the ability to provide batch-based qualitative gas analysis. Secondary confinement will typically provide for tritium detection, pressure (relative to ambient or tertiary confinement), and oxygen level (if secondary has a reduced oxygen atmosphere). Subsequent levels of confinement will provide monitoring abilities commensurate with the hazard anticipated and the operating conditions of the barrier. 2. Controls to maintain measured variables within prescribed limits and to isolate tritium subsystems when necessary for safety reasons. 3. The design for safety-class systems, including their ventilation systems, should incorporate sufficient redundancy and/or diversity to ensure that a single failure will not result in total loss of instrumentation or control for a safety function. The power supply for safety-class instrumentation and controls should meet the requirements for Class 1E electric power systems (IEEE 308). The different designs and operating characteristics of fusion facilities limit the amount of specific guidance that these criteria can provide. Existing DOE and NRC design requirements and guidance documents (IEEE 603, DOE 6430.1A, NUREG-0800, 10CFR50(A), USNRC Regulatory Guides (RG 1.100 - RG 1.89)) provide helpful general guidance for implementing these criteria at a particular fusion facility. Confinement Systems Tritium systems design should provide for confinement barriers to reduce tritium releases to an acceptable level. The safety analysis should define and the design should implement appropriate robustness and leak tightness for the barriers. The confinement system should include as a minimum primary confinement system and a secondary confinement system. Design should also provide for tertiary, quaternary or higher orders of confinement if the safety analysis indicates these higher orders are necessary. The assumption of a single failure within the system does not compromise the confinement function. 39 DOE-HDBK-6004-99 The safety analysis should identify the confinement safety functions and the process conditions for which the functions are required. The confinement systems should provide the required confinement safety functions for normal operation, anticipated off-normal events and design basis accidents with the assumption of a single failure in the system. Primary Confinement Systems All tritium systems should enclose tritium within a primary confinement that provides a low leak rate, pressure-rated static barrier. Normally, primary confinement systems are sealed systems and are opened only for maintenance, testing and inspection of confinement subsystems. Electrical equipment necessary to provide the required confinement safety function should be safety- class and should have a safety-class electrical power supply including a backup electrical power supply (DOE 3003).

Opening a confinement subsystem requires prior removal of tritium and cleansing. Cleansing steps that exhaust to the atmosphere should exhaust through a tritium removal system to limit the release of tritium to the environment consistent with release limits and ALARA principles. The safety analysis should prescribe limits for tritium releases to the environment. The exhaust from a confinement subsystem may be through a dedicated tritium removal system or through a secondary confinement subsystem which has an tritium removal system. The tritium removal systems should have capacity to recover from a design basis tritium release from primary confinement. 10CFR50(I) provides specific methods and evaluation criteria that are acceptable in implementing ALARA with respect to exhaust systems from a confinement system. DOE 6430.1A provides additional guidance for design of confinement systems. RG 1.140 provides guidance for design, testing and maintenance for exhaust system cleanup systems. Secondary and Higher Order Confinement Barriers A secondary confinement barrier should enclose the primary confinement system. Tritium systems should also have tertiary or higher orders of confinement in accordance with requirements of the safety analysis. Secondary and higher order confinement barriers should comply with the criteria of this section. Secondary confinement barriers should have a recirculating nitrogen or inert gas atmosphere. For the purposes of this document, when the term “inert” is used in reference to the confinement atmosphere, any combination of reduced oxygen environments is intended. Tertiary and higher orders of confinement should have atmospheres as directed by the safety analysis. Secondary and higher order confinement barriers should operate at subatmospheric pressure by exhausting some of the atmosphere to the environment. The atmospheric exhaust should be through an tritium removal system to limit the environmental release of tritium consistent with release limits and ALARA principles. The safety analysis should prescribe limits for tritium releases to the environment. 10CFR50(I) provides specific methods and evaluation criteria that are acceptable in implementing ALARA with respect to exhaust systems from a confinement barrier. DOE 6430.1A provides 40 DOE-HDBK-6004-99 additional guidance for design of confinement barriers. RG 1.140 provides guidance for design, testing and maintenance for tritium removal systems. Segmented Tritium Systems Tritium systems design should provide for segmentation of the tritium inventory to make acceptable the amount of tritium releasable in a single event. Design should provide for isolation of each segmented volume using valves or piping blanks. Check valves and other one-way valves are not acceptable as isolation devices. Release of tritium from the single largest segmented volume should not result in exceeding prescribed dose limits or other unacceptable consequences. Segmentation may be accomplished by either 1. Utilization of processes or devices with small inventory, or 2. Separation of the tritium inventory into isolable volumes, or 3. Storage of tritium in an immobile condition relative to the single event (e.g., metal hydride beds). Protection For Natural Phenomena

For the tritium systems that are safety class, including structures and components, design should provide robustness to withstand the effects of design basis natural phenomena such as earthquake, tornado, hurricane, flood tsunami, seiche, etc., without loss of safety function. The design should also provide for protection of safety-class equipment and systems from potential failure of non-safety­ class hardware during natural phenomena events. If protection includes isolation of safety-class systems, the equipment, instruments and electrical systems that provide for the isolation should be capable of withstanding the effects of design basis natural phenomena without failure of function and should be fail-safe in the event of power loss or failure within electrical systems. Protection from Environmental Conditions and Missiles For the tritium systems, including structures and components, that are safety class, design should provide robustness to accommodate the effects of environmental conditions of normal operations, maintenance, testing and postulated accidents without loss of safety function. Safety-class tritium systems should have robustness or protection to withstand dynamic effects of a missile, pipe whip, or runaway plasma that may result from equipment failures and from events outside the tritium systems if the safety analysis evaluates these as design basis accidents. Fire Protection The design should minimize the probability and consequences of tritium fires or explosions. Because fire oxidizes elemental tritium to tritium oxide, a form with a much greater biological hazard, design should place high priority on preventing fires. The design should use noncombustible or fire resistant materials to the greatest practical extent throughout the tritium systems. 41 DOE-HDBK-6004-99 Where the safety analysis evaluates fires as design basis accidents, design should provide for fire detection and suppression systems having appropriate capacity and capability to minimize adverse effects of fires on safety-class systems, structures and components. Rupture or inadvertent operation of fire suppression systems should not significantly impair the safety function of tritium systems, structures and components. Fire suppression systems should emphasize use of dry chemical or gas suppressants. Because of the natural affinity of tritium for water and the increased biological hazard of tritiated water, the use of water as a tritium fire extinguishing agent should require a technical or economic justification. Facilities that have the potential for introducing fire suppression water into a tritium contaminated environment should provide a tritiated water collection system with the capacity to store the total volume of fire suppression run-off. Design should provide for facilities to dispose of any tritiated water in an environmentally acceptable manner. Conversion of Elemental Tritium to Tritium Oxide The design should include engineered features as necessary to minimize the potential for tritium contact with ignition sources, water, moisture, hydrocarbons and other oxidizing sources. Because oxidized tritium is a significant biological hazard, the design must reduce to a practical minimum the unintended conversion of tritium to any oxidized form. This criterion recognizes that some tritium cleanup systems convert elemental tritium to an oxide form with deliberate intent, to facilitate removal from flowing gas streams. Heat Removal

The design should provide for reliable removal of total heat loading from all confinement barriers. Total heat loading consists of tritium decay heat and equipment energy dissipation within a barrier and heat transfer into the barrier from external energy sources. System Cleaning The design should provide for cleaning of tritium systems before and after installation. Tritium systems should be able to withstand vacuum conditions necessary for cleaning purposes. Once tritium has contaminated the primary confinement, only limited cleaning is permissible for tritium­ wetted surfaces. Tests and Inspections The design should provide for periodic tests and inspections of structures, systems and components related to the intended safety function. The tests and inspections should assess structural integrity, hydrogen embrittlement, leaktightness and other parameters related to the safety function. The design should provide for and operations should have an appropriate materials surveillance program. If the design does not permit periodic inspections and tests in accordance with applicable codes, particularly for systems contaminated with tritium, the safety analysis should develop and prescribe an acceptable testing program. The facility authorization basis should include the test and inspection program. 42 DOE-HDBK-6004-99 Design Considerations General The tritium primary confinement is the pressure (or vacuum) boundary, wetted routinely by tritium, outside the fusion machine’s vacuum vessel and associated vacuum system. Gages, stubs or other pressure-containing hardware attached to a safety-class primary confinement subsystem are safety- class components and design should have them serve as confinement barriers for all operational and accident modes of the tritium primary confinement. Radiation Shielding Radiation shielding is not a design consideration for tritium systems. Tritium decays to a stable element, helium (3He) by emission of low energy beta radiation, maximum 0.0185 MeV and average 0.0057 MeV. The maximum range (i.e., density thickness) of beta particles, about 0.6 mg/cm2, is less than the generally accepted 7 mg/cm2 thickness of the epidermis of the skin. The beta radiation is easily and completely shielded by a relatively thin layer of almost any material, including the materials of the tritium confinement system. Thus, if the primary confinement system is leak tight, tritium poses no radiological hazard to operating personnel. Confinement Barriers Tritium primary confinement is a major design consideration because tritium is difficult to contain. As noted above, tritium is not an external radiation hazard. However, when tritium is oxidized and ingested it produces a significant internal dose. Regardless of the care taken to assure physical integrity and leak tightness of the confinement, small quantities of tritium will escape at the various process connections during normal operations. Additionally, an increased level of loss will occur during maintenance operations which usually breach the primary barrier. By escaping to unwanted areas and reacting with normally present materials, tritium can create significant biological hazards. For example, tritiated water (tritium oxide) is a water molecule in which one or both of the hydrogen atoms is a tritium atom rather than the normal protium, e.g., T2O, HTO, DTO. Tritiated water is on the order of 104 times more hazardous to humans than elemental tritium. The human radiation dose hazard is through inhalation, ingestion or absorption through the skin.

Because tritium is very mobile and can create a biological hazard, tritium systems must have barriers to protect personnel and the environment from tritium and its compounds. As a minimum, a tritium system should have primary and secondary confinements. If the safety analysis determines that tritium systems, or certain components, require tertiary or higher order confinements, the design should provide for these confinements in a similar manner as secondary confinement as discussed below. The primary confinement system should consist of piping, tubing, valves, fittings, equipment and instrumentation components that define the pressure boundary of the tritium systems. The primary confinement system is normally a closed system in direct contact with tritium and containing it for conditions ranging from vacuum to full system pressure. Physical integrity is assured by compliance with the applicable ASME Code for boiler and pressure vessels, or equivalent Codes. If the safety analysis determines a portion or all of tritium primary confinement to be a safety-class system, the 43 DOE-HDBK-6004-99 associated individual components are safety-class and the design should consider them as the primary confinement barrier for all operational and design basis modes. Secondary confinement includes the 1) barriers that enclose the primary confinement and 2) systems that ventilate the secondary confinement volumes. If the safety analysis deems a portion or all of secondary confinement to be a safety-class system, the associated individual barrier components are safety-class and the design should consider them as confinement barriers for all operational and design basis modes. Examples of secondary confinement systems are glove boxes, sealed enclosures, bell jars, double jacketed vessels/duct work/piping, and stripper/scrubber systems. Ventilation systems for secondary and higher order confinement volumes will operate at a negative pressure relative to the ventilation systems of zones occupied by personnel. The negative pressure will assure that any air flow between zones will flow from personnel zones and into the zones that could be confining a tritium release. Structural Design Codes The design, fabrication, testing and inspection of safety-class tritium structures, systems or components should be in accord with the ASME Boiler and Pressure Vessel Code (ASME 93a), or to a comparable safety-related code. Either ASME Code Section III, Class 1 or 2 or the comparable elements of ASME Code Section VIII, Division 2 may apply for pressure vessels. For tritium systems, ASME Code Section III is acceptable. ASME Code Section VIII is acceptable if the design uses additional standards in areas such as attached valves, pumps, piping and supports, enhanced quality assurance and tritium/helium embrittlement effects which are comparable to relevant parts of ASME Code Section III. In general, the designer should prepare a detailed comparison between ASME Code Section III and the comparable code, for safety-class systems, and demonstrate comparability. The designer should prepare this comparison early in the design phase and the safety regulatory or licensing authority should endorse the comparability to ensure acceptability for construction. Finally, this document does not address the actual stamping of a vessel or component complying with Section III or VIII; this is a decision among the owner, fabricator and the cognizant regulatory agency.

Hydrogen Fire and Detonation Hydrogen fire and detonation are potential hazards which the safety analysis may declare design basis accidents (typical frequency > 10-6/year). If tritium primary confinement is a safety-class system, it must retain a required integrity during and after a fire or detonation event, although the non-safety­ related functions of the confinement can be compromised. If it is not a safety class, the tritium primary confinement may fail in a fire or detonation event, but the failure should not degrade the function of an adjacent safety-class system, structure or component. Hydrogen Fires The hydrogen isotopes tritium, deuterium and protium leak easily and can form a highly flammable mixture with air. Hydrogen and air mixtures can ignite and sustain a flame over a very wide range of composition, from 4% to 74% by volume of hydrogen, at room temperature and pressure (Hord 78). A minimum limit of 9% is needed to sustain a coherent flame. At room temperature and 44 DOE-HDBK-6004-99 pressure, a spark energy of 0.02 millijoule can ignite a stoichiometric mixture (29.5% tritium by volume). The potential for hydrogen fires can be minimized through leak prevention, elimination of ignition sources, reduction of available oxygen, and/or increased ventilation. Hydrogen Detonations The mode of burning in which the flame travels at supersonic speeds is called detonation. Heated to a high temperature, a mixture of hydrogen and air can spontaneously ignite and detonate. This temperature is the spontaneous ignition temperature which is a function of composition, pressure and container size. At one atmosphere of pressure, this temperature is about 540°C. Favorable conditions for detonation are stoichiometric mixture (29.5% hydrogen by volume), high energy ignition sources and confining surroundings. Unconfined hydrogen-air mixtures do not detonate unless the ignition source delivers considerable energy in the form of a shock wave. For a potential hydrogen fire or detonation to be a design basis accident, the safety analysis should evaluate the frequencies of the required conditions occurring at the same time: 1. Hydrogen isotopes in sufficient concentration, 2. Oxygen in sufficient concentration, and 3. High temperature or ignition source. To preclude a tritium fire or detonation as a design basis accident, the safety analysis must demonstrate a low event frequency, typically <10-6/year. Design features that promote a low event frequency include: 1. Leak tight primary confinement to prevent out leakage of tritium to the secondary confinement, 2. Inert gas in the space between primary confinement and secondary confinement barrier walls, to prevent oxygen contacting tritium, 3. Monitors to detect tritium out leakage or oxygen inleakage, 4. Minimize ignition sources or high temperatures near the primary or secondary confinement barriers, and 5. Utilize NFPA rated enclosures (NFPA 70) for electrical equipment in a location potential for contact with flammable mixtures exist. Metal Embrittlement Almost all metals will absorb hydrogen gas in a thin surface layer from which hydrogen will diffuse deeper into the metal. Additionally, some of the hydrogen isotope tritium will decay to helium-3. With time and continued exposure, both the diffused hydrogen isotopes and the tritium decay product helium will embrittle the metal.

Embrittlement alters the material properties of some metals significantly, by reducing ductility which leads to failure by crack growth at ambient temperature. In addition, some metals containing helium 45 DOE-HDBK-6004-99 can crack at elevated temperatures, including welding temperatures, by bubble agglomeration and creep crack growth. Design should eliminate embrittlement as a design issue by considering in the choice of materials a lifetime projection of pressures and temperatures and exposure to hydrogen isotopes. Exchange with Hydrogen, Hydrogenated Compounds, and Hazardous Wastes Tritium will readily exchange with a hydrogen atom in water, oils and almost all other hydrogenated compounds. Tritiated water and some tritium hydrocarbon compounds are absorbed quickly into the human body where the beta energy of tritium decay can cause biological damage. When tritiated, mercury, oils and other hazardous wastes become mixed waste with a significant disposal cost. The design should avoid use of water, moisture, mercury, hydrocarbons (oils), plastics, asbestos or elastomeric gaskets and other hydrogenated compounds that could contact tritium. Gaskets and O- rings in contact with tritium should not use elastomers or plastics or asbestos; tritium will degrade them and cause premature failure. Ultra-high molecular weight polyethylene (UHMWPE) is an exception to this rule; see “Recommended Design Practices” below. Components of Primary Confinement System Piping, pumps, valves and pressure relief devices should meet all pressure requirements and vacuum requirements for the primary confinement, and should comply with applicable ANSI/ASME standards (ASME 89d, ASME 93a, ASME 93b). Welded joints are preferable to compression fittings which are preferable to threaded fittings. Welded joints or mechanical joints are acceptable for piping enclosed in a secondary confinement glove box or cabinet. But outside glove boxes or cabinets, piping should have all welded joints. Pumps should comply with National Electrical Code requirements for explosion proof installation (NFPA 70), and should not use organics, hydrocarbons or other volatiles for surfaces that will contact the tritium process gas. Valves should meet prescribed leak requirements across the valve seat and from the valve bonnet and body. Recommended Design Practices Materials of Construction for Primary Confinement Recommended Materials For the primary confinement system for tritium, the recommended materials of construction are austenitic stainless steels: Type 304-L, Type 316, or Type 316L. 46 DOE-HDBK-6004-99 In addition, the following materials for instruments, gaskets and seals of the primary confinement system can contact tritium without detriment in the pressure and temperature ranges of most tritium systems: Copper, Aluminum, Nickel, Silver, Type 304 stainless steel, Stellite, or Nitronic 60® (Titanium Corporation of America) Vespel®, and Indium. For cryogenic processes, Type 316L austenitic stainless steel is the recommended material of construction. The design should give particular attention to avoid conditions that could cause stress corrosion cracking of austenitic stainless steels. If the performance of a particular material in a hydrogen environment is not well known, the designer should perform bench tests to establish performance in simulated operating and accident conditions. Materials Not Recommended

The design should avoid use of the following materials of construction and materials of operation for tritium primary confinement: Metals that are susceptible to embrittlement and cracking upon exposure to hydrogen,3 Water Hydrocarbons (oils) Mercury, Iron oxide contamination on either the tritium wetted surface or an outside surface as a contaminant, 3 Precipitation hardened steels (e.g., 17-4 PH, 15-5 PH) are especially subject to embrittlement by tritium and helium. Some metals including some type 300 stainless steels containing helium alone can crack at elevated temperatures, including welding temperatures, by bubble agglomeration and creep crack growth. 47 DOE-HDBK-6004-99 Materials capable of forming methane, Elastomers, plastics or asbestos. An exception is the use of ultra-high molecular weight polyethylene (UHMWPE) as a step tip in automatic valves. Valves will remain leak-tight longer with an UHMWPE step tip than with a metal tip (e.g., stellite). Carbon steel is significantly more susceptible to hydrogen embrittlement than Type 300-series stainless steel and is not a recommended material for primary confinement. Additionally, at elevated temperatures, carbon steel is vulnerable to hydrogen combining chemically with carbon, decarbonizing the metal, forming methane and causing cracking and blistering. Piping The recommended piping construction method is welding in accordance with the applicable ANSI/ASME standard (ASME 89d). Design should minimize the use of mechanical joints but, where use is necessary, the recommended mechanical joint is a high vacuum connector. Mechanical joints or welded joints are acceptable for piping enclosed within a secondary confinement glove box or cabinet. Outside a glove box or cabinet, only welded joints are acceptable. Metal-to-metal seals are preferable to elastomer seals. Where conditions necessitate the use of elastomer sealing, design should provide a dual O-ring configuration with ease of replacement. Pumps Process requirements will dictate the selection of pumps. In addition to providing for maximum design pressure, pumps should also have the capability of withstanding vacuum for cleaning purposes. Therefore, the selection of pumps for normal operations should include compliance with the vacuum specification. Pumps should not use organics, hydrocarbons or other volatiles on surfaces that can contact the tritium process gases. Metal-to-metal pumping surfaces are satisfactory, and other technologies may be also. If the safety analysis indicates a pump is safety-class, it should meet the requirements of the applicable ANSI/ASME standard (ASME 89c, ASME 93a). Pump motors should meet National Electrical Code requirements for explosion-proof installation (NFPA 70). Valves Valves are components of the primary confinement, and as such, should be designed and tested to the same standards of confinement/vacuum/leak tightness. When specifying leak rate for valves it is necessary to understand that there are two modes of leakage; 1) across the seat, where the tritium is still contained within primary confinement, and 2) bonnet/body leakage, where the tritium exits the primary confinement. Bonnet/body leakage creates a confinement problem and poses a personnel hazard potential. In addition, recovery from the primary confinement breach requires processes to be shut down to repair the leak. Welded, double metal bellows valve bonnets have proven to meet current leak tightness criteria.

48 DOE-HDBK-6004-99 Metal-to-metal valve seats are preferred. An exception is the use of ultra-high molecular weight polyethylene (UHMWPE) as a step tip in automatic valves that are not subject to high temperature environments. Valves will remain leak tight longer with an UHMWPE step tip than with a metal tip (e.g., stellite). During normal operation, seat leakage does not present a personnel or confinement hazard, but it does have a major impact on process operations, accountability, operability and volumetric segmentation. Consideration should be given to the use of double valve isolation to mitigate the potential for valve seat leakage consequences during maintenance breaching of primary confinement and to increase the confidence level for product purity. Pressure Relief Where the potential exists for the over, or under, pressurization of primary or secondary confinement barriers, pressure relief should be provided. Pressure protection may serve as process equipment protection without providing a safety function. For the primary confinement system, stringent leak tightness specifications necessitate that pressure protection be through the use of rupture disks instead of pressure relief valves, seal pots, etc. For the secondary confinement system, pressure differentials and leak tightness requirements are not as stringent, therefore pressure protection may use seal pots, bubblers, surge volumes, etc. Relief valves should not be used for tritium service. Their performance is inadequate for leak tight resealing after relief and reliable relief at low differential pressures. Heating and Ventilation - Personnel Zones Heating and ventilation systems should promote tritium confinement for zones occupied continuously or intermittently by operations or maintenance personnel. The design should provide heating and ventilation systems with pressure differentials to cause air flow from least contaminated areas to most contaminated in tritium process areas. Ventilation pressure in personnel zones should be greater than pressure in secondary confinement. Primary System Cleaning The design should include provisions to accommodate the cleaning of all tritium systems for initial installation, particularly vacuum cleaning of the primary confinement system. After tritium has contaminated the primary confinement’s interior, limited cleaning is permissible and this limited cleaning must avoid use of waters or organics that could oxidize tritium. Past Design Practice Tritium Confinement Some tritium facilities have used primary confinement, secondary confinement and tertiary confinement. The minimum essential design, however, uses a primary confinement with a secondary confinement as a cost effective and safe design for tritium operations. The following sketch illustrates this minimum essential design. 49 zones DOE-HDBK-6004-99 Secondary confinement system pressure is: - Negative relative to building personnel - Positive or negative relative to primary confinement, depending on pressure or vacuum conditions in primary confinement. H&V Exhaust Building Boundary Secondary Tritium Confinement Purge Recovery (Stripper) Primary Recovery (Stripper) Secondary Recovery (Stripper) Fusion Machine Tritium & Fueling Transfer Systems System Tritium TritiumPurification StorageSystem System Primary Confinement H&V Supply Cleaning Figure II-2. Tritium processing schematic.

