DOE-HDBK-6004-99, Supplementary Guidance and Design Experience for the Fusion Safety Standards DOE-STD-6002-96 and DOE-STD-6003-96

TS NOT MEASUREMENT SENSITIVE DOE-HDBK-6004-99 January 1999 DOE HANDBOOK SUPPLEMENTARY GUIDANCE AND DESIGN EXPERIENCE FOR THE FUSION SAFETY STANDARDS DOE-STD-6002-96 AND DOE-STD-6003-96 U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. This document has been reproduced from the best available copy. Available to DOE and DOE contractors from ES&H Technical Information Services, U.S. Department of Energy, (800) 473-4375, fax: (301) 903-9823. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 605-6000. DOE-HDBK-6004-99 FOREWORD Two standards have been developed that pertain to the safety of fusion facilities. These are DOE­ STD-6002-96, Safety of Magnetic Fusion Facilities: Requirements, and DOE-STD-6003-96, Safety of Magnetic Fusion Facilities: Guidance. The first of these standards identifies requirements that subscribers to that standard must meet to achieve safety in fusion facilities. The second standard contains guidance to assist in meeting the requirements identified in the first. This handbook provides additional documentation on good operations and design practices as well as lessons learned from the experiences of designers and operators of previous fusion facilities and related systems. It is intended to capture the experience gained in the various fields and pass it on to designers of future fusion facilities as a means of enhancing success and safety. The sections of this document are presented according to the physical location of the major systems of a fusion facility, beginning with the vacuum vessel and proceeding to those systems and components outside the vacuum vessel (the “Ex-vessel Systems”). The last section describes administrative procedures that cannot be localized to specific components. It has been tacitly assumed that the general structure of the fusion facilities addressed is that of a tokamak, though the same principles would apply to other magnetic confinement options. In what follows, use of the term “shall” has been avoided because this document is intended as advice and guidance only. It is not to be construed as regulatory in any way. In a similar vein, references to: safety-class or safety-significant structures, subsystems, and components should be viewed with the understanding that use of these designations, though not mandatory in the Requirements standard (DOE-STD-6002-96), are recommended in the Guidance standard (DOE-STD-6003-96). Again, the content of this document represents accumulated conventional wisdom of those who have experience building such systems and facilities. The material here is collected from a wide variety of sources. With the intent of capturing the information rather than making the product a polished document, there will be some variations in style and approach evident in the various sections. The authors felt allowing these variations would be a good stewardship of resources in the times of fiscal restraint and uncertainty in which this document was prepared. iii DOE-HDBK-6004-99 INTENTIONALLY BLANK iv DOE-HDBK-6004-99 CONTENTS FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii ACRONYMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

SECTION I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 VACUUM VESSEL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 GENERAL SAFETY DESIGN CRITERION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 POTENTIAL SYSTEM SAFETY FUNCTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 DESIGN CONSIDERATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Structural Design Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Hydrogen Detonation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 SAFETY-RELATED DESIGN STANDARDS AND CRITERIA . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Individual Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Static Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Normal Operating Pressure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Normal Operating Thermal Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Electromagnetic Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Interaction Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Natural Phenomena Hazard Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Loss-of-coolant Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Hydrogen Detonation Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Site-generated Missile Impact Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Combined Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Cyclic Loading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Structural Acceptance Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Vacuum vessel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Piping, Pumps and Valves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Other . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Deflection Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Weld Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Pressure Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Computer Code Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Instrumentation and Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Vacuum Vessel Penetrations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Ventilation and Exhaust System Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Containment Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 RECOMMENDED DESIGN PRACTICE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Bellows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Ceramic Breaks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 SECTION I REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 SECTION II . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 v DOE-HDBK-6004-99 EX-VESSEL SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 MAGNET SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Recommended Design Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 CRYOSTAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

General Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 CONFINEMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Ventilation/HVAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Ventilation systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Structural Design Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 General Safety Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Safety-Class Design Standards and Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 HVAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Potential Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Safety-Related Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 System Boundary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Structural Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 INSTRUMENTATION AND CONTROL SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 General Safety Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 I&C System Analysis and Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Safety System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Potential System Safety Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Safety Related Design Standards and Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Graded Approach to Defense In Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Response Time Requirements and Margins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Qualification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Human Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Testability and Maintainability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Control Room Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Safety Actuation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 TRITIUM SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 General Safety Design Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Generic System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Tritium Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Tritium Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Tritium Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Tritium Purification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 System Cleaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 vi DOE-HDBK-6004-99 Normal Operation: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Maintenance: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Design Basis Accidents: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Internal Initiators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 External Initiators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Beyond Design Basis Accidents: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Safety-Class Design Standards and Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Structural Acceptance Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Deflection Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Testing and Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Computational Methods Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Radiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Thermal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Tritium Embrittlement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Penetrations of Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Instrumentation and Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Primary Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Secondary and Higher Order Confinement Barriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Segmented Tritium Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Protection For Natural Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Protection from Environmental Conditions and Missiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Fire Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Conversion of Elemental Tritium to Tritium Oxide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Heat Removal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 System Cleaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Tests and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Radiation Shielding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Confinement Barriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Structural Design Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Hydrogen Fire and Detonation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Hydrogen Fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Hydrogen Detonations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Metal Embrittlement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Exchange with Hydrogen, Hydrogenated Compounds, and Hazardous Wastes . . . . . . . . . . . . . 46 Components of Primary Confinement System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Recommended Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Materials of Construction for Primary Confinement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Recommended Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Materials Not Recommended . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Piping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Pumps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Valves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Pressure Relief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 vii DOE-HDBK-6004-99 Heating and Ventilation - Personnel Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Primary System Cleaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Past Design Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Tritium Confinement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Metal Hydride Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Tritium Storage Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Purification Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Tritium Purification, Stripping and Recovery Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Purification Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Stripping and Recovery Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Tritium Control, Accountability and Physical Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Legal Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Nuclear Safety Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 DOE Orders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Good Practices - Nuclear Material Locations at a Fusion Facility . . . . . . . . . . . . . . . . . . . . . 56 Tritium Measurement Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Composition Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Thermal Methods of Inventory Measurement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Tritium Concentration Measurement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Facility Measurement Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Measurement of tritium input / output to facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 In Process tritium measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Tritium in Waste Streams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Stack emission measurements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 COOLING SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 General Safety Design Criterion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Normal Operation, Shutdowns and Anticipated Off-normal Events . . . . . . . . . . . . . . . . . . . . . . 62 Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Design Basis Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Internal Initiators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 External Initiators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Potential Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Beyond Design Basis Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Safety Design Standards and Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Structural Acceptance Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Deflection Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Testing and Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Computational Methods Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Instruments and Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Passive Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Recommended Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Generic System Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 viii DOE-HDBK-6004-99 Past Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 ELECTRICAL POWER SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 General Safety Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Safety-Class Design Criteria and Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 General Design Safety Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 General Design Criteria/Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Radiation/Contamination and Equipment Life . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Control and Instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Safety-class Diesel Generators and/or Combustion Turbine Generators . . . . . . . . . . . . . . . . . . . 77

Switchgear and Load Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Motor Control Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 AC Motor Control Centers: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 DC Motor Control Centers: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Direct Current Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Vital Instrumentation and Control Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Motors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Power, Control, and Instrumentation Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Raceways and Trays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Electrical Penetrations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Separation of Facility Safety Systems/Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Redundant Channel Separation: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Non-redundant Separation: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Cable Tray Separation: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Cable Color Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Reliability Design Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Independent Design Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Electrical Power Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Combustion turbine-generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Grounding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 System and Equipment Grounding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Cathodic Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Lightning Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Fire Detection and Fire Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 REMOTE MAINTENANCE SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 System Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

General Safety Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Potential System Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Normal Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Design Basis Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Beyond Design Basis Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Structural . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Normal Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Natural Phenomena and Accident Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Instrumentation and Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 ix DOE-HDBK-6004-99 Electrical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Function Protection for Natural Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Tests and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Mechanical Test Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Special Test Capability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Radiation Shielding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Structural Design Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Hydrogen Fires and Detonation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Expected Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 General Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 High Power Equipment in Confined Spaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Plasma Energy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Cryogenic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Radiological Fields. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Radiological Contamination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Magnetic Fields. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Radio Frequency Fields. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Hydrogen Isotopes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Materials Of Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Material Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Material Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Wiring Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Maintenance of Remote Handling Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Contamination Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Assembly and Disassembly Techniques. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Special Handling Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Past Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Activation Control Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Contamination Control Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Electronics Protection Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Internal Wiring Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Operational Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Mode of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Collision Avoidance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Multiple Remote Device Coordination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Swing Free Crane Technology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Retrieval Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Redundancy of Critical Controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Remote Release. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Safe Return of Equipment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Recommended Design Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Potential Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Safety Related-Design Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Structural Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Electrical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Tests and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Assembly and Disassembly Techniques. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 x DOE-HDBK-6004-99 Special Handling Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Design Guidance for Typical Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Closed Circuit Television (CCTV) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Electro Mechanical Manipulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Cranes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Remote Manipulators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Hoists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Remote Connector Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Specialized Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Robots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 SECTION II REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 SECTION III . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 ADMINISTRATIVE AND OPERATIONAL TECHNIQUES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 CONCEPT OF OPERATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Supplemental Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Operations Organization and Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Shift Routines and Operating Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Control Area Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Control of On-Shift Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Investigation of Abnormal Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Control of Equipment and System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Lockouts and Tagouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Independent Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Logkeeping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Operations Turnover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Operations Aspects of Facility Chemistry and Unique Processes . . . . . . . . . . . . . . . . . . . . . . . 123 Required Reading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Timely Orders to Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Operations Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Operator Aid Postings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Equipment and Pipe Labeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 EMERGENCY PREPAREDNESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Supplemental Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Concept of Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Operational Emergency Event Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Site Emergency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 General Emergency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Emergency Plans and Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Hazards Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Emergency Response Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Offsite Response Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Consequence Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 xi DOE-HDBK-6004-99 Protective Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Medical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Recovery and Reentry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Public Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Emergency Facilities and Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Drills and Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Drills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 TRAINING AND QUALIFICATION REQUIREMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Supplemental Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Administrative Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 General Facility Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Training Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Contracted Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Facility Training Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Personnel Selection and Staffing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Personnel Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Personnel Staffing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Training Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Training Matrices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Qualification and Certification Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Management Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Training Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Training Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Training Required for Facility Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Initial Training Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Continuing Training Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Maintenance of Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Qualification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Qualified Operators and Supervisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Education and Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Specific Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Medical Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Written Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Operational Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Maintenance of Proficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Requalification Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Other Qualified Positions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Certification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Certified Operators and Supervisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Education and Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Specific Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Medical Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Written Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Oral Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Operational Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Independent Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Maintenance of Proficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Recertification and Certification Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 xii DOE-HDBK-6004-99 Other Certified Positions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Written Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Oral Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Operational Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 APPENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 CONDUCT OF OPERATIONS SUPPLEMENTAL GUIDANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 APPENDIX B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 EMERGENCY PREPAREDNESS SUPPLEMENTAL GUIDANCE . . . . . . . . . . . . . . . . . . . . . . . . 141 APPENDIX C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 EMERGENCY PREPAREDNESS DEFINITIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 APPENDIX D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 TRAINING AND QUALIFICATION REQUIREMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 TERMS AND DEFINITIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 GUIDANCE DOCUMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 EDUCATION AND EXPERIENCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Minimums . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Alternatives Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Education Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 High School Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 College Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Experience Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Substitution of Course Work and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Training And Qualification Requirements - Basis and Rationale . . . . . . . . . . . . . . . . . . . . . . . 151 xiii DOE-HDBK-6004-99 INTENTIONALLY BLANK xiv DOE-HDBK-6004-99 ACRONYMS ACI American Concrete Institute AFOSH Air Force Occupational Safety and Health AISC American Institute of Steel Construction ANSI American National Standards Institute API American Petroleum Institute ASCE American Society of Civil Engineers ASHRAE American Society of Heating, Refrigerating and Air-Conditioning Engineers ASME American Society of Mechanical Engineers ASTM American Society for Testing and Materials AWWA American Water Works Association BIL Basic Impulse Level BSR Bureau of Standards Review CFR Code of Federal Regulations CMMA Crane Manufacturers Association of America EIA Electronic Industries Association EJMA Expansion Joint Manufacturers Association ESF Engineered Safety Features H&V heating and ventilating HEI Heat Exchanger Institute HIS Hydraulic Institute Standards HMI Hoist Manufacturers Institute HVAC heating, ventilating, and air conditioning I&C instrumentation and controls IEC Institute of Electrical Contractors xv DOE-HDBK-6004-99 IEEE Institute of Electrical and Electronics Engineers IPCEA Insulated Power Cable Engineers Association ISA Instrument Society of America ITER International Thermonuclear Experimental Reactor JIC Joint Industrial Council MCC motor control center NEMA National Electrical Manufacturers Association NFPA National Fire Protection Association NIOSH National Institute of Occupational Safety and Health NPH Natural Phenomena Hazards, (DOE 5480.11) NUREG Nuclear Regulatory Commission document OSHA Occupational Safety and Health Administration PIE postulated initiating events PPE personal protective equipment PVTC pressure-volume-temperature-composition RG Regulatory Guide RIA Robotics Industrial Association SAR Safety Analysis Report, (DOE 5480.28) SSC Structures, subsystems, and components TEMA Tubular Exchanger Manufacturers Association UHMWPE Ultra high molecular weight polyethylene xvi DOE-HDBK-6004-99 SECTION I VACUUM VESSEL Many of the components within and part of the vacuum vessel vacuum are unique to fusion systems. Thus, there is little precedence in the established codes and standards and little experience in the design of those components. Much of the design experience is taken from the design of plasma experiments where the power levels and radiation fluxes are much lower. The vacuum vessel is assumed to be a torus-shaped container usually made of a metal or metallic alloy, and its volume can be several times the plasma volume. It can be thin-walled or thick-walled. It may be double-walled with coolant passages between the walls. The perimeter of the vacuum vessel is outfitted with a number of ports for mounting hardware for plasma fueling and heating, plasma conditioning and for vacuum pumping. These ports can vary in size and shape and are usually located above, below, and on the horizontal plane as well as on top and bottom of the vacuum vessel. It may be of all-welded, continuous construction or use bolts between toroidal segments with vacuum seal welds at the joint.

