DOE-STD-1104-2009, Review and Approval of Nuclear Facility Safety Basis and Safety Design Basis Documents

NOT MEASUREMENT SENSITIVE DOE-STD-1104-2009 May 2009 Superseding DOE-STD-1104-96 DOE STANDARD REVIEW AND APPROVAL OF NUCLEAR FACILITY SAFETY BASIS AND SAFETY DESIGN BASIS DOCUMENTS U.S. Department of Energy AREA SAFT Washington, DC 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. DOE-STD-1104-2009 ii Available on the Department of Energy Technical Standards web page at http://www.hss.energy.gov/nuclearsafety/ns/techstds/ DOE-STD-1104-2009 iii CONTENTS FOREWORD .................................................................................................................................. v INTRODUCTION .......................................................................................................................... 1 APPLICABILITY AND SCOPE.................................................................................................... 1 1.0 MANAGEMENT AND COORDINATION OF SAFETY BASES........................................ 3 1.1 Responsibilities and Authorities .......................................................................................... 3 1.2 Planning ............................................................................................................................... 4 1.3 Interactions........................................................................................................................... 5 1.4 Issue Origination and Resolution ......................................................................................... 6 2.0 APPROVAL BASES FOR DOCUMENTED SAFETY ANALYSES ................................... 9 2.1 Base Information.................................................................................................................. 9 2.2 Hazard and Accident Analyses .......................................................................................... 11 2.3 Safety Structures, Systems, and Components.................................................................... 12 2.4 Specific Administrative Controls....................................................................................... 12 2.5 Derivation of Technical Safety Requirements................................................................... 12 2.6 Safety Management Program Characteristics.................................................................... 13 2.7 Conditions of Approval...................................................................................................... 14 3.0 APPROVAL BASIS FOR TECHNICAL SAFETY REQUIREMENTS.............................. 16 3.1 Management and Coordination.......................................................................................... 16 3.2 Approval Bases .................................................................................................................. 16 3.2.1 Hazards Analysis ........................................................................................................ 16 3.2.2 Safety SSC .................................................................................................................. 17 3.2.3 Specific Administrative Controls................................................................................ 17 3.2.4 Other Important Defense-In-Depth SSCs ................................................................... 17 3.2.5 Safety Management Programs .................................................................................... 17

4.0 SAFETY EVALUATION REPORTS................................................................................... 18 4.1 Title Page ........................................................................................................................... 20 4.2 Signature Page ................................................................................................................... 20 4.3 Executive Summary ........................................................................................................... 20 4.4 Review Process .................................................................................................................. 21 4.5 Base Information................................................................................................................ 21 4.6 Hazard and Accident Analyses .......................................................................................... 21 4.7 Safety Structures, Systems, and Components.................................................................... 22 4.9 Derivation of Technical Safety Requirements................................................................... 22 4.10 Safety Management Program Characteristics.................................................................. 23 DOE-STD-1104-2009 iv 4.11 Technical Safety Requirements ....................................................................................... 23 4.12 Conditions of Approval.................................................................................................... 23 4.13 Records ............................................................................................................................ 24 5.0 SAFETY DESIGN BASIS DOCUMENTS .......................................................................... 25 5.1 Safety Design Strategy, Review Teams, and Approvals ................................................... 25 5.2 Review Bases for Conceptual Safety Design Reports ....................................................... 27 5.3 Review Bases for Preliminary Safety Design Reports ...................................................... 29 5.4 Approval Bases for Preliminary Documented Safety Analyses ........................................ 31 5.5 Safety Validation Reports .................................................................................................. 34 5.5.1 General Discussion ..................................................................................................... 34 5.5.2 Content and Format..................................................................................................... 34 DOE-STD-1104-2009 v FOREWORD 1. This Department of Energy (DOE) Standard is approved for use or reference by DOE, including the National Nuclear Security Administration (NNSA) and its contractors. 2. Title 10 of the Code of Federal Regulations (CFR) Part 830 Final Rule, Nuclear Safety Management, issued January 10, 2001, establishes requirements for nuclear facility Preliminary Documented Safety Analyses (PDSA), Documented Safety Analyses (DSA), and Technical Safety Requirements (TSR) or TSR-equivalent documents for environmental restoration activities. DOE Order (O) 413.3A, Change 1, Program and Project Management for the Acquisition of Capital Assets, or successor document, establishes the requirements for safety design basis documents and invokes the use of DOE- Standard (STD)-1189-2008, Integration of Safety into the Design Process, for these documents.