The primary confinement system encloses tritium in a sealed, low leak system rated for all operating pressures and vacuum. Primary confinement is essentially a static, high integrity system of process equipment and piping. There is no intent that tritium will leave primary confinement except under controlled transfers. But tritium is difficult to contain, even in the highest integrity systems, and some small leakage is likely to occur. To ensure that tritium loss to the environment or exposure of personnel is minimal, the primary confinement system is within a secondary confinement barrier. The secondary confinement system is dynamic, depending on differential pressures or gas flows to confine and channel tritium within certain volumes or pathways. The secondary (or higher order) confinement system may not be sealed or leak tight. S T A C K 50 DOE-HDBK-6004-99 Metal Hydride Technology Metal hydridemetal hydride beds technology is multipurpose and has replaced several older technologies for tritium storage, pumping and hydrogen isotope separation. Hydride beds require less process space than does conventional equipment. Hydride beds are metal containers filled with other granular alloys or metals that can absorb hydrogen isotopes when the beds are cold and desorb the isotopes when the beds are heated. Electrical, gas or other heating and cooling systems are satisfactory. The following sketch shows nitrogen gas to heat and cool the hydride beds via shell and tube heat exchangers. Several types of hydride metals have been successfully used in past applications: - LANA (lanthanum, nickel, aluminum) for pumping and storage, - Mischmetal (calcium, mixed rare earth metals, and nickel) for compression, - Pd/K (palladium-coated kieselguhr) for purification and separation, and - Uranium for storage. Tritium Storage Process Past practices have stored tritium in conventional tankage and on metal hydride beds. Metal hydride beds provide significant safety advantages because they are low pressure devices and, if maintained below desorption temperature, will not release tritium should the bed wall rupture. Also, hydride beds require less process space with no significant sacrifice of storage capacity and are the preferred storage option for most modern applications. Purification Process The purification process removes hydrogen isotopes from other waste gases and then separates the hydrogen isotopes. A palladium diffuser bed removes hydrogen isotopes from helium and other waste gases. To separate the hydrogen isotopes from each other, past practices have used four processes: 1. Thermal Diffusion Columns, 2. Chromatograph Columns, 3. Cryogenic Distillation Stills, and 4. Thermal Cycling Absorption Process (TCAP). 51 DOE-HDBK-6004-99 The TCAP offers improved operating efficiency and a more compact process package with no sacrifice in separative capacity. It has replaced thermal diffusion and cryogenic distillation in modern applications. TCAP is a metal hydride bed using Pd/K (palladium-coated kieselguhr) that is thermally-cycled to separate tritium from H2 and D2 isotopes. The isotopes removed from the TCAP process may be stored separately on LANA storage beds for later use. Tritium Purification, Stripping and Recovery Processes Purification Process

The fusion machine will transfer some of its burned and unburned fuel gas to the tritium systems for purification and storage. The tritium purification process will recover tritium and deuterium isotopes by processing fuel gas through a Pd diffuser to separate tritium and deuterium from other gases. The tritium and deuterium mixture then proceeds through a separation process such as TCAP which separates tritium from deuterium. Separated tritium and deuterium gases go to separate storage facilities such as LANA metal hydride storage beds. Stripping and Recovery Processes The tritium system will also recover the small amounts of tritium that inevitably leak from the primary or secondary confinement. The recovery of leaked tritium involves use of a “stripper” system and a recovery process. The stripper consists of a oxidizer-reactor , a pumping system, and zeolite beds (Z-beds). The oxidizer-reactor incinerates elemental hydrogen isotopes to form oxides of these isotopes (water vapors: H2O, D2O, etc.). The recovery system will regenerate the zeolite beds and store the hydrogen isotopes prior to transfer to the purification process. A typical system consists of magnesium or uranium beds, a pumping system, and tanks. The magnesium or uranium beds break the hydrogen isotope oxides into O2 and H2, D2 and T2. The nitrogen (or inert gas) atmosphere of secondary confinement flows through the oxidizer-reactor and any hydrogen isotopes convert to oxides (water vapors). The gases then flow through the zeolite beds which absorb the water vapors. As a zeolite bed approaches water saturation, it goes off-line and another (regenerated) zeolite bed comes on-line. The zeolite bed saturated with water vapors undergoes regeneration which involves heating to drive off the water vapors. The water vapors pump to the uranium bed which breaks the water into elemental gases. Hydrogen elemental isotopes go to a separation process which recovers tritium for storage. Past practices used a system of three strippers (primary, secondary, and purge systems) and one recovery process to augment confinement and recovery of tritium. The secondary confinement’s nitrogen or inert gas atmosphere cycles to and from the primary stripper systems which remove any tritium that might leak from primary confinement. The secondary stripper is available should secondary confinement accumulate a significant tritium concentration from leaks or maintenance work. 52 DOE-HDBK-6004-99 The purge stripper maintains secondary confinement at subatmospheric pressure by exhausting a small portion of secondary atmosphere to the environment. Secondary confinement is an enclosed, but not sealed, system. Ventilation differential pressures will cause some building air to flow into the secondary atmospheric, causing a gradual pressure build up. To maintain secondary confinement at slightly below atmospheric pressure, some of the secondary atmosphere must discharge to atmosphere through the primary and purge strippers. The purge stripper system can safely handle all planned exhausts to the environment from tritium secondary confinement. The system includes redundant components to assure continuous stripping capability. Tritium Control, Accountability and Physical Protection The purpose of requirements placed on tritium control, accountability, and physical protection at DOE fusion facilities are: 1. Meet legal requirements for environmental releases, waste disposal, and transportation of tritium,

2. Meet the requirements of the 10 CFR 830, 3. Prevent the diversion of the material for unauthorized use, 4. Knowledge of the process efficiency, i.e. how much tritium is produced and used in processes under investigation, 5. Meet the requirements of the DOE Orders, 6. Increase operational safety of the facilities by providing knowledge of the location and form of tritium, 7. Prevent unwanted buildup of tritium within a facility. Scope This section will primarily cover methods for the control and accountability of tritium. Tritium is the predominate nuclear material used at fusion facilities. It is of interest because of safety concerns and possible unauthorized diversion for military applications. Tritium will be an issue for operation of fusion facilities since it will be a radioactive material released to the environment for operating facilities during normal operations. Although public exposures and environmental releases are expected to be small and well below regulatory limits, it is a radioactive material and the public will need to be assured that safety has not been compromised. Other radioactive materials that must be controlled at fusion facilities include depleted uranium (U238) for storage of tritium and various radioactive sources used for checks and calibration of radiation monitoring devices. The control and accountability of these materials is relatively straight forward and does not present significant problems for operating facilities. Deuterium, in quantities greater than 100 grams, is also controlled at DOE facilities. The requirements are primarily records management. There are not requirements to perform measurement. The accountability requirements are also straight forward and do not present concerns. 53 DOE-HDBK-6004-99 It is important to distinguish between a DOE nuclear facility and a DOE general radiological facility. The requirements on DOE nuclear facilities are substantially greater because of the possible greater risk to the public, the environment and the worker for accidents. The current categorization of nuclear facility is by inventory of radioactive materials. For this document, tritium is of concern. The current categorization is based on DOE-STD-1027-92: Less than 1,000 Curies General Radiological Facility 1,000 to 30,000 Curies Category IV Nuclear Facility Low Hazard 30,000 Curies and up Category II Nuclear Facility Moderate Hazard Category I is a High Hazard facility and are currently only category A reactors and other facilities as designated by the DOE Program Secretary Office. There are no tritium facilities in the US that are designated as Category I. It has not been determined if a demonstration fusion power plant would be a Category I facility. The Nuclear Safety Rules and Nuclear Safety Orders discussed in section 3 apply to all nuclear facilities. The requirements for control and accountability in other countries is not discussed in this section. Requirements The requirements placed on the control and accountability of tritium fall into three categories. Those required by the US Law, those required by DOE Orders and those required by “good practices.” It is also important to note that requirements are not consistent throughout the international community. There is considerable variation across the international community. Shipping requirements are defined for international shipments. Legal Requirements The legal requirements on tritium measurement are of the following types:

Environment facility emissions which included air emissions and releases to the ground water or at facilities outfalls. These include federal and state requirements. Some of the requirements for fusion facility that handles tritium are defined in the following laws: 1. Clean Water Act for water quality standards and effluent limitations, 2. National Environmental Policy Act for impacts of proposed activities, 3. Federal Clean Air Act which sets ambient air quality standards, 4. Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). 54 DOE-HDBK-6004-99 EPA regulates the type and quantity of facility emission. EPA specifies and must approve the measurement techniques. EPA sets the limits for exposure to the public and the notification required when certain quantities of radioactive materials are emitted. State laws usually regulate the facility outfalls. State requirements are not uniform across the country. Department of Transportation (DOT) transportation requirements specify packaging requirements that are dependent on the form and quantity of tritium. DOT must also approve all packaging containers when the radioactive material is transported on public highways. Waste storage requirements when mixed hazardous waste may be involved. The EPA administers the Resource Conservation and Recovery Act (RCRA). In many cases this authority has been delegated to the state. Waste disposal requirements. These are generally state-specific. The details of the state requirements will not be discussed in this section since they vary widely. Nuclear Safety Rules 10CFR834 (Radiation Protection of the Public and the Environment) (proposed), and 10CFR835 (Occupational Radiation Protection): Current DOE orders that are nuclear safety related are being reissued as “rules” that are law. Rule requirements were placed on DOE funded nuclear facilities by the US Congress in the amendments to the Price Anderson Act. The requirements and implications of the DOE Rules as defined in the 10CFR laws listed above are still to be determined for tritium control and accountability. Currently, the DOE orders dealing with nuclear materials control and physical protection will not be released as Rules. Rules specify requirements that will result in fines and criminal prosecution (as defined in 10CFR820) if they are not followed. The only rules that have been released are the Occupation Radiation Protection Rule and Quality Assurance Rule. These will have implication on the procedures and techniques that are used to determine personnel exposure to tritium and environmental releases of tritium. Since these requirements are part of the US law, they must be followed by all facilities that handle tritium or radioactive materials as applicable. DOE Orders DOE Orders are requirements placed on DOE facilities that define operations and the methods of conducting business. DOE 5633.3B, “Control and Accountability of Nuclear Materials” specified the minimum requirements and procedures based on the amount of tritium and the form of the tritium in a facility. Important requirements from this order are: 1. Tritium is treated as a Special Nuclear Material and the reportable transaction quantity is one hundredth of a gram (approximately 100 Curies). 55 DOE-HDBK-6004-99 2. Each facility requires a Materials control and accountability (MC&A) plan the specifies the following type of information: a) Material location,

b) Measure techniques, calibration methods and frequencies, DOE interlaboratory measurement program, and accuracy requirements, c) Personnel responsibilities, d) Category type, Category III Greater than 50 grams or IV, and e) Holdup analysis. f) Inventory requirements for category III materials are semi annual with a complete measured inventory at least annual. g) Inventory requirements on the shipper and receivers of controlled material and methods to control and resolve inventory differences. Access controls, depended on the tritium form and “attractiveness” must be established. Each facility DOE laboratory must establish an independent organization to provide oversight of the nuclear materials control and accountability. The physical protection requirements are specified in DOE order 5632.1C, “Protection and Control of Safeguards and Security Interests.” The current DOE requirements are dependent on the quantity and form. These include: 1. Control of tritium by personnel with a US DOE “Q” clearance. 2. Controlled locks, alarms and access during non working hours. 3. Other Orders specify waste requirements, environmental monitoring, and personnel protection. These physical protection requirements will not be discussed in this section. The DOE order requirements are in general not legal requirements. The facility can negotiate with DOE to determine the most cost effective manner of implementing the requirements and still maintain facility safety and material accountability. Good Practices - Nuclear Material Locations at a Fusion Facility Figure II-1, at the beginning of this section, is a block diagram of the primary locations, inputs and outputs, and measurement points for tritium at a nuclear facility. 56 DOE-HDBK-6004-99 Inputs to the tritium inventory at a nuclear facility are: 1. Shipments into the facility, 2. Production of tritium at the facility, 3. Locations of tritium within a facility, 4. “In Process,” 5. In system holdup, 6. In waste systems, and 7. In storage. The exit streams of tritium from a facility include: 1. Shipments of tritium from the facility. 2. Waste streams that include: a. Facility routine tritium stack emissions, b. Waste water releases, and c. Solid waste including trash and “high concentration” tritium. 3. Accidental tritium releases. Measurement locations: 1. Input tritium shipments to the facility, 2. Exit shipments from the facility, 3. In process measurements, 4. In storage measurements, 5. Waste stream measurements, 6. Personnel exposure measurements, 7. Work place measurements, and 8. Stack emission measurements. 57 DOE-HDBK-6004-99 Tritium Measurement Methods There are two primary categories of tritium measurements that are made at fusion facilitates. The first category of measurements determine the quantity and the location of tritium within the facility. These measurements are generally of large quantities of tritium in high concentrations. The second category is for environmental or safety determinations. These are generally lower concentrations and small quantities. This section will discuss methods for both categories. The measurements techniques for tritium can be grouped in the three general areas: 1. Composition measurements, 2. Thermal measurements, and 3. Tritium concentration measurement. Composition measurements determine the actual concentration determination for each atomic / molecular species. This method can be used for gases only.

Thermal methods (calorimetry) rely on the radioactive heat of decay of tritium. For one gram of tritium approximately 0.333 watts is generated by decay. The temperature increase or heat generation is measured. Calorimetry can be used for tritium in any form; either solid, liquid or gas. The only radioactive material present must be tritium since other radioactive materials will contribute to the thermal properties of the sample. The final method determined the total tritium concentration by the measurement of the products or the effects of the products of the radioactive decay. The beta particle can cause scintillation effects or ionization effects. These effects can be measured and the concentration of tritium determined. The following is a listing of methods that are used or proposed to be used for measurement of tritium: 1. Pressure/Volume/Temperature/Composition, using either Mass Spectrometer or laser Raman spectrometer for the composition measurement, 2. Beta scintillation counter, 3. Self assaying tritium storage beds, 4. Scintillation counting, and 5. Ion Chamber. Most of the techniques discussed here are batch samples, however as noted some techniques can be used for “on-line / real time” measurements. 58 DOE-HDBK-6004-99 Composition Measurements This method is used for measurement of gaseous samples only. A representative sample of the gas is taken. The gas that is to measured must be mixed well. The volume, pressure, and temperature must be measured accurately. The temperature is difficult to measure accurately because of temperature gradients caused by the heat of decay of tritium. The composition of the gas in the sample is then measured using a mass spectrometer or a laser Raman spectrometer. The mass spectrometer will measure all gas species. A high resolution mass spectrometer is required to distinguish between different molecules with the same mass number. For example HT and D2 have the same mass number, but must be separated to determine the tritium concentration. All species that can contain tritium must be measured. This includes, water as HTO, methane as C(H,D,T)4, ammonia as N(H,D,T)3, etc. If the approximate gas composition is known, the sum of all the species containing tritium can be determined. If the approximate gas composition is unknown, the use of the mass spectrometer may be difficult. The laser Raman spectrometer is a relatively new system that can be used to measure molecular concentrations in a gas mixture. The sample is placed in a cell with optical windows. The laser excites the rotational or vibrational atomic levels in the gas molecules. The light emitted as the excited levels decay back to the ground state are detected using a photodetector system. The measurement is absolute in that the frequency spectrum of each molecule is unique. The intensity is proportional to the amount of gas present. The disadvantages of the Raman method is that the amount of inert gases can not be determined. Common inert gases at fusion facility are the isotopes of helium. Both of these techniques can be used for real time measurements. For the mass spectrometer system a sample is bled to a high vacuum system for measurement. The Raman system is easily adopted to real time measurements. The gas stream at atmospheric pressure is passed through an optical cell. The spectrum for a mixture hydrogen isotopes can be determined in approximately one minute. The total accuracy of these measurements is approximately 3 to 5 %.

The mass spectrometer technique has been the standard method that DOE facilities have used for the determination of the tritium inventory. It is a proven system although it requires a expensive spectrometer ($200k) and accurate determination of the temperature, pressure and volume. The Raman system has not been accepted. Experiments are currently being performed to demonstrate that this will be an acceptable technique. Thermal Methods of Inventory Measurement The primary method to inventory large quantities of tritium in the liquid or solid form is to use a calorimeter. The sample is placed in a thermally isolated contained. The power required to maintain the temperature of the container is then a measure of the amount of tritium in the sample. Containers that can accept samples that vary from several inches in diameter up to a 55 gallon drum. The lower limit of accuracy can be as low as 100 Curies. Calorimeters are expensive (>$200k). There require high tech electronics. They are the primary methods used to measure tritium in waste such as HTO on molecular sieve. They have not been used to measure process tritium except in very 59 DOE-HDBK-6004-99 specific application. For example solid tritium storage beds that can be disconnected and moved have been placed in a calorimeter designed to accept the bed. New methods are being developed to allow for the determination of the amount of tritium stored on a solid storage bed. When tritium is stored on uranium bed the temperature increase of the bed can be used to determine the amount of tritium stored on the bed. When tritium is stored on a material such as LaAlNi, usually gas is passed through the secondary containment to maintain the temperature. The temperature rise of the gas as it passes through the bed can then be used to determine the amount of tritium. Both of these methods are being proposed for tritium accountability. Their acceptance is now based on a case by case system and they are not used widely. Development of these methods will be important for the operation of fusion facilities. They offer potential savings in time and effort to account for the tritium in a facility. Tritium Concentration Measurement. A beta scintillation counter has been used for tritium measurement if only the total tritium composition is required. In this instrument, the gas is passed over a crystal that will scintillate with the beta from the tritium decay. A photomultipier tube is used to detect the light. The tritium concentration can then be determined from the signal from the photomultipier tube. This method is commonly used for gas inventory requirements. Liquid scintillation is commonly used to determine small concentrations of tritium. The tritium liquid or compounds containing tritium are placed in a scintillation liquid. The liquid is then placed in a counter which determines the amount of tritium by the light emitted from the sample. Ion chambers are commonly used to determine environmental tritium releases and to monitor the atmosphere for personnel safety. Process ion chambers are used for determining tritium concentrations in secondary containment. Specially designed ion chambers can be used to determine high concentrations of tritium. Ion chambers will measure any radioactive material which can cause ion pairs. They are also susceptible to contamination from materials which adsorb on surfaces and can only be used for gas. Facility Measurement Recommendations.

Measurement of tritium input / output to facility The primary method used historically for the measurements of tritium shipments has been pressure / volume / temperature/ composition (PVTC) measurement with the composition determined by either a mass spectrometer or beta scintillation counter. Calorimeter can be used for the measurement of tritium absorbed on solid storage beds that are designed to be used as primary shipping containers and also be placed in the calorimeter. 60 DOE-HDBK-6004-99 In Process tritium measurements The measurement of tritium within a facility has usually been by PVTC. This requires a shutdown of the process and transferring all the gas to a volume for sampling and measurement. This is usually a substantial disruption of the process and will take a significant time. Tritium that is “held up” in process cannot be directly measured. This includes tritium in walls of the system, tritium in process components such as molecular sieve, and tritium contained within the waste disposal system. It must be estimated by difference measurements. Real time measurements of tritium amounts are done when tritium is moved around the facility or process. These are usually done by PVTC measurements. The laser Raman system offers advantages for the measurement of composition as tritium flows from location to location. The use of self assaying storage beds will greatly reduce the time required to determine the tritium in storage. Tritium in Waste Streams The characterization of tritium contained in waste streams is important and one of the more difficult measurements to make. Ionization chamber measurements, calorimetry, and difference measurements are used to determine the tritium levels. Stack emission measurements. Stack emissions are determined by ion chambers. The primary method used by facilities for the reporting to the EPA is based on a passive monitoring system. A small fraction of the air stream exhausted from a facility is passed through a system to remove the tritium. Both liquids, such as glycol, and solids, such as molecular sieves, are used to absorb HTO. These systems can distinguish between HTO and HT by passing the sample through a catalyst that will convert HT to HTO. The second collection system then collects the HT as HTO. COOLING SYSTEMS The cooling systems include all systems, structures and components that remove heat from the facility and transfer it to a heat sink such that: 1. Thermal, hydraulic and mechanical parameters are within design limits for the cooling system, fusion device, confinement barriers and other safety-class equipment. 2. A leaktight barrier is maintained against uncontrolled release of fusion ash and radioactivity to the environment. The cooling system includes coolant makeup systems and collection and disposal systems for spilled or drained coolant. Fusion devices requiring cooling systems usually radiate heat to the first wall of the plasma chamber. The first wall re-radiates the heat to the shield wall. Cooling pipes in the shield wall remove the majority of the heat. The divertor is a secondary but significant source of heat. Components such as the cryostat, vacuum pumps, magnetic coils may also require component cooling. 61 DOE-HDBK-6004-99 General Safety Design Criterion The cooling systems should remove heat from safety-class structures, systems and components and transfer it to a heat sink such that:

1. Thermal, hydraulic and mechanical parameters are within design limits for the cooling system, fusion device, confinement barriers and other safety-class equipment. 2. The cooling system provides and maintains a leaktight barrier against uncontrolled release of fusion ash and radioactivity to the environment. The cooling systems should comply with these criteria for normal operations, anticipated off-normal events, and design basis accidents, assuming a worst-case single failure. Potential System Safety Functions Cooling system functions credited in the facility safety analysis in order to meet prescribed safety criteria should be designated safety functions. Potential safety functions for cooling systems include: Normal Operation, Shutdowns and Anticipated Off-normal Events 1. Remove heat from safety-class structures, systems and components to maintain temperatures within design limits. For shutdown conditions, to the extent practical, heat removal should be passive and require no human intervention. 2. Transfer the combined heat load to a safety-class heat sink. For shutdown conditions, to the extent practical, transfer of heat to a heat sink should be passive and require no human intervention. 3. Confine radioactivity entrained or deposited in the coolant system, and provide for suitable releases to environment or transfer to a waste facility. 4. Detect, measure and isolate leaks or breaks in the coolant system pressure boundary. 5. Provide makeup coolant for small breaks or leaks in the cooling system pressure boundary. Maintenance Maintenance of the cooling system maintenance will normally occur during shutdown of the fusion device. Portions of the cooling system may, however, receive maintenance during normal operations. Whether maintenance occurs in normal operation or in a shutdown condition, the cooling system will have the following safety functions. 1. Remove heat from safety-class structures, systems and components to maintain temperatures within design limits. For shutdown conditions, to the extent practical, heat removal should be passive and require no human intervention. 62 DOE-HDBK-6004-99 2. Transfer the combined heat load to a safety-class heat sink. For shutdown conditions, to the extent practical, transfer of heat to a heat sink should be passive and require no human intervention. 3. Partially confine radioactivity entrained or deposited in the coolant system, and provide for suitable releases to environment or transfer to a waste facility. 4. Collect coolant drained from the coolant system in preparation for maintenance. 5. Provide makeup coolant for small breaks, leaks or draining required for maintenance activities in the cooling system pressure boundary. Design Basis Accidents The safety analysis should specify design basis accidents. Cooling systems design should implement the applicable safety functions credited in the safety analysis for design basis accidents. A typical frequency for design basis accidents is greater than 10-6/year. The safety analysis should specify the actual frequency. The following are potential design basis accidents for the cooling systems of fusion devices: Internal Initiators 1. Cooling leak within vacuum vessel 2. In-Cryostat tube leak 3. Out-of-Cryostat leak 4. Loss of coolant pumping 5. Low of coolant flow 6. Loss of heat sink 7. Missile or pipe whip 8. Increase in fusion power 9. Human Error External Initiators

1. Natural phenomena, including earthquake, tornado, hurricane, seiche, tsunami, etc. 2. Fires 3. Aircraft or other missile impact (excluding sabotage). 63 DOE-HDBK-6004-99 Potential Safety Functions The cooling system potential safety functions for design basis accidents are: 1. Remove heat from safety-class structures, systems and components. 2. Transfer the combined heat load to a safety-class heat sink. 3. Partially confine radioactivity entrained or deposited in the coolant system, and provide for suitable releases to environment or transfer to a waste facility. 4. For a large break in the cooling system pressure boundary: a) Provide makeup coolant at a sufficient rate that the system’s heat removal and rejection capacity will prevent damage of safety-class structures, systems or components while allowing only negligible materials reactions with the coolant. b) Collect coolant spilled from a large break to prevent damage to safety-class structures, systems or components. Beyond Design Basis Accidents Beyond design basis accidents include internal and external initiators whose frequencies are lower than the design basis frequency limit specified in the safety analysis. There are no cooling system safety functions for beyond design basis accidents. Safety Design Standards and Criteria Structures, systems and components needed to perform safety functions should be designated safety class. Components which do not perform safety functions but whose single failure causes loss of a safety function should also be designated safety class. Included in the safety-class are: 1. Gauges, instrument tubing, sensing lines, stubs and other pressure containing hardware on the pressure boundary of the safety-class coolant system, 2. Membrane interfaces and isolation devices between safety-class and non-safety-class coolant systems. The different designs and operating characteristics of fusion facilities limit the amount of specific guidance that these criteria can provide. Existing DOE and NRC design requirements and guidance documents provide helpful general guidance for implementing these criteria at a particular fusion facility. For safety-class cooling systems, the following design standards and criteria should apply to the structures, systems and components. 64 DOE-HDBK-6004-99 Structural General The cooling system boundary includes: 1. Heat removal, transfer and sink systems wetted on the interior by the coolant. The boundary includes piping, fittings, vessels, valves, pumps, heat exchangers, storage tanks and instruments. 2. Coolant makeup systems 3. Spilled or drained coolant collection systems. The cooling system design should reflect consideration of service temperatures and other conditions of the boundary materials, the uncertainties in determining material properties, effects of irradiation on those properties, residual, steady state and transient stresses, and size of flaws. Loads 1. Individual Loads Cooling systemscooling system loads should withstand the static load, normal operating pressure and temperature, anticipated operating transients, electromagnetic loads (normal operating and fault), interaction loads from adjacent systems, natural phenomena hazard loads and loads due to missile impacts. a) Static Loads - The static load should include the weight of the equipment and coolant identified as constituting the system (or component) and any supported hardware.