GENERAL SAFETY DESIGN CRITERION If required by the facility safety analysis, the vacuum vessel will be a confinement or containment barrier for tritium and tritiated compounds, radioactive impurities and activated dust. The requirement for robustness of the barrier will be defined in the safety analysis and implemented in the design. In performing this function, the vacuum vessel will be classified as a safety-class system. If the vacuum vessel is not considered a confinement or containment barrier in the safety analysis, those vacuum vessel components whose single failure results in loss of capability of another safety-class system to perform its safety function should be designated as safety-class components. The vacuum vessel may also be a physical barrier between different fluid streams (such as liquid metal and water) whose interconnection could potentially produce large energy release events which could compromise nearby safety-class systems. POTENTIAL SYSTEM SAFETY FUNCTIONS If the safety analysis requires that the vacuum vessel be a confinement or containment barrier, the following safety functions are specified: 1. Normal operation including anticipated operational likely and unlikely events - to act as the first barrier for tritium and tritiated compounds, radioactive impurities and activated dust. 2. Maintenance a) To act as the first barrier for tritium and tritiated compounds, radioactive impurities and activated dust during maintenance external to vacuum vessel. b) To act as a partial confinement barrier as defined in the safety analysis for tritium and tritiated compounds, radioactive impurities and activated dust during maintenance inside the vacuum vessel. 1 DOE-HDBK-6004-99 3. Design Basis Accidents - To act as the first barrier for tritium and tritiated compounds, radioactive impurities, activated dust, or any other coolant or material located in the vacuum vessel during design basis accidents. Design basis accidents will be specified in the safety analysis and mitigated in the system design requirements. A accident probability, P, for defining a design basis accident is typically 10-4/year>P>10-6/year; the actual probability will be specified in the facility safety analysis. The following are potential design basis accidents for fusion DT facilities: burn excursion, loss of vacuum pumping, loss of vacuum, loss of flow or coolant pressure to actively-cooled components inside the vacuum vessel, chemical reactions including hydrogen detonation, site-generated missile impact, and design basis natural phenomenon: earthquake, flooding, and severe winds. However, any of these may be categorized as likely or unlikely events depending on the probability as assessed in the safety analysis. 4. Beyond Design Basis Accidents - There are no system safety functions required for beyond design basis accidents. DESIGN CONSIDERATIONS General The primary confinement or containment should normally be provided by the pressure boundary of the fusion machine, its associated vacuum system, and the various tritium systems (DOE 6430.1A (c)). If this barrier is deemed a safety-class system, then other hardware with pressure containing surfaces on the vacuum boundary are safety-class components and must be designed to function as confinement or containment as appropriate in the same operational and accident modes for which the vacuum vessel is designed. Structural Design Codes

DOE Order 6430.1A, General Design Criteria, required that safety-class components be designed, fabricated, inspected, and tested in accordance with the ASME Boiler and Pressure Vessel Code, Section III, Class 3 or to a comparable safety-related code. The following discussion modifies this requirement for fusion safety-class items to provide more flexibility in design and manufacturing without compromising the safety function of the item. The complex nature of many fusion components may require specific analysis under the alternate design rules of Section III, Class 1 or 2 or the comparable elements of Section VIII, Division 2 for pressure vessels. In defining a comparable code to ASME Section III, the use of ASME Section VIII is acceptable if additional standards are provided in areas such as attached valves, pumps, piping and supports, enhanced quality assurance and radiation effects which are comparable to relevant parts of Section III. In general, a detailed comparison should be made between ASME, Section III and the comparable code to be used to design safety-class items to demonstrate actual comparability. This code comparison should be performed early in the design phase and should be endorsed by the licensing or regulatory authority to ensure the design product will be acceptable for construction. Finally, the actual stamping of a vessel designed, fabricated, inspected, and tested to Section III or VIII is not addressed by this document nor in the Fusion Safety Standards and is considered to be a decision between the owner, fabricator, and the cognizant regulatory agency. 2 DOE-HDBK-6004-99 Hydrogen Detonation A hydrogen detonation is a potential hazard which may occur as part of a design basis accident (typical probability > 10-6 per year). If it does occur and the vacuum vessel is a confinement or containment barrier, then the required integrity of the barrier must be maintained during and after this event, although the non-safety-related functions of the vacuum vessel (such as ability to maintain high vacuum) can be compromised. If the vacuum vessel is not a confinement or containment barrier and a hydrogen detonation is credible, it must be shown that no failure of a vacuum vessel component due to this event can degrade the function of an adjacent safety-class system or item.

To determine if a potential hydrogen detonation can occur in a design basis accident, it is necessary to evaluate the likelihood of having the three ingredients for detonation at the same time: hydrogen and oxygen in the appropriate mixtures and an ignition source (NUREG/CR-4961). Generally, direct initiation of hydrogen-air mixtures is possible with about 1 gram of high explosive (NUREG/CR­ 4961) (this is equivalent to about 4 kJ of energy). Since the plasma typically contains much higher levels of stored energy, it should be assumed that a point ignition source is always present during normal operations and wall conditioning. The factors determining the likelihood of a detonation are then the availability of hydrogen isotopes and air. Hydrogen isotopes are present in the solid matrix of the plasma facing components at substantial levels. This is not ordinarily available for combustion or detonation although a portion (including tritium) may be released if a detonation occurs. If hot plasma facing components or the vacuum vessel are cooled with water, a leak could result in the generation of hydrogen from water (steam)-Be (or C or W) reactions (Smolik 92, Smolik 91). The precise amount of hydrogen generated depends on the first wall material and temperature and the size and duration of the water leak but typical conditions in a D-T fusion plasma can generate sufficient quantities of hydrogen for a detonation. Air (oxygen) also has to be present for a detonation. If air is adjacent to the vacuum vessel, the in-leakage of air is possible due to the same event which generated the hydrogen. For example, Be-steam reactions from a water leak during wall conditioning can result in internal pressures of several bar or more (NET 93), which may be beyond the design value of the vacuum vessel. This air source can be eliminated in the device design by incorporating an inert gas volume in the region between the vacuum vessel and its ducts, and the next confinement barrier. To determine the probability of a hydrogen detonation, a conservative analysis of the above factors must be performed for a particular design. The likelihood of an in-vessel loss-of-coolant accident cannot be generally excluded given performance of such actively-cooled systems to date and the anticipated service conditions in a D-T fusion vacuum vessel. To preclude a hydrogen detonation for consideration as a design basis accident, it will typically be necessary to demonstrate a low event probability by: 1. Material selection in the plasma facing components or the fluids used for active in-vessel component cooling, or 2. Use of an inert gas boundary as discussed above. 3 DOE-HDBK-6004-99 SAFETY-RELATED DESIGN STANDARDS AND CRITERIA If the vacuum vessel system or individual components are designated safety-class the following design standards should apply to the system or components: Structural The vacuum vessel system boundary should be defined as the vacuum vessel proper including attached windows, flanges, and ports and all penetrations up to and including the first isolation valve in system piping which penetrates the vacuum vessel. Loads Individual Loads The vacuum vessel should be designed to withstand the static load, normal operating pressure, normal operating thermal load, electromagnetic loads (normal operating and fault), disruption/vertical displacement (VDE) loads, interaction loads from adjacent systems, and transient loads due to design basis accidents such as natural phenomena, loss-of-coolant into the vessel and subsequent chemical reactions, site-generated missile impacts, and hydrogen detonation. (These design basis accidents are for example only, since some of them may not be credible for a particular facility.)

Static Load The static load should include the weight of the vacuum vessel and all supported hardware. Normal Operating Pressure The normal operating pressure of the vacuum vessel may be one of the following: 1. 1 atmosphere internal pressure, 2. 1 atmosphere external pressure, 3. No net pressure. If the vacuum vessel is double-walled with a coolant in the annulus, the maximum coolant pressure should be the normal operating pressure in the annulus. Normal Operating Thermal Load The normal operating thermal load should include transient thermal loads during pulsed operation as well as the temperature distribution during bakeout and wall conditioning. 4 DOE-HDBK-6004-99 Electromagnetic Loads Electromagnetic loads induced during normal pulsed operation of the device are experienced as a result of eddy currents in the vessel interacting with the magnetic fields crossing them. Loads should include the electromagnetic effects of discharge cleaning. 1. Electromagnetic Loads During Faults - Electromagnetic loads induced during abnormal operating events such as control failures, power supply failures, bus opens or shorts, or magnet faults should be included in the design. 2. Disruption/VDE Loads - Disruption/VDE loads are any thermal or electromagnetic loads induced in the vessel due to loss of control of the plasma. A range of plasma motions and current behaviors should be considered to determine the worst case events. Analysis should include conservative assumptions for event amplitude, time scale, and event frequency. Interaction Loads Interaction loads are loads imposed on the vacuum vessel by other components during normal or fault conditions. Natural Phenomena Hazard Loads Natural phenomena hazard loads are site-specific loads due to earthquakes, wind, and floods. Guidelines for methods of establishing load levels on facilities from natural phenomena hazards and for methods of evaluating the behavior of structures and equipment to these load levels are contained in DOE 1020. Loss-of-coolant Loads The confinement or containment should be designed to remain functional after a potential loss-of­ coolant to the interior of the vessel including subsequent chemical reactions if this is evaluated as a design basis accident. Hydrogen Detonation Loads The confinement or containment should be designed to remain functional after a potential hydrogen detonation if this is evaluated as a design basis accident. For guidance on determining if this is a design basis accident, see Section IV “Design Considerations” within this Vacuum Vessel section. Site-generated Missile Impact Load The confinement or containment should be designed to remain functional after a potential missile impact if this is evaluated as a design basis accident. 5 DOE-HDBK-6004-99 Combined Loads Considerations for combined loads are indicated in Table I-1. Table I-1 Combined Loads Hydraulic Thermal Electro­ magnetic Plant Condition Static Norm. Trans. Norm. Trans. Norm. Fault Nat. Phen. Miss. Imp. Cyc Normal Operation X X X X X Maintenance X X1 X1 Design Basis Accidents Internal Initiators 1. Coolant Leak in Vacuum Vessel. X X X X 2. In-cryostat Leak X X X X 3. Out-of-cryostat Leak X X X X 4. Loss of Pumping X X X X 5. Loss of Flow X X X X 6. Loss of Heat Sink X X X 7. Missile or Pipe Whip X X X X X X X X 8. Increase in Fusion Power X X X 9. Human Error or Control Fault X X X X X X External Initiators 1. Natural Phenomena

X X X X X X X X X 2. Fires X X X X X X X 3. Aircraft or Missile Impact X X X X X X X X Beyond Design Basis Accidents2 1. Pressure and thermal loads are applicable for portions of system which remain pressurized during maintenance. 2. There are no load combinations for beyond-design-basis accidents. 6 DOE-HDBK-6004-99 Cyclic Loading The vacuum vessel and its supports are subject to cyclic loading during normal operations. Thermal cycling and unavoidable plasma disruption loads are expected. The necessity of a fatigue analysis should be evaluated based on the criteria of ASME 93 or comparable safety-related code using conservative values for variables such as number of pulses, percentage of pulses that have disruptions, and service life including expected changes in material properties with time. Cyclic loading must be defined on load/time diagrams so that a fatigue analysis, if necessary, can be performed. Structural Acceptance Criteria Vacuum vessel The vacuum vessel and its appendages should be designed, fabricated, inspected, and tested in accordance with a recognized safety-related code such as the ASME Boiler and Pressure Vessel Code. The design of the fusion facility components which is outside the scope of conventional codes or standards due to design temperature, materials selection and/or any other design feature, should meet the safety design criteria of this Fusion Safety Standard and should employ a design and analysis methodology which is consistent with requirements of a recognized safety-related code. Piping, Pumps and Valves Piping, pumps and valves should be designed in accordance with relevant criteria in ASME 93 or a comparable safety-related code. Other Hardware internal or adjacent to the vacuum vessel whose credible failure could impact the safety function of the vacuum vessel should be classified as safety-class components or items. Deflection Analysis Vacuum vessel deflections should be calculated and analyzed to determine potential interferences and to verify seal integrity. Testing Weld Inspection Non-destructive examination should be performed in accordance with Section V of the ASME Boiler and Pressure Vessel Code as modified by Section III, Article NC-5111 or approved equal. Non­ destructive test personnel qualification and weld acceptance criteria are found in Article NC-5000 of the ASME Boiler and Pressure Vessel Code or approved equal. Pressure Test 1. Vacuum Vessel - All vacuum vessels that provide a containment barrier should be leak checked before initial operations and periodically thereafter and meet the requirements specified in the 7 DOE-HDBK-6004-99 safety analysis (guidance on leak testing is provided in 10CFR50(J). All vacuum vessels that provide a confinement barrier should be leak checked before initial operations and periodically thereafter against the leakage criteria in the facility safety analysis. The vacuum vessel chamber should be pneumatically tested in accordance with ASME 93 or comparable safety-related code. A double-walled vacuum vessel should be hydrostatically tested in accordance with ASME 93 or comparable safety-related code. 2. Valves - System isolation valves should be hydrostatically tested in accordance with the ASME 93 or a comparable safety-related code. Computer Code Verification Computer codes used for design analysis of the vacuum vessel for normal operating and design basis accident conditions should have validation and/or verification as described in DOE Standard 6003-96. This validation and verification should support the use of the code in each intended application.

