DOE-NA-STD-3016-2018, Hazard Analysis Reports for Nuclear Explosive Operations

i DOE-NA-STD-3016-2018 October 2018 DOE LIMITED STANDARD HAZARD ANALYSIS REPORTS FOR NUCLEAR EXPLOSIVE OPERATIONS U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. NOT MEASUREMENT SENSITIVE Available to the public on the DOE Technical Standards Program website at www.standards.doe.gov DOE-NA-STD-3016-2016 iii FOREWORD This Department of Energy (DOE)/National Nuclear Security Administration (NNSA) Technical Standard is approved for use by the Assistant Deputy Administrator for Stockpile Management (NA-12), and is available for use to prepare Nuclear Explosive Operation (NEO) Hazard Analysis Reports (HARs) as required by 10 C.F.R. Part 830, “Nuclear Safety Management.” This Standard is approved for use by all DOE/NNSA components and their contractors who are responsible for nuclear explosive operations and associated activities and facilities. Standards are used to identify methods that DOE finds acceptable for implementing the Department's requirements. Beneficial comments (recommendations, additions, and deletions) and pertinent data that may be of use in improving this document should be addressed to: U.S. Department of Energy/National Nuclear Security Administration Assistant Deputy Administrator for Stockpile Management (NA-12) The 10 C.F.R. Part 830 rule imposes requirements for a Documented Safety Analysis (DSA) for both nuclear explosive operations and the facilities in which these operations are performed. This Standard represents a “safe harbor” for the preparation of HARs. DOE-NA-STD-3016-2018 iv Intentionally Blank DOE-NA-STD-3016-2018 v TABLE OF CONTENTS DEFINITIONS .................................................................................................................................. vi 1. APPLICABILITY .......................................................................................................................... 1 2. PURPOSE ....................................................................................................................................... 1 3. SCOPE ............................................................................................................................................ 1 4. OBJECTIVE................................................................................................................................... 2 5. CONTENT ...................................................................................................................................... 2 6. APPROACH TO HAZARD AND ACCIDENT ANALYSIS ..................................................... 2 6.1 Evaluation and Analysis ....................................................................................................... 4 6.2 Weapon Response ................................................................................................................. 4 6.2.1 Screened Responses .............................................................................................................. 5 6.2.2 Requesting Weapon Response ............................................................................................. 5 6.2.3 Issuing Weapon Response .................................................................................................... 5 6.2.4 Expert Judgment ................................................................................................................... 5

6.2.5 Expert Elicitation .................................................................................................................. 6 6.2.6 Peer Reviews .......................................................................................................................... 6 6.2.7 Incorporation of Weapon Response Information ............................................................... 7 6.3 Accident Selection and Analysis........................................................................................... 7 6.4 Identification of Controls Required and Control Effectiveness Determinations ............. 7 7. INTERFACE WITH SARs ........................................................................................................... 7 8. NEW OR EMERGING INFORMATION ................................................................................... 8 DOE-NA-STD-3016-2018 vi DEFINITIONS Note: The origins of the definitions below are indicated by references shown in square brackets. If no reference is listed, the definition originates in this Standard and is unique to its application. Burning Dispersal (BD). A category of weapon response used in hazard analysis that includes thermal dispersal of plutonium or material of comparable total effective dose contained in the physics package. Aerosolized Dispersal (AD). A category of weapon response used in hazard analysis that occurs when a main charge detonation potentially results in a significant aerosolization of fissile material. Inadvertent Nuclear Detonation (IND). A category of weapon response used in hazard analysis that includes the unintended energy release (via a nuclear process) from a nuclear explosive during a period of time (on the order of one microsecond), in an amount greater than the energy released by detonating four or more pounds of Trinitrotoluene (TNT). Mechanical Release (MR). A category of weapon response