3. This Standard was prepared to be consistent with 10 CFR Part 830 and its implementation Guides and should be used in conjunction with the Rule and its implementing guidance for safety basis documents. It was also prepared to be consistent with DOE O 413.3A, Change 1, and DOE-STD-1189-2008 and should be used in conjunction with those documents, the Rule, and their implementing guidance for safety design basis documents. 4. This revision of the Standard expands the scope of the previous revision to address the review and approval of all the safety basis documents developed per DOE-STD-1189- 2008. The previous version only addressed the review and approval of Documented Safety Analyses (DSAs) and Technical Safety Requirements (TSRs). Rather than restructuring the entire Standard, information on the review and approval of DSAs and TSRs was kept in the first two chapters even though other safety basis documents would be developed and reviewed prior to the development of DSAs and TSRs. This organization may be revisited in future after experience is gained with the new aspects of the Standard. 5. Comments (e.g., recommendations, additions, and deletions) and any pertinent data that may be of use in improving this document should be sent by letter to: Office of Nuclear Safety Policy and Assistance (HS-21) U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 Phone: (301) 903-1408 Facsimile: (301) 903-6172 DOE-STD-1104-2009 vi INTENTIONALLY BLANK DOE-STD-1104-2009 vii GUIDING PRINCIPLES The following guiding principles pertain to the application and provisions of this Standard: 1. The documents (i.e., DOE Orders, Manuals, Guides, and Standards, Nuclear Regulatory Commission Regulatory Guides and regulations) listed in Table 2 of Appendix A to 10 CFR Part 830, Subpart B, provide approved methodologies for meeting the DSA requirements of 10 CFR Part 830. These documents are commonly referred to as “safe harbors.” Developed consistent with, and as a companion to these documents, this Standard does not generally reiterate the provisions of these documents but may cite specific requirements from these documents, as convenient for the user of this Standard. 2. If a contractor uses a method other than a safe harbor method from Table 2 of Appendix A of 10 CFR Part 830, per 10 CFR 830.204, the contractor must obtain DOE approval of the method before developing the DSA. Likewise, if a contractor uses a safe harbor method to develop the DSA, but does not follow the method completely, per 10 CFR 830.204, the contractor must request DOE approval of the method with the specific deviations noted. Requirements and responsibilities for the use of alternative methods or specific deviations from the safe harbor methods are contained in DOE Manual (M) 411.1-1C, Safety Management Functions, Responsibilities and Authorities Manual, and DOE O 410.1, Central Technical Authorities Responsibilities Regarding Nuclear Safety Requirements. 3. DOE O 413.3A, Change 1, assigns the authority to designate a Safety Basis Approval Authority (SBAA) with the authority to review and approve safety basis and safety design basis documents to the Program Secretarial Officer (PSO). DOE M 411.1-1C1 defines provisions for delegation of authorities. In accordance with DOE M 411.1-1C, the PSO may establish a new SBAA, but does not relinquish the ultimate responsibility for ensuring adequate performance of that approval authority. In carrying out assigned responsibilities, the approval authority, if not the PSO, is at all times accountable to the PSO.

4. Independent review of the safety design basis and safety bases documents facilitates achieving defensible approval. Since both the preparation and the review and approval of these documents may fall under the purview of the SBAA, independent review is achieved by designating a review team leader with the responsibility and authority to conduct independent assessments. The review team leader is independent of any responsibility for preparation of the documents under review. The review team members are also independent of any responsibility for preparation of the documents. See Guiding Principle 6 for further information. 1A December 27, 2005, Deputy Secretary memorandum on safety delegations provides further instruction on safety delegation and remains in effect until M 411.1-1C is revised or rescinded. DOE-STD-1104-2009 viii 5. The SBAA is the single point of contact between DOE and the facility contractor for all areas of review and approval of DSAs and TSRs. In this capacity, the SBAA serves as the focal point through which DOE interfaces with the facility contractor and from which directions to the facility contractor originate. This is accomplished through the review team leader and in conjunction with official contractor interfaces and the DOE contracting officer. 6. DOE is responsible for both the operation and the regulation (e.g., review and approval of DSAs and TSRs) of the facilities for which these documents are required. This dual role places fundamental limits on the ability of DOE to completely segregate the processes of preparation and review of these documents. For example, the Field Element Manager (FEM) typically has responsibility for both the operation of the facility and the review and approval of the DSA and TSRs. However, in order to be as objective as possible in the review process, most of the reviewers of these documents should not be responsible for the design or operation of the facility, including the preparation of the safety design basis and safety bases documents. It is expected that these reviews will be conducted, to the extent practicable, by individuals and organizations separate from the document preparation. This Standard encourages interface between the two processes to develop familiarity with the facility’s safety basis, to respond to requests from the preparer for early identification and resolution of potential issues, and to establish the scope of subsequent review and the extent of approval documentation required. 7. DOE strives for an effective, streamlined review and approval process for safety design basis and safety basis documents while still achieving an acceptable level of safety assurance. This Standard advocates proper planning for a review and encourages an integrated review process where all parties with vested interest in a facility safety basis coordinate throughout the review and approval process. 8. DOE manages review issues requiring resolution for approval in that reviewers establish and document the safety significance of issues prior to submittal for possible resolution. Guidance is provided to focus facility contractor’s resolution of those issues determined to be necessary for adequately establishing and documenting the facility safety basis. 9. This Standard provides guidelines for reviewing the DSA through assessment of the major subject areas of a safety analysis as defined by the following DSA approval bases:

a. Base information; b. Hazard and accident analyses; c. Safety structures, systems, and components (SSCs); d. Specific administrative controls (SACs); e. Derivation of TSRs; and f. Safety management program characteristics. DOE-STD-1104-2009 ix 10. This Standard also provides guidelines for reviewing the TSRs. Determining the adequacy of the TSRs generally entails a disciplined analysis and tracing of commitments to hazard controls in a DSA through appropriate provisions that implement these controls in a TSR document. 11. The Safety Evaluation Report (SER) is primarily a management document that provides the SBAA the basis for the extent and detail of the review of the PDSA, DSA, and TSRs and the bases for any conditions of approval. This Standard endorses the concept that the contents of an SER are concise summary statements and that little benefit is gained from the wholesale repetition of elements already contained in a PDSA, DSA, or TSR or from reproducing original analysis that, if deemed critical, is performed as part of the review process. 12. SERs document the bases for approving revisions of DSAs/TSRs, including annual updates. Those revisions determined to not involve an Unreviewed Safety Question (USQ) in accordance with 10 CFR 830.203, Unreviewed Safety Question Process, may be reviewed and approved for accuracy and completeness by DOE subsequent to implementation of the changes by the facility contractor. This review and approval is of the incorporation of the information concerning the facility changes into the DSA, not for the change to the facility itself, as this was determined not to be needed because the change did not involve a USQ. 13. The safety design basis documents addressed in this Standard are the Safety Design Strategy (SDS), the Conceptual Safety Design Report (CSDR), the Preliminary Safety Design Report (PSDR), and the PDSA. These documents are provided for DOE review and approval during the design of the facility or the major modification to facilitate communication and mutual understanding of the ongoing design efforts. Contractors are not required to submit these documents for all modifications. The provisions of 10 CFR 830.206, Preliminary Documented Safety Analysis, require a PDSA for new hazard category 1, 2, and 3 nuclear facilities and major modifications. DOE-STD-1189-2008, Section 8.1.3, Determining a Major Modification, including the Major Modification Evaluation Criteria in Table 8.1, provides information on determining if a modification is a “major modification” requiring a PDSA. The discussion on the SDS in DOE-STD-1189-2008, Section 2.3, discusses the relationship between a revised hazard analysis and a determination that a change represents a major modification. This Standard does not address the criteria for determining if safety design basis documents are needed. Rather, it provides guidance on the review process for the CSDR, the PSDR, and the PDSA when they are submitted to DOE. The purpose of the review of the safety design basis documents is (1) to ensure that safety is integrated into the design as early as possible, and (2) to ensure the safety design is sufficient to proceed to the next phase of design or construction. Such activities are intended to preclude the need for expensive modifications to the design and/or construction at a later date when changes are more costly. 14. The reviews of the CSDR and of the PSDR are documented in the Conceptual Safety Validation Report (CSVR) and the Preliminary Safety Validation Report (PSVR).

DOE-STD-1104-2009 x Similar to the SER, Safety Validation Reports (SVR) should be concise summary statements of the bases for review of the CSDR and the PSDR, including any recommended actions. 15. Approval of the safety design basis documents signifies that the safety design is sufficient to proceed the next phase of design or construction. These activities are also intended to preclude the need for expensive modifications to the design and/or construction at a later date when changes are more costly. 16. Approval of the DSA signifies that DOE has reasonable assurance that the nuclear facility can be operated safely and in a manner that adequately protects workers, the public, and the environment. DOE-STD-1104-2009 1 INTRODUCTION Safety and health assurance may be increased by standardizing the process of reviewing and approving the SDS, CSDRs, PSDRs, PDSAs, DSAs, and TSRs. Although complete standardization of the process (e.g., standardized review plan) requires substantial commitments and is complicated by the diversity of facility operations throughout the DOE complex, certain benefits are gained by standardizing fundamental elements of the review and approval process. This Standard describes a framework and criteria for reviewing safety basis documents that will support DOE approval of the documents as required by 10 CFR 830 Subpart B and DOE-STD-1189-2008 (as invoked by DOE Order 413.3A, Chg 1) including preparation of SERs and SVRs for nuclear facilities. This Standard utilizes the verb “must” to specify requirements in associated rules or DOE Orders or critical actions in performing the safety basis document reviews. This Standard does not add any new requirements for DOE or its contractors. The verb “should” is utilized to identify an effective approach for performing these reviews. APPLICABILITY AND SCOPE Guidance provided in this Standard is applicable to the review and approval of the SDS, CSDRs, PSDRs, PDSAs, DSAs, and TSRs, and revisions thereto, including required updates for DSAs and TSRs (i.e., 10 CFR Part 830 annual updates) for existing nuclear facilities. Therefore, this Standard is appropriate for Hazard Category 1, 2, or 3 facilities (classified in accordance with DOE-STD-1027-92 Change Notice No. 1, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports) that document their safety basis in accordance with 10 CFR Part 830. For new facilities and major modifications, the review and approval processes for the SDS, CSDR, PSDR, and PDSA2 are focused on the adequacy of the proposed design for safety to support proceeding to the next phase of design or construction. The review and approval of the DSA and TSRs are focused on safety of the as-built facility. The body of this Standard focuses on management of the review and approval process, provides guidelines for establishing the basis of approval, and recommends a format and content for SERs and SVRs. Specific review guidelines that are technical in nature are more appropriately addressed individually by subject matter and require more detailed guidance and discussion. Therefore, the text provides general guidelines as opposed to a comprehensive list of technical safety criteria (e.g., Standard Review Plan [SRP]). Thus, this Standard does not constitute an SRP in the same context as the SRP employed by the Nuclear Regulatory Commission.