Materials Material properties used in the structural analysis of safety-class structures, systems, and components must be appropriate for the operating environment and compensated for the degradation of the material with time due to radiation, fatigue, corrosion, or any other harsh treatment. 1. Radiation - Materials selected should be qualified for the anticipated lifetime in the radiation environment. With irradiation, yield strength usually increases as ductility decreases. Conservative end-of-life properties should be used in the structural design analysis. 2. Thermal - Material properties used in analysis should always be those appropriate at the given temperature. If no published property data for a particular temperature exists, then materials should be tested for properties at the operating temperature. For those items to be designed in accordance with the ASME Boiler and Pressure Vessel Code, temperature limits are imposed within the Code. If the item will be subjected to temperatures higher or lower than the limit, material properties, such as allowable stress and creep, used in the analysis should be justified by testing the material at the anticipated temperature. 3. Swelling - The energetic neutron flux on the first wall, diverter and other plasma facing components results in displacement cascades and helium-producing nuclear reactions. During long-term irradiations vacancies coalesce to form helium-filled voids within the material. Dimensional changes are most severe at about half the melting point of the material. Allowance must be made for irradiation-induced swelling in the design of any components exposed to the high-energy neutron flux. 4. Hydrogen Embrittlement - Hydrogen reacts to some degree with almost all metals. When a metal comes in contact with hydrogen, its surface adsorbs the gas. Surface or physical adsorption is followed by activated adsorption, a preliminary stage of the diffusion of hydrogen into metals. With continued exposure, materials can become embrittled. The material properties based on end-of-life hydrogen embrittlement should be used in the structural design analysis. The actual 8 DOE-HDBK-6004-99 embrittlement of the vacuum vessel in the hydrogen environment should be determined by placing coupons in the vessel to be periodically removed and inspected for embrittlement. An inspection schedule should be developed and implemented. Instrumentation and Controls Instrumentation and controls, where appropriate, should be provided to monitor system parameters important to the safety function of the vacuum vessel over their anticipated ranges for normal operation and design basis accidents to ensure continuity of the required safety function. The design should incorporate sufficient instrument independence, redundancy and/or diversity to ensure that a single failure will not result in a loss of monitoring capability for safety-class systems. The different designs and operating characteristics of fusion facilities limit the amount of specific guidance that can be provided. However, helpful general guidance for implementing this criteria at a particular fusion facility may be obtained by reviewing the existing DOE and NRC design requirements and guidance documents (IEEE 603, DOE 6430.1A (a), NUREG-0800, 10CFR50(A), RG 1.47). The power to operate safety-class instrumentation should meet the requirements of Class 1E Electric Power Systems (IEEE 308). Vacuum Vessel Penetrations

For vacuum vessel containment penetrations, each line that is part of the vacuum vessel pressure boundary and that penetrates the vacuum vessel should be provided with isolation valves, unless it can be demonstrated that the containment isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other defined basis. A simple check valve should not be used as the automatic isolation valve outside containment. Isolation valves outside containment should be located as close to containment as practical and upon loss of actuating power, automatic isolation valves should be designed to take the position that provides greater safety. The power to operate isolation valves should meet the requirements of Class 1E Electric Power Systems (IEEE 308). Ventilation and Exhaust System Criteria Confinement Systems The design of a vacuum vessel confinement ventilation system should ensure the ability to maintain desired airflow characteristics when personnel access ports or hatches are open. When necessary, air locks or enclosed vestibules should be used to minimize the impact of this air flow on the ventilation system and to prevent the spread of airborne contamination within the facility. The ventilation system design should provide the required confinement capability under all normal operations and design basis accidents with the assumption of a single failure in the system. If the maintenance of a controlled continuous confinement airflow is required, electrical equipment and components required to provide this airflow should be supplied with safety-class electrical power and provided with a backup power source. Air cleanup systems should be provided in confinement ventilation exhaust systems to limit the release of radioactive or other hazardous material to the environment and to minimize the spread of contamination within the facility as determined by the safety analysis. Guidance for confinement systems is included in DOE 6430.1A (b). 9 DOE-HDBK-6004-99 Containment Systems For containment systems, RG 1.140 presents guidance for design testing and maintenance for exhaust systems air filtration that is acceptable to the DOE. As with the confinement systems the basic criteria are based on the As Low As Reasonably Achievable (ALARA)As Low As Reasonably Achievable (ALARA) concept given the present state of technology. 10CFR50(I) presents specific methods and evaluation criteria that are acceptable to DOE in implementing ALARA with respect to exhaust systems from a containment system. Inspection Components should be designed to permit periodic inspection and testing of important areas related to the intended safety function to assess their structural and leak tight integrity. There should be an appropriate material surveillance program. RECOMMENDED DESIGN PRACTICE Windows In the analysis of the windows, the condition of the edge restraint is important. It is recommended that it be assumed that the window is simply supported at the edges, since this is a more conservative approach (Robinson). However, the weak point in the window may be the edge glass-to-metal braze. The braze must be analyzed for stress with the fixed-edge assumption. All calculations should be based on the modulus of rupture which is equal to the ultimate tensile strength/1.75. Factors of safety lose meaning for glass, because subsurface imperfections can cause failure below the expected tensile strength. Therefore, a factor of safety of 10 on the modulus of rupture is recommended. Windows should be designed to minimize the risk of cracking due to a water leak onto the hot disc. This can be accomplished by providing an inner sacrificial disc with the main sealed disc on the outside. The connecting inner space is vented to the vacuum by a small hole. This hole would allow vacuum pump down but would prevent a water leak from reaching the outer window. (Caldwell 89)

Bellows Double bellows with a vacuum-tight inner space are recommended. See the Standards of the Expansion Joint Manufacturers Association, 6th Edition, 1885. Ceramic Breaks Ceramic breaks are used to insulate electrical lines that penetrate the vacuum boundary or to insulate attached piping that is connected to external equipment at a different potential or ground. Where possible, ceramic breaks should be designed to be shielded from direct line-of-sight with the plasma or potential spray from rupture of coolant lines. Ceramic breaks are used on radio frequency (RF) antennas to isolate inner and outer coaxial conductors at the vacuum boundary. The volume outside of the vacuum boundary contains a pressurized gas. These RF ceramic breaks are subject to voltage breakdown which could cause local 10 http:strength/1.75 DOE-HDBK-6004-99 melting of the coax and could lead to a breach of confinement or even a water leak. Ceramic breaks should be located away from where the coax is cooled. A breach in the ceramic break would allow pressurized gas into the vacuum vessel and tritium into the coax and through the transmission lines all the way back to the power supply. If the vacuum boundary is defined as a confinement system, then the use of redundant ceramic breaks is recommended which reduces the possible leak rate to what is determined acceptable by the facility safety analysis. If a vacuum vessel functions as a containment, which is a more stringent requirement, then containment of the RF/vacuum vessel interface could extend along the transmission line back to the power supply. 11 DOE-HDBK-6004-99 INTENTIONALLY BLANK 12 DOE-HDBK-6004-99 10CFR50 (A) 10CFR50 (I) 10CFR50 (J) ASME 93 Caldwell 89 DOE-STD-1020-94 DOE 6430.1A (a) DOE 6430.1A (b) DOE 6430.1A (c) IEEE 308 IEEE 603 NET 93 NUREG-0800 NUREG/CR-4961 RG 1.140 RG 1.47 SECTION I REFERENCES 10 CFR Part 50, Appendix A, “General Design Criteria for Nuclear Power Plants,” specifically: GDC 1, 13, 19, 20, 22, 23, 24, and 64. 10 CFR Part 50, Appendix I. 10 CFR Part 50, Appendix J, “Primary Reactor Containment Leakage Testing for Water-cooled Reactors.” ASME Boiler and Pressure Vessel Code, 1992 Edition with 1993 Addenda. Design Features of the JET Vacuum Enclosure for Safe Operation with Tritium, C. J. Caldwell-Nichols, E. Usselmann; IEEE Thirteenth Symposium on Fusion Engineering, October 1989, Knoxville, TN, p.716. DOE-STD-1020-94 DOE Standard, “Natural Phenomena Hazards Design and Evaluation Criteria for Department of Energy Facilities,” April, 1994. Division 13 of DOE Order 6430.1A, “General Design Criteria,” 1989. DOE 6430.1A, Section 1550.99, “Special Facilities,” 1989. DOE Order 6430.1A Section 1328-7.1, “Fusion Test Facilities,” 1989. IEEE Std 308 “Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Equipment,” 1991. IEEE-603, “Criteria for Safety Systems for Nuclear Power Generating Stations,” 1991. Next European Torus Predesign Report, Fusion Engr. and Design 21, pp. 335-338 (1993). Chapter 7.1 of NUREG-0800, “Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants,” July 1981. Summary of Hydrogen-Air Detonation Experiments, NUREG/CR­ 4961, May 1989. USNRC Regulatory Guide (Reg. Guide): 1.140. USNRC Regulatory Guides (Reg. Guides): 1.47, “Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems,” May 1973 . 13 DOE-HDBK-6004-99

RG 1.75 USNRC Regulatory Guides (Reg. Guides): 1.75 Rev. 2, “Physical Independence of Electric Systems,” September 1978. RG 1.97 USNRC Regulatory Guides (Reg. Guides): 1.97, Rev. 3 Instrumentation for Light Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident,” May 1983. Robinson 80 James Robinson, “Design of Viewing Windows for Controlled- atmosphere Chambers,” ORNL/TM-6864, 1980. Smolik 91 G. R. Smolik, B. J. Merrill, S. J. Piet and D. F. Holland, “Evaluation of Graphite/Steam Interactions for ITER Accident Scenarios,” Fusion Technol. 19, pp. 1342-1348 (1991). Smolik 92 G. R. Smolik, B. J. Merrill and R. S. Wallace, “Implications of Beryllium: Steam Interactions in Fusion Reactors,” J. Nuclear Material 191-194, pp. 153-157 (1992). 14 DOE-HDBK-6004-99 SECTION II EX-VESSEL SYSTEMS MAGNET SYSTEMS Description The magnet system, for a tokamak device, consists of the toroidal field coils, the poloidal field coils and the central solenoid. Toroidal field (TF) coils are superconducting cables cooled with liquid helium which are wound into D shapes. Each coil circumscribes the vacuum vessel cross-section, and the set of toroidal field coils make a complete circle around the torus. The poloidal field (PF) coils are also typically superconducting cables cooled with liquid helium and wound into horizontal rings which are located above and below the vacuum vessel with typically some coil sets inside and outside the toroidal field coils. The TF and PF coils provide the basic magnetic field geometry for plasma confinement and position control. The central solenoid conductors are typically superconducting cables wound horizontally and situated at the center of the vacuum vessel torus supported by, for example, a bucking cylinder. The central solenoid set provides the transient field to induce all or part of the plasma current. Recommended Design Practice The dielectric strength of the insulation should be provided either by materials with an intrinsic dielectric strength, or by materials tested before assembly onto the magnet. The mechanical integrity of the magnets should not depend on the shear strength of the insulating materials or the shear bond between insulation and structural materials. Since leaks at coolant connections are a common cause of magnet faults, such connections should be kept away from mechanical load paths, placed outside the winding pack and, as far as possible, in regions where some access is, in principle, possible for inspection or repair. Manufacturing can allow many faults to occur. Machining chips left in the coil slowly abrade insulation and then cause a failure after some years of machine operation. Very strict tests to determine the cleanliness of finished units should be performed. CRYOSTAT Description The cryostat is a metal chamber surrounding the fusion device which provides a thermal barrier to conduction and thermal radiation between the superconducting coils and other cold structures and the rest of the facility. It may also serve as the biological shield for radiation from the tokamak. The chamber is usually cylindrical with a top and bottom. There are usually large penetrations in the top, bottom, and sides of the cryostat, primarily for access to the vacuum vessel and magnets for maintenance and inspection. The cryostat may be double-walled with an evacuated or filled annulus. The cryostat itself is usually evacuated and it may be lined with cryogenic panels or insulating material to reduce radiant heat transfer.

15 DOE-HDBK-6004-99 General Recommendations For large DT fusion facilities the cryostat volume may be of order 10,000-30,000 m3. This volume is a significant fraction of the internal volume of a fission reactor containment vessel and it may be appropriate to design the fusion cryostat under the rules for metal containment structures rather than designing it as a pressure vessel. Double bellows with a vacuum tight interspace are recommended. CONFINEMENT General Confinement/HVAC systems include structures, systems, and components designed to serve as barriers against the spread or uncontrolled release of radioactive or other hazardous materials throughout the facility or to the environs. The facility confinement strategy may consist of successive confinement barriers based on the hazards present. The successive barriers are generally referred to as primary, secondary, tertiary, etc. and are defined by the facility safety analysis. Primary confinement is often the function of the vacuum vessel, cryostat, or system piping, but may be the function of ex-vessel structural barriers and process enclosures such as gloveboxes, piping, tanks, and ductwork. Secondary confinement consists of building structural elements and associated ventilation systems that confine any potential release of hazardous materials from the primary confinement system. This system includes the operating area boundary and the ventilation system and associated air cleaning systems serving the operating area. Penetrations of the secondary confinement barrier are generally provided with positive seals to prevent migration of contamination out of the secondary confinement area. Tertiary confinement consists of building elements and associated exhaust system of the process facility. This is often the final barrier to release of hazardous material to the environment. Tertiary confinement surrounds the secondary confinement with space which is controlled but not expected to become contaminated. Ventilation/HVAC Ventilation systems should be designed to operate in conjunction with their associated physical barriers to limit the release of radioactive or other hazardous material to the environment. The ventilation system capabilities should be sufficient to allow for any intentional breaches of the confinement system that are required during maintenance on any portion of the facility. Leak-tightness of the confinement pressure boundary should be considered in the design. Air locks to achieve the required leak-tightness between confinement/containment zone boundary interfaces should be considered. Appropriate filtration may be accomplished by multistage HEPA filtration of the exhaust or by an equivalent filtering capability. The exhaust ventilation system must be sized to ensure adequate inflow of air in the event of the largest credible breach of confinement. 16 DOE-HDBK-6004-99 Safety-class systems and components should be designed per ASME AG-1 (ASME 93c) or a comparable code or standard which considers the safety function(s) of the particular system or component (ASME 89a, ASME 89b). Non-safety-class systems and components should be designed per codes and standards used for industrial and commercial grade applications. Design Considerations Ventilation systems 1. The ventilation systems should be designed so that air flows from the cleaner areas with less potential for contamination to the potentially more contaminated areas.

2. The ventilation system should be designed so that the system parameters which are important to operational and nuclear safety can be monitored and if necessary tested. This includes but is not limited to pressure, temperature, air flow, filtering efficiency, environmental releases, etc. 3. The design of the ventilation system should ensure that each of the following design parameters can be met: a) Required differential pressures between confinement barriers b) Required air change rate to maintain concentrations of airborne radioactivity and other hazardous substances at or below acceptable levels. c) Required temperature and humidity conditions 4. The ventilation system should be capable of isolating released tritium gas (or other radiologically hazardous gas) in the event of a breach of the confinement system. In addition the system should be designed to limit potential releases during normal and accident conditions. The ventilation system should be designed to control the concentrations of other radiological, toxic and explosive substances below unacceptable levels. 5. The ventilation system should be capable of monitoring routine as well as accident releases to the environment through all possible discharge paths. 6. The resultant leak-tightness of the confinement zone pressure boundary should be considered in the design. Utilization of air locks to achieve the required leak-tightness between confinement/containment zone boundary interfaces should be considered. The pressure boundary of any confinement zone should have sufficient leak-tightness so that contamination control is achieved without excessive in-leakage. Structural Design Codes General design criteria for all DOE facilities is given in the DOE Order 1020. Requirements for the environmental, safety and health protection are given in the DOE Order 5480.4. Requirements for natural phenomena hazards (NPH) mitigation are given in the DOE Order 5480.28 with the accompanying DOE Standards 1020 and 1021. Although DOE 5480.28, DOE 1020 and DOE 1021 are for NPH they provide a baseline to be extended to fusion related SSCs. 17 DOE-HDBK-6004-99 General Safety Design Guidance The confinement system design should establish the features which minimize the spread of both gaseous and particulate contamination throughout the facility. The confinement systems discussed here are those that are beyond the boundary of the vacuum vessel and its ancillary systems. In order to establish the confinement areas for the facility outside the vacuum vessel, a safety analysis considering normal and accident conditions should be performed. The resultant safety classification of confinement zones from the safety analysis should be the basis for determining the ventilation system design requirements as well as the architectural/structural requirements for the respective confinement areas. (Burchsted 76) The confinement systems should be divided into the following confinement systems as necessary to support the safety analysis: 1. The ex-vessel primary confinement system should consist of structural barriers and process enclosures such as gloveboxes, piping, tanks and any associated ductwork and their associated ventilation and air cleaning systems that are required to prevent the release of hazardous material to areas beyond the confinement boundary. In addition, credible breaches in the primary confinement barrier should be compensated for by provision of adequate inflow of air or safe collection of hazardous material that escapes the confinement. This is accomplished by multistage HEPA filtration of the exhaust or by an equivalent filtering capability. The exhaust ventilation system must be sized to ensure adequate inflow of air in the event of the largest credible breach of confinement.