b) Normal Operating Pressure Load - The normal operating pressure load should range from the minimum to the maximum capability of the cooling system, including the capabilities of all pressure or vacuum sources. Additionally, the pressure load range should include temperature induced pressures, hydrostatic test pressures and any credible pressure augmentation resulting from small leaks between two coupled cooling systems. c) Normal Operating Thermal Load - The normal operating thermal load should include temperatures associated with normal processing operations, both cryogenic and elevated, and elevated bake out conditions required for cleansing prior to equipment removal. d) Anticipated Operating Transients - The anticipated operating transient load should include the pressure, flow and temperature fluctuations resulting from anticipated off-normal events in addition to normal system start up, operations, and shut down. e) Normal Electromagnetic Loads - Electromagnetic loads should include the forces induced as a result of plasma operation, fusion operation, eddy currents and control changes. Such forces will result in the cooling systems interacting with magnetic fields of the fusion machine's normal operation. 65 DOE-HDBK-6004-99 f) Electromagnetic Loads During Faults - Electromagnetic loads induced during abnormal operating events such as control failures, power supply failures, bus opens or shorts, or magnet faults. g) Natural Phenomena Loads - Natural phenomena hazard loads should include loads resulting from earthquakes, winds, and floods. UCRL-15910 provides guideline methods for establishing load levels and for evaluating the response of structures, systems and components. h) Missile Impact Loads - Missile impact loads should include missiles and pipe whip resulting from failure of high energy systems, if the safety analysis includes such failures as a design basis accident. 2. Combined Loads The system structural design evaluations will be based on predicted responses for concurrent event load combinations that are compared against the corresponding allowable stresses. In applications involving the ASME Code for example, the evaluation of load combinations would be performed as shown in Table II-1. 3. Cyclic Loads Cooling systems are subject to thermal and pressure cyclic loadings during normal and anticipated off-normal operation and maintenance. Also, systems and components are subject to vibration loading from motors, cavitation, water/steam hammer, etc. The ASME/ANSI design codes or comparable computational methods provide criteria for the evaluation which should use conservative analysis for the number of cycles and service life including the expected changes in materials properties with time. 66 DOE-HDBK-6004-99 Table II-1. Design Codes For Equipment 1 CODES EQUIPMENT Design and Fabrication Materials Welder Qualification and Procedures Inspection and Testing Pressure Vessels Atmospheric Tanks 0-15 PSIG Tanks Heat Exchangers Piping and Valves Pumps ASME Code Section VIII API 650, or AWWA D-1002 API 620 2 ASME Code Section VIII, and TEMA ANSI/ASME B31.3 Manufacturers' Standards3 ASME Code Section II ASME Code Section IX ASME Code 2 Section II ASME Code Section IX ASME Code 2 Section II ASME Code Section IX ASME Code Section II ASME Code Section IX ASTM and ASME Code Section II ASME Code Section IX ASME Code Section II or Manufacturers' Standards ASME Code Section IX (as

required) ASME Code Section VIII API 650, or AWWA D-100 2 API 620 2 ASME Code Section VIII ANSI/ASME B31.3 Hydraulic Institute 1The preferred design code for safety-class pressure retaining components is ASME Code. 2Fiberglass-reinforced plastic tanks may be used in accordance with appropriate articles of Section X of the ASME Boiler and Pressure Vessel Code for applications at ambient temperature. 3Manufacturers' standard for the intended service. Hydrotesting should be 1.5 times the design pressure. 67 DOE-HDBK-6004-99 Structural Acceptance Criteria Cooling systems that are safety-class should have design, fabrication, inspection and testing in accordance with a recognized safety-class code such as the ASME Boiler and Pressure Vessel Code (ASME 93a). The specific codes and criteria selected should be commensurate with the level of safety required and should have a technical justification. Where ASME design is not feasible, such as in the case of unique materials or designs, the alternate codes may be used. Piping and equipment supports should be designed to AISC N690 and ASME 95. Cooling system components that are not safety-class should have design, fabrication, inspection and testing in accordance with a recognized national consensus code such as the ANSI/ASME Standard B31.3 “Chemical Plant and Petroleum Refinery Piping.” Deflection Analysis An analysis of cooling system deflections over the full range of temperatures, vacuums and pressures should confirm no interferences or loss of pressure boundary integrity. Testing and Inspection The design of structures, systems and components of the safety-class cooling system should permit initial and periodic testing and inspection of important areas and components to assure integrity and capability to perform the safety function. The design should also permit a materials surveillance program. Non-destructive testing and inspection of safety-class welds, vessels, piping and valves should be in accordance with the ASME Boiler and Pressure Vessel Code (ASME 93a). Where ASME design is not feasible, such as in the case of unique materials or designs, alternate codes such as those listed in Table II-1 may be used with justification. Weld acceptance criteria should be in accordance with the requirements of codes listed in Table II-1. Computational Methods Validation Computer codes or other computational methods supporting the design of cooling systems should have validation and verification for the range of normal and off-normal operations including design basis accidents. This validation and verification should support the use of the computational method in each intended application. IEEE standard 730-1984, “IEEE Standard for Software Quality Assurance Plans” describes the validation and verification process. Materials The cooling system boundary materials and design should provide sufficient margin to assure that, when stressed, the boundary behaves in a non-brittle manner with a very low probability of rapidly propagating fracture. 68 DOE-HDBK-6004-99 Coolant should be compatible with structural materials which it may contact during normal operation, off-normal events and design basis accidents throughout the range of anticipated physical parameters. Table II-2 lists the materials requirements. Alternative codes and standards may be used with appropriate justification. Table II-2 Applicable DOE Orders and Design Standards DOE 6430.1A General Design Criteria

IEEE-308 Power Systems Criteria IEEE-323 Equipment Qualification IEEE-338 Periodic Testing IEEE-344 Seismic Qualification IEEE-379 Single Failure Criterion IEEE-383 Electrical Cable Qualification IEEE-384 Electrical Separation Criteria IEEE-603 Criteria for Power and I&C Instruments and Controls The cooling system design should provide for instrumentation to monitor safety related variables and controls to maintain the variables within design limits. The cooling system design should provide for instruments that detect and measure abnormal leakage and controls to isolate or mitigate the leak. To the extent practical, the primary mode of actuation of safety functions should be automatic and should be initiated by detection and control channels of suitable diversity and redundancy. Provisions should be made for manual monitoring and actuation of safety functions. Instrumentation and controls should be able to perform their intended safety function assuming a single failure. The power supply for safety grade instrumentation and controls should meet the IEEE Standard requirements for Class 1E power systems. 69 DOE-HDBK-6004-99 Passive Systems For shutdown conditions, the cooling system design should incorporate passive features to the extent practical for heat removal, transfer and rejection functions. The design objective should be to provide adequate cooling of all safety-class structures, systems and components without human intervention for as long a period as practical following shutdown of the fusion device. Design Considerations Cooling system structures, systems and components should be designed, fabricated, constructed and tested to the highest quality standards practical. Cooling system design should provide defense in depth through multiple confinement barriers and redundant or diverse critical components or systems. Unavailability of the onsite electrical power supply or the offsite power supply should be a consideration in assuring cooling system functions, assuming a single failure within the cooling system. Coincident failure of offsite and onsite power systems should not be a design consideration. Cooling system design should consider the thermal, hydraulic and mechanical effects of unintended operation of active components such as valves and pump motors. Cooling system design should consider the thermal, hydraulic and contamination effects of cross leaks between adjacent systems, such as the primary and secondary sides of heat exchanger. Materials properties for cooling systems should include the effects of radiation embrittlement at all levels of service temperatures. Coolant system pumping should provide for coolant flow coastdown to prevent exceeding design limits for safety-class structures, systems and components. Discharge of coolant for pressure relief should be to a confinement tank that maintains the confinement function of the coolant system. The coolant system should include protection for overpressure to prevent degradation of safety function. The coolant system should include provisions for sampling for analysis of coolant properties and to identify entrained radioactivity or other contaminants. The coolant system design should minimize the number of interfaces between safety-class systems and non-safety-class systems. Coolant system design should include provisions for maintenance and radiation protection. Cooling system design should include features to facilitate decontamination and decommissioning at the end of service life.

70 DOE-HDBK-6004-99 Recommended Design Practices Use of a primary cooling system and a secondary cooling system is the recommended design to comply with the general design criterion for containment of radioactivity assuming a single failure. Closed heat exchangers are the recommended coupling between primary and secondary cooling systems. Use of multiple cooling loops in the primary and secondary systems is recommended as a design feature to reduce the operational thermal-hydraulic transient associated with single (loop) failure. Components and headers of systems should be designed to provide individual isolation capabilities to ensure system function, control of system leakage, and allow system maintenance. The use of leak before break (LBB) is recommended in the analysis of pipe break accidents. The methodology described in section 3.6 of the Standard Review Plan, NUREG-0800 is recommended. Generic System Descriptions Fusion devices requiring cooling systems will usually radiate heat to the first wall of the plasma chamber. The first wall will re-radiate heat to the shield wall. Cooling pipes in the shield wall will remove the majority of the heat. The divertor provides a secondary but significant source of heat which must be removed. Components such as the cryostat, vacuum pumps, magnetic coils will also require some component cooling. For further information on the latest new design, the International Thermonuclear Experimental Reactor (ITERITER) has issued “ITER Outline Design Report,” “ITER Outline Design Summary,” and “Safety and Environment” (ITER). These documents provide generic descriptions of the cooling systems. Past Design Practices Past design practice has been to provide defense in depth, redundancy of critical components or systems and diversity. Some of these past practices may be applied to fusion machines. However, the essential need for rigorous quality levels, impeccable safety standards and stringent regulations will not be as applicable with the fusion machine. The needs of the fusion machine will be investigated further before past design practices will be recommended for the fusion machine. However, one may refer to International Thermonuclear Experimental Reactor (ITER) documentation “ITER Outline Design Report,” “ITER Outline Design Summary,” and “Safety and Environment” (ITER) for current information on current tokamak design practice. ELECTRICAL POWER SYSTEMS The electrical power system includes off-site sources and on-site AC/DC sources. The switchyard is the interface between the grid and the facility receiving power from the off-site grid. Power is transformed from the grid voltage (usually 345 or 500 kV) to the voltages which will be used in the facility. Fusion device power supplies may be very large (500 MW) and of relatively 71 DOE-HDBK-6004-99 high voltage (35-115 kV). The voltage supplied to the facility loads can be lower (13.8 kV) since the load will be significantly less. The switchyard will also contain the various high voltage breakers and disconnect switches. Downstream from the switchyard, the electrical power distribution system is divided into two main parts, namely the fusion facility distribution system and the plant distribution system. The fusion facility distribution system is primarily a high voltage system (35-115 kV) designed to supply the heavy (and often pulsed) loads for fusion facility operation. Included in this distribution system are the magnet power supplies and various plasma fueling and heating power supplies. Also included in this system will be the static volt-ampere-reactive (VAR) compensation and any energy storage equipment required.

The facility distribution system generally consists of four types (IV, III, II and I) of power to supply those loads which are required to operate independently of the Fusion Facility Distribution System. The four types of power supply are defined as follows: Type IV (Non-Safety Class): Interruptible AC supply for those loads which can be interrupted indefinitely without resulting in plant damage or safety hazards to either on-site personnel or the public. Type IV power is supplied by the grid. This type of power supplies the normal facility operating loads. Type III (Safety Class): Interruptible alternating current (AC) supply for those loads which can be interrupted briefly (5 minutes) without resulting in plant damage or safety hazards, but where longer interruptions may cause such problems. Type III is supplied from Type IV (grid) power when available, or by emergency (standby) generators. This type of power supplies loads which are needed to achieve and maintain the fusion facility in a safe condition. In the event of loss of grid power, the emergency generator power will fulfill the requirements. Type II (Safety Class): Uninterruptible AC supply for those loads requiring a very secure continuous power supply. This class of power is obtained by the use of inverters (or motor generators) driven by Type I power. Type I (Safety Class): Uninterruptible direct current (DC) supply for those loads requiring the most continuity of supply. This type of power is supplied by batteries, which are continuously recharged by Type III power through battery chargers fed from Type III MCCs. This class of power supplies safety and protective (DC) loads which must be available at all times. General Safety Design Guidance Electrical system functions should be designated safety functions if they are credited in the facility safety analysis in order to meet prescribed safety criteria. Systems or components needed to perform safety functions should be designated safety-class systems or components. Components which do not perform safety functions but whose failure causes the failure of a safety function should be designated safety-class components. 72 DOE-HDBK-6004-99 Fusion Facilities which require safety-class electrical systems should be supplied by two independent off-site sources and one on-site source of electric power to ensure the supply of electric power to each train of safety-class equipment The electrical power system equipment that provides the power supply to safety-class systems and components to perform fusion facility safety functions are classified as safety-class. Other electrical systems should be non-safety-class (NSC). The safety-class electrical power system should be fed from the safety bus. The safety-class electrical equipment defined by the facility safety analysis should be designed in accordance with the accepted design Standards given in this section. Where alternative methods are used, justification should be provided in the facility authorization basis. Equipment that is used for both safety and non-safety functions should be classified as part of the safety systems. Isolation devices used to effect a safety system boundary should be classified as part of the safety system. No credible failure on the non-safety side of an isolation device should prevent any portion of a safety system from meeting its minimum performance requirements during and following any design basis accident requiring that safety function. A failure in an isolation device should be evaluated in the same manner as a failure of other equipment in a safety system.

Potential System Safety Functions The potential safety functions for the back-up electrical systems are: 1. Normal Operation and Maintenance - Normal and backup power should be on-line or available to supply safety functions. Specific potential safety functions are: a) Provide for ability to survive or recover from off-normal events. b) Monitor normal/back-up power c) Monitor status of active components which must function during Design Basis Accidents (DBA). d) Monitor equipment required to isolate in the event of on-site or off-site system faults. 2. Design Basis Accidents - The safety analysis should specify design basis accidents and related safety functions. The electrical power systems design provide power needed to enable the safety functions. The following are potential design basis accidents for back-up electrical power systems: a) Internal Initiators: 1) Missile or pipe whip resulting from sudden failure of high energy systems. This accident has potential for causing release of radioactive material and simultaneously disrupting multiple electrical equipment. 73 DOE-HDBK-6004-99 2) Fire. 3) Human errors. b) External Initiators: 1) Natural phenomena including earthquakes, hurricanes, tornadoes, floods, etc. 2) Aircraft and other missile impact. 3. Beyond Design Basis Accidents: There are no system safety functions required for beyond design basis accidents. Beyond design basis accidents include internal and external initiators whose frequency is lower than the design basis frequency limit specified in the safety analysis. Safety-Class Design Criteria and Standards General Design Safety Features Electric power from the transmission grid to the on-site electrical distribution system should be supplied by two physically independent circuits designed and located so as to minimize, to the extent practical, the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. If safe shutdown equipment is identified as a safety function, two completely independent sets of shutdown equipment should be provided. Each of the two sets of equipment should be capable of safely shutting down the fusion facility independently of the other set of equipment. Each set of equipment is referred to as a train of safety-class equipment, and is identified as Train “A” and Train “B.” Both trains “A” and “B” are completely redundant and independent of each other. The on-site source of electrical power for each train is usually provided by safety-class diesel generator set, one for Train “A” and one for Train “B,” completely independent of each other with no inter-connections between the two. Alternate methods of comparable reliability are acceptable. General Design Criteria/Standards 1. Safety-class design criteria for protection against fire, natural phenomena: Structures, systems, and components of safety-class electrical systems/components should be designed to be capable of withstanding the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, and floods as established in fusion facility safety analysis, without loss of capability to perform their safety functions. The design should minimize the possibility and the consequence of fire and its effects on the electrical safety-class equipment and devices.

The design should prescribe the use of fire resistant materials to the maximum practical extent possible for all equipment to be used for the safety-class functions. The design should provide for fire detection and suppression systems having appropriate capacity and capability to minimize adverse 74 DOE-HDBK-6004-99 effects of fires on safety-class systems, structures and components. Rupture or inadvertent operation of fire suppression systems should not significantly impair the safety function of the electrical safety- class systems, equipment, structures and components. The design should also provide for protection of safety-class equipment and systems from potential failure of non-safety-class hardware systems. Equipment, instruments and electrical systems, that provide for the isolation should be capable of withstanding the effects of design basis natural phenomena without failure of function and should be fail-safe in the event of power loss or failure within electrical systems. The design bases for these structures, systems, and components should reflect: (1) Appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of safety functions to be performed. 2. Safety-class design criteria for environmental and dynamic effects: Structures, systems, and components of safety-class electrical systems/components should be designed to accommodate the effects of, and be compatible with, the environmental conditions associated with the normal operation, maintenance, testing, and postulated accidents (including loss of coolant accident, loss of flow accident, loss of vacuum accident, plasma transients, magnet transients, loss of cryogen, tritium plant events, and auxiliary system accidents). Also, structures, systems, and components of safety-class should be designed appropriately to protect against dynamic effects, including the effects of missiles, pipe whipping, and environmental conditions associated with normal operation and the above postulated accidents. 3. Safety-class design criteria for sharing of structures, systems, and components: Structures, systems, and components of safety-class electrical systems/components of the fusion facility should not be shared among other facilities unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions. 4. Safety-class design criteria for inspection and testing of electric power systems: The design should provide for periodic testing of safety-class electrical items to prevent equipment failure. The tests and inspections should assess the parameters related to their safety functions. The testability of safety-class on-site AC and DC power systems should be designed to meet the following guidelines or equivalent. AC systems and components: IEEE 308 and 338 Standards. DC systems and components: IEEE 308 and 387 Standards. 5. Design criteria for electrical penetration assemblies (Safety-Class and Non-Safety Class) of Fusion Facility containment: Containment electrical penetrations should be designed to be capable of withstanding, without loss of mechanical integrity, the maximum possible fault current versus time condition that could occur given a single random failure of circuit overload protective devices located in circuits of the on-site safety-class AC/DC power systems. IEEE 317 Standard., Electrical

75 DOE-HDBK-6004-99 Penetration Assemblies in Containment Structures for Nuclear Stations (see also Regulatory Guide 1.63), should be used as a design guide. Penetrations should be designed to meet the same requirements of robustness and leak tightness as the penetrated containment or confinement (shield) system. The safety analysis should determine the safety-class of each electrical confinement penetration. 6. Safety-class design criteria for electric power systems: Safety-class power supplies, including batteries, emergency power supply from diesel generator(s), and the on-site electric distribution system, should have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure. Acceptance is based on meeting, either wholly or in part as necessary, the following specific safety design criteria: IEEE 308 Std., Criteria for Class 1E Power Systems for Nuclear Power Generating Stations (see also Regulatory Guide 1.6) IEEE 323 Std., Qualifying Class 1E Equipment for Nuclear Power Generating Stations IEEE 336 Std., Standard Installation, Inspection and Testing Requirements for Power, Instrumentation, and Control Equipment at Nuclear IEEE 338 Std., Standard Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems (see also Regulatory Guide 1.118) IEEE 344 Std., Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating IEEE 352 Std., Guide for General Principles of Reliability Analysis of Nuclear Power Generating Station Safety Systems IEEE 379 Std., Standard Application of the Single-Failure Criterion to Nuclear Power Generating Safety Systems (see also Regulatory Guide 1.53) IEEE 382 Std., Standard for Qualification of Actuators for Power-Operated Valve Assemblies with Safety-Related Functions for Nuclear Power (see also Regulatory Guide 1.73) IEEE 383 Std., Standard for Type Test of Class 1E Electric Cables, Field Splices, and Connections for Nuclear Power Generating Stations IEEE 384 Std., Standard Criteria for Independence of Class 1E Equipment and Circuits (see also Regulatory Guide 1.75) IEEE 387 Std., Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations (see also Regulatory Guide 1.9) IEEE 450 Std., Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid Batteries for Stationary (see also Regulatory Guide 1.129) 76 DOE-HDBK-6004-99 IEEE 577 Std., Standard Requirements for Reliability Analysis in the Design and Operation of Safety Systems for Nuclear Power Generating Stations IEEE 603 Std., Standard Criteria for Safety Systems for Nuclear Power Generating Stations Radiation/Contamination and Equipment Life Provisions should be made to avoid installation of safety-class electrical equipment, systems, and components in areas of high radiation/contamination levels to prelude exposure that could degrade the elements quality. The electrical emergency/back-up power system, equipment and components should be qualified for the life time radiation environment. The equipment structural design and qualification analysis should use conservative end of life parameters. If a component expected lifetime is less than the facility design life, the design should provide for component replacements. Control and Instrumentation

The emergency/back-up power systems should be provided with instrumentation and control elements and components to monitor the necessary parameters to perform their safety functions for normal operation and for cases of emergency (Design Basis Accidents). The safety analysis should identify and the design should implement: 1. Instrumentation to monitor the safety-class parameters. 2. Controls to maintain the measured parameters within the operational limits. The design of safety-class systems should include sufficient redundancy and diversity to ensure that single failure will not result in total loss of instrumentation or controls for required safety function. Design Considerations General The preferred supply voltages are 13,800V, 3-phase, 60-Hz for all motors rated 3000-hp and above; 4,160V, 3-phase, 60-Hz, for all motors rated 251 to 2500-hp; and 480V, 3-phase, 60-Hz for all motors 1 to 250-hp. Motors rated 3/4-hp and less may operate at 120V, single phase, 60-Hz, except critical equipment and motor-operated valves (MOVs) that will be operated at a supply voltage of 480V, 3-phase, 60-Hz. Electrical equipment and systems essential to safety functions defined in the safety analysis should be identified as Safety Class, should conform to IEEE standards and guides for Class 1E electrical systems and components. Safety-class Diesel Generators and/or Combustion Turbine Generators One non-safety-class and two safety-class diesel generators or combustion turbine-generators should be provided for the fusion facility. 77 DOE-HDBK-6004-99 The safety-class diesel generators (or combustion turbine generators) should be designed in accordance with the requirements of USNRC Regulatory Guide 1.9 and should meet the requirements of IEEE-387 Standard. The capacity of diesel generators (or combustion turbine generators) should be sufficient to accommodate all safety-class loads as defined in fusion facility safety analysis. There should be no direct interconnections between the emergency/back-up electrical power sources of the facility. There should be no provisions for automatically paralleling these power sources within the facility, and administrative control should be provided to prevent manual paralleling of these power sources. Provisions should be made for auto/manual synchronizing each emergency/back-up power source, to its respective bus for periodic testing during normal facility operation. Each emergency/back-up power source and its auxiliaries should be located in seismically qualified separate rooms. After start initiation, the power source, diesel or combustion turbine generator, should accelerate to and stabilize at synchronous speed with rated frequency/voltage within the time period specified in the safety analysis, and accept the first block of loads. The safety-class diesel generators should be manufactured and tested in accordance with ANSI Standards C50.10 and C50.12, NEMA Standard Publication MG-1, and IEEE Standards 115 and 386. If an alternative type of power source is chosen, e.g. a dam and hydroelectric turbine, it should be manufactured and tested according to the requirements of procurement specifications. Switchgear and Load Centers The switchgear should be fully rated for the maximum expected short-circuit current and continuous current capacity. All switchgear breakers should be drawout type, electrically operated, stored energy air circuit breakers.