This Standard is applicable to government-owned, government-operated facilities in which DOE performs the function of the facility contractor, as well as government-owned, contractor- operated facilities. This revision of the Standard expands the scope of the previous revision to address the review and approval of all the safety basis documents developed per DOE-STD-1189-2008. The 2 For major modifications, in accordance with DOE-STD-1189-2008, the SDS will address whether there is a need for a CSDR and/or a PSDR. DOE-STD-1104-2009 2 previous version only addressed the review and approval of DSAs and TSRs. Rather than restructuring the entire Standard, information on the review and approval of DSAs and TSRs was kept in the first two chapters even though other safety basis documents would be developed and reviewed prior to the development of DSAs and TSRs. This organization may be revisited in the future after experience is gained with the new aspects of the Standard. DOE-STD-1104-2009 3 1.0 MANAGEMENT AND COORDINATION OF SAFETY BASES 1.1 Responsibilities and Authorities Responsibilities and authorities relating to the review and approval of safety basis and safety design basis documents are defined in requirement documents (e.g., Rules, Orders, Manuals, etc.), but are cited in this Standard for the convenience of the user and to provide clarifying guidance. Appendix A of 10 CFR Part 830 states that “The DOE Management Official for a DOE nuclear facility (i.e., the Assistant Secretary, the Assistant Administrator, or the Office Director who is primarily responsible for the management of the facility) has primary responsibility within DOE for ensuring that the safety basis for the facility is adequate and complies with the safety basis requirements of Part 830.” It further states that “The DOE Management Official is responsible for ensuring the timely and proper (1) review of all safety basis documents submitted to DOE and (2) preparation of a safety evaluation report concerning the safety basis for a facility.” DOE O 413.3A, Chg 1, assigns the authority to designate an SBAA with the authority to review and approve safety basis and safety design basis documents to the PSO. By assigning responsibilities for the review and approval of the DSA to another individual, the DOE Management Official for the facility establishes that individual as the new approval authority. Assigning responsibilities carries concurrent delegation of authority recognized by the line management and those responsible for monitoring and auditing implementation of the Rule. Refer to Guiding Principle 2 in this Standard for responsibilities for approval of the use of a methodology other than the “safe harbor” methodologies listed in Table 2 of Appendix A of 10 CFR Part 830. The SBAA is responsible for providing a defensible review and approval of the DSA. Achieving defensible review and approval is facilitated by an independent review process. Since both the preparation of the DSA and its review and approval typically fall within the purview of the SBAA, the SBAA assigns a review team leader the responsibility for performing the independent review. In making this assignment, the SBAA ensures that the review team leader maintains sufficient independence of the line organization responsible for DSA preparation (i.e., no responsibility for preparation of the DSA under review) and possesses the technical competence relevant to the DSA of concern. The details of independently reviewing the DSA, up to and including recommending approval to the SBAA, are managed by the review team leader.

The SBAA has responsibility as the single point of contact between DOE and the facility contractor for all matters regarding review of the DSA. This responsibility is typically assigned to the review team leader, but the SBAA remains the final authority on any points requiring arbitration. The single point of contact is the focal point through which DOE and the facility contractor interface and from which directions to the facility contractor originate. Requests for any material on the DSA, determination of the significance of identified issues on such material, and direction to the facility contractor for resolution of issues are approved by the single point of contact. As appropriate, transmittal of official communications and directions involving significant work effort by the facility contractor are coordinated with the Contracting Officer. Line management personnel and representatives of organizations responsible for monitoring and DOE-STD-1104-2009 4 auditing implementation of 10 CFR Part 830 coordinate their activities through the single point of contact as well. The SBAA has the specific responsibility of ensuring that the review and approval process represents all DOE entities with vested interest in the facility under review and considers commitments made to agencies outside DOE. Agencies external to DOE, however, have no standing under the Orders/Rules structure for approval. Identifying safety issues and their resolution may involve negotiations between concerned organizations. Issues raised by any vested interest should be given proper consideration to enhance safety assurance. On behalf of the SBAA, the review team leader coordinates the day-to-day aspects of managing the review and approval process for the DSA. General responsibilities in this capacity include the following: • Serving as the focal point for interface between DOE and the facility contractor for review matters; • Developing a DSA review plan, including review milestones developed in consultation with the facility contractor; • Establishing and managing the review team; • Supervising the overall review process, including planning and scheduling changes; • Coordinating, scheduling, and arbitrating issue resolution; and • Preparing an SER. The SBAA has the responsibility for ensuring adequate performance of the review team leader in fulfilling assigned responsibilities. 1.2 Planning A review plan defines the extent and details of the review process deemed necessary for each DSA. Well before submittal of the DSA for approval, plans should be developed in coordination with the facility contractor where support of the contractor will be required (e.g., briefings on the DSA, facility walkthroughs, and issue resolution). The review plan can be very brief for the least hazardous or the least complex facility DSAs and is generally not necessary for the review of revisions and annual updates of DSAs. The plan should be approved by the SBAA with a copy forwarded to the facility contractor for its information. Basic components of a review plan include the following: • Scope and objectives of the review and their bases, including technical-, mission-, and/or project-related influences impacting the extent and detail of the review; • Methodology of the review, including basic task identification, objectives, and criteria by which the review is to be conducted; • Resources required for the review; DOE-STD-1104-2009 5