2. The secondary confinement system should consist of the walls, roofs and associated ventilation systems that confine any potential release of hazardous materials from the primary confinement system. This system includes the operating area boundary and the ventilation system and any associated air cleaning systems serving the operating area. The ventilation system should be designed to ensure proper airflow direction and velocity to counteract the largest credible breach in secondary confinement barrier. Penetrations of the secondary confinement barrier should be provided with positive seals to prevent migration of contamination out of the secondary confinement area. 3. The tertiary confinement system should consist of the walls, floor, roof and associated exhaust system of the process facility. It is the final barrier to release of hazardous material to the environment. This level of confinement should be provided for the space bounding the secondary confinement which is not expected to become contaminated. Potential System Safety Functions The confinement systems along with their associated HVAC systems should be designed to provide the following functions for the facility: 1. Normal Operation: a) Prevent and control the spread of gaseous and particulate contamination. This is accomplished by controlling confinement zone differential pressures as well as 18 DOE-HDBK-6004-99 providing sufficient air exchange rate within the confinement zones. (ASHRAE, ASHRAE 91, DOE 6430.1A) b) Monitor the contamination levels in the zones to ensure personnel radiological safety is maintained. (ASHRAE 91, DOE 5480.11, DOE 6430.1A) In addition, any potential for airborne toxic and corrosive products in the atmosphere that may compromise personnel safety or equipment operability should be monitored and controlled. c) Monitor the radiological releases to the environment to ensure the continued effectiveness of the confinement system to capture and retain radioactive contaminants before they are exhausted to the environment. (ASHRAE 91, DOE 5480.11, DOE 6430.1A) d) Maintain the required temperature and humidity conditions in the zone. (ASHRAE 91) 2. Maintenance: Provide the necessary ventilation system functional capabilities to allow for any intentional breaches of the confinement system that are required to perform maintenance on any portion of the system. (ASHRAE 91) 3. Design Basis Accidents: a) Prevent and control the spread of gaseous and radioactive contamination during and following all credible design basis accidents. (ASHRAE, ASHRAE 91, DOE 6430.1A) b) Monitor the radiological releases to the environment during and following any credible design basis accident. (ASHRAE 91, DOE 5480.11, DOE 6430.1A) c) Maintain temperature, pressure and humidity conditions for the equipment required to operate during and following a DBA. This includes the ability to rapidly remove heat in worst case loss of coolant accident condition. Safety-Class Design Standards and Criteria

The safety analysis to determine the safety system classification of the confinement systems and their associated HVAC systems should be based on the requirements given in DOE-STD-1027-92 or equivalent. Ventilation systems that are classified as “safety class” should be designed to operate in conjunction with their associated physical barriers to limit the release of radioactive or other hazardous material to the environment. In addition they should be subject to appropriately higher quality design, fabrication and test standards and codes to increase the reliability of the system and allow credit to be taken for their functional capability in a safety analysis. In addition the safety analysis should determine the appropriate level of redundancy, diversity, independence and the need for emergency power to ensure safety system function capability during and following all credible postulated design basis accidents. 19 DOE-HDBK-6004-99 Structural 1. Design Approach The structural design philosophy should be similar to that given for the design and evaluation of DOE facilities for NPH in DOE Order 6430.1A, (DOE 6430.1A), with its supplemental Standards, (DOE 1020, DOE 1021). The design procedure combines probabilistic and deterministic approaches and is summarized below: a) Establish performance category based on the desired target probabilistic performance goal, expressed as mean annual probability of exceeding the acceptable behavior limits. b) Develop loads from hazards assessment by specifying mean annual probabilities of exceeding the acceptable limits. c) Use deterministic design and evaluation procedures for the resulting load combinations, to achieve performance goals and to provide a consistent and appropriate level of conservatism. The design procedures conform closely to industry practices using national consensus codes and standards. The procedures extend to methods of analyses and to criteria to assess whether or not the computed response is within acceptable behavior limits. d) Implement design detailing provisions e) Maintain appropriate quality assurance and peer review. Detailing, quality control and peer review are emphasized because: a) Inelastic energy absorption capacity depends explicitly upon ductility in the structural behavior. b) New technology may involve judgments beyond routine engineering. The structural design should be based on a graded approach. A graded approach is one in which various levels of design, evaluation and construction requirements of varying conservatism and rigor are established ranging from common practice for conventional facilities to very rigorous practices used for more hazardous facilities. The motivation for the graded approach is that it enables design or evaluation to be performed in a manner consistent with their importance to safety, importance to mission, and cost. 2. Design Basis Loads Design basis loads are derived from the internal and external events identified as the PIE (Postulated Initiating Events) in the safety analysis. Loads and the combinations thereof should envelop loads considered in structures per ANSI 83. Design basis loads arise from different categories: normal operations, unlikely events, and extremely unlikely events. The performance classification incorporates the probabilities of these events. Loading combinations should be generated from the bounding sets of these events identified in the safety analysis. 20

DOE-HDBK-6004-99 3. Methods of Analysis The method of analysis should depend on the performance category and loads being considered. Some of the methods are described in (ASCE 80). Elastic system analysis methods may be adequate for lower performance categories whereas for higher performance categories inelastic analysis methods nay be required. Guidelines to seismic analysis are available in (DOD 86). Dynamic seismic structural analysis may be performed for predicted ground motions based on geotechnical site specific information including variability using response spectra or time history. For large embedded structures, soil structure analysis may be considered. 4. Acceptance Criteria For lower performance categories, and for normal operations damage should be limited so that hazardous materials can be controlled and confined, occupants are protected, and functions are not interrupted. Thus damage should typically be limited in confinement barriers, ventilation systems and filtering, and monitoring and control equipment. For the higher performance categories, and for unlikely events, structures should be permitted to undergo limited inelastic deformations without unacceptable damage when subjected to transient loads. Energy absorption factors may be used to achieve appropriate conservatism in the design or evaluation process. Stability and other post yield behavior criteria should be met. For extremely unlikely events risk analysis should be performed to determine the extent of permissible damage. In design approaches where ductility and inelastic energy absorption are taken benefit of, attention should be paid to the design details and quality assurance. For all performance categories deformations expected from design load combinations should be able to be withstood. If concrete is used as a pressure boundary, inelastic energy absorption should not be considered. 5. System Interaction Effects Any SSC whose structural failure could impact the function of SSC of a higher performance category SSC are evaluated for interactions. To account for adverse interactions, a determination of failure probability of an SSC given a postulated failure in the lower performance category is required. HVAC The application of design criteria from codes and standards for systems and components should be applied in a graded approach relative to the significance of the safety function. For safety-class systems and components, the design requirements of ASME AG-1 (ASME 93b) or a comparable code or standard which considers the safety function(s) of the particular system or component should be applied (ASME 89a and ASME 89b). For non safety-class systems and components, codes and standards for industrial and commercial grade application should be applied. Some of the major HVAC components that should have a graded approach application of codes and standards are fans, dampers, ductwork, filters and filter housings and instrumentation and controls. 21 DOE-HDBK-6004-99 Potential Safety Functions The potential safety functions for confinement systems and their associated HVAC systems are: 1. Provide barriers against the release or spread of gaseous and particulate contamination during normal and off-normal conditions (ASHRAE , ASHRAE 91 and DOE 6430.1A) 2. Provide the necessary ventilation system functional capabilities to control differential pressures such that air flows from cleaner areas to potentially more contaminated areas during normal and off-normal conditions. (ASHRAE 91)

3. Provide filters or other means to remove contaminants before exhausting to the environs. 4. Maintain the required ambient conditions within confinement, e.g. temperature, pressure, humidity, and concentrations of radiological, toxic, corrosive or explosive substances, to protect personnel and ensure the capability of personnel or equipment to perform safety functions. (ASHRAE 91) 5. Provide the capability to isolate and control tritium or any other contaminant released within confinement. 6. Provide instrumentation and/or testing and surveillance to monitor the condition and capabilities of the confinement system, the ambient conditions within confinement, and the effluents from confinement to the environs. Applicable items should be monitored during normal and off-normal conditions as required to ensure and verify safety function. In addition potential airborne contaminants or corrosive agents that may compromise the ability of personnel or equipment to perform safety functions should be monitored and controlled. (ASHRAE 91, DOE 5480.11 and DOE 6430.1A) Safety-Related Design Guidance System Boundary The confinement/HVAC system boundary is defined for each confinement barrier and includes the contiguous structural barrier and its associated ventilation and filtration equipment. Structural Design Design basis loads are derived from the internal and external events identified as the PIE (Postulated Initiating Events) in the safety analysis. Loads and the combinations thereof should envelope loads considered in structures per ASCE 93. The methods of analysis depend on the performance category and loads being considered. Some of the methods are described in ASCE 80. Elastic system analysis methods may be adequate for lower performance categories whereas for higher performance categories inelastic analysis methods may be required. Guidelines to seismic analysis are available in DOD 86. Dynamic seismic structural analysis may be performed for predicted ground motions based on geotechnical site specific 22 DOE-HDBK-6004-99 information including variability using response spectra or time history. For large embedded structures, soil structure analysis may be considered. Capacity calculations, DOE 1994a, depend primarily on the national consensus code, UBC 94. For reinforced concrete structures DOE 1984 and ACI 318 provide the criteria for safety-class and other building structures, respectively. For steel structures AISC Codes, ANSI 84 and AISC 86a provide the criteria for safety-class and other building structures. AISC 86b is an alternate for AISC 86a if load and resistance factor design procedure is used. ASME Code (ASME 93a) should be used for equipment and components, and ASME Code (ASME 93b) for piping. Deformation may be allowed and inelastic energy absorption credited for ductile structural materials, especially for lower performance categories. Inelastic absorption capacity should not be credited if concrete is used as a pressure boundary. For lower performance categories, and for normal operations, damage may be permitted but should be limited so that hazardous materials can be controlled and confined, occupants are protected, and safety functions are maintained. For the higher performance categories, and for unlikely events, structures should be permitted to undergo limited inelastic deformations. Energy absorption factors may be used to achieve appropriate conservatism in the design or evaluation process. Stability and other post yield behavior criteria should be met.

For extremely unlikely events risk analysis should be performed to determine the extent of permissible damage. INSTRUMENTATION AND CONTROL SYSTEMS Instrumentation and Control (I&C) systems include equipment and components that monitor and display facility parameters, indicate parameter value changes, actuate equipment to maintain the parameters within specified limits, return the facility to operation within these limits, and mitigate conditions resulting from operation outside limits. Specific equipment includes sensors, signal transfer media, signal processors, control circuits and actuation devices. General Safety Design Guidance The purpose of this section is to present the principal design criteria for the Instrumentation and Control (I&C)Instrumentation and Control systems and components. The I&C system design should be separated into the basic control system and the safety system. The separation of these I&C system functions is necessary to ensure that once a safety system is called upon the control function will not stop or impede the proper safety system function execution. Conversely, the safety system must not interfere with the operation of the control function, when the facility or system is operating within the normal design envelope. The basic control and the safety systems analysis and design should ensure independence of system functions and displays with sufficient analytical margin, physical separation, and electrical isolation to enable each system to support the others function without interference under failure, accident, or normal operating conditions. To ensure that these basic principles are properly addressed, the I&C analysis and design efforts must be properly integrated between control and safety system design and with the design and analysis of the facility systems (FS) they are intended to service. 23 DOE-HDBK-6004-99 I&C System Analysis and Design The design of the I&C systems should be integrated with the design of the facility systems (FS) to account for both normal and off normal operation and to prevent or mitigate postulated accidents. The integration of the facility systems and I&C system design functions should address: 1. the capability of I&C system to provide the proper measuring, detection, and control functions, including adequate control and safety margins, 2. the necessary taps, ports, and penetrations to obtain the most desirable measurement parameters for control and safety function actions, 3. a central control room with sufficient displays and command features to allow monitoring and response to all accident Postulated Initiating Events (PIE), except those that are highly unlikely, 4. automatic initiation of all safety function actuations which are not assigned to the operator, 5. feedback from control function actions to determine the effect on the process, 6. a system of interlocks and permissives to reduce the likelihood of erroneous operator action, 7. a system of controlled by-passes to permit deliberate operator action in abnormal unanticipated situations, 8. manual initiation and control for safety function actions not appropriate for automatic initiation or for chosen automatic action interruption or adjustment capabilities. Control System Basic Control systems should be designed with sufficient margin to ensure that the design conditions are not exceeded, during any condition of normal operation including anticipated operational occurrences and transients.