The electrical equipment with 480 V or higher for the safety-class systems should be designed and qualified in accordance with IEEE Standards 344 and 323 for Class 1E electrical equipment. Fault calculations should be made in accordance with the latest issue of ANSI Standards C37.010 and C37.13. Selected high voltage switchgear breakers including 480V should be provided with local control in addition to the remote control in the control room and the automatic controls. The control voltage should be 125 VDC. All switchgear and load centers should be located indoors. Access space should be provided in back and in front of the switchgear and load centers as recommended by the manufacturer. Large 480V loads (60 through 250-hp motor loads, 100 through 400-kW non-motor loads) and motor control centers should be supplied from 480V load centers. Each load center should be provided with 4160 to 480V, 3-phase, 60 Hz, dry type transformer, with a 60 kV Basic Impulse Level (BIL) primary rating. “De-energized change” taps should be provided the same as specified for the 78 DOE-HDBK-6004-99 facility auxiliary transformers. The 480V secondary winding of the transformer should be wye-connected with the neutral solidly grounded, except where the loads are the pressurizer heaters, in which case the secondary should be delta connected. The transformer primary should be fed from the 4160 V switchgear by cable. The transformers and the switchgear buses should have sufficient capacity and should be connected so that overloading under any condition of operation is prevented. A separate ground fault relay should be provided for the transformer neutral and each load center feeder. Motor Control Centers AC Motor Control Centers: The 480 V MCCs should be metal enclosed, NEMA Class II, Type B. All 480 VAC motor control center motor starter circuits should be full-voltage non-reversing and full-voltage reversing, combination type with breakers, contactors, and individual control transformers. Transformers supplying the control power should be of uniform rating for similar units and will be sized to provide for the addition of relays and other loads. The minimum size should be 150 V-amperes. Starter sizes should be based on motor hp, voltage, and type of service. Table II-3 below covers low-voltage (600 V and below) NEMA Class A (for induction motors) general purpose starters. Table II-3. Load voltages for general-purpose starters Size of Starter (480 volts, 3-phase) Type of Load 0 Heater 1 0 - 10 hp motor 2 15 - 25 hp motor 3 30 - 50 hp motor All MCCs should be designed to contain approximately 20% spare circuit breakers, motor starters, and/or spaces. Essential circuits should be designed to provide for the maximum possible continuity of unit operation so that after a brief loss of power or voltage dip, the starter will return to its original position after the power is restored. DC Motor Control Centers: The DC MCCs will be similar to the 480 VAC MCCs except that starters will be reduced-voltage type to limit the motor starting inrush current to 200% of rated current. Some loads will be controlled locally at the equipment in addition to automatic remote control from the control room. 79 DOE-HDBK-6004-99 Direct Current Systems The facility direct current power for safety-class systems should be provided by several independent DC systems as required for normal and abnormal plant operations. Each safety-class DC system will consist of one independent 125 VDC battery, battery charger, and a DC control center. DC motor control centers will be provided where required for motor-operated valves and pump motors as indicated above.

Each DC subsystem will be of adequate size to provide control and switching power to safety-class systems and components. The DC power systems should be designed so that no single failure will result in conditions that prevent safe shutdown of the fusion facility. Redundant safety-class loads will be distributed between the redundant DC subsystems. The DC systems will operate ungrounded. A DC ground detector relay for each system will be provided to annunciate an undervoltage condition. All batteries will have sufficient capacity to supply power to the DC systems for the time period specified in the safety analysis without the support of the charger. The capacity of each battery charger will be based on the largest combined demands of the various steady-state loads and the charging capacity required to restore the battery from the design minimum charge state to the fully charged state within 12 hours under any facility operating condition. Calculations for battery sizing will be in accordance with the method presented in IEEE-485. The Class 1E system design should be in conformance with IEEE 308. Vital Instrumentation and Control Power Supply Independent ungrounded vital instrumentation and control power supplies should be provided to supply emergency/back-up power to instruments and controls systems credited in the safety analysis report. Each vital AC power supply will consist of an inverter, distribution panel, and manual transfer switch. Normally, the distribution panel will be supplied by the inverter. Each inverter will be supplied by a 480 VAC safety-class power source and a separate safety-class 125 VDC subsystem. A backup supply will be provided to each vital AC bus from a safety-class AC regulating type transformer through a manual transfer switch. The capacity of each regulating transformer should be adequate to meet the largest demand of any of the two vital AC distribution panels to which each regulating transformer may be connected. Motors All motors for safety-class equipment should be rated, manufactured, and tested in accordance with NEMA Standard MG-1 and other applicable USA and ISC standards. All motors should be sized to ensure operation within the temperature limits given in NEMA Standard MG-1. All DC motors should be rated at 120 and 240 volts. The voltage rating of the AC motors, in general, should be as in Table II-4 following: 80 DOE-HDBK-6004-99 Table II-4. Voltage ratings for AC motors 1. All motors for motor-operated valves and Class 1E damper motors 480 volts, three-phase, 60 Hz 2. Motors 1/3 hp and below, except as specified in item 1 (above) 115 volts, single-phase, 60 Hz 3. Motors from 1/2 hp through 250 hp 480 volts, three-phase, 60 Hz 4. Motors from 251 hp through 2500 hp 4,160 volts, three-phase, 60 Hz 5. Motors 3000 hp and above 13,800 volts, three phase, 60 Hz All AC motors should be suitable for across-the-line starting. Non-safety-class motors should be designed to accelerate the connected load with a minimum of 80% rated voltage at the motor terminals. Safety-class motors should be designed to accelerate the connected load with a minimum of 75% rated voltage. Wherever possible, DC motor starting current should be limited to 200% of rated current. The full-voltage starting current of AC induction motors rated 250 hp or more should not exceed 6.5 times the full-load current. In general, motors 60 hp through 250 hp will be fed from load centers. Motors 50 hp and below, and MOVs, will be fed from MCCs.

All safety-class motors should have non-hygroscopic Class F or Class H insulation with Class B temperature rise. All non-safety-class motors should have at least Class B insulation sealed against moisture and contaminants. Enclosed motor windings should have moisture resistant Class B insulation systems, suitable for power plant service, conforming to the requirements of NEMA Standard MG-1. Class F or H insulation may be used if the temperature rise does not exceed limits for Class B insulation. All motors 3 hp and above located outdoors, and motors 25 hp or larger located indoors, should have space heaters. Open, drip-proof motors 3 hp and larger in damp, indoor locations should have space heaters. Wherever possible, space heaters should be rated for 220-240 volts, but are to be connected to a 120 volt single-phase service. All motors installed indoors should be open, drip-proof, and fully guarded or should be totally enclosed, and fan cooled. Motors installed outdoors should be NEMA weather protected Type I or should be totally enclosed and fan cooled. Stator resistance temperature detectors (RTDs) should be provided for all medium voltage motors. Rotor temperature monitoring should be provided on all motors above 1000 hp. 81 DOE-HDBK-6004-99 Power, Control, and Instrumentation Cables Except in the case of thermocouple and lighting cables, all conductors should be Class B stranded, tin-coated or lead-alloy-coated, soft or annealed copper. The following classes of cables should be provided: 15 kV and 5 kV power cable 600 volt power cable Lighting wire rated 600 volts Control cable rated 600 volts Instrument cables and special cables Communication cables All cables should be capable of passing the cable tray vertical flame test set forth in IEEE-383. Individual conductor in cables should be capable of passing the vertical flame test of subsection 6.19.6 of IPCEA S-19-81 and/or S-66-524. Safety-class cables which must survive exposure to abnormal environmental conditions such as those following postulated design basis accidents should be qualified for such service per IEEE-383. The medium-voltage power cables for the 13.8 kV system should be rated at 15 kV, and the cables for the 4.16 kV system should be rated at 5 kV. The conductors should be insulated with an ethylene propylene rubber (EPR) or equivalent compound rated for 90o C conductor temperature. The 13.8 kV cables should be single-conductor (1/C) shielded with hypalon or equivalent jacket. The 4160 V cables in trays should be either 1/C or 3/C cables with a hypalon or equivalent jacket. The 4160 V cables in conduit and in underground ducts should be 1/C, shielded cables with a hypalon or equivalent jacket. Power cable for use at voltages of 480 V and less should be rated at 600 V. Each conductor should be insulated with an ethylene propylene rubber (EPR) or equivalent compound rated for 90o C conductor temperature. Multiple conductor cables should be used for all wire sizes up through No. 2 American Wire Gage (AWG) and should be provided with an overall jacket of neoprene, hypalon, or equivalent material. Single conductor cables should only be used for sizes No. 1/O AWG and larger, except in special cases where a calculation is made to verify the acceptability of and need for single conductor power cables No. 2 AWG or smaller. Insulation and jacket thicknesses should be in accordance with Insulated Power Cable Engineers Association (IPCEA) standards.

Control cables should be rated at 600 V. Each conductor should be insulated with cross-linked polyethylene, Tefzel, ethylene propylene rubber, or equivalent compound rated for 90o C conductor temperature. Multiple conductor cables should be used for all control circuits; they should be provided with an overall jacket of neoprene, hypalon, or an equivalent material. Insulation and jacket thicknesses should be in accordance with IPCEA standards. Conductor size for control cables should be at least No. 16 AWG. Control cables between switchyard and plant area should be of the shielded type. 82 DOE-HDBK-6004-99 Instrumentation cables should be multi-conductor, No. 16 AWG, twisted and shielded, and should have 600 V insulation. Shield grounding should be in accordance with the equipment manufacturer's recommendation. Multi-paired cables should be used wherever possible between terminal boxes and the cabinets. The insulation and jacket material should be the same as specified for the control cable. All thermocouple circuits should be No. 18 AWG or 20 AWG with twisted and shielded leads. Multi-paired cables should be used wherever practicable. Coaxial and triaxial cables should conform to the specifications of the suppliers of the systems in which they are used. All individual load circuit conducts should be capable of carrying 125% of rated full load at ambient temperature with due allowance for cable grouping. Transformer primary and secondary feeder cables should be capable of continuously carrying 115% of the maximum transformer rating. Cable size should meet the requirements of short circuit duty, and limit the voltage drop to 5% (2% in supply feeder cable plus 3% in branch circuit feeder equals 5% overall voltage drop). Cable current carrying capacity (ampacity) information contained in IPCEA Publications P-46-426 and P-54-440 should be used to select cable size. For circuits which will be routed partly through conduit and partly through trays or underground ducts, the cable size should be based on the ampacity in the portion of the circuit with the highest conductor temperature. The conductor size should be large enough to ensure that the conductor temperature, after a short circuit, (assuming rated conductor temperature prior to the short circuit) will not exceed 2500 C. For purpose of sizing the cable, it should be assumed that over load operation at the emergency temperature of the conductor will be limited to 100 hours per year, and that such 100-hour overload periods will not occur more than five times during the life of the facility. The emergency temperature rating is 130o C for cross linked polyethylene and EPR insulated cable. Raceways and Trays Underground, exposed, and embedded conduits should be used through the facility where the use of trays is not economical or practicable. Underground conduits for other than safety-class circuits should be type PVC ducts encased in a concrete duct bank. Underground safety-class circuits should be run in cable trenches, tunnels, or duct banks designed to withstand the SSE. The minimum size of conduit used in duct bank should be 2 inches.

The top of duct banks should be buried a minimum of 2 feet below grade. Underground conduit within duct bank for non-Category I (non-seismic) installation should be non-metallic type DB. The duct encasement should be reinforced concrete. The surrounding encasement should be a minimum of 3 inches thick. PVC type DB encased in reinforced concrete should be used for a Seismic Category I duct bank. Rigid steel conduit encased in reinforced concrete should be used for isolated runs. Single conduit leaving a duct bank between manholes or groups of conduits should be rigid steel galvanized encased in un-reinforced concrete with 3 inch cover all around. The top surface of the electrical duct banks should be covered with red dye on the surface to distinguish them from other underground structures. 83 DOE-HDBK-6004-99 All safety-class circuits inside the facility should be run in trays or in rigid steel conduit for all sizes. Safety-class circuits should be routed only through safety-class raceways. All non-safety-class circuits originating in safety-class equipment (associated circuits) including space heater circuits should be routed in the same manner as safety-class circuits up to the isolation device. No other circuits should be routed through safety-class raceways. Trough-type cable trays should be utilized where practicable. Tray strength should be verified by tests in accordance with the latest revisions of NEMA VE 1-1991 Metal Cable Tray Systems. The fill of power trays should be limited to 30% of usable area of 3 inch deep tray. The fill of control trays and instrumentation trays should be limited to 30% area. The loading of each section of tray should be calculated based upon the cable manufacturer's data. Separate power trays and control trays should be provided in the vicinity of motor control centers and 480 V switchgear. In outlying areas, control cable and 600 V power cables may be run in the same tray. Lighting branch circuits should not be run in trays in any location, except for lighting panel feeders which will be 90o C cable. Trays for cables of different voltage levels should be stacked in descending order with the higher voltage. Instrumentation trays should always be at the bottom. At least 12 inches of clear space should be provided between tray levels. Trays should be made of hot-dipped galvanized steel. Adequate tray support must be provided to bear the electromagnetic loading in cables and trays when trays are used in areas of strong magnetic field gradients and time varying fields. Instrumentation cables should not share the same raceway with power cables, control cables, or telephone cables. Cable tray systems related to safety-class electrical systems should be designed the requirements of IEEE-344. Separate conduit should be supplied for the DC battery feeders. Cable trays should be designed for a dead cable load of fifty pounds per foot, plus a single live load of 200 pounds applied at any point along the tray between supports. In addition, tray supports should be designed for loads due to the interaction between DC currents and the local magnetic field. In general, the medium voltage cable trays will be sized to allow spacing between cables of more than one cable diameter in a single layer. Fire stops of fire retardant materials will be used at floor and wall penetrations and long vertical runs. Normally, trays will not be routed over areas of high fire hazard; e. g., main lubricating oil reservoir, diesel generator sets, etc.

Cable tray systems related to safety-class electrical systems should be designed to the requirements of IEEE-344. Electrical Penetrations Electrical penetration assemblies should be provided as a means of passing electrical circuits through the containment building wall while maintaining the integrity of the containment pressure barrier. The 84 DOE-HDBK-6004-99 assemblies should meet the requirements set forth in IEEE-317. The assemblies should be inserted in and bolted to feed-through sleeves welded to the steel liner of the wall of the containment building and have a double electrical conductor seal. A seal should be provided at the bolted connection to the feed-through sleeve. At least four separate electrical penetration areas should be provided to maintain the physical separation specified in USNRC Regulatory Guide 1.75. Where Safety-class redundant protection system sensors are located within the containment building, each circuit should be brought to a penetration area with separation maintained among the redundant circuits. The electrical penetration assemblies should conform to USNRC Regulator Guide 1.63. Three basic types of electrical penetrations should be provided: Type I Medium voltage power, 15 kV or 5.0 kV Type II Power and control, 600 volts and below Type III Instrumentation, thermocouple, coaxial, triaxial, and other special circuits Circuit loading should be limited, based upon the manufacturer's recommendations, to ensure that the temperature will not cause excessive drying of the concrete adjacent to the penetration assemblies. Provisions should be made for periodic leak testing of the electrical penetration assemblies. Separation of Facility Safety Systems/Components Physical separation and independence of electrical systems should be established in accordance with IEEE-384, Standard Criteria for Independence of Class 1E Equipment and Circuits, and USNRC Regulatory Guide 1.75 to ensure meeting the requirements of IEEE-308 and 603. Separation requirements should be applied to the following electrical systems when these systems serve safety functions: Cable tray and conduit system Circuit wiring Diesel generator or alternate emergency/back-up power system Medium and low voltage switchgear Motor control centers DC batteries, chargers, and distribution system Electrical penetrations 85 DOE-HDBK-6004-99 Physical separation and independence should be provided for the four fusion device protection system channels, identified as Channels 1, 2, 3, and 4, and for two load groups of safety related equipment, identified as Trains A and B. Redundant Channel Separation: Raceways for the four redundant protection channels, engineered safety feature (ESF) actuation signals, and the two safety related trains should be physically separated from each other. However, Channel 1 and an ESF actuation signal channel may be run in the same raceway stack without separation as Train A; also Channel 2 and an ESF actuation signal channel may be run in the same raceway stack as Train B without separation. Channels 3 and 4 should conform to the separation requirements as required. Separation should be maintained or a barrier should be used to the terminating devices. Non-redundant Separation: Circuits for non-redundant balance of plant (BOP) functions originating at safety-class equipment should be provided with isolation devices or may be run in raceways used by associated safety-class circuits; however, the routing of such non-redundant circuits will be controlled the same as the safety- class circuits.

Cable Tray Separation: In general, physical separation of cable trays for redundant safety-class circuits should be maintained by a minimum of three feet horizontal separation. Vertical stacking of redundant cable trays should be avoided, if at all possible, but where such arrangement is employed, minimum vertical spacing should be five feet between the two groups. Where this is not practicable, barriers will be provided or rigid steel conduit and thermal barriers should be used. Divided cable trays should not be used to separate redundant systems. The cable tray system should be designed and installed according to the requirements of IEEE-384. (see also Regulatory Guide 1.75). Cable Color Coding Cables for redundant systems should be color coded. Cable trays and conduits carrying these cables should be identified by the same color marking or colored labels at intervals, when passing through a barrier, or wherever confusion may exist. Acceptable color coding of the cables is as follows: Safety Class: Train A Red Train B Green Channel 1 Red 86 DOE-HDBK-6004-99 Channel 2 Green Channel 3 Yellow Channel 4 Blue Non-safety class: Black Reliability Design Features To meet the expected stringent reliability requirements and to keep partial power system failures from having a cascading failure effect, the system should be designed with the following features. 1. The design assumes that three sets of lines (circuits) should connect the facility to the switchyard (grid); two for fusion facility operation and one for main (power) generator output. To maximize the separation of pulsed (tokamak) and plant loads, it is assumed that one set of circuits will supply the tokamak loads while the second will supply the plant loads during fusion facility operation. In the event of loss of one circuit, the fusion facility load would be shed (plasma shutdown) and the remaining set of circuits would supply the plant loads. During the fusion power generation (if designed), the third set of circuits will be used. 2. Since each safety bus has double supply paths, any single failure can be limited to a single bus. This provides redundant backup capability with a high degree of independence. 3. Each type of power is subdivided into two, three, or four segments with limited cross ties to provide redundancy without excessive cross-links. 4. The distribution system should have automatic fast transfer logic systems which sense the loss of supply to a bus, determine what alternative supplies are available, and carry out switching to connect the affected bus to a viable power supply. 5. Physical separation of redundant buses will be provided for protection against common causes of failure (e.g. fires, or in-plant flooding). 6. Four 125 VDC buses are proposed to provide four independent channels of safety-class system instrumentation to permit the use of single failure resistant, 2 out of 3, 2 out of 4, or 3 out of 4 channel voting logic on Fusion Facility Protection Systems. 7. The use of two emergency (standby) generators for Safety Train A and B is proposed, each with the sufficient capability of providing power for the emergency loads needed to safely shut down the fusion facility. 8. Suitable test capability will be required to allow periodic testing of all safety-class systems and automatic transfer systems as well as periodic operation of all circuit breakers and disconnects without adversely affecting system operation or compromising safety. Depending on the reliability requirements, such testing may have to be on-line.

87 DOE-HDBK-6004-99 Independent Design Review The primary objective in the independent design review of the Emergency/Back-up power system is to determine that these systems satisfy the acceptance criteria and will perform their design functions during fusion facility normal operation, anticipated operational occurrences, and accident conditions. In the independent design review, the descriptive information, including the design bases and their relation to the acceptance criteria, preliminary analyses, electrical single line diagrams, functional logic diagrams, preliminary functional piping and instrumentation diagrams (P&ID), and preliminary physical arrangement drawings are scrutinized to determine that there is reasonable assurance that the final design will meet the these objectives. Electrical Power Systems Combustion turbine-generators Recently, the combustion turbine-generator has been used as an emergency power source in the power plants and the other heavy industries due to it's high reliability, availability, and maintainability. Therefore, design should perform an application study for the use of combustion turbine as an emergency power source in the fusion facility. (see ASME 91 and West 211) Grounding A facility grounding grid consisting of bare copper cables buried beneath grade will be furnished to limit step and touch potentials to safe values under all fault conditions. Bare copper risers should be furnished for all electrical underground ducts and equipment, and for connections to the grounding systems within buildings. The design analysis will be based on the procedures and recommendations of IEEE-80. Grounding within buildings should be in accordance with the NFPA 70. Grounding systems connected to the station ground grid should be provided in each building with connections made to metallic tanks, equipment, cable trays, and exposed metal structures. Every other perimeter steel column should be connected directly to the ground grid. Each major piece of equipment or tanks should have two ground connections diagonally to each other. System and Equipment Grounding System and equipment grounding should be in accordance with IEEE-142. One No. 4/0 AWG bare copper cable should be installed with each underground electrical duct run. It should be connected with the ground cables from other duct runs at each manhole. All hardware in each manhole should be bonded to these ground cables. All metallic structures, towers, poles, and like items should be connected to the ground grid. All switchgear, motor control centers, and control cabinets should be furnished with horizontal ground bus. The ground bus in switchgear and MCC's should be connected to the grounding system with one No. 4/0 AWG copper ground cable at each end tied to the building steel or a ground pad set in the floor. The ground bus in control cabinets should be connected to the grounding system 88 DOE-HDBK-6004-99 with No. 2/0 AWG Stranded copper cable at each end tied to the building steel or a ground pad set in the floor. An insulated grounding grid should be installed in the control room and computer room for grounding the computer and any other panel that needs grounding connected to the facility grounding system. Cathodic Protection A recommendation for cathodic protection should be made based on the results of soils analysis and resistivity readings.

Consideration should be given for protection of such facility structures as underground pipes and storage tanks, surface mounted storage tank bottoms, sheet piling, and concrete encased steel for the fusion facility containment or confinement building. Lightning Protection A lightning protection system should be provided for all major structures. Design and installation of the system should be in accordance with the NFPA-780. Lightning protection should be provided for all buildings that need to be protected. The system should be connected to the station ground grid and to supplementary ground rods if required. Station type lightning arresters will be provided on each phase of the incoming transmission lines to the main step-up and the start-up transformers. The arresters will be either mounted on each transformer, or separately supported and located near each transformer with connections to the high voltage bushings. The voltage rating of the lightning arresters should be compatible with the ratings of other surge protective equipment connected to the system. Fire Detection and Fire Protection The fire protection system should be designed in accordance with the requirements of National Fire Protection Association and the applicable local codes and regulations. Equipment and facilities for fire protection will be provided to protect facility equipment, structures and personnel from fire and the resultant release of toxic vapors. If there is a possibility of an explosion, the designer should consider the use of an explosion suppression system (NPFA 69). Smoke, ionization, and fire detectors should be provided in enclosed areas where electrical switchgear, motor control centers, control cabinets, etc., are located. Detectors should also be provided in areas of heavy concentration of cable trays, in ventilation ducts, penetration rooms, the diesel generator rooms, and selected areas of the containment or confinement. Smoke and fire detection alarms will be annunciated in the control room and at the fire department or fire brigade. Fire-walls, barriers and physical separation of redundant safety features electrical equipment should be provided as required. Vertical cable tray runs will have horizontal fire barriers where required. Where cable trays pass through openings in walls or floors, fire stops should be provided. Any smoke from fires should be controlled so that heat and toxic combustion products are kept from the control room and computer control areas. Smoke movement and control should be accomplished 89 DOE-HDBK-6004-99 with ventilation dampers activated by smoke detectors in ducts. Designers should consider using smoke hatches in building roofs. NFPA 92A and NFPA 204M give smoke control design guidance. REMOTE MAINTENANCE SYSTEMS The remote handling systems include robotic, telerobotic, teleoperated, and crane systems for servicing the areas of a fusion facility with either high potential personnel hazards or where other methods are not practical. The latter includes combinations of high accuracy, large capacity, and limited space unique to the fusion facility that will have to be addressed. Remote handling systems should be provided to minimize personnel exposure to radiation and other hazards during the operation and maintenance. Remote handling systems should be considered where it is anticipated that personnel exposures would otherwise approach dose guideline limits or where contaminated puncture wounds could occur.