• Process and requirements for providing orientation for the reviewers (e.g., briefings, training on review plan and review criteria, facility walkthroughs); • Means of coordinating the review (e.g., periodic monitoring of individual tasks, documentation of review efforts, formats for issue submittal and responses, tracking of issues and their resolutions, and record keeping); • Required SER reviews and signoffs; • Schedule for the review, including key milestones for the review process (e.g., dates of facility walkthroughs, briefings, and/or meetings, calendar time allotted for issue submittal and issue resolution, SER reviews, and final SER approval). The review plan is developed from a general understanding of the overall facility safety basis derived from existing safety basis documentation (e.g., Basis for Interim Operations), familiarity with the facility, and DOE experiences with similar facilities. Typical considerations include facility hazard category, complexity of operations, dominant accident concerns, apparent or known operational and/or design vulnerabilities, hazard controls, safety impact of software failures, existing mission or program influences (e.g., mission-related considerations and objectives), and time constraints for the review and approval. Careful consideration should be given to developing the review plan and any subsequent updating of the plan due to major changes in the DSA development schedule, provisions, or approach to its review. Many elements considered in planning the review will be summarized as part of the SER to document the basis and the extent and detail of the review. Documentation establishing the basis and conduct of the review is maintained for subsequent demonstration that the review process was complete and adequate. An important part of planning is selecting the individuals who comprise the review team. Members of the review team are typically selected based on technical qualifications, experience, familiarity with the subject matter, independence from preparation of the DSA, understanding of DOE’s safety assurance strategy (e.g., nuclear safety requirements), and availability. The review team requires a core team with expertise in process hazards analysis and accident analysis. The core of the review effort is assessing the hazard and accident analyses in the DSA because they are the primary sources of original material with which the remainder of the DSA is aligned. Other personnel with diverse experience in safety and health, facility operations, safety systems, and safety software are not necessarily members of the core team, but collectively provide support as needed for a thorough assessment of the facility safety basis. The extent of support necessary is generally reflected by the hazard and complexity level of the activities being examined. Personnel resources may be augmented with available personnel from DOE Headquarters or unaffiliated Field/Operations Offices. To support a comprehensive and integrated review, the review team should include representatives from any party responsible for the review of the DSA and may also include representatives of parties responsible for oversight of the review and approval to monitor the review process. 1.3 Interactions DOE has certain fundamental limits on its ability to completely separate the DSA preparation DOE-STD-1104-2009 6

and review processes because it is responsible for both the operation and regulation of the facilities for which DSAs are prepared, reviewed, and approved. Therefore, reviews are not expected to be conducted completely segregated from preparation of the DSA. Some degree of interaction between the preparation and review processes is useful in streamlining the review and approval. This interaction provides the means by which DOE keeps abreast of issues that arise during development of the DSA and by which DOE responds to requests from the DSA preparer to assist in resolving fundamental conceptual issues. It is through such interaction that DOE is afforded the opportunity to commence research on potential issues in preparation for the official review. It is important to maintain a balance in the interaction of the review and preparation processes. Requests for material outside the provisions of the review plan are made solely by the review team leader. Reviewers do not directly request draft material from the preparers. Informal direction of preparation by reviewers is unacceptable. Tendencies exist for facility contractors to view any comments or direction offered by reviewers as a firm prerequisite for approval. The actual preparation of and changes to a DSA are the responsibilities of the preparers, not the review team or its members. Therefore, comments or advice affecting DSA preparation should result from unequivocal solicitation by the preparer. Even so, the review team leader, as authorized by the SBAA, is the only authority for originating any official intervention driving the content and details of a DSA. Any intervention is officially communicated by DOE to the facility contractor after ensuring that it is crucial to the development of the facility safety basis and originates from a sound technical foundation (i.e., undergone technically qualified independent review). Even then, intervention generally takes the form of guidance or recommendation and is well documented for subsequent reference by the reviewers during the review. 1.4 Issue Origination and Resolution Traditionally, in reviewing DSAs, both line management personnel and representatives of other organizations generate a large number of comments, many of which were not commensurate with a consistent concept of the DSA and its purpose. The preparer of the DSA has often borne the sole burden of resolving all such comments, while reviewers have not been held accountable for justifying comments. This often resulted in forced integration of contradictory comments or comments contrary to a particular approach or structure for the DSA. To prevent such occurrences, the SBAA, through the review team leader, maintains authority to determine what issues are significant and are transmitted to the preparer for formal (i.e., a documented, traceable, written record) resolution. For this reason, the “burden of proof” lies with reviewers to justify the safety significance of an issue through substantiation of its impact on the safety basis if left unresolved. Each “significant issue” submitted should be accompanied by justification for its significance. The review team leader, and subsequently the SBAA, should rely upon these justifications in determining the relevance of all issues. A significant issue identifies a problem or concern that affects the utility or validity of the safety basis documentation. Such issues are generally those involving (1) hazardous material or energy release with significant consequences to the public, worker, or environment that will otherwise