The Basic Control System should be capable of maintaining the normal operating parameters and should provide all operator interface (indication, alarm, and data collection), during normal operation and anticipated operational occurrences and transients that may be created by postulated initiating events. A Task Analysis should be conducted to determine which control functions are to be assigned to the operator and which functions are to be machine (automatic action) assigned. The control system design should provide for operator control and monitoring of essential facility systems in a central control room. The control room, as well as supporting I&C system local control and monitoring panels, should be designed for man/machine interface and local area or room habitability considerations. This design should consider control and monitoring functions for conduct of operations under both normal operation and postulated accident scenarios. 24 DOE-HDBK-6004-99 Safety System The Safety System should be capable of maintaining the facility within the design basis safety analysis limits and provide operator interface (indication, alarm, data collection, and any necessary manual interaction), during accident or off normal conditions that may be created by any PIE. A safety system task analysis should be conducted to determine which safety functions are to be assigned to the operator and which safety functions are to be machine (automatic action) assigned. The operator should be provided with manual safety action initiating capability for all safety functions and with feedback information to confirm the occurrence of the proper actuation and completion of the selected safety function. Safety Systems should be designed to fail safe on loss of motive force or power. In addition, safety systems should be designed to meet single failure criteria. The system should be designed to preclude failure of a component or subsystem from preventing completion of the required safety function. Diversity in the monitoring of the parameters and actuation of the control systems should be a basic principle of the safety system design. To prevent a failure in the basic control system from degrading the operation of the safety system, isolation should be provided between any interface of the basic control and safety systems and separation should be provided and maintained between these systems. Instrumentation The process variables (parameters) that are selected to provide inputs to the I&C system should be those which characterize the relevant safety and operational status of the monitored systems and barriers. This selected set of variables must be analyzed to determine their adequacy to measure and provide for the necessary control and safety functions. The analysis should include the measurability, variability, and response action time capability of the process parameter variables and the operational demands and limitations placed upon the control or safety system design by these parameter variable properties. The instrumentation selected to measure a process variable should directly measure the variable, instead of some secondary parameter. Instrumentation should be analyzed to determine if its reliability, accuracy, and response time characteristics satisfy the control or safety system needs for all required operating conditions.

Instrumentation should be provided to monitor variables of the facility systems over their anticipated ranges for normal operation, anticipated operational transients and occurrences, and for postulated accident conditions to ensure adequate safety and design margins are maintained. Potential System Safety Function The potential safety functions for the I&C Systems are: 1. Monitor and indicate by alarm off normal facility systems operating parameters or transient conditions. 25 DOE-HDBK-6004-99 2. Display parameter values necessary for operator response to off normal systems operating parameters or transient conditions. 3. Operate permissive or interlock functions designed to prevent facility systems from: a) entering into off normal operating parameter or transient conditions, or b) allowing an existing transient condition to continue its off normal excursion. 4. Operate automatically to: a) respond to off normal or accident conditions, b) move the facility toward or attain a safe operational state, or c) mitigate the consequences of the off normal or accident conditions. 5. Enable operator manual initiation of safety related control actions or bypasses. 6. Detect and indicate parameters necessary to ensure the integrity of designated defense in depth barriers. These parameters may include but are not limited to: a) indicators of radioactive, toxic, or other material leakage or migration to detect breach of a barrier, b) temperature conditions indicative of trends toward undesired material conditions (e.g., nil ductility considerations or high-temperature loss of strength), c) over or under pressurization detection for facility systems, or d) chemical or gas mixture potential flammability or deflagration detection. 7. Monitor safety barriers and provide for response or mitigation action designed to prevent the breach of a barrier or to control the effect of barrier breach. 8. Post accident monitoring or control functions necessary for indication, data logging or required continued systems operations. 9. Measure, display, and alarm conditions approaching or exceeding parameter limits defined by Technical Specification Requirements or Technical Standards. Safety Related Design Standards and Criteria The following listed standards and criteria provide a cohesive philosophy and set of principles appropriate for application to the analysis and design of I&C Systems and components for fusion devices. The concepts and principles contained in these documents, including referenced standards, should be applied, using the necessary adjustments required to account for any specific fusion technology special considerations. 26 DOE-HDBK-6004-99 These standards and criteria cover both component level and system level design feature considerations for safety systems. Component design features necessary for safety systems include attributes such as equipment qualification, maintainability, failure criteria and testability. In addition to these attributes, the system level design features should include but not be limited to reliability, independence, redundancy, human factors and separation. Each of the standards listed below form a portion of the overall design philosophy for I&C safety systems. As such, the design intent of all of these standards should be taken as a whole for the analysis and design of I&C systems. IEC 964 (1989-03) Design for control rooms of nuclear power plants.

IEEE 603 Standard Criteria for Safety Systems for Nuclear Power Generating Stations IEEE 323 Qualifying Class IE Equipment for Nuclear Power Generating Stations IEEE 352 IEEE Guide for General Principles for Reliability Analysis for Nuclear Power Generating Station Safety Systems IEEE 577 IEEE Standard Requirements for Reliability Analysis in the Design and Operation of Safety Systems IEEE 420 IEEE Standard for the Design and Qualification of Class IE Control Boards, Panels, and Racks used in Nuclear Power Generating Stations. IEEE 379 IEEE Standard Application of the Single Failure Criterion to Nuclear Power Generating Station Safety Systems IEEE 384 IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits IEEE 338 IEEE Standard Criteria for Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems ISA 67.02 S67.02.01: Nuclear Safety-Related Instrument Sensing Line Piping and Tubing Standard for Use in Nuclear Power Plants ISA 67.04 S67.04--Part I: Setpoints for Nuclear Safety-Related Instrumentation-- ANSI/ISA­ 1994 RP67.04--Part II: Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation-1994 ISA 67.06 S67.06: Response Time Testing of Nuclear Safety-Related Instrument Channels in Nuclear Power Plants-- ANSI/ISA-1984 27 http:S67.02.01 DOE-HDBK-6004-99 ANSI/ANS 3.8.5-1992 Criteria for Emergency Radiological Field Monitoring, Sampling, and Analysis ANSI/ANS 3.8.6-1995 Criteria for Conduct of Offsite Radiological Assessment for Emergency Response for Nuclear Power Plants IEEE 730 Software Quality Assurance Plans IEEE 829 Standard for Software Test Documentation IEEE 830 Guide for Software Requirements Specifications IEEE1012 Standard Software Verification and Validation Plans IEEE 1016 Recommended Practice for Software Design Descriptions IEEE 1042 Guide to Software Configuration Management IEEE 1063 Standard for Software User Documentation Design Considerations Diversity In the selection of the sensors and measuring systems for the in-vessel and near vessel parameters, multiple diverse technologies should be implemented since these instrument components will be exposed to harsh environments (potential radiation exposure, magnetic fields, temperature gradients, ion pulses, etc.) Unexpected failure mechanisms within a single measurement technology could lead to erroneous control or safety actions. Provision for the use of diverse measurement technologies in the design would provide alternative sensing capabilities and reduce the possibility of failure to detect and initiate a safety function due to common mode or common cause failures. Graded Approach to Defense In Depth The failure consequence and frequency of the PIE should be considered in the determining the degree of the redundancy and diversity required in the I&C system. Anticipated operational events of high consequence should require an analyzed probability of successful action. This analysis should include the presence of an undetected failure in the safety related I&C system equipment necessary to accomplish the required safety function. Events of lower frequency and/or consequence may be shown to be mitigated by less rigorous analysis and subsequently less rigorous I&C equipment requirements. 28 DOE-HDBK-6004-99 Response Time Requirements and Margins

Facility system designs should be sufficiently robust, to withstand a process perturbation, without damage or degradation, until the I&C system can detect the change in the monitored parameter, command a change in the controlled variable and have that system return to the safe or process normal state. The margin (allowed variation of the process parameter for the allowed time) should be sufficient for the I&C system to detect the change in the process and respond within some defined degree of internal delay or failure. The Basic Control System should be reliable and exhibit adequate response time to maintain normal fusion operations without unnecessary challenges to or actuation of the safety system. These necessary attributes should be addressed by performance of sufficient setpoint and instrumentation uncertainty and response time analysis to ensure adequate margins exist between normal control and safety system setpoints and limits. Qualification Safety related I&C components should be qualified to perform their intended safety function for the life of the component. Qualification should address operational requirements and environmental requirements. Qualification for operational conditions should consider maintenance, testing, and operation during all operational modes, such as, normal, off normal shutdown, and postulated accidents. Qualification for environmental conditions should be limited to normal operational environments, except for those components and systems that must remain operable during and/or after an accident. Those I&C systems and components required to remain operable during and/or after an accident should be environmentally qualified for the conditions they are subjected to during the time it takes to complete their safety functions. Seismic qualification of I&C systems and components should be considered for those items that are required to maintain their structural integrity and operability during and after a design basis earthquake. Qualification requirements (if any) for systems credited in Design Basis Events should be explicitly stated in the overall functional requirements. Additional Graded Approach guidance should be provided to ensure consistency across Facility System Boundaries. This is important to I&C since the I&C System crosses these boundaries. Human Factors A human factors analysis of the control room or local I&C panel operator interfaces with console or panel controls, displays, indications and alarms should be performed. This includes the interface of control room functions with local panel operations capability and the interface with digital system displays and control and response capabilities. Testability and Maintainability The I&C system and components should be designed to provide the capability for performance of periodic testing of all instruments, logic, interlocks, permissive features, bypasses, and other facility systems. The safety system portion of the I&C system should be capable of confirming the required calibration, setpoint and time responses with test frequencies that meet the uncertainty analysis 29 DOE-HDBK-6004-99 requirements. Test features of the safety system I&C should be able to detect failures of the system that could degrade or prevent a safety function from occurring in the presence of a single failure.

The I&C system should include maintainability considerations in the design process. These considerations should include ease of replacement of components, modules, or subsystems, the access availability of the equipment with consideration for personnel hazard conditions (radiation, magnetic fields, temperature, proximity to steam piping or other stored energy conditions, etc.), and the provision for sufficient bypass or disable capability and test point access to allow for the valid performance of necessary and adequate testing. Power The I&C power system design should provide for the necessary redundant power sources to ensure that the system will be capable of performing its required function under all normal and postulated accident scenarios. Power sources that should be considered for the I&C system include uninterruptible power sources, critical instrument busses capable of being powered from diesel generator back up power, and battery back up systems. Control Room Design The design of the control room should be implemented in accordance with IEC 964 standard guidelines, with the appropriate modifications for fusion versus fission technologies and hazards. The underlying principles of the man/machine interface and functional analysis presented in IEC 964 are appropriate to the design of fusion control facilities. Adequate radiation and environmental protection should be provided to permit access and occupancy of the control room under accident conditions where the operator monitoring, mitigative or response actions are required during or following an accident. Equipment at locations outside the control room should be provided to achieve and/or maintain the facility systems in a safe or shutdown condition in the absence of the control functions designated for that purpose. Safety Actuation Safety function actuation should be sealed in, so that the safety function actuation is maintained even if the logic that initiates the actuation is lost. Monitoring Monitoring of after-heat removal after-heat removal (and normal operating heat removal) should include sufficient information processing and displays to present the heat balance and energy transport and verify parameters are within the expected ranges. Higher order logical processing and display may be required to present operators with an integrated picture of the fusion heat removal system. The input sensors, algorithms, software and hardware required for this safety-significant activity should meet appropriate reliability standards. The inherent robustness of the facility confinement systems should be analyzed (and demonstrated) to show survivability during PIE with the worst case performance of the I&C System. The design 30 DOE-HDBK-6004-99 basis (or Graded Approach) should specifically describe the requirements for coupling PIE and internal transients; the influence of PIE on parameter measurements, uncertainties and response times should be evaluated for those scenarios requiring coupling of events. Monitoring of the inventory levels and barrier integrity should address the Postulated Initiating Event of concern. Active detection and venting to expansion volumes must meet the response times assumed in the analysis criteria. Passive designs for channeling coolant to the expansion volume should be considered. TRITIUM SYSTEMS General Safety Design Criteria

Tritium system tritium system design should include features which minimize the environmental release of tritium and exposure of personnel, minimize quantities of tritium available for release during accidents or off-normal events, and minimize the unintended conversion of elemental tritium to an oxide form. Consistent with facility safety analysis, design features should include: 1. Segmentation of the tritium inventory such that release of all tritium from the single largest segmented volume has acceptable consequences, 2. Confinement barriers1 to reduce tritium environmental release to an acceptable level, 3. Materials and equipment which are tritium compatible and minimize exposure of tritium to oxygen, and 4. Cleanup systems to recover gaseous tritium released within any confinement barrier or to process streams exhausting to atmosphere. Tritium system functions should be designated safety functions if they are credited in the facility safety analysis in order to meet prescribed safety criteria. Systems or components needed to perform safety functions should be designated safety-class systems or components. Components which do not perform safety functions but whose single failure causes the failure of a safety function should be designated safety-class components. Generic System Description The following sketch illustrates the tritium system consisting of five major functional areas within multiple confinement barriers: Primary confinement, a sealed system rated for design maximum pressure and low leak rate, is the 1 This document considers the tritium containment system to be a type of confinement. Sealed high- integrity process equipment and piping provide the containment system, for vacuum and pressure conditions, and constitute the primary confinement barrier. The secondary confinement barrier consists of gloveboxes and cabinets which house the primary confinement (containment) system. To complete the secondary confinement, process piping between glove boxes or cabinets are within a jacket enclosure which seals to the glovebox or cabinet. Additional sealed cabinets or rooms may extend the concept to tertiary, quaternary or higher orders of confinement in accordance with the facility’s safety analysis. 31 DOE-HDBK-6004-99 primary barrier for tritium. Although primary confinement is sealed and leak tight, tritium is an elusive molecule and small tritium leaks will occur inevitably. Secondary confinement, a system with controlled outflow, collects the leaked tritium in a recirculating nitrogen (or inert) gas stream for subsequent recovery of the tritium. Secondary confinement operates at a subatmospheric pressure, by virtue of a small purge stream to the exhaust stack, and thus is unlikely to leak tritium to the tertiary or higher order confinements. Personnel may not enter primary confinement or secondary confinement zones during normal operation. They may enter for maintenance activities, and only after tritium removal is complete for the affected systems. Personnel may routinely occupy the tertiary or higher order confinement zones without wearing protective clothing and respiratory equipment. But personal protective equipment (PPE) is available for rapid donning if the safety analysis reveals a credible event wherein tritium enters tertiary or a higher order confinement zone.