The following sections give generalized requirements for remote handling systems derived from the unique characteristics of the fusion facility. These should be viewed as additions to the requirements of more traditional robotic systems. System Definitions Robot - An automatic, position-controlled, reprogammable, multi-functional manipulator having several axis, capable of handling materials, parts, tools, or specialized devices through variable programmed operations for the performance of a variety of tasks. Telerobot - A robot that is directed through a series of preprogrammed functions or steps by an operator, in menu driven, teach and play, or simulator functional steps. Teleoperator - A robot that is under the immediate control of an operator, to perform a series of robotic motions or functions within workcell constraints, including collision avoidance and automatic alignment. Crane systems - A conventional crane of specialized nature or “smart” crane, such as a “swing free” crane. General Safety Design Guidance Remote handling systems should be provided to minimize personnel radiation exposure during the operation and maintenance of the fusion device. ALARA concepts should be applied to minimize exposures where cost effective. Remote handling systems should be considered where it is anticipated that personnel exposures would otherwise approach dose guideline limits or where contaminated puncture wounds could occur. Systems or components needed to perform safety functions should be designated as safety-class systems or components. Components which do not perform safety functions but whose single failure causes the failure of a safety function should be designated safety-significant components. 90 DOE-HDBK-6004-99 Potential System Safety Functions Normal Operations Safety-significant remote handling systems and components should not cause a Safety System to fail under normal plant operating conditions. Potential safety functions during normal operation include: 1. Erect portable radiation shielding panels 2. Place or relocate experimental devices in high radiation fields 3. Test or inspect SSCs as necessary to assure performance of safety functions Maintenance Remote handling systems and components should not cause a collision with safety systems or components while performing normal or abnormal plant maintenance. System design and operational controls should limit operator radiation exposure. Potential safety functions during maintenance include: 1. Erect portable radiation shielding panels 2. Replace equipment or components in high radiation fields or transport equipment or components to a hot-cell. 3. Decontaminate SSCs in preparation for maintenance Design Basis Accidents Remote handling equipment classified as safety-class should be designed to function both during and after a design basis event. Safety-significant remote handling systems and components should not drop their loads, collide with structures or releasing gas or aerosols under basis accident conditions. Safety-significant remote handling systems and components should also not cause safety systems or components to fail under design basis accident conditions. Potential safety functions during design basis accidents include: 1. Install/place diagnostic instruments 2. Install consequence mitigation devices in high radiation fields or otherwise unsafe conditions. Beyond Design Basis Accidents

There are no system safety functions required for beyond design basis accidents. Beyond design basis accidents include internal and external initiators whose frequency is lower than the design basis frequency specified in the safety analysis. 91 DOE-HDBK-6004-99 Structural General Remote handling systems and components encompass all components up to the primary plant support structures. The design allowables for safety-class or safety-significant remote handling systems and components should be in accordance with codes identified in Table 2 of this volume. Normal Loads Remote handling systems should withstand the static, dynamic, thermal, and normal plant loads, without exceeding applicable code allowable stresses. Natural Phenomena and Accident Loads Safety-class remote handling systems should be designed to withstand effects of natural phenomena and design basis accidents. Loads from natural phenomena and accidents should not cause safety- significant remote handling systems and components to fail in such a manner as to cause failure of safety-class components or systems. Materials Materials of construction should be qualified for the life time service with the anticipated thermal and radiation environment. The structural design analyses should use conservative end of life properties. If a component's expected life time is less than the fusion facility life time, design should provide for component replacement. Additionally, the minimization of material activation and the ability to decontaminate materials should be considered. The nature of a fusion facility is such that very high levels of radiation, temperature, magnetic flux, and neutron flux are expected. Additionally, the presence of hydrogen, deuterium, and tritium gases is anticipated during off normal events. The effects of galvanic or chemical corrosion should be evaluated as part of the material selection process. Materials used in the fabrication of remote handling equipment load bearing members should conform to standards defining chemical and mechanical properties specified by the designer. Allowable stresses in remote handling equipment structural steel members during normal operation should not exceed those codes identified in Table 2, and allowable design stresses in mechanical components should provide a factor of safety of 5 when under rated load. Brittle fracture and fatigue during all operation and testing conditions should be design considerations. Joint and weld details should be designed to prevent fracture, lamellar tearing, low-cycle fatigue and embrittlement. Lubricants, sealants and protective coatings should be compatible with their intended service and environment. In the selection of materials, including lubricants, sealants and electrical insulation for equipment to be stored or used in the primary confinement, design life radiation exposure (during normal operation 92 DOE-HDBK-6004-99 and, where applicable, accident conditions) should be considered and materials selected so there will be no loss in function for the design life of the equipment. The surface finish of all external materials should allow for ease of radiological decontamination. Highly polished, non oxidizing, and non painted surfaces should be used so as to not entrap radiological material or produce mobile dust. The potential for hydrogen embrittlement and weakening of structural members should be considered in all locations where exposure to hydrogen, deuterium, or tritium is anticipated.

The radiological activation of materials in areas of high gamma and neutron fluxes should be considered in the choice of materials. This includes metals, greases, fluids, and elastomers. Instrumentation and Controls The following instrumentation and control features should be provided in the design of the remote handling equipment as necessary to prevent damage to the handling equipment, to nearby safety-class or safety-related SSCs, and to the handled components; to provide for personnel safety; and to remotely recover equipment (to prevent the necessity of personnel recovery of equipment): 1. Underload - An interlock actuated upon a reduction in load, while lowering with grapple attached, at other than full down position, to prevent any further downward travel. 2. Overload - An interlock actuated upon an unacceptable increase in hoisting force to prevent upward travel. 3. Up-Position - An interlock set at a predetermined operational limit to prevent any further upward travel. 4. Down-Position - An interlock set at the predetermined operational limit to prevent any further down travel. 5. End-Travel (hardstop) - Physical limit to translation. 6. Up-Limit (hardstop) - Physical limit to hoisting. 7. Slow Zone - Region of travel where a reduction in hoist speed is mandatory and automatic. 8. Non-Simultaneous Motion - Automatic restriction against simultaneous hoisting and translating motions. 9. Grapple Release - An interlock to prevent opening a grapple under load. 10. Bridge Travel - An interlock at a predetermined operational bridge travel limit. 11. Trolley Travel - An interlock at a predetermined operational trolley travel limit. 12. Slack Cable - An interlock actuated at a loss of cable load to prevent further downward travel. 93 DOE-HDBK-6004-99 13. Translation Inhibit - An interlock to prevent bridge or trolley movement unless its associated hoist is at or above a predetermined operational up position 14. Robotic systems should be provided with intelligent systems to avoid known structures and obstacles. This may include direct sensing of obstacles or knowledge based systems that have been preloaded with the location of obstacles. 15. Remotely controlled systems should be provide with a backup means of safe release of attached radiological hazardous materials, to facilitate remote recovery of failed remote handling equipment for repair. 16. Redundancy of critical controls should be provided to prevent single mode control failure of remote or robotic equipment causing unplanned or unanticipated equipment motion. 17. Provision should be made for maintenance of anticipated large capacity remote or robotic equipment in the presence of personnel, without creating impact hazard to the personnel. It is anticipated the most equipment will require a minimum of maintenance functions while energized, typical of robotic systems. This must be provided for in a personnel safe manner. 18. The expected high presence of radio frequency and magnetic fields during both normal and off normal operation should not create hazards to personnel through unplanned movements or other means. Manual bypasses for interlocks may be supplied at the discretion of the designer. Electrical The remote maintenance systems should be designed to the equivalent of the National Fire Protection Association Class 1, Division 1 requirements. It is assumed, but not required, that this would be met with the pressurized, interlocked systems approach.

Function Protection for Natural Phenomena Safety functions should be assured for loads from natural phenomena. Design should provide for protection of safety-class equipment and systems from potential failure of non-safety-class hardware during natural phenomena events. Tests and Inspections Provisions should be made for the periodic tests and inspections of structures, components, and systems within the remote handling system. The tests and inspections should be performed in accordance with applicable codes and standards. Provisions should be made in the design of the equipment to allow testing the following components on a scheduled basis: 1. Electrical Test Capabilities - The design should include provisions to allow testing electrical safety features and controls to verify at least the following: 2. All limit switches are operable and functioning as required. 94 DOE-HDBK-6004-99 3. All controlling signals from sensing devices are within specifications. 4. All control switches are operable. 5. All indicating instrumentation is operable and within specified accuracy. 6. All annunciators are operable as specified. 7. All electrical interlocks are operable and functioning as required. Mechanical Test Capabilities The design should include provisions to test mechanical safety features and controls to verify at least the following: 1. Proper performance of all load cells. 2. All motors are operable and functioning as required. 3. Hoist load and brake tests. Special Test Capability The design should include provisions to perform any special testing that is unique to that equipment. Design Considerations General Most of the remote handling system will be located in the fusion facility. Most remote handling systems’ components will be idle during normal plant operation. The area around the fusion device could be subjected to intense electromagnetic, thermal, neutron and gamma radiation environments. Persistent low levels of hydrogen, deuterium, and tritium gases, as well as potential high levels of these gases during unplanned events, should be considered. Activated dust from plasma facing components may be present during maintenance or accident conditions and should be considered. The design should provide for the following general criteria: 1. The remote handling system should be designed such that the operator will not be exposed to a whole body radiation dose rate greater than the current exposure limits. The maximum allowable exposure to tritium must be observed. 2. Allowances should be made for equipment movement so that, in performing intended operations, safe distances can be maintained from personnel in normally accessible work areas. 3. Equipment should be located in areas accessible for operation, testing, inspection, and maintenance. Where this is not possible, a means of safely retrieving the equipment to a safe area should be provided. This requirement must include backup methods of safely disconnecting from radiological hazardous materials, for which the remote equipment is intended. 95 DOE-HDBK-6004-99 4. Control panels should be located to afford the operator a full view of the equipment. 5. Equipment should fail safe upon the loss of motive power. 6. Safety features should be incorporated such that failure of one of the drive mechanisms or any component of the equipment will not result in exposure of personnel to radiation in excess of 2.5 mrem/hr while recovering from such failure.

7. Redundancy of critical controls should be provided to prevent single mode control failure of remote or robotic equipment causing unplanned or unanticipated equipment motion. 8. The expected high levels of radio frequency and magnetic interference potentially present should not interfere with control systems on the normal operation of systems. 9. The presence of large quantities of cryogenic materials during both normal and off-normal conditions must be considered in the design of remote equipment. Radiation Shielding Design should provide radiation shields between the fusion facility and the remote handling system components in order to reduce exposure to the system components. Structural Design Codes The design, fabrication, testing, and inspection of safety-class and safety-significant remote handling equipment should be in accordance with commercial codes and standards applicable to that particular type of equipment. The majority of the systems and components should be considered as non­ nuclear-safety (NNS) and should be designed and fabricated to industrial standard requirements outlined in this volume. Hydrogen Fires and Detonation Remote handling systems should not initiate a fire or detonation in normal or anticipated off-normal events in the presence of hydrogen gases. Safety-significant remote handling systems and components may fail in a fire or detonation event, but the failure should not degrade the function of an adjacent safety-class system, structure or component. Safety-class equipment should withstand the effects of design basis fire or detonation and retain its basic safety functions. Expected Hazards General Requirements Normal industrial hazards associated with large, automated facilities will be present in a fusion facility. Remote handling facilities should address all of those in their basic design. In addition, a series of specialized hazards may exist during normal or off normal operation whose combination is unique. The following sections discuss the unique hazards that also must be addressed in the basic system design. 96 DOE-HDBK-6004-99 In some off normal excursions it is not expected that remote equipment always continue to be operable, but in all cases it should not contribute to problems through its failure mode and should be recoverable to a safe area. High Power Equipment in Confined Spaces. The physical hazards of high power and/or automated systems in restrictive spaces should be addressed. Very high capacity and rigid systems (typical of high precision) will be present, with possibly multiple systems in a common workspace. The hazards associated with this should be addressed. Plasma Energy Plasma energy will be present within the fusion facility during normal operation. During off normal excursions the plasma energy will be dissipated into its surroundings, in an extremely short period of time. The rapid collapse of a plasma field will create very large electromagnetic transients and runaway electrons. Remote equipment either operating or stored within range of the plasma energy must be able to withstand any off normal event that equipment is intended to address. From other off normal events, all critical equipment should be safely recoverable. Cryogenic Cryogenic materials in large quantities (e.g. liquid nitrogen, and liquid helium) will be present many areas around the fusion facility. Remote equipment intended to work near or service cryogenic facilities should provide appropriate materials of construction. Seals, wire insulation, etc. should be appropriately chosen or protected.

Radiological Fields Radiological fields will be normally present at high levels during operation and at decaying levels during outages. During the life of a fusion facility, the outage levels of ionizing radiation are expected to be continually increasing, due to activation of metals. The primary hazards to the remote handling equipment are high energy ionizing radiation (gamma and some beta), and neutrons. The expected results to the equipment are activation of materials, degradation of non-metallics, and destruction of electronics. The latter is expected to have the most severe effect on the operability of the remote systems. Electronic systems will be most vulnerable to the direct gamma attack, and, to a lesser extent, damage due to neutrons and runaway electrons. Shielding or remote placement of electronics appropriately should be designed into all systems. Cameras for remote maintenance will require radiation-resistant optics and shielding of electronics. 97 DOE-HDBK-6004-99 Radiological Contamination Radiological contamination concerns include tritium and activated dust from plasma facing components. The tritium contamination is primarily a personnel protection concern that effects the design of systems or modules and is not a direct threat to equipment. However, any high stress components that see a significant tritium environment must be monitored for hydrogen embrittlement. The direct contamination of equipment from other radiological materials is a potential. Equipment design should allow for rapid decontamination and maintenance to ensure operability and minimize personnel exposure potential. Magnetic Fields The magnetic fields associated with the fusion facility magnets is very large. A constant magnetic field will be present near the torus and extremely large transient fields occur during plasma disturbances. The electrical interference caused by the above field transients should not cause critical electronic failures or unexpected responses from remote handling equipment. A significant level of electromagnetic interference is expected due to routine magnet cycling. The remote equipment must be able to accommodate this interference without damage. Radio Frequency Fields High radio frequency (RF) fields are normally present near the torus. Remote handling equipment in this vicinity should be able to accommodate the resultant interference as a normal occurrence. Hydrogen Isotopes Hydrogen generation is a potential result of plasma excursions or excursions of other process materials into the plasma, during off normal excursions. Tritium and deuterium are also potentially present during off normal events. All of the hydrogen isotopes are equally flammable, and when present near the remote handling equipment present an equipment and personnel hazard. The oxidized state of tritium is a particular personnel hazard. Materials Of Construction Material Considerations The acceptable materials of construction for equipment in the vicinity of the fusion facility are affected by the hazards unique to a fusion facility. Major areas of concern are the activation of materials by the intense neutron bombardment, the degradation of materials by all forms of radiation, and the contamination of surfaces from the transfer of radiological materials. 98 DOE-HDBK-6004-99

The activation and degradation issues should be addressed by the careful choice of materials, to minimize these effects. The contamination issue should be addressed by careful surface preparation to both prevent the entrapment of radiological materials and facilitate the removal of material. Replaceable materials should be radiation tolerant to 1 x 109 rads of cumulative dosage. Materials that are inaccessible or otherwise difficult to replace should be radiation tolerant to 1 x 109 rads cumulative exposure. Material Requirements All structural materials used should be chosen for their non oxidizing surface characteristics and resistance to neutron activation, to the extent possible. Stainless steels should be used unless other materials are agreed upon. Non metallic materials should be chosen for their resistance to neutron activation and to radiological degradation. The failure mode of the materials should not directly cause failures of other systems (e.g. elastomers that become liquids upon radiological exposure). Non metallic materials should not be used that cause degradation of adjoining metallic materials, such as materials that release chlorine. All metallic and non metallic materials used should be resistant to the chemical, high temperature, low temperature, and other hazards unique to fusion facilities. The specific hazards to be addressed are relative to the equipment's expected location within the fusion facility. Metal surface characteristics should be smooth and free of paints or coatings, with the exception of strippable coatings used for decontamination. High polish or electropolished surfaces are preferred, due to their ease of decontamination. All metallic and non metallic materials should be resistant to decontamination processes to be used prior to maintenance. These methods include cleaning with high pressure water, cryogenic materials, and mild acids. Special care must be used to prevent gaps and crevices from entrapping and retaining radiological materials. Wiring Requirements Wiring should be resistant to radiological damage to the levels stated in this report. All cabling should be protected from physical hazards expected within the very large fusion facility. Cabling should be adequately shielded from the high magnetic and radio frequency fields it is expected to encounter. The shielding should be such that the equipment serviced by that cabling is adequately protected from cabling induced interference. Electrical connectors and wiring methods (per National Electrical Code definitions, or equivalent) should be used to minimize repair or replacement time. Sealed, quick-disconnect connectors should be used wherever possible and all individual wiring methods (e.g. terminal strips) should be avoided. These requirements are intended to minimize the exposure of personnel related to maintenance. 99 DOE-HDBK-6004-99 The wiring count from remote equipment to personnel areas should be minimized. The failure potential for remote handling equipment is directly related to the amount of vulnerable wiring, and connectors required from the work area. Maintenance of Remote Handling Equipment All remote handling equipment will potentially require maintenance while radiologically activated or contaminated (tritium or other), and should be designed accordingly. Maintenance requirements should allow for personnel using rubber gloves, plastic suits, or similar personal protective equipment. Additionally, the time required to perform maintenance may be directly related to the resultant exposure of personnel to radiological hazards.

Maintenance methods should allow for rapid replacement of components or modules utilizing quick disconnects for all services. Fasteners should be designed for gloved handling and be a captive type if possible. Contamination Control Surface contamination from tritium and activated dust should be considered in remote handling system design. The design should allow for rapid surface decontamination, when needed, to ensure function and minimize personnel exposure potential. The design should allow for external liquid contact and should have surface finishes that facilitate decontamination. The potential for tritium entrapment is assumed to be a potential problem for all remote systems. Assembly and Disassembly Techniques All systems should be of modular construction, if possible, to facilitate maintenance. Modules can be replaced or relocated to other maintenance facilities with less potential for personnel exposure. Systems for use in highly congested areas must also allow for modular construction to a sufficient degree to allow for access and recovery of components. Systems or modules of systems should provide for handling by fully protected personnel (e.g. plastic suits) with a minimum of special requirements. Permanent lifting points are desired, and lifting slings (ropes, cables, straps) should be avoided. Gloved or double gloved hand compatible electrical and service connectors should be used to facilitate connections. Sharp edges or rough surfaces are to be particularly avoided, to prevent compromising protective clothing. Special Handling Requirements The handling of typically large and powerful remote equipment in confined spaces and the subsequent maintenance of that equipment should be a design factor. The problem of live system troubleshooting in such an environment is of particular concern. System designs should allow for a methodology of required personnel work without hazard to personnel. 100 DOE-HDBK-6004-99 Past Design Practices Activation Control Methods The choice of materials of construction is the only known means of minimizing the activation of materials from neutron bombardment. For metallic materials, the over riding structural and contamination concerns require the usage of activating materials, usually stainless steel. For non­ metallic materials, if possible, materials of lower activation potential should be utilized, for greases, elastomers, etc. Contamination Control Methods Tritium contamination is volumetric in nature and can not be easily eliminated. The contamination by other materials can be minimized by surface condition induced entrapment. Smooth surfaces and no surface coatings will both minimize contamination and simplify decontamination. Electronics Protection Methods The very high electrical and magnetic normal and transient fields potentially present in the fusion facility will present a hazard to all electronics systems. Maximum protection should be provided for all interferences that will normally occur as to not interfere with routine operation of remote handling operations. The off normal interferences should not prevent safe retrieval of equipment for repair, and must not introduce unwanted motions; but off normal excursions may result in discontinuation of operation. Internal Wiring Methods

Wiring through sections and/or modules of remote handling equipment should be provided within the equipment. Externally deployed wiring is expected to present an undesirable hazard to operations. The damage to or damage by externally routed cabling has historically represented an impediment to successful operation. The wiring connectors between sections should also be internal, for operability reasons and to address the requirements shown in the following section. Operational Requirements Mode of Operation The remote handling systems may be operated in the following modes: Fully Robotic Telerobotic Teleoperation Manual 101 DOE-HDBK-6004-99 All systems should be operable in the operational modes of less sophistication than their normal mode. For example, robotic systems should also be operable telerobotic, etc. This requirement is to facilitate recovery from off normal or unanticipated events without personnel entry. Programmed assistance should be provided in the form of graphics based work cell modeling, or similar, coupled to the movements of any automated system. This should display the location of all known obstacles or objects within a work cell and the present location of the remote system. The control systems should display all programmed motions in the modeled environment, in real time, with display before movement capabilities. This will allow all actions to be tested before operations are started. Collision Avoidance The most desirable mode of operation is with active system control to prevent operation in areas of exclusion. In this type of operation, the control system portion of a robotic, telerobotic, or teleoperational system will intervene when commands (either manual or programmed) direct a system into a predetermined exclusion area. The environment can be either statistically modeled, when unchanging, or actively modeled, when dynamic. The active modeling can be vision based, structured light sensed, or similar. The control system should be the primary means of obstacle avoidance. Active sensors on systems should also be provided where needed to avoid high damage potential collisions. Multiple Remote Device Coordination Multiple remote handling systems in the same or overlapping workspace(s) are anticipated. All such systems should have coordinated motions, to prevent their direct interaction. When two systems have an interaction potential, one system will be designated as the lead and the other the follower. Swing Free Crane Technology The development of “swing free” technology for cranes or crane systems has been sufficiently demonstrated as having significant economic payback on any crane like system. It should be provided for all remote handling facilities, for which it is appropriate. Retrieval Requirements Redundancy of Critical Controls. All remote handling system controls that, on failure, can cause either (1) a system to perform unintended motions, or (2) a system to fail in a non-recoverable mode, should be redundant, to prevent a common mode failure. This requirement is in addition to normal emergency stops. etc., which required a personnel intervention to be effective. Remote Release Remote handling systems must be provided with provision to safely release from highly hazardous loads or materials, in the event of other system failures. 102 DOE-HDBK-6004-99 Safe Return of Equipment

Remote handling systems must be recoverable to a safe area for repair, without undo exposure to personnel. The failure of a critical system must not prevent some secondary means of recovering that equipment for repair, if its usage is required to continue operation. Recommended Design Practices Potential Safety Functions Remote handling systems perform a number of safety functions to minimize personnel exposure to radiation and other hazards during normal and off-normal conditions. In addition, system safety functions may be required to prevent or mitigate the off-site consequences of off-normal events. Potential safety functions include: 1. Erect portable radiation shielding panels 2. Place or relocate experimental devices or other equipment in high radiation fields 3. Test or inspect SSCs as necessary to assure performance of safety functions 4. Replace equipment or components in high radiation fields 5. Decontaminate SSCs in preparation for maintenance 6. Install/place diagnostic instruments 7. Install consequence mitigation devices in high radiation fields or otherwise unsafe conditions. Safety Related-Design Guidance Remote handling systems may be operated and stored near the fusion device in an area subject to intense magnetic, thermal, neutron and gamma radiation environments. Persistent low levels of hydrogen, deuterium, and tritium gases, as well as potential high levels of these gases during unplanned events, may be present and should be considered in design. Activated dust from plasma facing components may be present during maintenance or accident conditions and should be considered. The design should accommodate the following general guidance: 1. The remote handling system should be designed such that the operator will not be exposed to a whole body radiation dose rate greater than the current exposure limits. 2. Remote handling systems and components should not cause a collision with safety systems or components while performing normal or abnormal plant maintenance. Wiring through sections and / or modules of remote handling equipment should be provided within the equipment. 3. Allowances should be made for equipment movement so that, in performing intended operations, safe distances can be maintained from personnel in normally accessible work areas. 103 DOE-HDBK-6004-99 4. Equipment should be located in areas accessible for operation, testing, inspection, and maintenance. Where this is not possible, a means of safely retrieving the equipment to a safe area should be provided. This must include backup methods of safely disconnecting from radiological hazardous materials, for which the remote equipment is intended. 5. Control panels should be located to afford the operator a full view of the equipment. 6. Equipment should fail safe upon the loss of motive power. 7. Safety features should be incorporated such that failure of one of the drive mechanisms or any component of the equipment will not result in exposure of personnel to radiation in excess of 2.5 mrem/hr while recovering from such failure. 8. Redundancy of critical controls should be provided to prevent single mode control failure of remote or robotic equipment causing unplanned or unanticipated equipment motion. 9. The expected high levels of radio frequency and magnetic interference potentially present should not interfere with control systems or the normal operation of systems.

