DOE-NA-STD-2016-2006, Hazard Analysis Reports for Nuclear Explosive Operations

DOE-NA-STD-3016-2006 May 2006 DOE LIMITED STANDARD HAZARD ANALYSIS REPORTS FOR NUCLEAR EXPLOSIVE OPERATIONS U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. NOT MEASUREMENT SENSITIVE ii Available on the Department of Energy Technical Standards Program web site at http://www.eh.doe.gov/techstds/ DOE-NA-STD-3016-2006 iii FORWARD This Department of Energy (DOE)/National Nuclear Security Administration (NNSA) technical standard is approved for use by the Assistant Deputy Administrator for Military Application and Stockpile Operations (NA-12), and is available for use to prepare Nuclear Explosive Operation (NEO) Hazard Analysis Reports (HARs) as required by 10 CFR 830, “Nuclear Safety Management.” This Standard is approved for use by all DOE/NNSA components and their contractors who are responsible for nuclear explosive operations and associated activities and facilities. Standards are used to identify methods that DOE finds acceptable for implementing the Department's requirements. Beneficial comments (recommendations, additions, and deletions) and pertinent data that may be of use in improving this document should be addressed to: Assistant Deputy Administrator for Military Application and Stockpile Operations Office of Nuclear Weapon Surety and Quality (NA-121, GTN) U.S. Department of Energy/National Nuclear Security Administration 19901 Germantown Road Germantown, MD 20874-1290 Phone: (301) 903-7167 Fax: (301) 903-8628 The 10 CFR 830 rule imposes requirements for a Documented Safety Analysis (DSA) for both nuclear explosive operations and the facilities in which these operations are performed. This Standard represents a “safe harbor” for the preparation of HARs. DOE-NA-STD-3016-2006 iv TABLE OF CONTENTS FORWARD .................................................................................................................................... iii 1. APPLICABILITY.................................................................................................................... 1 2. PURPOSE ................................................................................................................................ 1 3. SCOPE..................................................................................................................................... 1 4. OBJECTIVE ............................................................................................................................ 1 5. CONTENT............................................................................................................................... 1 6. APPROACH TO HAZARD AND ACCIDENT ANALYSIS..................................................... 1 6.1 EVALUATION AND ANALYSIS ..............................................................................................2 6.2 WEAPON RESPONSE............................................................................................................3 6.2.1 Screening Tables ........................................................................................................... 3 6.2.2 Requesting Weapon Response......................................................................................... 3 6.2.3 Issuing Weapon Response .............................................................................................. 4 6.2.4 Expert Judgment/Elicitation and Peer Reviews................................................................ 4 6.2.5 Incorporation of Weapon Response Information .............................................................. 5

6.3 ACCIDENT SELECTION AND ANALYSIS.................................................................................5 6.4 CONTROL IDENTIFICATION AND EFFECTIVENESS DETERMINATIONS.......................................5 7. INTERFACE WITH SARS...................................................................................................... 6 8. CHARACTERIZATION OF PROBABILITIES AND UNCERTAINTIES.............................. 6 9. NEW INFORMATION............................................................................................................ 6 CONCLUDING MATERIAL.......................................................................................................... 8 DOE-NA-STD-3016-2006 1 1. APPLICABILITY This technical standard applies to the conduct of hazard analyses and preparation of Hazard Analysis Reports (HARs) for Nuclear Explosive Operations (NEOs) conducted by DOE/NNSA. This standard addresses operation-specific HARs and their interface with facility safety basis documents (Safety Analysis Reports [SARs] or other DOE/NNSA-approved safety basis documents). Federal rule 10 CFR 830, “Nuclear Safety Management,” uses the term “Documented Safety Analysis” (DSA) for both the facility SAR and the operation-specific HAR. This standard will continue to use the acronyms SAR and HAR in their traditional sense. The HAR is prepared and maintained by the Production Plant Contractor (PPC). This Standard shall also be applied to any DSA that involves weapon response (e.g., site-wide SAR). 2. PURPOSE The purpose of this technical standard is to clarify DOE/NNSA expectations and to provide guidance for preparing HARs for NEOs. The general requirements for operation-specific HARs are those contained in Chapters 2-5 of DOE-STD-3009-94, Change Notice 2, “Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analysis”, or superseding directives. These general requirements are more fully developed in this standard in order to account for issues unique to NEOs and interface issues with the facility or special operations (e.g., transportation). 3. SCOPE The scope of the HAR must address the full scope of operations, if not covered in a SAR, for which DOE authorization is sought. The HAR shall include the operational processes, equipment, facility or facility interfaces, and operation-unique activities related to manipulations and movements within the facilities where the activities are to be conducted. The HAR shall consider all hazards that could lead to Inadvertent Nuclear Detonation (IND), High Explosive Violent Reaction (HEVR), and radioactive or other hazardous material dispersal, and adverse Worker Safety (WS) effects from a weapon assembly. Material Dispersal includes tritium release, mechanical and burning release of special nuclear material, and toxic material release. The HAR is not required to address deliberate unauthorized acts. Routine industrial accidents, resulting in only worker consequences such as falls, electrocution, etc., are not part of these analyses, even if uniquely caused by operational conditions. The HAR evaluation should ensure that all (non-industrial) potential operational and facility hazards are addressed and that process- specific and common-facility controls applicable to the NEO are identified.