The tritium facility’s heating and ventilation system (H&V) promotes the confinement concept by maintaining pressure differentials such that air flow is always towards zones with greater contamination potential. In the above sketch, fresh air enters the quaternary zone then flows to the tertiary zone from which it discharges to a stack. 32 DOE-HDBK-6004-99 H&V Supply Tritium Transfer Tritium Purification Tritium Recovery Tritium Storage System Cleaning S T A C K Tertiary Confinement Quaternary Confinement H&V Exhaust H&V Transfer Recirculating Gas Primary Confinement Secondary Confinement Fresh Air Inlet Figure II-1. Tritium confinement scheme. The function of each major tritium area within primary confinement is as follows: Tritium Storage The tritium inventory resides in the storage medium unless it is undergoing transfer, recovery, purification or burning in the fusion machine. The storage medium can be tankage or hydride beds. Tritium Transfer The transfer function moves tritium from one part of the primary confinement to another or to the fusion machine vacuum vessel or a pellet process. The transfer motive force can be either residual differential pressure, or active pumping, or thermal cycling of a hydride bed, or all three. 33 DOE-HDBK-6004-99 Tritium Recovery The recovery function recovers the small amounts of tritium that invariably escape from the primary confinement during operations and maintenance. Recovery involves removing tritium and any deuterium or protium isotopes from the secondary confinement volume and holding the isotopes for subsequent processing in the purification function. The recovery process can use zeolite beds or metal hydride beds. ! A primary recovery system operates continuously, and recovers tritium from small leaks occurring during normal operation. ! A secondary recovery operates on demand and provides a greater tritium recovery capacity necessary for large leaks or maintenance operations. ! A purge recovery system maintains the secondary confinement at a subatmospheric pressure by exhausting continuously some of the secondary confinement atmosphere to the environment. The purge system recovers tritium from these exhaust flows. Tritium Purification The purification function removes the hydrogen isotopes protium, deuterium and tritium from other gases and then separates the tritium isotopes from protium and deuterium. The purification process can use thermal diffusion columns or cryogenic distillation or a chromatographic process or (preferred) a thermal cycling absorption process. The thermal cycling absorption process uses a palladium-coated kieselguhr2 hydride bed which, upon temperature cycling, separates tritium from protium and deuterium. System Cleaning The cleaning function operates on demand and cleans impurities (suspended solids, oils, moisture, halides, etc.) from the tritium systems. Cleaning uses various detergents, chlorinated fluorocarbons, solvents and water, followed by vacuum drying to <10-2 torr. Removal of impurities is important to prevent stress corrosion cracking of stainless steel and contamination of the fusion machine’s vacuum vessel. Potential System Safety Functions The potential safety functions for the tritium systems are: Normal Operation:

1. Provide for primary and secondary confinement barriers that separate tritium from onsite and offsite personnel and the environment. If the safety analysis requires tertiary or higher levels of confinement, the tritium systems should provide the additional barriers. This safety function includes the structures, systems and components necessary to establish the barriers and the power sources necessary to maintain the barrier operation within prescribed safety limits. 2 loose or porous diatomite 34 DOE-HDBK-6004-99 2. Provide for monitors and signals or alarms dictating a need to isolate or otherwise control a tritium system to prevent monitored system variables exceeding a safety limit. The safety analysis should identify the system variables requiring monitoring, which will normally include system pressure, oxygen inleakage and tritium out leakage from a confinement barrier. 3. Provide for recovery from anticipated off-normal events by providing systems that remove tritium from secondary and greater confinements and from any air stream exhausting a confinement to the environment. Maintenance: 1. Provide for primary confinement of tritium during maintenance within secondary, tertiary or any greater levels of confinement barriers. 2. Provide for tritium removal, evacuation and cleansing of primary confinement systems prior to breaking the primary confinement barrier for maintenance. This preparation for maintenance will minimize the resultant tritium losses. Design Basis Accidents: The safety analysis should specify design basis accidents. Tritium systems design should implement requirements and provide for corresponding safety functions to make the accident consequences acceptable. A typical frequency for design basis accidents is P>10-6/year. The safety analysis will specify the actual frequency. The quantity and form of tritium released during a design basis accident will determine the consequences of the accident. Probability and consequence are the parameters determining risk. The following are potential design basis accidents for tritium systems: Internal Initiators 1. Tritium fire or detonation 2. Missile or pipe whip resulting from sudden failure of high energy system. This accident has potential for causing a release of tritium and simultaneously disrupting multiple confinement barriers. 3. Human errors External Initiators 1. Natural phenomena, including earthquakes, hurricanes, tornadoes, floods, tsunami, etc. 2. Aircraft and other missile impact (excluding sabotage). Beyond Design Basis Accidents: There are no system safety functions required for beyond design basis accidents. 35 DOE-HDBK-6004-99 Beyond design basis accidents include internal and external initiators whose frequency is lower than the design basis frequency limit specified in the safety analysis. Safety-Class Design Standards and Criteria For safety-class tritium systems, the following design standards and criteria should apply to the system, structures or components: Structural General The tritium systems boundary is the pressure (or vacuum) confinement barrier afforded by the piping, fittings, vessels, valves, and instrumentation that are wetted on their interior surfaces by tritium. The boundary extends to the first or second isolation valve in system piping to the fusion device’s vacuum vessel. Loads 1. Individual Loads

Tritium systems should withstand the static load, vacuum, normal operating pressure, normal operating thermal load, electromagnetic loads (normal operating and fault), interaction loads from adjacent systems, natural phenomena hazard loads and loads due to missile impact and hydrogen detonation (if these are design basis accidents, see Section IV). a) Static Load - The static load should include the weight of the equipment identified as constituting the system (or component), and any supported hardware. b) Vacuum Load - The vacuum load should include forces arising from complete vacuum within the primary confinement barrier. A vacuum of <10-2 torr within the primary confinement system is customary for cleansing prior to and following maintenance, inspections, etc. c) Normal Operating Pressure - Normal operating pressure loads should range up to and include the design pressure of the system or components. d) Normal Operating Thermal Load - The normal operating thermal load should include temperatures associated with routine processing operations, both cryogenic and elevated, and elevated bakeout conditions required for cleansing prior to equipment removal. e) Electromagnetic Loads - Electromagnetic loads should include the forces induced as a result of power, instrument and control and eddy currents in the tritium system interacting with magnetic fields of the fusion machine’s normal operation. f) Electromagnetic Loads During Faults - Electromagnetic loads should include the loads induced during abnormal operating events such as control failures, power supply failures, bus opens or shorts, or magnet faults. 36 DOE-HDBK-6004-99 g) Interaction Loads - Interaction loads should include the loads imposed on the tritium systems by adjacent systems during normal or fault conditions. h) Natural Phenomena Loads - Natural phenomena hazard loads should include loads resulting from earthquake, wind, flood, tsunami and seiche. UCRL-15910 provides guideline methods for establishing load levels and for evaluating the response of structures, systems and components to the load levels. i) Hydrogen Detonation Loads - Hydrogen detonation loads should include the mechanical and thermal effects of tritium, deuterium and protium ignition or detonation, if the safety analysis includes such failure as a design basis accident. j) Missile Impact Loads - Missile impact loads should include missiles and pipe whip resulting from failure of high energy systems, if the safety analysis includes such failure as a design basis accident. 2. Combined Loads Table I-1 lists the load combination which the design should consider for normal and anticipated off- normal operations. Because maintenance involves isolating, depressurizing and evacuating a system, the load during maintenance is the static load only. 3. Cyclic Loads Tritium systems are subject to thermal and pressure cyclic loadings during normal and anticipated off- normal operation and maintenance. An evaluation should determine if a formal fatigue analysis is necessary. ASME 93a or comparable computational methods provide criteria for the evaluation which should use a conservative analysis for the number of cycles and service life including the expected changes in material properties with time. Structural Acceptance Criteria

Tritium systems that are safety-class should have design, fabrication, inspection and testing in accordance with a recognized safety-class code such as the ASME Boiler and Pressure Vessel Code. The specific codes and criteria selected should be commensurate with the level of safety required and should have a technical justification. Tritium systems that are NOT safety-class should have design, fabrication, inspection and testing in accordance with a recognized national consensus code such as the ANSI/ASME Standard B31.3 “Chemical Plant and Petroleum Refinery Piping” (ANSI 93). Structures, systems and components near a tritium system should be safety-class if their credible failure could impact the safety function of a tritium system. 37 DOE-HDBK-6004-99 Deflection Analysis An analysis of tritium system deflections over the full range of temperatures, vacuums and pressures should confirm no interferences or loss of confinement integrity. Testing and Inspection Non-destructive testing and inspection of safety-class welds, vessels, piping and valves should be in accordance with the ASME Boiler and Pressure Vessel Code (ASME 93a). Personnel qualification and weld acceptance criteria should also be in accordance with ASME 93a. Testing and inspection should occur before initial operations. The hazards associated with testing of contaminated systems, processing of the contaminated test medium, and increased potential for environmental losses of tritium, may impede subsequent periodic testing and inspection. Any system, subsystem, or component, that is determined to require periodic testing and inspection should be identified during the design of that system so that the test requirements are incorporated into the design. Computational Methods Validation Computer codes or other computational methods supporting the design of tritium systems should have validation and verification for the range of normal and off-normal operations including design basis accidents. This validation and verification should support the use of the computational method in each intended application. Materials Radiation Materials of construction should be qualified for the lifetime radiation environment. The structural design analyses should use conservative end-of-life properties. If a component’s expected lifetime is less than the system’s lifetime, design should provide for component replacement. Radiation environment refers principally to external sources of radioactive energy, but it includes the beta energy of tritium decay also. Thermal The structural design analyses should use material properties appropriate for the operating conditions. If no published materials property data exist for a particular operating temperature, tests should establish the material properties at the temperature. The ASME Boiler and Pressure Vessel Code (ASME 93a) imposes temperature limits for structural designs. For items whose design complies with the Code and whose temperature could exceed the Code’s limit, the design analyses should reduce allowable stress to an acceptable value determined by testing the material at the elevated temperature. 38 DOE-HDBK-6004-99 Tritium Embrittlement The structural design analysis should use material properties based on tritium and helium embrittlement for the projected end-of-life. Penetrations of Confinement Systems Penetrations should meet the same materials requirements as the penetrated confinement system.

Instrumentation and Controls Tritium systems design should provide for instrumentation and control to monitor parameters important to the safety function for normal operation and design basis accidents. The safety analysis should identify and the design should implement: 1. Instruments to monitor safety-related variables. Primary confinement will typically provide monitoring for pressure, vacuum, temperature, and the ability to provide batch-based qualitative gas analysis. Secondary confinement will typically provide for tritium detection, pressure (relative to ambient or tertiary confinement), and oxygen level (if secondary has a reduced oxygen atmosphere). Subsequent levels of confinement will provide monitoring abilities commensurate with the hazard anticipated and the operating conditions of the barrier. 2. Controls to maintain measured variables within prescribed limits and to isolate tritium subsystems when necessary for safety reasons. 3. The design for safety-class systems, including their ventilation systems, should incorporate sufficient redundancy and/or diversity to ensure that a single failure will not result in total loss of instrumentation or control for a safety function. The power supply for safety-class instrumentation and controls should meet the requirements for Class 1E electric power systems (IEEE 308). The different designs and operating characteristics of fusion facilities limit the amount of specific guidance that these criteria can provide. Existing DOE and NRC design requirements and guidance documents (IEEE 603, DOE 6430.1A, NUREG-0800, 10CFR50(A), USNRC Regulatory Guides (RG 1.100 - RG 1.89)) provide helpful general guidance for implementing these criteria at a particular fusion facility. Confinement Systems Tritium systems design should provide for confinement barriers to reduce tritium releases to an acceptable level. The safety analysis should define and the design should implement appropriate robustness and leak tightness for the barriers. The confinement system should include as a minimum primary confinement system and a secondary confinement system. Design should also provide for tertiary, quaternary or higher orders of confinement if the safety analysis indicates these higher orders are necessary. The assumption of a single failure within the system does not compromise the confinement function. 39 DOE-HDBK-6004-99 The safety analysis should identify the confinement safety functions and the process conditions for which the functions are required. The confinement systems should provide the required confinement safety functions for normal operation, anticipated off-normal events and design basis accidents with the assumption of a single failure in the system. Primary Confinement Systems All tritium systems should enclose tritium within a primary confinement that provides a low leak rate, pressure-rated static barrier. Normally, primary confinement systems are sealed systems and are opened only for maintenance, testing and inspection of confinement subsystems. Electrical equipment necessary to provide the required confinement safety function should be safety- class and should have a safety-class electrical power supply including a backup electrical power supply (DOE 3003).

Opening a confinement subsystem requires prior removal of tritium and cleansing. Cleansing steps that exhaust to the atmosphere should exhaust through a tritium removal system to limit the release of tritium to the environment consistent with release limits and ALARA principles. The safety analysis should prescribe limits for tritium releases to the environment. The exhaust from a confinement subsystem may be through a dedicated tritium removal system or through a secondary confinement subsystem which has an tritium removal system. The tritium removal systems should have capacity to recover from a design basis tritium release from primary confinement. 10CFR50(I) provides specific methods and evaluation criteria that are acceptable in implementing ALARA with respect to exhaust systems from a confinement system. DOE 6430.1A provides additional guidance for design of confinement systems. RG 1.140 provides guidance for design, testing and maintenance for exhaust system cleanup systems. Secondary and Higher Order Confinement Barriers A secondary confinement barrier should enclose the primary confinement system. Tritium systems should also have tertiary or higher orders of confinement in accordance with requirements of the safety analysis. Secondary and higher order confinement barriers should comply with the criteria of this section. Secondary confinement barriers should have a recirculating nitrogen or inert gas atmosphere. For the purposes of this document, when the term “inert” is used in reference to the confinement atmosphere, any combination of reduced oxygen environments is intended. Tertiary and higher orders of confinement should have atmospheres as directed by the safety analysis. Secondary and higher order confinement barriers should operate at subatmospheric pressure by exhausting some of the atmosphere to the environment. The atmospheric exhaust should be through an tritium removal system to limit the environmental release of tritium consistent with release limits and ALARA principles. The safety analysis should prescribe limits for tritium releases to the environment. 10CFR50(I) provides specific methods and evaluation criteria that are acceptable in implementing ALARA with respect to exhaust systems from a confinement barrier. DOE 6430.1A provides 40 DOE-HDBK-6004-99 additional guidance for design of confinement barriers. RG 1.140 provides guidance for design, testing and maintenance for tritium removal systems. Segmented Tritium Systems Tritium systems design should provide for segmentation of the tritium inventory to make acceptable the amount of tritium releasable in a single event. Design should provide for isolation of each segmented volume using valves or piping blanks. Check valves and other one-way valves are not acceptable as isolation devices. Release of tritium from the single largest segmented volume should not result in exceeding prescribed dose limits or other unacceptable consequences. Segmentation may be accomplished by either 1. Utilization of processes or devices with small inventory, or 2. Separation of the tritium inventory into isolable volumes, or 3. Storage of tritium in an immobile condition relative to the single event (e.g., metal hydride beds). Protection For Natural Phenomena