DOE-STD-1104-2009 7 be left without coverage in the DSA; (2) technical errors that invalidate major conclusions relevant to the safety basis; or (3) failure to cover topical material required by DOE regulations, directives, and guidance on DSAs. DSAs prepared in accordance with 10 CFR Part 830 use the graded approach in documenting the facility safety basis. The absence of information in a DSA is not a potential issue unless that absence adversely impacts the adequacy of the facility safety basis documentation. For example, DOE-STD-3009-94, Change Notice No. 3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis, states that standard industrial hazards are not generically covered in the DSA. But an issue requiring that a standard industrial hazard be included in a DSA would be justified if a clear case can be made that there is a potential contributor to a significant release of hazardous material involving that hazard. If thorough justification of the significance of an issue is not provided and supported, then the review team leader is not obligated to transmit the issue to the DSA preparer as significant and requiring resolution. Such judgments may be appealed to the approving authority. DOE M 442.1-1, Differing Professional Opinions Manual for Technical Issues Involving Environment, Safety and Health, can be used to resolve any professional disagreements that cannot be resolved locally. While only significant issues require formal resolution, the review team leader will typically transmit all issues to the preparer that will improve overall preparation of the DSA. The preparer may resolve these issues to the extent they enhance the final product without formal response. In the process outlined by this Standard, the objective is not to document a large number of issues, but to contribute to improving the DSA to meet the mission established by 10 CFR Part 830 and the intent of amplifying guidance (i.e., to provide assurance that the DSA appropriately establishes the safety basis of the facility). For issues transmitted to the preparer as significant, the preparer should formally prepare resolutions and submit them to the review team leader. The review team leader transmits proposed resolutions to reviewers originating the issues, who should notify the review team leader if a resolution is considered unsatisfactory. All responses are transmitted through the review team leader, who schedules and arbitrates the process of resolution. The review team leader may consider proposed resolutions satisfactory in the absence of timely responses or adequate justification of unacceptability by the issue originator. As a matter of course, the review team leader should ensure that the preparer is formally notified of acceptable and unacceptable resolutions proposed for significant issues. Reviewers or the preparer of the DSA may appeal the disposition of an issue by the review team leader to the SBAA. The SBAA determines the final disposition of issues as it is the ultimate responsibility of the SBAA to achieve a defensible position for the final product (i.e., determine when resolution is adequate). Neither a reviewer nor the preparer has veto power over ultimate resolution or disposition of an issue, and neither need be satisfied with the final resolution. The review team leader ensures that final disposition of significant issues is documented (i.e., with a traceable, written record), including minority opinions and dissenting views.

As stated in 10 CFR 830.202, contractors must incorporate in the safety basis any changes, conditions, or hazard controls directed by DOE. The regulation also states that the SER must document the basis for approval of the safety basis for the facility including any conditions of DOE-STD-1104-2009 8 approval. Documenting directed changes and conditions of approval in the SER provides a way to address inadequacies in the safety basis that are not significant enough to warrant rejection of the safety basis but which need to be addressed. Section 2.7 provides guidance on what constitutes an appropriate condition of approval for DSAs. Section 4.12 presents guidance on information to be documented in the SER for each condition of approval. To ensure adequate tracking and closure of conditions of approval, the DOE site office staff must: • Verify that contractors have a documented process for: o tracking conditions of approval to closure (including any required compensatory measures), o verifying satisfactory closure of the condition of approval, o notifying DOE when a condition of approval has been satisfied, and o managing any conditions of approval until they are closed. • Ensure that when a condition of approval is satisfied, the basis for closure is documented in the next update of the DSA, and the closure of the condition of approval is noted in the DOE approval of that update of the DSA; and • Periodically assess the closure progress and status of conditions of approval, as well as the contractor tracking process for them. TSRs identify the limits, controls, and related actions that establish the specific parameters and requisite actions for the safe operation of a nuclear facility/activity/process. Consistent with 10 CFR 830.202, the SER may direct changes or impose additional hazard controls to be applied to the TSRs before operation, but it is not appropriate to specify temporary conditions to be applied to TSRs. These directed changes must be incorporated into the approved TSRs prior to operation under the approved safety basis. DOE-STD-1104-2009 9 2.0 APPROVAL BASES FOR DOCUMENTED SAFETY ANALYSES DOE evaluates the DSA by considering the extent to which the DSA (1) adequately addresses the criteria set forth in 10 CFR 830.202 and 10 CFR 830.204, and (2) satisfies the provisions of the methodology used to prepare the DSA. DSA review and approval focuses on the adequacy of the following approval bases: • Base information; • Planned improvements; • Hazard and accident analyses; • Safety Structures, Systems, and Components (SSC); • Defense-in-depth and worker protection controls; • Specific Administrative Controls (SAC); • Derivation of TSRs; and • Safety management program characteristics and attributes. Once technical justification exists to support conclusions that the DSA adequately describes how the facility is satisfactory with respect to the approval bases, the DSA may generally be considered adequate. These approval bases also form the foundation for documenting DSA approval in an SER. For new facilities and major modifications, the DSA evolves from the PDSA with the addition of the final analysis of operational hazards and any upset conditions that were not considered previously. The DSA also documents any changes that were necessary during the construction phase. The review of the DSA and TSRs includes verifying that the commitments in the PDSA have been met. 2.1 Base Information