used in hazard analysis that includes release of plutonium or material of comparable total effective dose by breaching or fracturing special nuclear material from weapon components. Screened. The weapon response likelihood provided for given hazards and associated nuclear weapon configuration combinations that the responsible DA(s) asserts will not result in a specific weapon response consequence. The assignment of an IND or AD numerical likelihood WR will be treated as screened if the likelihood were ≤ 10-9. The assignment of a BD, TR, MR, or WS numerical likelihood WR will be treated as screened if the likelihood were ≤ 10-6. Tritium Release (TR). A category of weapon response used in hazard analysis that includes the result of a breach of the gas transfer system that releases tritium into the atmosphere. Worker Safety (WS). A category of weapon response used in hazard analysis that includes consequence outside of those produced by standard industrial hazards that result in a loss of life to one or more persons, loss of the use of a limb or organ, or other serious injury to a worker, including when the high explosive components undergo deflagration (burning) or detonation and does not result in significant aerosolized release of special nuclear material. DOE-NA-STD-3016-2018 1 1. APPLICABILITY

This Technical Standard applies to the conduct of hazard analyses and preparation of Hazard Analysis Reports (HARs) for Nuclear Explosive Operations (NEOs) conducted by DOE/NNSA. This Standard addresses operation-specific HARs and their interface with facility safety basis documents (Documented Safety Analyses (DSA), Safety Analysis Reports (SARs), or other DOE/NNSA-approved safety basis documents). Federal rule 10 C.F.R. Part 830, “Nuclear Safety Management,” uses the term “Documented Safety Analysis” (DSA) for both the facility SAR and the operation-specific HAR. This Standard will continue to use the acronyms SAR and HAR in their traditional sense. The HAR is prepared and maintained by the Production Plant Contractor (PPC). This Standard shall also be applied to any DSA that involves weapon response (e.g., site-wide SAR). Throughout this Standard, the words “shall” and “must” denote actions that are required to comply with this Standard. The word “should” is used to indicate recommended practices. The use of “may” with reference to application of a procedure or method indicates that the use of the procedure or method is optional. 2. PURPOSE The purpose of this Technical Standard is to define requirements and guidance for preparing HARs for NEOs in accordance with 10 C.F.R. Part 830. The general requirements for operation-specific HARs are those contained in DOE-STD-3009, “Preparation of Nonreactor Nuclear Facility Documented Safety Analysis,” or successor directives. These general requirements are more fully developed in this Standard in order to account for issues unique to NEOs and interface issues with the facility or special operations (e.g., transportation). 3. SCOPE The scope of the HAR must address the full scope of nuclear explosive operations and shall contain a list of all controls either directly or by reference from the relevant DSAs for which DOE/NNSA authorization is sought. The HAR shall include the operational processes, equipment, facility or facility interfaces, and operation-unique activities related to manipulations and movements within the facilities where the activities are to be conducted. The HAR shall consider all hazards that could lead to Inadvertent Nuclear Detonation (IND), Aerosolized Dispersal (AD), radioactive or other hazardous material dispersal, and adverse Worker Safety (WS) effects from weapon operations. Although the hazard identification process is comprehensive of all radiological and non-radiological hazards, DSAs are not intended to analyze and provide controls for standard industrial hazards such as burns from hot surfaces, electrocution, and falling objects, even if uniquely caused by operational conditions. These hazards are adequately analyzed and controlled in accordance with 10 C.F.R. Part 851, “Worker Safety and Health Program.” They shall be analyzed in a DSA only if they can be an accident initiator, a contributor to a significant uncontrolled release of radioactive or other hazardous material (e.g., 115-volt wiring as initiator of a fire), or considered a unique worker hazard such as explosive energy. The HAR is not required to address deliberate unauthorized acts. DOE-NA-STD-3016-2018 2 HAR evaluation shall, directly or by reference to applicable SARs, ensure that all (non-industrial) potential operational hazards are addressed and that process specific controls applicable to the NEO are identified. 4. OBJECTIVE