10. The presence of large quantities of cryogenic materials during both normal and off-normal conditions must be considered in the design of remote equipment. 11. Design should provide radiation shields between the fusion facility and the remote handling system components in order to reduce exposure to the system components. Structural Design The design, fabrication, testing, and inspection of safety-class and safety-significant remote handling equipment should be in accordance with commercial codes and standards applicable to that particular type of equipment. The majority of the systems and components should be considered as non­ nuclear-safety (NNS) and should be designed and fabricated to industrial standard requirements. The design allowables for safety-class or safety-significant remote handling systems and components should be in accordance with codes identified in Section o, Design Guidance for Typical Systems. Allowable design stresses in mechanical components should provide a factor of safety of 5 when under rated load. Brittle fracture and fatigue during all operation and testing conditions should be design considerations. Joint and weld details should be designed to prevent lamellar tearing. Materials Materials of construction for equipment in the fusion facility are affected by a unique combination of hazards. Major concerns are the activation of materials by the intense neutron bombardment , the degradation of materials by all forms of radiation, and the contamination of surfaces from the transfer of radiological materials. Activation and degradation issues should be addressed by careful choice of materials. Replaceable materials should be radiation tolerant to 1 x 108 rads of cumulative dosage. Materials that are 104 DOE-HDBK-6004-99 inaccessible or otherwise difficult to replace should be radiation tolerant to 1 x 109 rads cumulative exposure. All structural materials used should be chosen for their non-oxidizing surface characteristics and resistance to neutron activation, to the extent possible. Stainless steels should be used unless other materials are agreed upon. Non-metallic materials should be chosen for their resistance to neutron activation and to radiological degradation. The failure mode of the materials should not directly cause failures of other systems (e.g. elastomers that become liquids upon radiological exposure). Non-metallic materials should not be used that cause degradation of adjoining metallic materials, such as materials that release chlorine. All metallic and non-metallic materials used should be resistant to the chemical, high temperature, low temperature, and other anticipated hazards. The specific hazards to be addressed are relative to the equipment's expected location within the fusion facility. The contamination issue should be addressed by careful surface selection and preparation to prevent the entrapment of radiological materials and facilitate the removal of material. Metal surface characteristics should be smooth and free of paints or coatings, with the except of strippable coatings used for decontamination. High polish or electropolished surfaces are preferred, due to their ease of decontamination. All metallic and non-metallic materials should be resistant to decontamination processes to be used prior to maintenance. These methods include cleaning with high pressure water, cryogenic materials, and mild acids. Special care must be used to prevent gaps and crevices from entrapping and retaining radiological materials.

Electrical The remote systems should be designed to the equivalent of the National Fire Protection Association Class 1, Division 1 requirements. It is assumed, but not required, that this would be met with the pressurized, interlocked systems approach. Wiring should be resistant to radiological damage. All cabling should be protected from physical hazards expected within the very large fusion facility. Cabling should be adequately shielded from the high magnetic and radio frequency fields it is expected to encounter. The shielding should be such that the equipment serviced by that cabling is adequately protected from cabling induced interference. Electrical connectors and wiring methods (per National Electrical Code definitions, or equivalent) should be used to minimize repair or replacement time. Sealed, quick disconnect type, connectors should be used wherever possible and all individual wiring methods (e.g. terminal strips) should be avoided. These requirements are intended to minimize the exposure of personnel related to maintenance. The wiring count from remote equipment to personnel areas should be minimized. The failure potential for remote handling equipment is directly related to the amount of vulnerable wiring, and connectors required from the work area. 105 DOE-HDBK-6004-99 Tests and Inspections Provisions should be made to allow testing on a scheduled basis in accordance with applicable codes and standards to verify: 1. All limit switches are operable and functioning as required. 2. All controlling signals from sensing devices are within specifications. 3. All control switches are operable. 4. All indicating instrumentation is operable and within specified accuracy. 5. All annunciators are operable as specified. 6. All electrical interlocks are operable and functioning as required. 7. Proper performance of all load cells. 8. All motors are operable and functioning as required. 9. Hoist load and brake tests. 10. Any special function that is unique to the equipment. Assembly and Disassembly Techniques All systems should be of modular construction, if possible, to facilitate maintenance. Modules can be replaced or relocated to other maintenance facilities with less potential for personnel exposure. Systems for use in highly congested areas must also allow for modular construction to a sufficient degree to allow for access and recovery of components. Systems or modules of systems should provide for handling by fully protected personnel (e.g. plastic suits) with a minimum of special requirements. Permanent lifting points are desired, and lifting slings (ropes, cables, straps) should be avoided. Gloved or double gloved hand compatible electrical and service connectors should be used to facilitate connections. Sharp edges or rough surfaces are to be particularly avoided, to prevent compromising protective clothing. Special Handling Requirements The handling of typically large and powerful remote equipment in confined spaces and the subsequent maintenance of that equipment should be a design factor. The problem of live system troubleshooting in such an environment is of particular concern. System designs should allow for methodology of required personnel work without hazard to personnel. 106 DOE-HDBK-6004-99 Design Guidance for Typical Systems Typical remote handling systems and equipment include: CCTV ( Closed Circuit television ) Electro-Mechanical Manipulator Cranes Master Slave manipulators

Hoists Remote (“Hanford”) Connector System Specialized Tools (Reach Rods etc.) Robots Descriptions and design guidance for each type follows. Closed Circuit Television (CCTV) Closed circuit TV is generally used to monitor the remotely performed handling and operations activities. The CCTV equipment should meet the electrical performance standards for monochrome television studio facilities EIA Standard EIA-170-57 Electrical Performance Standards ­ Monochrome Television Studio Facilities (Nov., 1957) and EIA Standard IETNTS1 Color Television Studio Picture Line Amplifier Output Drawing (Nov., 1977) (Partial Revision of EIA-170). CCTV electrical wiring should be in accordance with NFPA 70, National Electrical Code. The radiation hardness of the required CCTV system is a function of the particular application, with significant cost and complexity advantages to the non radiation hardened systems, when they are applicable. Each application should define its realistic radiation hardness needs. Electro Mechanical Manipulator Design, fabrication, inspection, and testing of Electro-Mechanical Manipulator (EMM) should comply with the requirements of following codes and standards: Controls NEMA ICS 1-1993 Industrial Control and Systems: General Requirements NEMA ICS 2 through ICS 10 Industrial Control and Systems Electrical NFPA 70 National Electrical Code 1993 Edition 107 DOE-HDBK-6004-99 Related References: Design Guide, Manipulators, Auxiliary Tools, and Handling Devices, ANS 11.9, February, 1985. Force Reflecting Hand Controller for Manipulator Teleoperation, Section 1.3 Final Technical Report NASA Contract # NAS7-1069, Dec. 1991. Cranes Design, fabrication, inspection, testing of cranes should be in accordance with the following codes and standards: Cranes and Hoists: CMAA #70-1975 - “Specifications for Electric Overhead Traveling Cranes, and CMAA #74-1974 - “Specifications for Top Running and Under Running Single Girder Electric Overhead Traveling Cranes and /or ANSI/ASME NOG-1-1989: Overhead and Gantry Cranes (Top Running Bridge, Multiple Girder), Rules for Construction of, ANSI/ASME B30.16-1993: Overhead Hoists (Underhung), and ANSI/ASME NUM-1-1996 Rules for Construction of Cranes, Monorails, and Hoists (with Bridge or Trolley or Hoist of the Underhung Type) Seismic Analysis: CMAA #70 Specification for Electric Overhead Traveling Cranes and /or ANSI/ASME NOG-1-1989: Overhead and Gantry Cranes (Top Running Bridge, Multiple Girder), Rules for Construction of, Overhead and Gantry Cranes: ANSI/ASME B30.2-1996: Overhead and Gantry Cranes (Top Running Bridge, Single or Multiple Girder, Top Running Trolley Hoist) Hooks: ANSI/ASME B30.10-1993: Hooks Electrical: NFPA 70: National Electrical Code 1993 Edition, Art 610 IPCEA S-61-402 and IEEE Standard 835-1994, IEEE Standard Power Cable Ampacity Tables NEMA MG 1-1993 Motors and Generators NEMA ICS 1-1993 Industrial Control and Systems: General Requirement, NEMA WC 3-1992 Rubber Insulated Wire and Cable for the Transmission and Distribution of Electrical Energy (ICEA S-19-1981 Sixth Edition) ANSI C2 ANSI C2-1997 e: National Electrical Safety Code Fire Protection: ANSI/NFPA 12 Carbon Dioxide Extinguishing Systems ANSI/NFPA 12 NFPA 72: National Fire Alarm Code Factory Mutual Approval Guide 108 DOE-HDBK-6004-99 The cranes should be provided with all components and appurtenances required for safe operation and handling, in accordance with the Occupational Safety and Health Administration (OSHA) Regulations Section 1910.179 and ANSI B30.2, ANSI B30.1, B30.16 Safety Codes as applicable.

Remote Manipulators Design, fabrication, inspection and testing of Remote Manipulators should be in conformance with applicable requirements of the following codes and standards: Hooks - ANSI/ASME B30.10-1993: Hooks, and ANSI/ASME B30.1-1992: Jacks Hydraulic Power - ANSI/(NFPA/JIC) T2.24.1-1991: Hydraulic Fluid Power - Systems Standard for Stationary Industrial Machinery Hoists Auxiliary hoists should be designed and manufactured to comply with the Hoist Manufacturers Institute Specification HMI 100 for Electric Wire Rope Hoists and/or ANSI/ASME HST-4M-1991 (R1996): Performance Standard for Overhead Electric Wire Rope Hoists. Remote Connector Systems Remote connector systems (sometimes referred to as “Hanford” type) can be used in the process piping as mechanical jumpers. This type of jumper system allows remote assembly and disassembly of mechanical components such as pumps, valves, pressure vessels, etc. These mechanical jumpers and/or connectors can be remotely operated. The design, fabrication, inspection, and testing of these connector/jumpers and associated equipment should be per manufacturer standards. Remote connector systems (or jumpers) typically consist of rigid or semi-rigid piping or conduit, for process or electrical service, fitted with remotely coupled end connectors. The remote coupling is accomplished with crane, manipulator, or robot induced locking or unlocking. The assemblies must be designed for routine usage under typically harsh environmental conditions. The electrical type connector systems must protect the connecting pins or sockets from damage during the coupling operations. The internal wiring and connector pins/sockets must be suitable for their electrical service relative to amperage, shielding requirement, etc. The entire assembly must meet the electrical classification requirements of the particular service. Historically, electrical systems have incorporated hard clamping, seals, and rigid conduits to meet classification requirements as sealed pressurized housings. Specialized Tools Specialized tools such as custom designed fixtures , wrenches, reach rods, manipulators etc. can be designed for specific requirements of handling and operation of a particular equipment associated with fusion facility plant. These can be custom designed and fabricated using good engineering and industry practices. 109 DOE-HDBK-6004-99 Robots Industrial robots, custom designed robots, and robotic manipulators can perform certain handling functions. The robot systems consists of four major subsystems: the mechanical unit, drive, control system, and tooling. The mechanical unit consists of a fabricated structural frame with provisions for supporting mechanical linkage and joints, guides, actuators, control valves, limiting devices, and sensors. The physical dimensions, design, and loading capability of the robot depend upon the application requirements. Most new robots use electric drives. Pneumatic drives have been used for high speed, non servo robots and are often used for powering tools such as grippers. Hydraulic drives have been used for heavier lift systems, or where severe service is anticipated. Electric drive systems can provide both lift and/or precision, depending on the motor and servo system selection and design. An AC or DC-powered motor may be used depending on the system design and applications. Hydraulic robots should be provided with operational fluids considered non hazardous (i.e. not flammable or corrosive, negligible radiolytic effects, etc.), to avoid the creation of mixed waste. Mixed waste is the combination of hazardous and radiological components in the same waste form, and is extremely difficult to process.

Most industrial robots incorporate computer or microprocessor-based controllers. These perform computational functions, and interface with and control sensors, grippers, tooling, and other peripheral equipment. The control system also performs sequencing and memory functions associated with communication and interfacing for on-line sensing, branching, and integration of other equipment. Controller programming may be done on-line or from remote, off-line control stations. Robot controllers can have self-diagnostic capability, which can reduce the downtime of robot systems. In addition, the robot controller may be in a control hierarchy in which it receives instructions and reports positions or gives directions. Robot manufacturers typically use proprietary language for programming robot controllers and systems. Tooling is manipulated by the robot to perform the functions required for the application. Depending on the application, the robot may have one functional capability, such as making spot welds or spray painting. These capabilities may be integrated with the robots mechanical system or may be attached at the robot’s wrist-end effector interface. Alternatively, the robot may use multiple tools that may be changed manually or automatically during a work cycle. 110 DOE-HDBK-6004-99 Table II-5 following shows Standards and Codes used for robot design, fabrication and safety requirements. Table 5 Standards and codes for robots. Group Standard Subject 1. ANSI/RIA R15.06-1992 Robotic Industries Association standards for Industrial robots and robot systems 2. BSR/RIA BSR/RIA R15.06-1992 (ANSI) Board of Standards Review proposed standard for industrial robots and robot systems 3. ANSI/RIA R15.02-1990 Human engineering design criteria for hand- held robot control pendants 4. OSHA Pub. 2254 (revised) Training requirements in standards and training guidelines 5. NIOSH Pub. 88-108 Safe maintenance guidelines for robotics workstations 6. OSHA Pub. 8-1.3, 1987 Guidelines for robotics safety 7. OSHA 29 CFR 1910.147 Control of hazardous energy source) (lockout/tagout final rule) 8. AFOSH 127-12, 1991 Occupational safety machinery 9. OSHA DOE/EH-0353P OSHA Technical Reference Manual 111 DOE-HDBK-6004-99 Section II References 10CFR50(A) 10CFR50, Appendix A, “General Design Criteria for Nuclear Power Plants,” specifically criteria 1, 13, 19, 20, 22, 23, 24 and 64. 10CFR50(I) 10CFR50, Appendix I, “Numerical Guides for Design Objectives and Limiting Conditions for Operation to Meet the Criterion ‘As Low As Reasonably Achievable” for Radioactive Material in Light Water-Cooled Nuclear Power Plant Effluents.” 10CFR820 Procedural Rules for DOE Nuclear Activities 10CFR830 Nuclear Safety Management 10CFR835 Occupational Radiation Protection ACI 318 ACI 318, “Building Code Requirements for Reinforced Concrete,” 1989 ACI 349 ACI 349, “Code Requirements for Nuclear Safety Related Concrete Structures and Commentary,” 1985 AISC 84 American Institute of Steel Constructors (AISC) standard N690, “Specification for Design, Fabrication and Erection,” 1984. AISC 86a AISC, “Manual of Steel Construction and Specification for the Design, Fabrication and Erection of Structural Steel for Buildings,” 9 Edition, 1986 AISC 86b AISC-LRFD, “Load and Resistance Factor Design Specification for Structural Steel Buildings,” 1 Edition, 1986 AISC N690 American Institute of Steel Constructors (AISC) standard N690, “Specification for Design, Fabrication and Erection,” 1984.

ANSI 83. American National Standard Institute/American Nuclear Society (ANSI/ANS), ANSI/ANS 51.1-1983, “Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants.” ANSI 84 ANSI/AISC N690, “Nuclear Facilities Steel Safety Related Structures Design, Fabrication and Erection,” 1984 ANSI-89 ANSI/IEEE C37.010-1979 (R1989) “Application Guide for AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis (includes supplements ANSI/IEEE C37.010b and C37.010d) ANSI 90 ANSI/RIA R15.02-1-1990, “Human Engineering Design Criteria for Hand- Held Robot Control Pendants” 112 DOE-HDBK-6004-99 ANSI-92 ANSI/ANS 3.8.5-1992 “Criteria for Emergency Radiological Field Monitoring, Sampling, and Analysis” ANSI 92b ANSI/RIA R15.06-1992, “Industrial Robots and Robot Systems - Safety Requirements” ANSI 93 American National Standards Institute (ANSI) ANSI/ASME Standard B31.3, “Chemical Plant and Petroleum Refinery Piping,” 1993. ANSI-95 ANSI/ANS 3.8.6-1995 “Criteria for Conduct of Offsite Radiological Assessment for Emergency Response for Nuclear Power Plants” ANSI-96 “Rules for Construction of Cranes, Monorails, and Hoists (with Bridge or Trolley or Hoist of the Underhung Type,” ANSI/ASME NUM-1-1996. API-620 American Petroleum Institute (API) API-620, “Design and Construction of Large, Welded, Low-Pressure Storage Tanks, Ninth Edition,” 01-Feb-96 API-650 American Petroleum Institute (API), API-650, “Welded Steel Tanks for Oil Storage,” 1993. ASCE 80 “Structural Analysis and Design of Nuclear Plant Facilities,” ASCE, Manual No. 58, 1980 ASCE 93 ANSI/ASCE, “Minimum Design Loads for Buildings and Other Structures,” 7-93, ASCE ASHRAE 91 ASHRAE Handbook of HVAC Application, 1991, Chapter 24 entitled “HVAC for Nuclear Facilities.” ASHRAE ASHRAE, “Design Guide for Department of Energy Nuclear Facilities,” ISBN 1-883413-03-6 ASME 89a ASME N509, “Nuclear Power Plant Air-Cleaning Units and Components” - 1989 ASME 89b ASME N510, “Testing of Nuclear Air Treatment Systems,” 1989 ASME 89c American Society of Mechanical Engineers (ASME), “Rules for Inservice Inspection of Nuclear Power Plants,” Section XI, 1989. ASME 89d ASME Boiler and Pressure Vessel Code Section IX, “Welding and Brazing Qualification,” 1989 Edition ASME 91 ASME Papers: 91-GT-366, “Reliability, Availability, and Maintainability Usage in the Development of the 501F Combustion Turbine and Auxiliaries.” 113 DOE-HDBK-6004-99 92-GT-208, “Reliability Measurements for Gas Turbine Warranty Situations.” 92-GT-236, “Operating Experience and Site Performance Testing of the CW251B12 Gas Turbine Engine.” ASME 93a American Society of Mechanical Engineers (ASME), “Boiler and Pressure Vessel Code,” 1992 Edition with 1993 Addenda. ASME 93b ANSI/ASME, “Chemical Plant and Petroleum Refinery Piping,” Standard B31.3, 1993 ASME 93c ASME AG-1, “Code on Nuclear Air and Gas Treatment,” 1993 ASME 95 ANSI/ASME B40.5-1995, “Snubbers” ASTM-95 ASTM D5537-94 “Heat Release, Flame Spread and Mass Loss Testing of Insulating Materials Contained in Electrical or Optical Fiber Cables When Burning in a Vertical Cable Tray Configuration,” American Society for Testing and Materials, West Conshohocken, PA,1994. AWWA D-100 American Water Works Association (AWWA), AWWA D-100, “Welded Steel Tanks for Water Storage,” 1984, with 1989 Addendum A. Burchsted 76 A. Burchsted, A. B. Fuller, and J. E. Kahn, Handbook,” ERDA 76-21, March 1976 “Nuclear Air Cleaning

CMAA CMAA #70-1975 - “Specifications for Electric Overhead Traveling Cranes and CMAA #74-1974 - “Specifications for Top Running and Under Running Single Girder Electric Overhead Traveling Cranes, Crane Manufacturers Association of America, 1326 Freeport Road, Pittsburgh, PA, 15238. DOD 86 “Seismic Design Guidelines for Essential Buildings, a supplement to Seismic Design for Buildings,” Army TM5-809-10-1, Navy NAVFAC P-355.1, Air Force AFM 88-3, Tri-Service Manual, Departments of Army, Navy and Air Force, Washington, D.C., February 1986 DOE 1020 DOE Standard, “Natural Phenomena Hazards Design and Evaluation Criteria for Department of Energy Facilities,” DOE-STD-1020-94, April 1994 DOE 1021 DOE Standard, “Natural Phenomena Hazards Performance Categorization Guidelines for Structures, Systems, and Components,” DOE-STD-1021-94 DOE 3003 DOE-DP-STD-3003-93, Back-up Power Sources for DOE DP facilities DOE 5480.11 DOE Order 5480.11, “Radiation Protection for Occupational Workers, June, 1990. DOE 5480.23 DOE Order 5480.23, “Nuclear Safety Analysis Reports” 114 DOE-HDBK-6004-99 DOE 5480.28 DOE Order 5480.28, “Natural Phenomena Hazards Mitigation,” January 15, 1993 DOE 5480.4 DOE Order 5480.4, Environmental Protection, Safety and Health Protection Standards,” May 15, 1984. DOE 5632.1C DOE Order 5632.1C, “Protection and Control of Safeguards and Security Interests” DOE 5633.3B DOE Order 5633.3B, “Control and Accountability of Nuclear Materials,” September 7, 1994. DOE 6430.1A DOE Order 6430.1A, General Design Criteria, Division 13, 1989. EIA-170 “Electrical Performance Standards - Monochrome Television Studio Facilities,” Electronic Industries Association, November, 1957 EIA-IETNTS1 “Color Television Studio Picture Line Amplifier Output Drawing,” Electronic Industries Association, Nov., 1977 (Partial Revision of EIA-170) HEI 80 Heat Exchanger Institute, Inc., “Standard for Power Plant Heat Exchangers,” 1/e, Cleveland, Ohio, 1980. HIS Hydraulic Institute Standards, Cleveland, Ohio. HMI 100 “Specification for Electric Wire Rope Hoists,” Hoist Manufacturers Institute, 8720 Red Oak Blvd. Suite 201 - Charlotte, NC 28217 Hord 78 Hord, J., “Is Hydrogen Safe?” International Journal of Hydrogen Energy, Vol. 3, pp. 157-176, 1978. IEC 964 Design for Control Rooms of Nuclear Power Plants, (1989-03) International Electrotechnical Commission 1989. IEEE 80 IEEE 80-1986, “Guide for Safety in AC substation Grounding” IEEE 115 IEEE 115-1995, “Test Procedures for Synchronous Machine” IEEE 142 IEEE 142-1991, “IEEE Recommended Practice for Grounding of Industrial and Commercial Power Systems” IEEE 308 IEEE 308-1991, “IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations” (see also Regulatory Guide 1.6) IEEE 317 IEEE 317-1983, “IEEE Standard for Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations” IEEE 323 IEEE 323-1983 “Qualifying Class 1E Equipment for Nuclear Power Generating Stations,” 1983. 115 DOE-HDBK-6004-99 IEEE 336 IEEE 336-1985, “IEEE Standard Installation, Inspection and Testing Requirements for Power, Instrumentation and Control Equipment at Nuclear Facilities” IEEE 338 IEEE 338-1987, “IEEE Standard Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems” (see also Regulatory Guide 1.118) IEEE 344 IEEE 344-1987 “IEEE Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations”