For the tritium systems that are safety class, including structures and components, design should provide robustness to withstand the effects of design basis natural phenomena such as earthquake, tornado, hurricane, flood tsunami, seiche, etc., without loss of safety function. The design should also provide for protection of safety-class equipment and systems from potential failure of non-safety­ class hardware during natural phenomena events. If protection includes isolation of safety-class systems, the equipment, instruments and electrical systems that provide for the isolation should be capable of withstanding the effects of design basis natural phenomena without failure of function and should be fail-safe in the event of power loss or failure within electrical systems. Protection from Environmental Conditions and Missiles For the tritium systems, including structures and components, that are safety class, design should provide robustness to accommodate the effects of environmental conditions of normal operations, maintenance, testing and postulated accidents without loss of safety function. Safety-class tritium systems should have robustness or protection to withstand dynamic effects of a missile, pipe whip, or runaway plasma that may result from equipment failures and from events outside the tritium systems if the safety analysis evaluates these as design basis accidents. Fire Protection The design should minimize the probability and consequences of tritium fires or explosions. Because fire oxidizes elemental tritium to tritium oxide, a form with a much greater biological hazard, design should place high priority on preventing fires. The design should use noncombustible or fire resistant materials to the greatest practical extent throughout the tritium systems. 41 DOE-HDBK-6004-99 Where the safety analysis evaluates fires as design basis accidents, design should provide for fire detection and suppression systems having appropriate capacity and capability to minimize adverse effects of fires on safety-class systems, structures and components. Rupture or inadvertent operation of fire suppression systems should not significantly impair the safety function of tritium systems, structures and components. Fire suppression systems should emphasize use of dry chemical or gas suppressants. Because of the natural affinity of tritium for water and the increased biological hazard of tritiated water, the use of water as a tritium fire extinguishing agent should require a technical or economic justification. Facilities that have the potential for introducing fire suppression water into a tritium contaminated environment should provide a tritiated water collection system with the capacity to store the total volume of fire suppression run-off. Design should provide for facilities to dispose of any tritiated water in an environmentally acceptable manner. Conversion of Elemental Tritium to Tritium Oxide The design should include engineered features as necessary to minimize the potential for tritium contact with ignition sources, water, moisture, hydrocarbons and other oxidizing sources. Because oxidized tritium is a significant biological hazard, the design must reduce to a practical minimum the unintended conversion of tritium to any oxidized form. This criterion recognizes that some tritium cleanup systems convert elemental tritium to an oxide form with deliberate intent, to facilitate removal from flowing gas streams. Heat Removal

The design should provide for reliable removal of total heat loading from all confinement barriers. Total heat loading consists of tritium decay heat and equipment energy dissipation within a barrier and heat transfer into the barrier from external energy sources. System Cleaning The design should provide for cleaning of tritium systems before and after installation. Tritium systems should be able to withstand vacuum conditions necessary for cleaning purposes. Once tritium has contaminated the primary confinement, only limited cleaning is permissible for tritium­ wetted surfaces. Tests and Inspections The design should provide for periodic tests and inspections of structures, systems and components related to the intended safety function. The tests and inspections should assess structural integrity, hydrogen embrittlement, leaktightness and other parameters related to the safety function. The design should provide for and operations should have an appropriate materials surveillance program. If the design does not permit periodic inspections and tests in accordance with applicable codes, particularly for systems contaminated with tritium, the safety analysis should develop and prescribe an acceptable testing program. The facility authorization basis should include the test and inspection program. 42 DOE-HDBK-6004-99 Design Considerations General The tritium primary confinement is the pressure (or vacuum) boundary, wetted routinely by tritium, outside the fusion machine’s vacuum vessel and associated vacuum system. Gages, stubs or other pressure-containing hardware attached to a safety-class primary confinement subsystem are safety- class components and design should have them serve as confinement barriers for all operational and accident modes of the tritium primary confinement. Radiation Shielding Radiation shielding is not a design consideration for tritium systems. Tritium decays to a stable element, helium (3He) by emission of low energy beta radiation, maximum 0.0185 MeV and average 0.0057 MeV. The maximum range (i.e., density thickness) of beta particles, about 0.6 mg/cm2, is less than the generally accepted 7 mg/cm2 thickness of the epidermis of the skin. The beta radiation is easily and completely shielded by a relatively thin layer of almost any material, including the materials of the tritium confinement system. Thus, if the primary confinement system is leak tight, tritium poses no radiological hazard to operating personnel. Confinement Barriers Tritium primary confinement is a major design consideration because tritium is difficult to contain. As noted above, tritium is not an external radiation hazard. However, when tritium is oxidized and ingested it produces a significant internal dose. Regardless of the care taken to assure physical integrity and leak tightness of the confinement, small quantities of tritium will escape at the various process connections during normal operations. Additionally, an increased level of loss will occur during maintenance operations which usually breach the primary barrier. By escaping to unwanted areas and reacting with normally present materials, tritium can create significant biological hazards. For example, tritiated water (tritium oxide) is a water molecule in which one or both of the hydrogen atoms is a tritium atom rather than the normal protium, e.g., T2O, HTO, DTO. Tritiated water is on the order of 104 times more hazardous to humans than elemental tritium. The human radiation dose hazard is through inhalation, ingestion or absorption through the skin.

Because tritium is very mobile and can create a biological hazard, tritium systems must have barriers to protect personnel and the environment from tritium and its compounds. As a minimum, a tritium system should have primary and secondary confinements. If the safety analysis determines that tritium systems, or certain components, require tertiary or higher order confinements, the design should provide for these confinements in a similar manner as secondary confinement as discussed below. The primary confinement system should consist of piping, tubing, valves, fittings, equipment and instrumentation components that define the pressure boundary of the tritium systems. The primary confinement system is normally a closed system in direct contact with tritium and containing it for conditions ranging from vacuum to full system pressure. Physical integrity is assured by compliance with the applicable ASME Code for boiler and pressure vessels, or equivalent Codes. If the safety analysis determines a portion or all of tritium primary confinement to be a safety-class system, the 43 DOE-HDBK-6004-99 associated individual components are safety-class and the design should consider them as the primary confinement barrier for all operational and design basis modes. Secondary confinement includes the 1) barriers that enclose the primary confinement and 2) systems that ventilate the secondary confinement volumes. If the safety analysis deems a portion or all of secondary confinement to be a safety-class system, the associated individual barrier components are safety-class and the design should consider them as confinement barriers for all operational and design basis modes. Examples of secondary confinement systems are glove boxes, sealed enclosures, bell jars, double jacketed vessels/duct work/piping, and stripper/scrubber systems. Ventilation systems for secondary and higher order confinement volumes will operate at a negative pressure relative to the ventilation systems of zones occupied by personnel. The negative pressure will assure that any air flow between zones will flow from personnel zones and into the zones that could be confining a tritium release. Structural Design Codes The design, fabrication, testing and inspection of safety-class tritium structures, systems or components should be in accord with the ASME Boiler and Pressure Vessel Code (ASME 93a), or to a comparable safety-related code. Either ASME Code Section III, Class 1 or 2 or the comparable elements of ASME Code Section VIII, Division 2 may apply for pressure vessels. For tritium systems, ASME Code Section III is acceptable. ASME Code Section VIII is acceptable if the design uses additional standards in areas such as attached valves, pumps, piping and supports, enhanced quality assurance and tritium/helium embrittlement effects which are comparable to relevant parts of ASME Code Section III. In general, the designer should prepare a detailed comparison between ASME Code Section III and the comparable code, for safety-class systems, and demonstrate comparability. The designer should prepare this comparison early in the design phase and the safety regulatory or licensing authority should endorse the comparability to ensure acceptability for construction. Finally, this document does not address the actual stamping of a vessel or component complying with Section III or VIII; this is a decision among the owner, fabricator and the cognizant regulatory agency.

Hydrogen Fire and Detonation Hydrogen fire and detonation are potential hazards which the safety analysis may declare design basis accidents (typical frequency > 10-6/year). If tritium primary confinement is a safety-class system, it must retain a required integrity during and after a fire or detonation event, although the non-safety­ related functions of the confinement can be compromised. If it is not a safety class, the tritium primary confinement may fail in a fire or detonation event, but the failure should not degrade the function of an adjacent safety-class system, structure or component. Hydrogen Fires The hydrogen isotopes tritium, deuterium and protium leak easily and can form a highly flammable mixture with air. Hydrogen and air mixtures can ignite and sustain a flame over a very wide range of composition, from 4% to 74% by volume of hydrogen, at room temperature and pressure (Hord 78). A minimum limit of 9% is needed to sustain a coherent flame. At room temperature and 44 DOE-HDBK-6004-99 pressure, a spark energy of 0.02 millijoule can ignite a stoichiometric mixture (29.5% tritium by volume). The potential for hydrogen fires can be minimized through leak prevention, elimination of ignition sources, reduction of available oxygen, and/or increased ventilation. Hydrogen Detonations The mode of burning in which the flame travels at supersonic speeds is called detonation. Heated to a high temperature, a mixture of hydrogen and air can spontaneously ignite and detonate. This temperature is the spontaneous ignition temperature which is a function of composition, pressure and container size. At one atmosphere of pressure, this temperature is about 540°C. Favorable conditions for detonation are stoichiometric mixture (29.5% hydrogen by volume), high energy ignition sources and confining surroundings. Unconfined hydrogen-air mixtures do not detonate unless the ignition source delivers considerable energy in the form of a shock wave. For a potential hydrogen fire or detonation to be a design basis accident, the safety analysis should evaluate the frequencies of the required conditions occurring at the same time: 1. Hydrogen isotopes in sufficient concentration, 2. Oxygen in sufficient concentration, and 3. High temperature or ignition source. To preclude a tritium fire or detonation as a design basis accident, the safety analysis must demonstrate a low event frequency, typically <10-6/year. Design features that promote a low event frequency include: 1. Leak tight primary confinement to prevent out leakage of tritium to the secondary confinement, 2. Inert gas in the space between primary confinement and secondary confinement barrier walls, to prevent oxygen contacting tritium, 3. Monitors to detect tritium out leakage or oxygen inleakage, 4. Minimize ignition sources or high temperatures near the primary or secondary confinement barriers, and 5. Utilize NFPA rated enclosures (NFPA 70) for electrical equipment in a location potential for contact with flammable mixtures exist. Metal Embrittlement Almost all metals will absorb hydrogen gas in a thin surface layer from which hydrogen will diffuse deeper into the metal. Additionally, some of the hydrogen isotope tritium will decay to helium-3. With time and continued exposure, both the diffused hydrogen isotopes and the tritium decay product helium will embrittle the metal.

Embrittlement alters the material properties of some metals significantly, by reducing ductility which leads to failure by crack growth at ambient temperature. In addition, some metals containing helium 45 DOE-HDBK-6004-99 can crack at elevated temperatures, including welding temperatures, by bubble agglomeration and creep crack growth. Design should eliminate embrittlement as a design issue by considering in the choice of materials a lifetime projection of pressures and temperatures and exposure to hydrogen isotopes. Exchange with Hydrogen, Hydrogenated Compounds, and Hazardous Wastes Tritium will readily exchange with a hydrogen atom in water, oils and almost all other hydrogenated compounds. Tritiated water and some tritium hydrocarbon compounds are absorbed quickly into the human body where the beta energy of tritium decay can cause biological damage. When tritiated, mercury, oils and other hazardous wastes become mixed waste with a significant disposal cost. The design should avoid use of water, moisture, mercury, hydrocarbons (oils), plastics, asbestos or elastomeric gaskets and other hydrogenated compounds that could contact tritium. Gaskets and O- rings in contact with tritium should not use elastomers or plastics or asbestos; tritium will degrade them and cause premature failure. Ultra-high molecular weight polyethylene (UHMWPE) is an exception to this rule; see “Recommended Design Practices” below. Components of Primary Confinement System Piping, pumps, valves and pressure relief devices should meet all pressure requirements and vacuum requirements for the primary confinement, and should comply with applicable ANSI/ASME standards (ASME 89d, ASME 93a, ASME 93b). Welded joints are preferable to compression fittings which are preferable to threaded fittings. Welded joints or mechanical joints are acceptable for piping enclosed in a secondary confinement glove box or cabinet. But outside glove boxes or cabinets, piping should have all welded joints. Pumps should comply with National Electrical Code requirements for explosion proof installation (NFPA 70), and should not use organics, hydrocarbons or other volatiles for surfaces that will contact the tritium process gas. Valves should meet prescribed leak requirements across the valve seat and from the valve bonnet and body. Recommended Design Practices Materials of Construction for Primary Confinement Recommended Materials For the primary confinement system for tritium, the recommended materials of construction are austenitic stainless steels: Type 304-L, Type 316, or Type 316L. 46 DOE-HDBK-6004-99 In addition, the following materials for instruments, gaskets and seals of the primary confinement system can contact tritium without detriment in the pressure and temperature ranges of most tritium systems: Copper, Aluminum, Nickel, Silver, Type 304 stainless steel, Stellite, or Nitronic 60® (Titanium Corporation of America) Vespel®, and Indium. For cryogenic processes, Type 316L austenitic stainless steel is the recommended material of construction. The design should give particular attention to avoid conditions that could cause stress corrosion cracking of austenitic stainless steels. If the performance of a particular material in a hydrogen environment is not well known, the designer should perform bench tests to establish performance in simulated operating and accident conditions. Materials Not Recommended

The design should avoid use of the following materials of construction and materials of operation for tritium primary confinement: Metals that are susceptible to embrittlement and cracking upon exposure to hydrogen,3 Water Hydrocarbons (oils) Mercury, Iron oxide contamination on either the tritium wetted surface or an outside surface as a contaminant, 3 Precipitation hardened steels (e.g., 17-4 PH, 15-5 PH) are especially subject to embrittlement by tritium and helium. Some metals including some type 300 stainless steels containing helium alone can crack at elevated temperatures, including welding temperatures, by bubble agglomeration and creep crack growth. 47 DOE-HDBK-6004-99 Materials capable of forming methane, Elastomers, plastics or asbestos. An exception is the use of ultra-high molecular weight polyethylene (UHMWPE) as a step tip in automatic valves. Valves will remain leak-tight longer with an UHMWPE step tip than with a metal tip (e.g., stellite). Carbon steel is significantly more susceptible to hydrogen embrittlement than Type 300-series stainless steel and is not a recommended material for primary confinement. Additionally, at elevated temperatures, carbon steel is vulnerable to hydrogen combining chemically with carbon, decarbonizing the metal, forming methane and causing cracking and blistering. Piping The recommended piping construction method is welding in accordance with the applicable ANSI/ASME standard (ASME 89d). Design should minimize the use of mechanical joints but, where use is necessary, the recommended mechanical joint is a high vacuum connector. Mechanical joints or welded joints are acceptable for piping enclosed within a secondary confinement glove box or cabinet. Outside a glove box or cabinet, only welded joints are acceptable. Metal-to-metal seals are preferable to elastomer seals. Where conditions necessitate the use of elastomer sealing, design should provide a dual O-ring configuration with ease of replacement. Pumps Process requirements will dictate the selection of pumps. In addition to providing for maximum design pressure, pumps should also have the capability of withstanding vacuum for cleaning purposes. Therefore, the selection of pumps for normal operations should include compliance with the vacuum specification. Pumps should not use organics, hydrocarbons or other volatiles on surfaces that can contact the tritium process gases. Metal-to-metal pumping surfaces are satisfactory, and other technologies may be also. If the safety analysis indicates a pump is safety-class, it should meet the requirements of the applicable ANSI/ASME standard (ASME 89c, ASME 93a). Pump motors should meet National Electrical Code requirements for explosion-proof installation (NFPA 70). Valves Valves are components of the primary confinement, and as such, should be designed and tested to the same standards of confinement/vacuum/leak tightness. When specifying leak rate for valves it is necessary to understand that there are two modes of leakage; 1) across the seat, where the tritium is still contained within primary confinement, and 2) bonnet/body leakage, where the tritium exits the primary confinement. Bonnet/body leakage creates a confinement problem and poses a personnel hazard potential. In addition, recovery from the primary confinement breach requires processes to be shut down to repair the leak. Welded, double metal bellows valve bonnets have proven to meet current leak tightness criteria.