4. OBJECTIVE As stated in DOE-STD-3009, or superseding directives, the overall objective of the hazard and accident analysis portion of a SAR is to identify controls and establish their adequacy through la rgely qualitative methods. The objective of a HAR is the same with the difference in focus of covering a specific NEO. A HAR, together with its associated SARs and Technical Safety Requirements (TSRs), should provide all necessary information, either directly or by reference, in order to make the decision to authorize a NEO. 5. CONTENT The format and content of chapters 3 through 5 of a HAR are the same as those described in STD-3009. Chapter 1 of the HAR is different from STD-3009 in that it is an executive summary that provides an overview of the HAR and its main conclusions. Chapter 2 will include the NEO process description. 6. APPROACH TO HAZARD AND ACCIDENT ANALYSIS The analytical approach to hazard and accident analysis in a HAR is the same as that described in Chapter 3 of STD-3009. This standard discusses features of this approach that are unique to nuclear explosive DOE-NA-STD-3016-2006 2 operations. Information that supports the documentation used in the preparation of the HAR shall be complete and accurate in all material respects as required by 10 CFR 830 Subpart B, Appendix E, Paragraph 2. DOE/NNSA expects a reasonable level of conservatism using engineering judgment throughout HAR development. 6.1 Evaluation and Analysis Hazard evaluation characterizes the identified hazards in the context of the actual NEO process. Some hazards may originate from within the nuclear explosive itself (e.g., internal power supplies, energetic devices). As discussed in DOE-STD-3009, or superseding directives, the process of hazard evaluation is qualitative in nature and intended to result in effective controls for prevention or mitigation of consequences. The hazard evaluation must be comprehensive in its identification of the physically meaningful hazard scenarios (i.e., determined to be non-negligible contributors to accident scenario probabilities) and potential controls. This evaluation is best achieved by initially identifying hazards, controls, and their safety functions in the hazard analysis process in close association with weapon configurations and process steps to establish a final control set. This necessitates that the hazard analysis table follow single, or properly grouped, process steps, weapon configurations, and/or tasks so that controls can be clearly linked to potential hazards associated with each. This clear linkage between hazard scenarios and controls also clarifies the important process of safety function definitions. Hazard scenarios must be fully developed and account for factors that influence scenario progression such as controls and physical phenomena (e.g., sufficient voltage, capacitance). This evaluation should include the generation of energy, possible ways to apply the energy to the weapon with consideration of potential controls, and then the application of energy to a sensitive component that could lead to undesired consequences. The first two elements of the analysis are developed by the PPC (in consultation with the Design Agencies (DAs) as appropriate), to define the weapon environment, while the DA weapon response determines the last element. The definition of the boundary between the hazardous environment and the weapon response is critical to the proper characterization of the hazard scenarios. The boundary definition must be well understood by both the PPC and the DA and shall be documented in the HAR.