As stated in DOE-STD-3009, the overall objective of the hazard and accident analysis portion of a SAR is to identify controls and establish their adequacy through largely qualitative methods. The objective of a HAR is the same with the difference in focus of covering a specific NEO. A HAR, together with its associated SARs and Technical Safety Requirements (TSRs), shall provide all necessary information, either directly or by reference, in order for DOE/NNSA to make the decision to authorize a NEO. 5. CONTENT The format and content of Chapters 3 through 5 of a HAR are the same as those described in DOE-STD- 3009. Chapter 1 of the HAR is an executive summary that provides an overview of the HAR and its main conclusions. Chapter 2 is the NEO process description. 6. APPROACH TO HAZARD AND ACCIDENT ANALYSIS The analytical approach to hazard and accident analysis in a HAR is the same as that described in Chapter 3 of DOE-STD-3009. This Standard discusses hazard analysis attributes that are unique to nuclear explosive operations. Information that supports the documentation used in the preparation of the HAR shall be complete and accurate in all material respects as required by 10 C.F.R. Part 830. A reasonable level of conservatism using engineering judgment shall be used throughout HAR and weapon response development. DOE-NA-STD-3016-2018 3 The flowchart below illustrates the HAR development process as contained within Section 6: DOE-NA-STD-3016-2018 4 6.1 Evaluation and Analysis Hazard evaluation characterizes the identified hazards in the context of the actual NEO. Some hazards may originate from within the nuclear explosive itself (e.g., internal power supplies, energetic devices). As discussed in DOE-STD-3009, the process of hazard evaluation is qualitative in nature and intended to result in effective controls for prevention or mitigation of consequences. The hazard evaluation must be comprehensive in its identification of the plausible hazard scenarios. Hazard analyses follow single or properly grouped process steps, weapon configurations, and/or tasks so that controls can be clearly linked to hazards associated with each step. Hazard scenario development is led by the PPC. The PPC and Design Agencies (DAs) must work together to define the hazardous environment and account for factors that influence scenario progression including everything that affects the environment (e.g., the nuclear explosive operation, the working environment, and physical phenomena that represent unwanted energy if applied to a nuclear explosive). This evaluation shall include the magnitude of the energy and possible pathways for unwanted energy to reach the weapon. These possibilities (similar to a “What If” exercise) shall be documented in the hazard analysis portion of the HAR. Those hazards requiring further evaluation shall be listed with controls in a summary hazard table also included in the HAR. For some complex hazard scenarios, the development of the summary hazard table may need to be augmented with event trees and/or fault trees that break out certain events into more basic events. In such cases, the summary hazard table will simply reference the applicable analyses, but the results must still be included in the summary hazard table. Screened responses provided by the Design Agencies may be used to screen scenarios from further development (i.e., the consequence is not credible given the hazard). The PPC shall apply controls that are implemented and maintained as part of the facility, equipment or specific operation. Selected controls shall be designated as Safety Class or Safety Significant according to DOE-STD-3009, and the effectiveness of these controls shall be evaluated in the accident analysis. Weapon response must be requested from the DA(s) for all scenarios where the hazards are not screened, an anticipated weapon response is not assumed, or a weapon response has not already been provided. In addition to these events, the PPC and the DAs may jointly determine that additional weapon response may be requested.

6.2 Weapon Response Weapon response (WR) is the probability of IND, AD, material dispersal and adverse worker safety effects given the specific hazard environment definitions provided by the PPC. WR is requested by the PPC from the cognizant DAs. Definition of the hazard environment requires joint participation from the PPC and the DAs. The DAs provide WR for those instances that the probability of an adverse response cannot be screened with adequate margin. Adequate margin is subjectively determined by the DAs in each case and is a function of the degree of uncertainty associated with the particular WR. DOE-NA-STD-3016-2018 5 6.2.1 Screened Responses Hazards and associated weapon configuration combinations that cannot result in a weapon response are identified in a weapon response summary document issued by the DAs or by using the Engineering Authorization system, or equivalent. The screening information must be associated with the specific weapon configuration(s), screening rationale, and reference the bases information used for the screened response. 6.2.2 Requesting Weapon Response The weapon configurations, hazardous environment (e.g., a smooth flat stainless steel surface) and magnitude of the hazard (e.g., three-foot drop) are documented in a formal weapon response request prepared by the PPC using the Engineering Authorization System, or equivalent. Weapon response requests must be forwarded to the appropriate DAs. PPC and DAs must work together to assure the PPC weapon response request defines the hazardous environment and the magnitude of the hazard in a way that permits the development of weapon response by the DAs. Assumptions and initial conditions necessary to provide weapon response must be developed jointly by the DAs and PPC. These assumptions and initial conditions may need to be protected as controls by the PPC. 6.2.3 Issuing Weapon Response Weapon response information is provided to the PPC in the weapon