48 DOE-HDBK-6004-99 Metal-to-metal valve seats are preferred. An exception is the use of ultra-high molecular weight polyethylene (UHMWPE) as a step tip in automatic valves that are not subject to high temperature environments. Valves will remain leak tight longer with an UHMWPE step tip than with a metal tip (e.g., stellite). During normal operation, seat leakage does not present a personnel or confinement hazard, but it does have a major impact on process operations, accountability, operability and volumetric segmentation. Consideration should be given to the use of double valve isolation to mitigate the potential for valve seat leakage consequences during maintenance breaching of primary confinement and to increase the confidence level for product purity. Pressure Relief Where the potential exists for the over, or under, pressurization of primary or secondary confinement barriers, pressure relief should be provided. Pressure protection may serve as process equipment protection without providing a safety function. For the primary confinement system, stringent leak tightness specifications necessitate that pressure protection be through the use of rupture disks instead of pressure relief valves, seal pots, etc. For the secondary confinement system, pressure differentials and leak tightness requirements are not as stringent, therefore pressure protection may use seal pots, bubblers, surge volumes, etc. Relief valves should not be used for tritium service. Their performance is inadequate for leak tight resealing after relief and reliable relief at low differential pressures. Heating and Ventilation - Personnel Zones Heating and ventilation systems should promote tritium confinement for zones occupied continuously or intermittently by operations or maintenance personnel. The design should provide heating and ventilation systems with pressure differentials to cause air flow from least contaminated areas to most contaminated in tritium process areas. Ventilation pressure in personnel zones should be greater than pressure in secondary confinement. Primary System Cleaning The design should include provisions to accommodate the cleaning of all tritium systems for initial installation, particularly vacuum cleaning of the primary confinement system. After tritium has contaminated the primary confinement’s interior, limited cleaning is permissible and this limited cleaning must avoid use of waters or organics that could oxidize tritium. Past Design Practice Tritium Confinement Some tritium facilities have used primary confinement, secondary confinement and tertiary confinement. The minimum essential design, however, uses a primary confinement with a secondary confinement as a cost effective and safe design for tritium operations. The following sketch illustrates this minimum essential design. 49 zones DOE-HDBK-6004-99 Secondary confinement system pressure is: - Negative relative to building personnel - Positive or negative relative to primary confinement, depending on pressure or vacuum conditions in primary confinement. H&V Exhaust Building Boundary Secondary Tritium Confinement Purge Recovery (Stripper) Primary Recovery (Stripper) Secondary Recovery (Stripper) Fusion Machine Tritium & Fueling Transfer Systems System Tritium TritiumPurification StorageSystem System Primary Confinement H&V Supply Cleaning Figure II-2. Tritium processing schematic.

The primary confinement system encloses tritium in a sealed, low leak system rated for all operating pressures and vacuum. Primary confinement is essentially a static, high integrity system of process equipment and piping. There is no intent that tritium will leave primary confinement except under controlled transfers. But tritium is difficult to contain, even in the highest integrity systems, and some small leakage is likely to occur. To ensure that tritium loss to the environment or exposure of personnel is minimal, the primary confinement system is within a secondary confinement barrier. The secondary confinement system is dynamic, depending on differential pressures or gas flows to confine and channel tritium within certain volumes or pathways. The secondary (or higher order) confinement system may not be sealed or leak tight. S T A C K 50 DOE-HDBK-6004-99 Metal Hydride Technology Metal hydridemetal hydride beds technology is multipurpose and has replaced several older technologies for tritium storage, pumping and hydrogen isotope separation. Hydride beds require less process space than does conventional equipment. Hydride beds are metal containers filled with other granular alloys or metals that can absorb hydrogen isotopes when the beds are cold and desorb the isotopes when the beds are heated. Electrical, gas or other heating and cooling systems are satisfactory. The following sketch shows nitrogen gas to heat and cool the hydride beds via shell and tube heat exchangers. Several types of hydride metals have been successfully used in past applications: - LANA (lanthanum, nickel, aluminum) for pumping and storage, - Mischmetal (calcium, mixed rare earth metals, and nickel) for compression, - Pd/K (palladium-coated kieselguhr) for purification and separation, and - Uranium for storage. Tritium Storage Process Past practices have stored tritium in conventional tankage and on metal hydride beds. Metal hydride beds provide significant safety advantages because they are low pressure devices and, if maintained below desorption temperature, will not release tritium should the bed wall rupture. Also, hydride beds require less process space with no significant sacrifice of storage capacity and are the preferred storage option for most modern applications. Purification Process The purification process removes hydrogen isotopes from other waste gases and then separates the hydrogen isotopes. A palladium diffuser bed removes hydrogen isotopes from helium and other waste gases. To separate the hydrogen isotopes from each other, past practices have used four processes: 1. Thermal Diffusion Columns, 2. Chromatograph Columns, 3. Cryogenic Distillation Stills, and 4. Thermal Cycling Absorption Process (TCAP). 51 DOE-HDBK-6004-99 The TCAP offers improved operating efficiency and a more compact process package with no sacrifice in separative capacity. It has replaced thermal diffusion and cryogenic distillation in modern applications. TCAP is a metal hydride bed using Pd/K (palladium-coated kieselguhr) that is thermally-cycled to separate tritium from H2 and D2 isotopes. The isotopes removed from the TCAP process may be stored separately on LANA storage beds for later use. Tritium Purification, Stripping and Recovery Processes Purification Process

The fusion machine will transfer some of its burned and unburned fuel gas to the tritium systems for purification and storage. The tritium purification process will recover tritium and deuterium isotopes by processing fuel gas through a Pd diffuser to separate tritium and deuterium from other gases. The tritium and deuterium mixture then proceeds through a separation process such as TCAP which separates tritium from deuterium. Separated tritium and deuterium gases go to separate storage facilities such as LANA metal hydride storage beds. Stripping and Recovery Processes The tritium system will also recover the small amounts of tritium that inevitably leak from the primary or secondary confinement. The recovery of leaked tritium involves use of a “stripper” system and a recovery process. The stripper consists of a oxidizer-reactor , a pumping system, and zeolite beds (Z-beds). The oxidizer-reactor incinerates elemental hydrogen isotopes to form oxides of these isotopes (water vapors: H2O, D2O, etc.). The recovery system will regenerate the zeolite beds and store the hydrogen isotopes prior to transfer to the purification process. A typical system consists of magnesium or uranium beds, a pumping system, and tanks. The magnesium or uranium beds break the hydrogen isotope oxides into O2 and H2, D2 and T2. The nitrogen (or inert gas) atmosphere of secondary confinement flows through the oxidizer-reactor and any hydrogen isotopes convert to oxides (water vapors). The gases then flow through the zeolite beds which absorb the water vapors. As a zeolite bed approaches water saturation, it goes off-line and another (regenerated) zeolite bed comes on-line. The zeolite bed saturated with water vapors undergoes regeneration which involves heating to drive off the water vapors. The water vapors pump to the uranium bed which breaks the water into elemental gases. Hydrogen elemental isotopes go to a separation process which recovers tritium for storage. Past practices used a system of three strippers (primary, secondary, and purge systems) and one recovery process to augment confinement and recovery of tritium. The secondary confinement’s nitrogen or inert gas atmosphere cycles to and from the primary stripper systems which remove any tritium that might leak from primary confinement. The secondary stripper is available should secondary confinement accumulate a significant tritium concentration from leaks or maintenance work. 52 DOE-HDBK-6004-99 The purge stripper maintains secondary confinement at subatmospheric pressure by exhausting a small portion of secondary atmosphere to the environment. Secondary confinement is an enclosed, but not sealed, system. Ventilation differential pressures will cause some building air to flow into the secondary atmospheric, causing a gradual pressure build up. To maintain secondary confinement at slightly below atmospheric pressure, some of the secondary atmosphere must discharge to atmosphere through the primary and purge strippers. The purge stripper system can safely handle all planned exhausts to the environment from tritium secondary confinement. The system includes redundant components to assure continuous stripping capability. Tritium Control, Accountability and Physical Protection The purpose of requirements placed on tritium control, accountability, and physical protection at DOE fusion facilities are: 1. Meet legal requirements for environmental releases, waste disposal, and transportation of tritium,

2. Meet the requirements of the 10 CFR 830, 3. Prevent the diversion of the material for unauthorized use, 4. Knowledge of the process efficiency, i.e. how much tritium is produced and used in processes under investigation, 5. Meet the requirements of the DOE Orders, 6. Increase operational safety of the facilities by providing knowledge of the location and form of tritium, 7. Prevent unwanted buildup of tritium within a facility. Scope This section will primarily cover methods for the control and accountability of tritium. Tritium is the predominate nuclear material used at fusion facilities. It is of interest because of safety concerns and possible unauthorized diversion for military applications. Tritium will be an issue for operation of fusion facilities since it will be a radioactive material released to the environment for operating facilities during normal operations. Although public exposures and environmental releases are expected to be small and well below regulatory limits, it is a radioactive material and the public will need to be assured that safety has not been compromised. Other radioactive materials that must be controlled at fusion facilities include depleted uranium (U238) for storage of tritium and various radioactive sources used for checks and calibration of radiation monitoring devices. The control and accountability of these materials is relatively straight forward and does not present significant problems for operating facilities. Deuterium, in quantities greater than 100 grams, is also controlled at DOE facilities. The requirements are primarily records management. There are not requirements to perform measurement. The accountability requirements are also straight forward and do not present concerns. 53 DOE-HDBK-6004-99 It is important to distinguish between a DOE nuclear facility and a DOE general radiological facility. The requirements on DOE nuclear facilities are substantially greater because of the possible greater risk to the public, the environment and the worker for accidents. The current categorization of nuclear facility is by inventory of radioactive materials. For this document, tritium is of concern. The current categorization is based on DOE-STD-1027-92: Less than 1,000 Curies General Radiological Facility 1,000 to 30,000 Curies Category IV Nuclear Facility Low Hazard 30,000 Curies and up Category II Nuclear Facility Moderate Hazard Category I is a High Hazard facility and are currently only category A reactors and other facilities as designated by the DOE Program Secretary Office. There are no tritium facilities in the US that are designated as Category I. It has not been determined if a demonstration fusion power plant would be a Category I facility. The Nuclear Safety Rules and Nuclear Safety Orders discussed in section 3 apply to all nuclear facilities. The requirements for control and accountability in other countries is not discussed in this section. Requirements The requirements placed on the control and accountability of tritium fall into three categories. Those required by the US Law, those required by DOE Orders and those required by “good practices.” It is also important to note that requirements are not consistent throughout the international community. There is considerable variation across the international community. Shipping requirements are defined for international shipments. Legal Requirements The legal requirements on tritium measurement are of the following types:

Environment facility emissions which included air emissions and releases to the ground water or at facilities outfalls. These include federal and state requirements. Some of the requirements for fusion facility that handles tritium are defined in the following laws: 1. Clean Water Act for water quality standards and effluent limitations, 2. National Environmental Policy Act for impacts of proposed activities, 3. Federal Clean Air Act which sets ambient air quality standards, 4. Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). 54 DOE-HDBK-6004-99 EPA regulates the type and quantity of facility emission. EPA specifies and must approve the measurement techniques. EPA sets the limits for exposure to the public and the notification required when certain quantities of radioactive materials are emitted. State laws usually regulate the facility outfalls. State requirements are not uniform across the country. Department of Transportation (DOT) transportation requirements specify packaging requirements that are dependent on the form and quantity of tritium. DOT must also approve all packaging containers when the radioactive material is transported on public highways. Waste storage requirements when mixed hazardous waste may be involved. The EPA administers the Resource Conservation and Recovery Act (RCRA). In many cases this authority has been delegated to the state. Waste disposal requirements. These are generally state-specific. The details of the state requirements will not be discussed in this section since they vary widely. Nuclear Safety Rules 10CFR834 (Radiation Protection of the Public and the Environment) (proposed), and 10CFR835 (Occupational Radiation Protection): Current DOE orders that are nuclear safety related are being reissued as “rules” that are law. Rule requirements were placed on DOE funded nuclear facilities by the US Congress in the amendments to the Price Anderson Act. The requirements and implications of the DOE Rules as defined in the 10CFR laws listed above are still to be determined for tritium control and accountability. Currently, the DOE orders dealing with nuclear materials control and physical protection will not be released as Rules. Rules specify requirements that will result in fines and criminal prosecution (as defined in 10CFR820) if they are not followed. The only rules that have been released are the Occupation Radiation Protection Rule and Quality Assurance Rule. These will have implication on the procedures and techniques that are used to determine personnel exposure to tritium and environmental releases of tritium. Since these requirements are part of the US law, they must be followed by all facilities that handle tritium or radioactive materials as applica