All hazard scenarios are listed in a hazard table that shall be included in the HAR. Those hazards that are not screened shall be listed with potential controls in a summary hazard table also included in the HAR. The following table is a suggested format of a summary hazard table that must be included in the HAR and present conclusions of the hazard analysis suitable for NEOs. DOE-NA-STD-3016-2006 3 Id # Weapon Configuration /Process Step(s) Hazard and Parameters Control Description Other Parameters Scenario Description 1. PP: 2.4.7, 2.4.9-16 (I) ESD; worker charged to voltage of concern and makes contact with weapon, Pr(I) = 1E-2 (B) Bonding wrist straps failure, Pr(B)=1E-3 (BA) Bonding admin. req. failure, Pr(BA) = 1E-2 (CF) Control failure, Pr(CF) = 1.1E-2 (D) Worker contacts sensitive component, Pr(D) = 1E-2 (WR) Sensitive component response, Pr(WR)=1E-3 Worker charged to voltage of concern, bonding controls fail, contacts sensitive component, sensitive component responds – HEVR results, Pr(HEVR) = Pr(I.CF.D.WR) = 1.1E-9 Note: The entries in this table are for illustrative purposes only The descriptions of the example summary hazard table entries are as follows: 1) Identification Number – the unique scenario identifier; 2) Weapon Configuration/Process Step(s) – includes both the configuration of the weapon and the steps of the process applicable to that configuration (distinction of process steps is needed to account for steps that require different controls); 3) Hazard and Parameters – identifies the hazard of concern (e.g., ESD), the parameters that affect the hazard, and their probabilities (e.g., voltage and capacitance for ESD and the probability the energy will be deposited); 4) Control Description – identification of the controls and the failure probabilities; 5) Other Parameters – listing of other parameters that contribute to the specifics of scenario progression including weapon response; and 6) Scenario Description – provides a summary of the combinations of occurrence for initiating event, occurrence of other events, and failure of controls and their associated probabilities. For some complex hazard scenarios, the development of the summary hazard table may need to be augmented with event trees and/or fault trees that break out certain events into more basic events. In such cases, the summary hazard table will simply reference the applicable analysis, but the results must still be included in the summary hazard table. 6.2 Weapon Response 6.2.1 Screening Tables Hazards and associated weapon configuration combinations that cannot result in a weapon response are identified in a screening table issued by the DA. The screening tables must be accompanied with bases information that include the weapon configuration and the screening rationale with reference to appropriate and defensible documentation. The screening tables should be approved by the applicable DAs for use in a time frame to support the hazard analysis development. 6.2.2 Requesting Weapon Response The weapon configurations, hazards, and parameters for scenarios (that cannot be screened utilizing the screening tables) are documented in a formal weapon response request prepared by the PPC utilizing the Engineering Authorization System or equivalent. Weapon response requests must be forwarded to the DOE-NA-STD-3016-2006 4 appropriate DAs. Weapon response consequences shall be categorized into consequence categories of IND, HEVR, Material Dispersal, and Worker Safety as a minimum.

6.2.3 Issuing Weapon Response When requested by the PPC, the DAs provide conditional weapon response probabilities for each scenario for which weapon response could not be screened. Weapon response information is provided as a weapon response summary and bases documentation or equivalents. The DA shall formally transmit the weapon response summary document to the PPC utilizing the Engineering Authorization System or equivalent. The DAs shall specify any assumptions made and initial conditions imposed that may need to be preserved as controls at the production plant. The DAs’ weapon response documentation must be coordinated between the applicable DAs in order to preclude internal inconsistencies and to gain efficiencies. When weapon response from more than one DA is required, the DAs must provide a coordinated and consolidated weapon response summary. The bases information (e.g., experimental data, modeling results, test results, calculations) that the DAs use to provide reference and support for developing weapon response for the PPC is kept at the DA, and is maintained in accordance with requirements of the DA’s DOE/NNSA-approved Quality Assurance Program (QAP) as required in 10 CFR 830.120, Subpart A, and DOE O 414.1C, “Quality Assurance,” or superseding directives. Source data and methods used in developing weapon response must be traceable. All information used within, or to support, the weapon response bases documentation (including all references) shall be accurate and available to support the DOE/NNSA HAR review. 