response summary document. The DA shall formally transmit the weapon response summary document to the PPC using the Engineering Authorization System, or equivalent. Assumptions and initial conditions should be captured in the PPC weapon response request or DA weapon response and may need to be protected as controls by the PPC. The DAs’ weapon response documentation must be coordinated between the applicable DAs in order to preclude internal inconsistencies. When weapon response from more than one DA is required, the DAs must provide a coordinated weapon response. Weapon response summary documents must be under formal change control. The technical bases information (e.g., experimental data, modeling results, test results, calculations) that the DAs use to support the weapon response shall be maintained and controlled by the DA in accordance with requirements of the DA’s DOE/NNSA-approved Quality Assurance Program (QAP). Source data and methods used in developing weapon response must be traceable. All information used within, or to support, the weapon response (including all references) shall be available upon request by DOE/NNSA. 6.2.4 Expert Judgment Expert, professional, or engineering judgment refers to assessments provided by a subject matter expert. The subject matter expert’s opinion or belief is based on reasoning. Expert judgments can be evaluations of theories, models, experiments, or recommendations for further research. Expert judgments can be either qualitative or quantitative. Subject matter experts are individuals recognized by their peers and designated by their management as authorities in a specific subject matter or topic.

DOE-NA-STD-3016-2018 6 The weapon response process relies heavily on subject matter expert judgments. Scientists, engineers, and technical program managers exercise expert judgment routinely and usually informally. Each organization utilizing expert judgment within the bases information supporting weapon response must do so through a process that is defined in the DA’s local procedure(s). The local procedure must have a clear flow down through the DA’s QAP. This procedure shall establish the requisite criteria for training and qualification of personnel performing expert judgment. 6.2.5 Expert Elicitation Expert elicitation is a formal, highly structured, and well-documented process for obtaining the judgments of multiple experts (e.g., NUREG-1563, “Branch Technical Position on the Use of Expert Elicitation in the High-Level Radioactive Waste Program,” November 1996). Use of expert elicitation is optional and at the laboratories’ discretion. Expert elicitation should be considered in the following situations: • Empirical data is not reasonably obtainable or the analysis is not practical to perform. • Multiple diverse sources of applicable data that need to be assessed. • Uncertainties are large and significant. • More than one conceptual model can explain and be consistent with the available data. • Technical judgments are required to assess whether calculations are appropriately conservative. • Source data includes the use of unpublished, un-reviewed, or draft information. If an organization chooses to utilize expert elicitation within the bases information supporting weapon response it must do so through a process that is defined in the DA’s local procedure(s). The local procedure must be included as part of the DA’s QAP. This procedure shall establish the process for documenting the qualifications of personnel performing expert elicitation. 6.2.6 Peer Reviews Peer reviews are performed in order to ensure completeness and accuracy and to limit the potential bias of weapon response information, while bringing in additional sources of expertise. Peer reviewers shall have the requisite technical knowledge to understand and challenge the information, but must not have been involved in the development of the information. Each organization providing formal weapon response, in accordance with this Standard, shall perform formal peer reviews of the weapon response and technical bases information prior to its release. Each organization shall do so in accordance with a DA procedure that describes the peer review process, including criteria for establishing and maintaining the requisite training, qualification, and independence of the peer reviewers. This procedure shall be included in the DA’s QAP. DOE-NA-STD-3016-2018 7 6.2.7 Incorporation of Weapon Response Information The PPC shall incorporate the weapon response information into the hazard analysis. When it is not clear that a DA weapon response applies to a given hazard, the PPC shall request guidance from the DA. The DAs shall work with the PPC to validate the appropriate use of this weapon response information. 6.3 Accident Selection and Analysis Hazard scenarios that are not screened for IND or AD consequences or for which weapon responses are assumed are designated as Design Basis Accidents (DBAs), and are retained for consideration in the accident analysis section per DOE-STD-3009. For hazard scenarios with other consequences of concern (i.e., BD, MR, TR, and WS), accident selection will be performed according to DOE-STD-3009. With the exception of NPH, initiating event probability information must not be used to dismiss the need to apply controls for plausible accident scenarios resulting in IND or AD.