Base information is the first of the approval bases that should be reviewed and encompasses elements of DSA preparation, completeness, and general content. Base information is reviewed for sufficiency to allow assessment of the other approval bases that rely on this information. The review for sufficiency can range from a simple screening effort to more detailed discussions, depending on the complexity of the DSA. Insufficient or incomplete base information in a DSA may prevent further review of the DSA. Reviewers should require resolution of major discrepancies in base information (e.g., incomplete site characteristics) before evaluation of the more specific aspects (e.g., hazard and accident analyses) of the safety basis proceeds. It is for this reason that the SER need only provide a brief statement as to the adequacy of base information. For example, for DSAs adhering to the DOE-STD-3009-94, Change Notice No. 3, format, the review of base information primarily determines the sufficiency of the information provided in the Executive Summary, Site Characteristics (Chapter 1), Facility Description (Chapter 2), and, DOE-STD-1104-2009 10 to some extent, material generic to all DSA chapters (e.g., statutes, Rules, Orders, and principal health and safety criteria). Determining the adequacy of base information generally entails being able to conclude that the DSA contains sufficient documentation and basis to arrive at the following conclusions: • The facility contractor development and approval processes (e.g., personnel involvement in developing the DSA, management cognizance and acceptance, internal reviews) demonstrate sufficient commitment to establish the facility safety basis. • The facility mission(s) and scope of operations (i.e., the scope of work to be performed) for which safety basis approval is being sought are clearly stated and reflected in the type and scope of operations analyzed in the DSA. For example, a DSA documenting the safety basis of a spent fuel storage facility whose mission includes size reduction of spent fuel elements would be unacceptable if the DSA omitted safety analysis of size-reduction operations. • A description of the facility’s life-cycle stage, mission(s), scope of operations, and the design of safety SSCs3 is presented, including explanation of the impact on the facility safety basis. • Clear bases for and provisions of exemptions, consent agreements, and open issues are presented. • Description of the site, facility, and operational processes provide a knowledgeable reviewer sufficient background material to understand the major elements of the safety analysis. • Correlation is established between actual facility arrangements and operations with those stated in the DSA. This may be accomplished successfully through reference to facility walkthroughs during DSA preparation. Walkthroughs may also be warranted during DSA review to provide some level of assurance that the actual physical arrangement of a facility corresponds to that documented in the DSA. For example, a walkthrough may be considered for a facility and/or operation that was modified in the time frame between when DSA development was started and completed. This is not intended to imply the review team must perform detailed verifications of facility configuration. The objective is to allow the review team to conclude that the basic descriptions provided are fundamentally up-to-date and correct.