6.2.4 Expert Judgment/Elicitation and Peer Reviews Expert, professional, or engineering judgment refers to assessments provided by a subject matter expert. The subject matter expert’s opinion or belief is based on reasoning. Expert judgments can be evaluations of theories, models, experiments, or recommendations for further research. Expert judgments can be either qualitative or quantitative. Subject matter experts are individuals recognized by their peers as authorities in a specific subject matter or topic. The weapons response process relies heavily on subject matter expert judgments and expert elicitation. Scientists, engineers, and technical program managers exercise expert judgment routinely and usually informally. When expert judgment is used within the bases documentation, a person qualified in the expert elicitation process using a structured procedure may be used to gather necessary judgments from recognized DA subject matter experts. Expert elicitation is a formal, highly structured, and well-documented process for obtaining the judgments of multiple experts (NUREG-1563, “Branch Technical Position on the Use of Expert Elicitation in the High-Level Radioactive Waste Program,” November 1996). Expert elicitation may be of the greatest value and should be considered in the following situations : • Empirical data is not reasonably obtainable or the analysis is not practical to perform. • Multiple diverse sources of applicable data must be assessed. • Uncertainties are large and significant. • More than one conceptual model can explain and be consistent with the available data. • Technical judgments are required to assess whether calculations are appropriately conservative. • Source data includes the use of unpublished, un-reviewed, or draft information.

Each organization utilizing expert judgment within the bases information supporting weapon response shall do so through a process that is defined in the DA’s local procedure(s). The local procedure shall be included as part of the DA’s QAP submitted to DOE/NNSA for approval per 10 CFR 830.120, Subpart A DOE-NA-STD-3016-2006 5 and DOE O 414.1C, or superseding directives. This procedure shall establish the requisite criteria for training and qualification of personnel providing expert judgment and performing expert elicitation. Peer reviews are performed in order to ensure completeness and accuracy and to limit the potential bias of weapons response information, while bringing in additional sources of expertise. Peer reviewers shall have the requisite technical knowledge to understand and challenge the information, but must not have been involved in the development of the information. Each organization providing formal weapon response, in accordance with this standard, shall perform peer reviews of the information prior to its release. Each organization shall do so in accordance with a DA procedure that describes the peer review process including criteria for establishing and maintaining the requisite training, qualification, and independence of the peer reviewers. This procedure shall be included in the DA’s QAP submitted for DOE/NNSA approval per 10 CFR 830.120, Subpart A and DOE O 414.1C, or superseding directives. The level of rigor employed in DA expert elicitation and peer review processes must be commensurate with the secondary role all probabilities play within the HAR. 6.2.5 Incorporation of Weapon Response Information The PPC shall incorporate the weapon response information into the hazard analysis. In order to preclude extensive, last-minute reviews, the DAs shall work with the PPC to ensure appropriate use of the weapon response information. 6.3 Accident Selection and Analysis Hazard scenarios that are not screened for HEVR or IND consequences are designated as Design Basis Accidents (DBAs), and are retained for consideration in the accident analysis section per DOE STD-3009, or superseding directives. The specific operations covered by a HAR run for a limited duration of weeks or months. Therefore, the HAR accident sequence likelihood estimations should be represented in units of probability per single unit weapon operation (e.g., assembly, disassembly). Accident scenarios are binned in each consequence category and are ranked in terms of their approximate probabilities (see section 8). The overall (and approximate) probability of each consequence category (i.e., IND and HEVR) for scenarios analyzed in the HAR should be provided by the summation of the probabilities of all accident scenarios contributing to the category. This process helps to provide an order-of-magnitude understanding of the probability of each consequence category, as well as for the degree of contribution of each accident scenario to the overall probability of each consequence category. In addition, other useful information such as measures of importance can also be readily obtained. Natural Phenomenon Hazards (NPH) and external initiating event likelihood, typically expressed in terms of frequency, must be converted into probability based on the scenario attributes in order to provide a common basis for comparing accidents within a HAR.