6.4 Identification of Controls Required and Control Effectiveness Determinations The approach to the identification and classification of controls in the hazard analysis is the same as the process described in DOE-STD-3009, including the Defense-in-depth concept, with the added simplification that any IND or AD of plutonium should be treated as an event that will challenge the Evaluation Guideline (EG) to the maximally-exposed offsite individual. Per DOE-STD-3009, if it is clear that unmitigated consequences will far exceed the EG, the actual consequences need not be determined because the need for Safety Class controls has already been identified. Based on this simplification, the primary focus of controls for IND or AD is to prevent the occurrence of the hazard, therefore there is no requirement to evaluate unmitigated releases for these scenarios in a HAR or SAR. Qualitative identification of controls and ensuring their adequacy is the centerpiece of the safety evaluation process. In a qualitative hazard analysis, the hazard analysts are concerned with how each control may fail, how to prevent such failures, and whether redundant components, verifications, or diverse systems need to be considered to ensure adequacy of controls for each hazard/accident scenario. This analysis aids DOE/NNSA in making an informed decision on whether to authorize the operation. 7. INTERFACE WITH SARs The HAR must evaluate all hazards that could impact the NEO and must serve as the final safety basis integration document, either directly or by reference. Another DSA (e.g., a facility SAR) may provide analysis and resulting controls for hazards that are relevant to the NEO for hazards but not otherwise addressed directly in the HAR. The scope of the HAR must address the full scope of nuclear explosive operations and shall contain a list of all controls either directly or by reference from the relevant SARs for which DOE/NNSA authorization is sought. DOE-NA-STD-3016-2018 8 8. NEW OR EMERGING INFORMATION As the weapon stockpile ages and technology develops, the DAs continue to learn more about the behavior and aging of weapon systems and components. This understanding is accomplished through a variety of sources including surveillance assessments, significant finding investigations, enhanced surveillance, and modeling. This information flows informally between the production sites and the DAs as part of day-to-day operations and takes a variety of forms. It could be a presentation made by a researcher, a technical paper related to a component similar to one found in a weapon, or even a phone call between the DAs and the PPC. Information exchange of this kind is encouraged within the nuclear security enterprise to continuously monitor and potentially improve the safety of NEOs. If the Chief Engineer of Nuclear Weapons, or equivalent, determines that emerging information is sufficiently mature and potentially drives negative changes in weapon response, this information is considered new information and must be communicated to the PPC. The PPC must take action according to the site’s unreviewed safety question evaluation processes.

New information that changes, or has the potential to change, information relied upon within the SARs and HARs is evaluated through the site's new information and unreviewed safety question evaluation processes per 10 C.F.R. Part 830 as appropriate. Once the Chief Engineer of Nuclear Weapons, or equivalent, has determined that the weapon response information is developed enough to require action, the information must be formally transmitted from the DA to the PPC utilizing the Engineering Authorization System, or equivalent. The weapon response information should also be shared with the other DAs for potential applicability to their systems. Actions in response to this information at the PPC site (e.g., cessation of certain activities, compensatory measures) are taken by the PPC as deemed necessary with the appropriate notifications to the local DOE/NNSA office per the current requirements. DEFINITIONS 1. APPLICABILITY 2. PURPOSE 3. SCOPE 4. OBJECTIVE 5. CONTENT 6. APPROACH TO HAZARD AND ACCIDENT ANALYSIS 6.1 Evaluation and Analysis 6.2 Weapon Response 6.2.1 Screened Responses 6.2.2 Requesting Weapon Response 6.2.3 Issuing Weapon Response 6.2.4 Expert Judgment 6.2.5 Expert Elicitation 6.2.6 Peer Reviews 6.2.7 Incorporation of Weapon Response Information 6.3 Accident Selection and Analysis 6.4 Identification of Controls Required and Control Effectiveness Determinations 7. INTERFACE WITH SARs 8. NEW OR EMERGING INFORMATION