IEEE 352 IEEE 352-1987, “IEEE Guide for General Principles of Reliability Analysis of Nuclear Generating Station Safety Systems IEEE 379 IEEE 379-1994, “IEEE Standard Application of the Single Failure Criterion to Nuclear Power Generating Station Safety Systems” (see also Regulatory Guide 1.53) IEEE 382 IEEE 382-1996 “IEEE Standard for Qualification of Actuators for Power- Operated Valve Assemblies with Safety-Related Functions for Nuclear Power Plants,” (see also regulatory Guide 1.73) IEEE 383 IEEE 383-1974 “IEEE Standard for Type Testing of Class 1E Electrical Cables, Field Splices, and Connections for Nuclear Power Generating Stations” IEEE 384 IEEE 384-1992 “IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits,” (see also Regulatory Guide 1.75) IEEE 386 IEEE 386-1995 “IEEE Standard for Separable Insulated Connector systems for Power Distribution systems Above 600 V” IEEE 387 IEEE 387-1995 “IEEE Standard Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations,” (see also Regulatory Guide 1.9) IEEE 420 IEEE 420-1982 “IEEE Standard for the Design and Qualification of Class 1E Control Boards, Panels, and Racks Used in Nuclear Power Generating Stations” IEEE 450 Recommended Practice for Maintenance Testing and Replacement of Large Lead Storage Batteries for Generating Stations and Substations (see also Regulatory Guide 1.129) IEEE 485 IEEE 485-1983 “IEEE Recommended Practice for Sizing Large Lead Storage Batteries for Generating Stations and Substations” 116 DOE-HDBK-6004-99 IEEE 577 IEEE 577-1976 “IEEE Standard Requirements for Reliability Analysis in the Design and Operation of Safety Systems for Nuclear Power Generating Stations” IEEE 603 IEEE 603-1991 “IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations” IEEE 730 IEEE 730-1989 “IEEE Standard for Software Quality Assurance Plans” IEEE 829 IEEE 829-1983 “IEEE Standard for Software Test Documentation” IEEE 830 IEEE 830-1993 “IEEE Recommended Practice for Software Requirements Specifications” IEEE 1012 IEEE 1012-1986 “IEEE Standard for Software Verification and Validation Plans” IEEE 1016 IEEE 1016-1987 Descriptions” “IEEE Recommended Practice for Software Design IEEE 1042 IEEE 1042-1987 “IEEE Guide to Software Configuration Management” IEEE 1063 IEEE 1063-1987 “IEEE Standard for Software User Documentation” IPCEA Insulated Power Cable Engineers Association (IPCEA) Standards: S-19-81 and S-66-524 Publications: P-46-426 and P-54-440 ISA 67.02 S67.02.01: Nuclear Safety-Related Instrument Sensing Line Piping and Tubing Standard for Use in Nuclear Power Plants ISA 67.04 S67.04--Part I: Setpoints for Nuclear Safety-Related Instrumentation-­ ANSI/ISA-1994 RP67.04--Part II: Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation-1994 ISA 67.06 ITER S67.06: Response Time Testing of Nuclear Safety-Related Instrument Channels in Nuclear Power Plants--ANSI/ISA-1984 “ITER Outline Design Report” document # ITER TAC-4-01, “ITER Outline Design Summary” document # ITER TAC-4-02, “ITER Safety and Environment” document # ITER TAC-4-13. NEMA ICS 1 “Industrial Control and Systems: General Requirements,” NEMA ICS-1­ 1993, National Electrical Manufacturers Association, 1993. 117 DOE-HDBK-6004-99 NEMA ICS 2 through ICS 10 Industrial Control and Systems NEMA MG-1 NEMA Standard MG 1-1993 Motors and Generators

NEMA VE-1 NEMA Standard VE 1-1991, Metal Cable Tray Systems NFPA 12 ANSI/NFPA 12, “Carbon Dioxide Extinguishing Systems,” National Fire Protection Association. NFPA 69 NFPA 69, “Explosion Prevention Systems,” National Fire Protection Association, 1997. NFPA 70 NFPA 70, National Electrical Code, “Chapter 5, Special Occupancies, Article 500-Hazardous (Classified) Locations,” National Fire Protection Association, 1993. NFPA 92A NFPA 92A, “Smoke-Control Systems,” National Fire Protection Association, 1996. NFPA 204M: NFPA 204M, “Smoke and Heat Venting,” National Fire Protection Association, 1991. NFPA 262 ANSI/NFPA 262, “Fire and Smoke Characteristics of Wires and Cables,” National Fire Protection Association, 1994. NFPA 780 NFPA 780 “Lightning Protection Code,” National Fire Protection Association, 1995. NUREG-0800 NUREG-0800, “Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants,” Chapter 7.1 RG 1.6 Regulatory Guide 1.6, “Independence Between Redundant Standby (On-Site) Power Sources and Between Their Distribution Systems RG 1.30 Regulatory Guide 1.30, “Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment,” August 1972. RG 1.47 Regulatory Guide 1.47, “Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems,” US Nuclear Regulatory Commission, May 1973. RG 1.53 Regulatory Guide 1.53, “Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems” 118 DOE-HDBK-6004-99 RG 1.63 Regulatory Guide 1.63, “Electric Penetration Assemblies in Containment Structures for Nuclear Power Plants.” U.S. Nuclear Regulatory Commission, February 1987. RG 1.75 Regulatory Guide 1.75, “Physical Independence of Electric Systems,” US Nuclear Regulatory Commission, September 1978. RG 1.89 Regulatory Guide 1.89, “Environmental Qualification of Certain Electric Equipment Important to Safety for Nuclear Power Plants” RG 1.100 Regulatory Guide 1.100, “Seismic Qualification of Electric and Mechanical Equipment and Mechanical for Nuclear Power Plants” RG 1.105 Regulatory Guide 1.105, “Instrument Setpoints for Safety-Related Systems” RG 1.131 “Qualification Tests of Electric Cables, Field Splices and Connections for Light-Water Cooled Nuclear Power Reactors” RG 1.139 “Guidance for Residual Heat Removal” RG 1.140 Regulatory Guide 1.140, “Design, Testing and Maintenance Criteria for Normal Ventilation Exhaust System Air Filtration and Absorption Units of Light Water Cooled Nuclear Power Plants,” US Nuclear Regulatory Commission, October 1979. RG 1.153 “Criteria for Power, Instrumentation and Control Portions of Safety Systems” TEMA Tubular Exchanger Manufacturers Association, “TEMA Standards,” Seventh Edition, Tarrytown, NY, 1988. UBC 94 “Uniform Building Code,” International Conference of Building Officials, Whittier, CA, 1994 UCRL 15910 University of California Research Labs (UCRL), UCRL-15910, “Design and Evaluation Guidelines for Department of Energy Facilities Subjected to Natural Phenomena Hazards,” 1990. West 211 Westinghouse RB211 ECONOPAC - 27 MW Combustion Turbine Packaged Plant 119 DOE-HDBK-6004-99 INTENTIONALLY BLANK 120 DOE-HDBK-6004-99 SECTION III ADMINISTRATIVE AND OPERATIONAL TECHNIQUES CONCEPT OF OPERATIONS Purpose The purpose of this section is to establish a conduct of operations program which should result in improved quality and uniformity of operations. Supplemental Guidance

Appendix A provides a listing of guidance documents that may be useful in developing the site specific conduct of operations program. Policy Fusion facilities should have a policy that assures: operations are managed, organized and conducted in a manner to assure an acceptable level of safety; and operators have procedures in place to control the conduct of their operations. Guidance Experience has shown that the better operating facilities have well defined, effectively administered policies and programs to govern the activities of the operating organization, including the areas described by these guidelines. The guidance is based upon well developed industrial operations practices. They are written to be flexible, so that they encompass the range of facilities and operations. Each fusion facility should develop a conduct of operations program which covers the following topics, as appropriate, using a graded approach. Specifics for each of the sections can be found in the references cited in Appendix A. Operations Organization and Administration The organization and administration of operations should ensure that a high level of performance is achieved through effective implementation and control of operations activities. Operations should establish a policy of excellence under which the facility is operated and clear lines of responsibility for normal and emergency conditions are established. Policies, resources, monitoring and accountability for operations should be established to meet this guideline. Shift Routines and Operating Practices Standards for the professional conduct of operations personnel should be established and followed so that the operator performance meets the expectations of facility management. Specifically, requirements for watch standing practices and routine shift practices should be established. 121 DOE-HDBK-6004-99 Control Area Activities This area should address important elements of control area activities that are necessary to support safe and efficient facility operations. Communications This area should address important aspects of providing accurate transmission of information within the facility. Control of On-Shift Training This area should address the control of training activities by operations personnel in the area of hands- on operational experience. Investigation of Abnormal Events A process for the investigation of abnormal events should ensure that facility events are thoroughly investigated to assess the impact of the event, to determine the root cause, and to identify corrective actions to prevent recurrence of the event. Notifications A process to notify appropriate personnel and agencies should be employed by the facility for issues affecting public health and safety. Control of Equipment and System Status A process should be in effect to ensure that the facility configuration is maintained in accordance with the design requirements and that the operating shift knows the status of the equipment and systems. Lockouts and Tagout A process should be in effect provide a method for equipment status control through component tagging or locking which protects personnel from injury, protects equipment from damage, maintains operability of plant systems and maintains the integrity of the physical boundaries of plant systems. Independent Verification An independent verification process should be established to assure that the correct position of components such as valves, switches and circuit breakers are maintained to provide a high degree of reliable operations.

Logkeeping Requirements for operations records should be established which includes narrative logs of the facilities status and a history of facility operations. 122 DOE-HDBK-6004-99 Operations Turnover A method for shift turnovers should be established so that oncoming operators are provided with an accurate picture of the overall facility status. Operations Aspects of Facility Chemistry and Unique Processes Processes should be established for monitoring chemistry and unique process parameters to promote maximum component life and reliable operations. Required Reading A required reading process should be established so that operations personnel are made aware of important information that is related to job assignment. Timely Orders to Operators Plant management should establish a means to communicate short-term information and administrative instructions to operations personnel in a timely manner. Operations Procedures Operations procedures should be established to provide appropriate direction to ensure that the facility is operated within its design bases and should be effectively used to support safe operation of the facility. Operator Aid Postings An operator aid process should be established to ensure that operator aids that are posted are current, correct, and useful. Equipment and Pipe Labeling A well established and maintained equipment labeling process should be established to help ensure that facility personnel are able to positively identify equipment they operate. EMERGENCY PREPAREDNESS Purpose To establish requirements for Emergency Management Programs for operational emergencies involving fusion facilities. Fusion facilities should develop, using a graded approach, an emergency management program consistent with the determined level of risk at the facility. Supplemental Guidance Appendix B provides a listing of guidance documents that may be useful in developing the site specific emergency management program. 123 DOE-HDBK-6004-99 Appendix C provides a listing of definitions used in this section of the document. Concept of Operations The Emergency Management System (EMS) should include a graded approach to emergency management concepts such as planning, preparedness, and response. “Planning” includes the development and preparation of emergency plans and procedures and the identification of necessary personnel and resources to provide an effective response. “Preparedness” includes the training of personnel, acquisition and maintenance of resources, and exercising of the plans, procedures, personnel, and resources essential for emergency response. “Response” represents the implementation of planning and preparedness during an emergency and involves the effective decisions, actions, and application of resources that must be accomplished to mitigate consequences and recover from an emergency. Operational Emergency Event Classes Emergencies should be characterized as one of the Operational Emergency classes (e.g., Alert, Site Area Emergency, or General Emergency). Emergency Action Levels (EALs), the specific criteria used to recognize and categorize events, should be developed for the spectrum of potential operational emergencies consistent with the hazards assessment. Alert

An event in progress or having occurred which involves an actual or potential substantial reduction of the level of safety of the facility. Limited offsite releases of radioactive materials may occur. For other toxic materials, offsite releases are not expected to exceed applicable, permissible limits. The purpose of an Alert level is to assure that onsite and offsite emergency response personnel are properly advised and available for activation if the situation becomes more serious, to initiate and perform confirmatory monitoring as required, and to assure appropriate notification of emergency conditions to the responsible organizations. Site Emergency An event in progress or having occurred which involves actual or likely major failures of facility functions which are needed for the protection of onsite personnel, the public health and safety, and the environment. Significant releases offsite of radioactive material are likely or are occurring. For other toxic materials, offsite releases have the potential to exceed applicable permissible limits. The purpose of the site emergency level is to assure that emergency control centers are manned, appropriate monitoring teams are dispatched, personnel required for determining onsite protective measures are at duty stations, predetermined protective measures for onsite personnel are initiated, and to provide current information and consultation with offsite officials and organizations. General Emergency An event in progress or having occurred which involves actual or imminent substantial reduction of facility safety systems. Releases offsite of radioactive materials are occurring or expected to occur and exceed allowable limits. Offsite releases of other toxic materials are expected to exceed 124 DOE-HDBK-6004-99 applicable permissible limits. The purpose of the general emergency level is to initiate predetermined protective measures for onsite personnel, the public health and safety, and the environment, and to provide continuous assessment of emergency conditions and exchange of information both onsite and offsite. Declaration of a general emergency will initiate major activation of resources required to effectively mitigate the consequences of emergency conditions and assure the protection of onsite personnel, the public health and safety, and the environment to the extent possible. Emergency Plans and Procedures An emergency plan and procedures should be developed for the fusion facility. The plan is a documented “concept of operation” that describes the essential elements of advance planning that have been considered and the provisions that have been made to mitigate emergency situations. The plan should incorporate information about the emergency response roles of supporting organizations and agencies and should be consistent with a graded approach to managing an incident. Programs must consist of special emergency plan implementing procedures (e.g., EALs, event categorization, notification, Emergency Operations Center operation) as well as other procedures currently in use (e.g., equipment operation, chemistry controls, radiological monitoring, and maintenance) which would be utilized in, or associated with, emergency response activities. Procedures must be consistent and compatible with the emergency plan. Emergency procedures must contain the detailed information and the specific instructions needed to carry out the emergency plan during a drill, exercise, or actual emergency.

Procedures must maintain consistency with the general graded approach and nomenclature of emergency planning and preparedness elements within Federal and State agencies, private industry, tribal, and local authorities. Hazards Assessment Hazards assessments provide the technical basis for emergency management programs. The extent of emergency planning and preparedness required for a particular facility directly corresponds to the type and scope of hazards present and the potential consequences of accidents or events. A hazards assessment includes identification of any hazards and targets unique to a facility, analyses of potential accidents or events, and evaluation of potential accident or event consequences. Methodology, models, and evaluation techniques used in the hazards assessment should be documented. Also, the hazards assessment should include a determination of the size of the Emergency Planning Zones where applicable, i.e., the area surrounding the facility for which special planning and preparedness efforts are required to ensure that prompt and effective protective actions can be taken to minimize the risk to workers, the general public, and the environment. Other hazards assessments are documented in Material Safety Data Sheets; Safety Assessments; Spill Prevention, Control, and Countermeasure Plans; Pre-Fire Plans; Environmental Assessments and Impact Statements (EAs and EISs); ERPG's; Severe Accident Analyses; and the Emergency and Hazardous Chemical Inventory Forms and Toxic Chemical Release Forms, prepared pursuant to the requirements of the Emergency Planning and Community Right-to-Know Act (SARA Title III). 125 DOE-HDBK-6004-99 Emergency Response Organization An emergency response organization should have overall responsibility for the initial and ongoing response to, and mitigation of, an emergency, and must perform, but not be limited to, the following functions: Event categorization, determination of the emergency class, notification, provision of protective action recommendations, management and decision making, control of onsite emergency activities, consequence assessment, medical support, public information, activation and coordination of onsite response resources, security, communications, administrative support, and coordination and liaison with offsite support and response organizations; Consist of an adequate number of experienced and trained personnel, including designated alternates, for timely performance of the functions identified above; Assign emergency response responsibilities and tasks to specific individuals identified by title, or position; and Integrate local agencies and organizations which would be relied upon to provide onsite response services and include those contractor and private organizations that may be relied upon to provide specialized expertise and assistance to all emergency planning, preparedness, and readiness assurance activities. Offsite Response Interfaces Provisions should be in place for interface and coordination with Federal, state, tribal, and local agencies and organizations responsible for offsite emergency response and for protection of the environment and the health and safety of the general public. Interrelationships with offsite organizations should be prearranged and documented. Notification Provisions should be in place for prompt initial notification of emergency response personnel and response organizations, including appropriate offsite elements and for continuing effective communication among the response organizations throughout an emergency.

Consequence Assessment Provisions should be in place to adequately assess the actual or potential onsite and offsite consequences of an emergency and include: 1. Timely initial assessment of the actual or potential consequences. 2. Integration of consequence assessment with the process for categorization of an event as an emergency. 3. Monitoring and evaluation of the specific indicators necessary to continually assess the consequences of emergency events. 126 DOE-HDBK-6004-99 4. Coordination with Federal, state, tribal, and local organizations to locate and track hazardous materials released to the environment. Protective Actions Where applicable, provisions should be in place for predetermined actions to be taken in response to emergency conditions to protect onsite personnel and the public and include: 1. Protective Action Guides (PAGs) and Emergency Response Planning Guidelines (ERPGs). 2. Control, monitoring, and maintenance of records of onsite personnel exposures to hazardous materials; 3. Accountability for facility personnel of emergency determination, and timely sheltering and/or evacuation of workers, in the affected area. 4. Radiological and/or hazardous material decontamination of workers and equipment evacuated from the site; 5. Determination of the area surrounding the specific facility actually affected by an Operational Emergency; and 6. Timely recommendation to appropriate offsite organizations of protective actions, such as sheltering and/or evacuation, for the general public, where applicable. Medical Support Provisions should be in place for medical support for workers, including those with radiological and/or hazardous material contamination, and include: 1. Immediate, onsite first aid and emergency medical treatment capability; 2. Transportation of injured onsite personnel to onsite or offsite medical facilities, as appropriate; and 3. Documented arrangements with onsite and offsite medical facilities to accept and treat contaminated, injured personnel. Recovery and Reentry Provisions should be made for recovery and reentry from an operational emergency and reentry into the affected facility. The approach and general procedures for recovery include: decision making and communications associated with termination of an emergency; dissemination of information to offsite organizations regarding the emergency and relaxation of public protective actions; establishment of a recovery organization; and establishment of general criteria for resumption of normal operations. The means must exist for estimating dosage and for protecting workers and the general public from hazardous exposure during recovery and reentry activities. 127 DOE-HDBK-6004-99 Public Information An emergency public information program should be developed to ensure that necessary public affairs actions are planned, coordinated and taken as an integral part of the total emergency response effort. Emergency Facilities and Equipment Facilities and equipment, adequate to support emergency response, should be established and maintained as follows: 1. An Emergency Operations Center (EOC) should be established from which the emergency response organization assesses, evaluates, coordinates, and directs emergency response activities and communicates within DOE and offsite response organizations. 2. The staffing, operation, and response activities pertaining to the EOC, should be predetermined and documented in procedures for a timely and coordinated overall emergency response.

3. Primary and backup means of communications should be available. 4. Adequate equipment and supplies should be available and operable for emergency response personnel to carry out their respective duties and responsibilities. 5. Training 6. Training must be provided to effected workers regarding operational emergencies, and specialized training must be conducted for workers and be available to offsite emergency response organizations. 7. Training should be provided annually to workers who may have to take protective actions (e.g., assembly, evacuation) in the event of an emergency. 8. A training program should be in place for the instruction and qualification of personnel (i.e., primary and alternate) comprising the facility emergency response organization to include initial training and bi-annual retraining for both onsite and offsite incidents, including transportation incidents. 9. Retraining should include training on weaknesses detected during drills and exercises, changes to plans and procedures, and lessons learned from emergencies at other facilities. 10. Offsite emergency response organizations should be offered facility-specific orientation training and information on hazards and emergency response bi-annually. Drills and Exercises A coordinated program of drills and exercises should be an integral part of the emergency management program as follows: 128 DOE-HDBK-6004-99 Drills Drills should be used to develop and maintain personnel skills, expertise, and response capability. Drills should be of sufficient scope and frequency to ensure adequate response capability in applicable areas. Drills should include emergency response activities such as notification, emergency communication, fire, medical emergencies, hazardous material detection and monitoring, environmental sampling and analyses, security, personnel, accountability, evacuation, emergency categorization, decontamination, facility activation, public information, and health physics. There should be at least one drill per year to train in notification and emergency communications with offsite authorities. Exercises “Table Top” exercises should be conducted annually to test and demonstrate an integrated emergency response capability. A full participation exercise should be conducted bi-annually in accordance with established plans and implementing procedures. A controller and evaluation group should be established for each exercise to ensure that events occur which address the objectives of the exercise. A critique process should be conducted for each exercise to provide accomplishments and shortcomings discovered during the exercise; Each member of the functional emergency response organization should participate in a “table top” drill and/or exercise at least annually to demonstrate proficiency in assigned response duties. TRAINING AND QUALIFICATION REQUIREMENTS Purpose The purpose of this section is to establish the staffing, training, qualification, and certification (herein called training and qualification) requirements for personnel at fusion facilities. It contains requirements that must be included in training and qualification programs using a graded approach based upon the hazards of the facility. The requirements are based on governmental and related industry standards. Supplemental Guidance Appendix D provides a listing definitions used in this section of the document. It also provides a listing of guidance documents that may be useful in developing the site specific training and qualification programs.

Administrative Requirements General Facility Requirements The responsibilities and authority of individuals must be specific, and appropriate plans and procedures must be developed and implemented to assure that the objectives of this program are met. Each fusion facility should: 129 DOE-HDBK-6004-99 1. Develop and implement a training and qualification program using a graded approach based upon the hazards of the facility; 2. Prepare, approve and implement a training plan that sets forth the staffing, training, and qualification requirements. Training Organization Each facility should establish an organization that is responsible for the training and qualification of facility personnel. The duties, responsibilities, qualifications and authority of training organization personnel should be documented, and managerial responsibilities and authority clearly defined. Contracted Personnel Each facility should establish training and qualification criteria for contracted personnel used in facility organizations: 1. Contracted personnel who act as regular employees in the organization should complete the same training and qualifications programs required of regular employees, as appropriate to the job. 2. Contracted personnel who perform specialized, temporary or other scope-of-work functions should be qualified by their contracting company to perform their assigned jobs. The facility should provide any facility-unique training that may be required. When contracted personnel used do not meet the training and qualification criteria established, their work should be overseen by qualified personnel. Facility Training Plan The facility training plan is the document that provides the overall description of facility staffing, training, qualification, and certification programs. This plan should be prepared to address the following: 1. Initial and continuing training programs, including maintenance of training; 2. Training and qualification programs for personnel who require formal qualification and certification; and 3. Examination program requirements for qualification and certification. The facility training plan should be supplemented, as needed, with written procedures that address, as a minimum: examination and operational evaluation development, approval, security, administration, and maintenance; administration of medical requirements; and recordkeeping requirements. 130 DOE-HDBK-6004-99 Personnel Selection and Staffing Personnel Selection Each facility should establish a process for the selection and assignment of personnel. The personnel selection process should include an evaluation of their education, experience, previous training, and existing job skills and capabilities. It is the responsibility of management to assure that personnel assigned to a specific job function have the requisite background and/or receive sufficient qualification training for the job. In those cases where an individual does not meet the literal experience requirements for the position, consideration should be given to the collective experience of the work unit. Individuals who do not meet the experience requirements for a position may be assigned to that position provided the experience of the overall work unit is considered balanced and strong. In such cases, the decision to assign the individual should be documented and approved by facility management.

Entry-level education and experience minimums are provided in Appendix D. In addition, each facility should describe in a procedure methods for accepting alternatives to the specified education and experience minimums. Examples of alternatives are provided in Appendix D. Personnel Staffing The following categories of facility staff are identified as requiring training, qualification, or certification in order to perform job functions [see Appendix D for definitions]. If qualification or certification is identified, it should be documented in writing. 1. Operators and their Supervisors - those who operate primary systems (such as those that produce the fusion reaction) require certification. Those who operate other systems (such as auxiliary systems) require qualification. 2. Technicians - training 3. Maintenance Personnel - training 4. Supervisors and Managers - training 5. Operations and Facility Support Functions - those who perform engineering or analytical support functions require training. Those who perform specialized support functions (such as quality control, radiation control, or emergency response) require qualification. Training Requirements Training Matrices The program for personnel who require only training is typically detailed in a training matrix prepared in accordance with a facility procedure. This matrix should include the training requirements as appropriate to the job function. 131 DOE-HDBK-6004-99 Qualification and Certification Procedures Positions that require formal qualification or certification should be documented in a written procedure that outlines the qualification or certification requirements. Management Training Personnel with management responsibilities should receive training in managerial, communication, and interpersonal skills that is appropriately tailored to the organization that they supervise. In disciplines where this training is not included in the manager's university or college curricula (such as the scientific and engineering disciplines), the plan should require such training as part of the functional responsibilities of those managers. Training Exceptions Initial training programs are developed for personnel with entry-level knowledge and skills. In some cases, personnel may already possess the requisite knowledge and skills, and may be excepted from training. The basis for exceptions includes education, prior training, experience, or challenge testing. Job Incumbency may also be used as a basis for exception for entry-level training and examination requirements based upon the individual’s incumbency prior to the development of training and examination requirements and the cognizant manager’s verification of technical competency in the stated job function. Personnel who develop or present training programs should receive training credit for their activities and are excepted from completing this training as “participants.” As a general rule, exceptions to “hands-on” training or “on the job” may not be granted due to the unique nature of such training, except for those individuals who develop or present such training. Exceptions to training (other than by challenge testing or material development/presentation) should be documented in writing and approved by the facility Training Manager, as recommended by facility line management. Such documentation should include the name of the individual, the specific training for which exception is taken, and full and detailed justification for the exception. In no case should exceptions be granted for required qualification or certification examinations for non-job incumbents.