6.4 Control Identification and Effectiveness Determinations The approach to the identification and classification of controls in the hazard analysis is the same as the process described in DOE-STD-3009, or superseding directives, with the added simplification that any IND or explosive dispersal (HEVR) of plutonium should be treated as an event that will challenge the Evaluation Guideline of 25 rem to the maximally exposed offsite individual. Control effectiveness determinations should include a discussion of single failure faults in the final control set. DOE-NA-STD-3016-2006 6 Qualitative identification of controls and ensuring their adequacy is the centerpiece of the safety evaluation process. In a qualitative hazard analysis, the hazard analysts are concerned with how each control may fail, how to prevent such failures, and whether redundant components, verifications, or diverse systems need to be considered to ensure adequacy of controls for each hazard/accident scenario. This analysis aids DOE/NNSA in making an informed decision on whether to authorize the operation. The information provided must also include the evaluation of how each control meets the safety function derived from the analysis. Controls should be prescribed at a level of appropriate detail to ensure their effectiveness. 7. INTERFACE WITH SARs The HAR must evaluate all hazards that could impact the NEO and must serve as the final safety basis integration document. Another DSA (e.g., a SAR) may provide analysis and resulting controls for hazards that are relevant to the NEO. However, the HAR must verify the analysis and controls are adequate for the hazard. DOE-STD-3009, or superseding directives, provides adequate criteria for evaluating NPH in regard to systems, structures, and components associated with NEO. 8. CHARACTERIZATION OF PROBABILITIES AND UNCERTAINTIES Probability estimates for weapon responses, safety function failures, and intermediate events as part of an accident sequence should: a) Provide reasonably approximate, order-of-magnitude point-estimates commensurate with the secondary role that estimation of accident scenario probabilities play in the safety basis documentation, b) Characterize the degree of uncertainties from the range of variability in supporting information that was used to develop the point-estimate probability, c) Be reasonably conservative, and d) Be associated with properly and thoroughly defined events. The application of this model for characterizing probabilities and uncertainties can be accomplished as described below. 1) Establish point-estimate probability for any event from the associated underlying probability distribution (e.g., 95/5, 80/20, mean and standard deviation, or median and uncertainty factor) to those values. When using percentiles, they represent the confidence levels associated with the upper- and lower-bound probability values. The PPC will use the appropriate two parameters of the supplied information to develop a lognormal distribution, and derive the mean of the distribution as the representative and reasonably conservative point-estimate for the probability of the associated event. 2) For those probability estimates based on detailed modeling or data resulting in a reasonably conservative estimate, it may not be necessary to assume an underlying distribution associated with the variability of the point-estimate probability.

Probabilities previously established using the binning methodology do not have to be changed for compliance with this standard. 9. NEW INFORMATION As the weapon stockpile ages and technology develops, the DAs continue to learn more about the behavior and aging of weapon systems and components. This understanding is accomplished through a DOE-NA-STD-3016-2006 7 variety of sources including surveillance assessments, significant finding investigations, enhanced surveillance, and modeling. This information flows informally between the production sites and the DAs as part of day-to-day operations and takes a variety of forms. It could be a presentation made by a researcher, a technical paper related to a component similar to one found in a weapon, or even a phone call between the DAs and the PPC. Information exchange of this kind is encouraged within the nuclear weapon complex to continuously monitor and potentially improve the safety and efficiency of NEOs. New information that changes, or has the potential to change, information relied upon within the SARs and HARs is evaluated through the site's new information and unreviewed safety question evaluation processes per 10 CFR 830 as appropriate. Once DA management has determined that the information is developed enough to require action and is applicable to production plant operations, the information must be formally transmitted from the DA to the PPC utilizing the Engineering Authorization System, or equivalent. The information should also be shared with the other DAs for potential applicability to their systems. Actions in response to this information at the PPC site (e.g., cessation of certain activities, compensatory measures) are taken by the PPC as deemed necessary with the appropr iate notifications to the local NNSA/DOE office per the current requirements. DOE-NA-STD-3016-2006 8 CONCLUDING MATERIAL Review Activity: HQ Offices Site Offices National Laboratories NA SSO Los Alamos National Laboratory SC LASO Sandia National Laboratories LSO Lawrence Livermore National Laboratory NSO PXSO SRSO YSO DOE Contractors BWXT Pantex Bechtel Nevada BWXT Y-12 WSI Nevada Preparing Activity: NA-121.1 Project Number: SAFT-0107