Training Programs Training programs at fusion facilities should consist of regulatory-driven training (such as OSHA training) and position-specific training (procedures and methods associated with the job function), to the extent needed. Training Required for Facility Access Each facility should define the minimum training required access (escorted and unescorted). It should be recognized that completion of access training does not automatically grant access authorization for the facility. Facility management retains the right to authorize or deny access, in accordance with approved procedures. 132 DOE-HDBK-6004-99 Minimum training required for facility access should include General Employee Training and Radiation Safety Training. Initial Training Requirements The training matrix should include required and recommended entry-level training for the job function. Each line manager should identify initial training requirements, training priorities, and the sequence of training for personnel under their supervision who require only training. The qualification or certification procedure, as applicable, should identify required and recommended entry-level training for the job function. Such procedures should include both technical (subject matter) and training evaluators reviews. Continuing Training Requirements Continuing training programs should be implemented to maintain and enhance the proficiency of personnel. A required reading program may also be used, when appropriate, to accomplish continuing training. Maintenance of Training Continuing training includes topics which require renewal. The following is recommended: 1. Two (2) year renewals for General Employee Training and Radiological Health and Safety programs. 2. “Just in Time” training for facility changes, “Lessons Learned” training and when a governing document changes, as in the case of procedures. Unless specified by a regulatory rule, renewal intervals should be determined by each facility based upon experience with the topic. Personnel should maintain training in those topics required to support their job function. If an individual does not maintain training, only that part of their job covered by the lapsed training is impacted. Qualification Requirements Qualified Operators and Supervisors The qualification program for qualified operators and supervisors should be detailed in a procedure that addresses the following elements of this section. Upon completion of program requirements, the candidate may be granted qualification. Education and Experience Minimum education and experience requirements should be established. Recommended requirements are detailed in Appendix D. 133 DOE-HDBK-6004-99 Specific Training Specific training requirements should be detailed in a training curriculum developed for the qualification procedure. The training curriculum should prescribe the minimum training required for qualification, and should include classroom , practical and on-shift. Medical Examinations Medical examination requirements are based upon the physical demands imposed by the job function. If required, medical examinations are conducted at periodic intervals not to exceed two years. Medical examination criteria should be detailed in the qualification procedure. Written Examinations Written examinations should be required for qualification candidates. However, they are not required when the training curriculum does not support the need for written examinations, or when the administration of a written examination does not add value to the overall qualification process.

Operational Evaluations Operational evaluations should be required for qualification candidates. Maintenance of Proficiency Initial qualifications should be issued for an effective period not to exceed two (2) years, unless otherwise suspended or revoked, at which time Requalification is required. If it is determined at any time that the capabilities of an individual are not in accordance with the qualifications specified for that job, that individual should be removed from that job. Reinstatement may be made upon completion of remedial actions, such as retraining and/or reexamination. Requalification Factors The qualification procedure should clearly denote which method of Requalification is required for the specified job function. Requalification should be granted based upon successful completion of Requalification examinations (written and/or operational evaluation) or continuous satisfactory performance documented in writing by the cognizant supervisor and approved by the applicable line manager. Other Qualified Positions The qualification program for positions other than operators and supervisors should be detailed in a procedure that addresses education and experience, medical examination criteria, and training and examination requirements, as appropriate to the job function. Upon completion of program requirements, the candidate may be granted qualification. Personnel qualifications other than those for operators and supervisors may be issued with an indefinite effective period, unless otherwise suspended or revoked, at which time Requalification is required. 134 DOE-HDBK-6004-99 Certification Requirements Certified Operators and Supervisors The program leading to certification for operators and supervisors should be governed by a written procedure, which includes requirements for documented assessment of the person’s qualifications through examination and operational evaluations. Upon completion of program requirements, the candidate may be granted certification. The procedure should address the following elements: Education and Experience Minimum education and experience requirements should be established. Recommended requirements are detailed in Appendix D. Specific Training Specific training programs should be established to develop or enhance the knowledge, skills, and ability of certified operators and certified supervisors to perform job assignments. The program should consist of a combination of classroom and on-the-job training, as it applies to the position and include training on basic theory and fundamentals, principles of facility operation and operating characteristics, facility systems, and normal, abnormal, and emergency operating procedures. The training curriculum should prescribes the minimum training required for certification, and include classroom, practical and on-shift training. Medical Examinations A candidate for certification should received an initial medical examination by a physician and should be reexamined at least every 2 years to verify health and physical fitness to perform assigned tasks safely. Medical examination criteria and documentation should be detailed in the certification procedure. Written Examinations Written examinations should be required for certification candidates. Oral Examinations Oral examinations should be required for certification candidates if the position requires the ability to work proficiently under pressure and to make facility-affecting decisions in real-time scenarios. Oral examinations may be conducted as a one-on-one walkthrough or as a formal oral board.

Operational Evaluations Operational evaluations should be required for certification candidates. 135 DOE-HDBK-6004-99 Independent Verification The qualifications of candidates should be independently verified prior to certification. This verification should be performed by an individual who was not involved in the training process or who is not in the candidate’s line organization. The Independent Verification process should be described in the certification procedure. Maintenance of Proficiency Initial certifications are issued for an effective period not to exceed two (2) years, unless otherwise suspended or revoked, at which time recertification is required. Certified operators and supervisors should actively participate in certification duties to maintain an active certification status. The certification procedure should establish requirements and frequency necessary to maintain an active status. Evidence of this activity must be documented and retained in the individual’s file. If an individual has not performed within this specified time, the certification should be suspended and placed on “inactive” status. If it is determined at any time that the capabilities of an individual are not in accordance with the qualifications specified for that job, that individual should be removed from that job. Reinstatement may be made upon completion of remedial actions, such as retraining and/or reexamination. Recertification and Certification Extension The certification procedure should denote which method of recertification is required for the specified job function. Recertification of operators and supervisors is based upon: continuous active status in the certification; has performed certification duties competently and safely; has a current medical examination; capable of continuing to assume certification duties competently and safely; current in the continuing training program; and comprehensive evaluation of performance is documented in writing and approved by the applicable line manager. Certifications may be extended for ninety (90) days beyond the effective period of certification with written approval of the certifying authority. In no case should a certification be extended beyond 180 days. Other Certified Positions The certification program for other certified positions should be detailed in a procedure that addresses education and experience, medical examination criteria, and training and examination requirements, as appropriate to the job function. Upon completion of program requirements, the candidate may be granted certification. Other personnel certifications are issued with an effective period specified by a national consensus code or standard, as appropriate, unless otherwise suspended or revoked, at which time recertification is required. Examinations Procedures for development, approval, security, administration, and maintenance of examinations and operational evaluations should be established. 136 DOE-HDBK-6004-99 Written Examinations Written examinations should be based upon the topics presented in classroom training portion of the training curriculum as detailed in the qualification or certification procedure and contain a representative selection of questions derived from these topics. The qualification or certification procedure should identify the passing score for written examination. The written examination score for qualification or certification may be a composite grade of all individual examination scores.

Oral Examinations Oral examinations should be based upon the topics presented in classroom and/or practical training portion of the training curriculum detailed in the certification procedure. No numerical value is assigned to oral examinations. The candidate's responses should be evaluated by the examiner as “satisfactory” or “unsatisfactory” based upon the individual exhibiting a basic knowledge in the questioned area and the individual is capable of correctly responding to the question. The questions asked, the candidate's responses to those questions, and the examiner's evaluation should be documented. The oral examination score for certification should be a composite grade of all individual oral examinations. Operational Evaluations Operational evaluations are based upon the performance items presented in practical training portion of the training curriculum detailed in the qualification or certification procedure. Operational evaluations should require the candidate to demonstrate an understanding of, and the ability to perform the actions necessary to operate the facility safely. Operational evaluations should contain questions and operational exercises, and may include system and/or component operations. No numerical value is assigned to operational evaluations. The candidate's demonstrations are evaluated by the examiner as “satisfactory” or “unsatisfactory.” The job functions demonstrated, the candidate's performance in these demonstrations, and the examiner's evaluation should be documented. The operational evaluation score for qualification or certification should be a composite grade of all individual operational evaluations. Records Each qualification and certification procedure should specify the records used to document an individual’s qualifications, and specify how such documentation is processed for approval. Training records should be developed, prepared, and maintained in accordance with written procedures. These procedures should identify the types of records kept and organization responsible for controlling and retaining training records. Records of initial qualification, certification and Requalification should be maintained as individual files. Records should be documented and include the following types of information: 1. Records of education and experience, including resumes; 2. Results of medical examinations (when required); 3. Records of training completed, such as attendance sheets or computer summaries; 137 DOE-HDBK-6004-99 4. Records of training exceptions; 5. Results of examinations, including written examinations and operational evaluations (when required); 6. Evidence of maintenance of proficiency; and 7. Approvals and effective dates, if applicable. 138 DOE-HDBK-6004-99 APPENDIX A CONDUCT OF OPERATIONS SUPPLEMENTAL GUIDANCE DOE-STD-1030-96 Guide to Good Practices for Lockouts and Tagouts DOE-STD-1031-92 Guide to Good Practices for Communications (includes Change Notice No. 1, December 1998) DOE-STD-1032-92 Guide to Good Practices for Operations Organization and Administration (includes Change Notice No. 1, December 1998) DOE-STD-1033-92 Guide to Good Practices for Operations and Administration Updates through Required Reading (includes Change Notice No. 1, December 1998) DOE-STD-1034-93 Guide to Good Practices for Timely Orders to Operators (includes Change Notice No. 1, December 1998) DOE-STD-1035-93 Guide to Good Practices for Logkeeping (includes Change Notice No. 1, December 1998)

DOE-STD-1036-93 Guide to Good Practices for Independent Verification (includes Change Notice No. 1, December 1998) DOE-STD-1037-93 Guide to Good Practices for Operations Aspects of Unique Processes (includes Change Notice No. 1, December 1998) DOE-STD-1038-93 Guide to Good Practices for Operations Turnover (includes Change Notice No. 1, December 1998) DOE-STD-1039-93 Guide to Good Practices for Control of Equipment and System Status (includes Change Notice No. 1, December 1998) DOE-STD-1040-93 Guide to Good Practices for Control of On-shift Training (includes Change Notice No. 1, December 1998) DOE-STD-1041-93 Guide to Good Practices for Shift Routines and Operating Practices (includes Change Notice No. 1, December 1998) DOE-STD-1042-93 Guide to Good Practices for Control Area Activities (includes Change Notice No. 1, December 1998) DOE-STD-1043-93 Guide to Good Practices for Operator Aid Postings (includes Change Notice No. 1, December 1998) DOE-STD-1044-93 Guide to Good Practices for Equipment and Piping Labeling (includes Change Notice No. 1, December 1998) DOE-STD-1045-93 Guide to Good Practices for Notifications and Investigation of Abnormal Events (includes Change Notice No. 1, December 1998) DOE-STD-1050-93 Guideline to Good Practices for Planning, Scheduling and Coordination of Maintenance at DOE Nuclear Facilities 139 DOE-HDBK-6004-99 INTENTIONALLY BLANK 140 DOE-HDBK-6004-99 APPENDIX B EMERGENCY PREPAREDNESS SUPPLEMENTAL GUIDANCE DOE 5500.1A Emergency Management System DOE 5500.2 Emergency Planning, Preparedness and Response for Operations DOE 5500.2A Emergency Notification, Reporting and Response Levels DOE 5500.3A Emergency Planning and Preparedness for Operational Emergencies DOE 5500.4A Public Affairs Planning Requirements for Emergencies DOE 5500.8 Emergency Planning and Management ANS 15.16 Emergency Planning for Research Reactors NFPA 1561 Standard on Fire Department Incident Management System 141 DOE-HDBK-6004-99 INTENTIONALLY BLANK 142 DOE-HDBK-6004-99 APPENDIX C EMERGENCY PREPAREDNESS DEFINITIONS Affected Persons Individuals who have been exposed or physically injured as a result of an accident to a degree requiring special attention, e.g., decontamination, first aid, or medical services. Assessment Actions Those actions taken prior to, during or after an accident which are collectively necessary to make decisions to implement specific emergency measures. Corrective Actions Those emergency measures taken to ameliorate or terminate an emergency situation at or near the source of the problem. Emergency Action Radiological dose rates; specific contamination levels of airborne, water- Levels borne, or surface-deposited concentrations of radioactivity; or specific instrument readings that may be used as thresholds for initiating specific emergency measures. Facility Equipment, structure, system, process, or activity that fulfills a specific purpose. Examples include accelerators, storage areas, fusion research devices, and research laboratories. Operational Are those radiological and non-radiological accidents and events Emergencies associated with the serious degradation of safety or security at a DOE owned or leased Research & Development facility, operation, or activity. Protective Actions Those emergency measures taken after an uncontrolled release of radioactive material has occurred for the purpose of preventing or minimizing radiological exposures to persons that would be likely to occur if the actions were not taken.

Population at Risk Those persons for whom protective actions are or would be taken. Recovery Actions Those actions taken after the emergency to restore the plant as nearly as possible to its pre-emergency condition. 143 DOE-HDBK-6004-99 INTENTIONALLY BLANK 144 DOE-HDBK-6004-99 APPENDIX D TRAINING AND QUALIFICATION REQUIREMENTS TERMS AND DEFINITIONS Certificate of Qualification - document signed by the certifying authority attesting to an individual’s certification. Certification - process by which management provides written endorsement of the satisfactory achievement of qualification of an individual for a specialized operations position based upon its criticality or safety impact, and generally in response to a DOE Order or national consensus code or standard. Certifying Authority - that individual who certifies operators and operator supervisors, in accordance with a certification procedure. Maintenance Personnel - persons responsible for performing maintenance and repair of mechanical and electrical equipment. Managers - persons whose assigned responsibilities include ensuring that a facility is safely and reliably operated, and that supporting operating and administrative activities are properly controlled. Each facility should determine which level personnel and higher are considered Managers. On-Shift Training - that portion of qualification training where the student receives training within the job environment and with as much hands-on experience as possible. Operators - persons responsible for manipulating facility controls, monitoring facility parameters, and operating facility equipment. Certified Operators - operators who require certification as determined by facility management. Qualified Operators - operators who require qualification as determined by facility management. Qualification - process by which factors, such as education, experience, and any special requirements (e.g., medical examination) are evaluated in addition to training to assure that an individual can competently perform a specialized job function to an anticipated level of proficiency. Qualified - the ability to perform a specific job function based upon completion of a training, qualification, or certification program developed for the job function. Trained personnel are qualified to perform their job function based upon completion of training. Qualified and certified personnel are qualified to perform their job function based upon completion of a specific program. As used in this document, the term “qualified” personnel has two meanings, based upon context: Qualified personnel are those personnel who have successfully completed either training, qualification, or certification requirements appropriate to their job function. 145 DOE-HDBK-6004-99 Qualified personnel are those personnel who have successfully completed a formal qualification program appropriate to their job function. Statement of Qualification - document signed by an appropriate individual (supervisory or higher) indicating that an individual is qualified to perform a specialized job function to an anticipated level of proficiency. Supervisors - persons who are responsible for the quantity and quality of work, and who direct the actions of the operators or other personnel. Certified Supervisors - supervisors who are responsible for the operational activities of certified operators who require certification as determined by facility management.

Qualified Supervisors - supervisors who are responsible for the operational activities of qualified operators who require qualification as determined by facility management. Technicians - persons responsible for performing specific maintenance or analytical laboratory work. Operations and Facility Support Personnel - those individuals who perform technical functions, (such as engineering evaluations, program reviews, technical problem resolution, or data analyses, within their area of expertise), or safety, quality assurance, radiation protection, emergency services, and training functions. Training Matrix - A listing of the courses and other appropriate requirements to be completed by an individual in order to satisfy training requirements for a specified job function. Training requirements and recommendations are matrixed by position. 146 DOE-HDBK-6004-99 GUIDANCE DOCUMENTS 10 CFR 830 Nuclear Safety Management 29 CFR 1910 OSHA Regulations 29 CFR 1926 OSHA Construction Regulations DOE Order 4330.4A Maintenance Management Program (canceled, replaced by DOE Order 4330.4B) DOE Order 5480.20A Personnel Selection, Qualification, and Training Requirements for DOE Nuclear Facilities DOE Order 5480.9A Construction Project Safety and Health Management DOE-HDBK-1001-96 Guide to Good Practices For Training and Qualification of Instructors DOE-HDBK-1002-96 Guide to Good Practices for Training and Qualification of Chemical Operators DOE-HDBK-1003-96 Guide to Good Practices for Training and Qualification of Maintenance Personnel DOE-HDBK-1074-95 Alternative Systematic Approaches to Training DOE-HDBK-1080-97 Guide to Good Practices For Oral Examinations DOE-HDBK-1114-98 Guide to Good Practices For Line and Training Manager Activities DOE-HDBK-1116-98 Guide to Good Practices for Developing and Conducting Case Studies DOE-HDBK-1200-97 Guide to Good Practices For Developing Learning Objectives DOE-HDBK-1201-97 Guide to Good Practices Evaluation Instrument Examples DOE-HDBK-1202-97 Guide to Good Practices For Teamwork Training and Diagnostic Skills Development DOE-HDBK-1203-97 Guide to Good Practices For Training of Technical Staff and Managers DOE-HDBK-1204-97 Guide to Good Practices For the Development of Test Items DOE-HDBK-1205-97 Guide to Good Practices for the Design, Development, and Implementation of Examinations DOE-HDBK-1206-98 Guide to Good Practices For On-the-Job Training DOE-STD-1029-92 Writer's Guide for Technical Procedures (includes Change Notice No. 1, December 1998) DOE-STD-1059-93 Guide to Good Practices for Maintenance Supervisor Selection and Development 147 DOE-HDBK-6004-99 DOE-STD-1060-93 Guide to Good Practices For Continuing Training DOE-STD-1061-93 Guide to Good Practices For the Selection, Training , and Qualification of Shift Supervisors DOE/EH-0256T Rev 1 DOE Radiological Control Manual DOE/EH-0353P Occupational Safety and Health Technical Reference Manual DOE/NE-0102T TAP 2 - Performance-Based Training Manual DOE/NE-0103T TAP 3 - Training Program Support Manual SG 830.120 Safety Guide for Quality Assurance SG 830.310 Guidelines for the Conduct of Operations at DOE Facilities SG 830.330 Guidelines for the Selection, Training, Qualification and Certification of Personnel at DOE Nuclear Facilities TTR89-009 TRADE Document TTR89-009,”Job Task Analysis - Guide to Good Practices: Volumes I & II” TTR92-010 TRADE Document TTR92-010, “The Occasional Trainer's Handbook,” 1992 148 DOE-HDBK-6004-99

EDUCATION AND EXPERIENCE Minimums Position Education Experience Operators High School 2 Years Technicians High School 1 Year Maintenance Personnel High School 1 Year Supervisors High School 3 Years Operations and Facility Support Functions (Note 1) Baccalaureate in Engineering or Related Science 2 Years Operations and Facility Support Functions (Note 2) High School Work experience as appropriate to the specific job-function Managers Baccalaureate in Engineering or Related Science 4 Years Training Manager Baccalaureate with course work in education and technical subjects 4 Years Note 1 Operations and Facility Support personnel who perform engineering or analytical support functions. Note 2 Operations and Facility Support personnel who perform specialized support functions (such as quality control, radiation control, or emergency response). Alternatives Guidelines The education and experience guidelines written below may be considered when making an evaluation of alternatives, recognizing that other factors (such as job incumbency and the ability to competently perform the assigned job function) and may also be appropriate in lieu of the education and experience minimums specified. 149 DOE-HDBK-6004-99 Education Alternatives The education requirements identified in this section are high school diploma and baccalaureate degree. Persons who do not possess the formal educational requirements specified should not be automatically eliminated where other factors provide sufficient assurance of their abilities to fulfill the duties of a specific position. These factors should be evaluated on a case-by-case basis, and approved and documented. High School Alternatives: General Educational Development (GED) diploma or completed test. Certificate of Completion from a post-secondary technical institution. Completion of technical training provided by the US Armed Forces. College Alternatives: Professional engineer license. Completion of technical portions of a baccalaureate program, with the overall completion of 80 semester credit hours, as determined by a written transcript. Related experience substituted for education at the rate of six semester credit hours for each year of experience up to a maximum of 80 credits. Experience Alternatives Persons who do not possess the experience requirements specified should not be automatically eliminated where other factors provide sufficient assurance of their abilities to fulfill the duties of a specific position. These factors should be evaluated on a case-by-case basis, and approved and documented in accordance with this procedure. General: In those cases where an individual does not meet the literal experience required for a position, and no other basis for an experience alternative is available, consideration may be given to the collective experience of the operating organization in lieu of the individual meeting the required experience. Individuals may be assigned to positions providing the overall operating organization is considered balanced and strong. In such cases, management approval of this approach (documented in a memorandum) is required. Substitution of Course Work and Training: Where course work is related to job assignments, post-secondary education may be substituted. Formal education may not be substituted for more than 50% of the experience requirements unless otherwise specified herein. 150 DOE-HDBK-6004-99

Job-related training in the position sought may qualify as equivalent to nuclear experience on a one-to­ one basis for up to a maximum of two years. Completion of technical training provided by the United States Armed Forces. Training And Qualification Requirements - Basis and Rationale The Training and Qualification section of the Fusion Safety Standard is based upon the referenced documents shown in Appendix 1. The program is a compilation of expected requirements [10CFR830] as well as existing programs in place due to DOE orders. It also includes information from other standards and documents. If a facility develops a comprehensive program for training and qualification of its staff using this document on a graded approach, the intent of the requirements and reference documents will be achieved. The overall effectiveness of such a program can only be determined by evaluating the effectiveness of the facility during operations. 151 DOE-HDBK-6004-99 INTENTIONALLY BLANK 152 DOE-HDBK-6004-99 CONCLUDING MATERIAL Review Activity: Preparing Activity: DOE ER Field Offices Idaho DOE-ER-54 Project Number: SAFT-0059 National Laboratories Princeton Plasma Physics Laboratory Savannah River Laboratory Oak Ridge National Laboratory Idaho National Engineering and Environmental Laboratory Untitled FOREWORD CONTENTS ACRONYMS SECTION I. VACUUM VESSEL GENERAL SAFETY DESIGN CRITERION POTENTIAL SYSTEM SAFETY FUNCTIONS DESIGN CONSIDERATIONS General General Structural Design Codes Hydrogen Detonation SAFETY-RELATED DESIGN STANDARDS AND CRITERIA. Structural Loads Static Load Normal Operating Pressure Normal Operating Thermal Load Electromagnetic Loads Interaction Loads Natural Phenomena Hazard Loads Loss-of-coolant Loads Hydrogen Detonation Loads Site-generated Missile Impact Load Combined Loads Cyclic Loading Vacuum vessel Piping, Pumps and Valves Other Deflection Analysis Testing Pressure Test Computer Code Verification Materials Instrumentation and Controls Vacuum Vessel Penetrations Ventilation and Exhaust System Criteria Containment Systems Inspection RECOMMENDED DESIGN PRACTICE Bellows Ceramic Breaks SECTION I REFERENCES Description Recommended Design Practice CRYOSTAT General Recommendations CONFINEMENT Ventilation/HVAC Ventilation systems Structural Design Codes General Safety Design Guidance Potential System Safety Functions Safety-Class Design Standards and Criteria Potential Safety Functions Safety-Related Design Guidance Structural Design INSTRUMENTATION AND CONTROL SYSTEMS General Safety Design Guidance I&C System Analysis and Design Control System Safety System Instrumentation Potential System Safety Function Safety Related Design Standards and Criteria Diversity Graded Approach to Defense In Depth Response Time Requirements and Margins Qualification Human Factors Testability and Maintainability Power Control Room Design Safety Actuation Monitoring TRITIUM SYSTEMS Generic System Description Tritium Storage Tritium Transfer Tritium Recovery Tritium Purification System Cleaning Potential System Safety Functions Design Basis Accidents: General Loads Structural Acceptance Criteria Deflection Analysis Testing and Inspection Computational Methods Validation Radiation Thermal Tritium Embrittlement Penetrations of Confinement Systems Primary Confinement Systems Secondary and Higher Order Confinement Barriers General Hydrogen Fires Hydrogen Detonations Metal Embrittlement Recommended Materials Materials Not Recommended