3 Safety SSCs are defined in 10 CFR 830.3 as the combination of safety class SSCs and safety significant SSCs. DOE-STD-1104-2009 11 2.2 Hazard and Accident Analyses Another of the DSA approval bases is hazard and accident analyses that form the foundation upon which the remaining approval bases (i.e., safety SSCs, SACs, derivation of TSRs, and safety management program characteristics) rely. Determining the adequacy of hazard and accident analyses generally entails being able to conclude that the DSA contains sufficient documentation and basis to arrive at the following conclusions: • The hazard analysis includes hazard identification that specifies or estimates the hazards relevant for DSA consideration (i.e., both natural and man-made hazards associated with the work and the facility) in terms of type, quantity, and form and also includes properly performed facility hazard categorization. • The final hazard category for the facility is determined consistent with DOE-STD-1027-92, Change Notice No. 1. Any differences between the final hazard category and the initial hazard category are explained. • The hazard analysis includes a hazard evaluation that covers the activities for which approval is sought, is consistent in approach with safe harbor methodologies, identifies preventive and mitigative features for the spectrum of events examined, and identifies dominant accident scenarios through ranking. • The hazard analysis evaluates normal, abnormal, and accident conditions, including consideration of natural and man-made external events, identification of energy sources or processes that might contribute to the generation or uncontrolled release of radioactive and other hazardous materials, and consideration of the need for analysis of accidents that may be beyond the design basis of the facility. • The hazard analysis results are clearly characterized in terms of public safety, defense in depth, worker safety, and environmental protection as part of the safety basis of the facility. The logic behind assessing the results in terms of safety significant SSCs, SACs, and designation of TSRs is understandable and internally consistent. • Subsequent accident analysis clearly substantiates the findings and delineations of hazard analysis for the subset of events examined and confirms their potential consequences. Safety class and safety significant SSCs, SACs and associated TSRs have been identified for preventing and/or mitigating events potentially exceeding evaluation guidelines. The goal of the review is to ensure that the safety basis is comprehensive relative to hazards presented and is based on a consistent, substantiated logic. As a minimum, reviewers should utilize the safe harbor methodology used in developing the DSA (e.g., DOE-STD-3009, Chg 3), DOE-STD-1189, and DOE’s DSA guide (DOE G 421.1-2, Implementation Guide for Use in Developing Documented Safety Analyses to Meet Subpart B of 10 CFR 830) as a reference to DOE-STD-1104-2009 12 support their review. In addition, the review of the hazard analysis should include the entire analysis and not just the summary of the analysis that might be included in the DSA. 2.3 Safety Structures, Systems, and Components The next DSA approval basis is safety SSCs. Identification of safety SSCs is a product of the hazard and accident analyses. Determining the adequacy of safety SSCs generally entails being able to conclude that the DSA contains sufficient documentation and basis to arrive at the following conclusions:

• The safety SSCs identified and described are consistent with the logic presented in the hazard and accident analyses. • Safety functions for safety SSCs are defined with clarity and are consistent with the bases derived in the hazard and accident analyses. • The boundaries of safety SSCs are clearly defined, including the support systems. • Functional requirements and system evaluations are derived from the safety functions and provide evidence that the safety functions can be performed when called upon. • System Evaluation is performed to assure functional requirements are met. • Control of safety SSCs relevant to TSR development is clearly defined. 2.4 Specific Administrative Controls As stated in DOE-STD-1186-2004, Specific Administrative Controls, SACs are administrative controls that are selected to prevent and/or mitigate specific accident scenarios and which have safety importance equivalent to engineered controls that would normally be classified as safety SSCs. Engineered controls (safety SSCs) are preferred over SACs for these functions; thus, SACs should only be selected if engineered controls cannot be identified to serve these functions or are not practical. The approval basis for SACs is the same as for safety SSCs. Specific expectations for SACs are delineated in DOE-STD-1186-2004. 2.5 Derivation of Technical Safety Requirements Derivation of TSRs is the next of the DSA approval bases. Hazard controls are derived to eliminate, limit, or mitigate hazards. The controls generally are safety SSCs, SACs, or commitments to safety management programs, which are ultimately included in TSRs. Identification of TSRs results from the most significant preventative and mitigative features identified in the hazard and accident analyses and from the designation of safety SSCs and SACs. Determining the adequacy of the derivation of TSRs generally entails being able to conclude that the DSA contains sufficient documentation and bases to arrive at the following conclusions: DOE-STD-1104-2009 13 • TSRs are identified to ensure adequate protection of workers, the public, and the environment. • The bases for deriving TSRs are identified and described in the hazard and accident analyses, safety SSC, and SAC chapters and are consistent with the logic and assumptions presented in the analyses. • The bases for deriving safety limits, limiting control settings, limiting conditions for operation, surveillance requirements, and administrative controls are provided as appropriate. • The process for maintaining the TSRs current at all times and for controlling their use is defined. 2.6 Safety Management Program Characteristics Safety management program characteristics are the last of the DSA approval bases and encompass the elements of institutional programs and facility management that are necessary to ensure safe operations based on assumptions made in the hazard and accident analyses. While these elements must be addressed in the DSA, generic descriptions of these institutional programs should not be duplicated in the DSA if they can be referenced in Integrated Safety Management System documents or site-wide manuals. These institutional programs include (where applicable) quality assurance, procedures, maintenance, personnel training, conduct of operations, emergency preparedness, fire protection, waste management, radiation protection, and criticality safety. Identification of safety management program characteristics and credited attributes is a product of hazard and accident analyses, designation of safety SSCs and SACs, and derivation of TSRs. Determining the adequacy of safety management program characteristics generally entails being able to conclude that the DSA contains sufficient documentation and basis to arrive at the following conclusions:

• The major programs needed to provide programmatic safety management are identified. • Basic provisions of identified programs are noted, and references to facility or site program documentation are provided. The review of safety management programs is normally performed at the site-wide level and a reference to the site-wide review is sufficient to support the DSA review. The acceptance of safety management program characteristics does not constitute acceptance of the adequacy of program compliance with DOE directives. Acceptance can be accomplished only by a detailed compliance review of each of the programs, which is beyond the scope of a DSA. Detailed reviews of the adequacy of safety management programs only need to be performed for safety management programs that are specific to the facility. DOE-STD-1104-2009 14 2.7 Conditions of Approval Conditions of approval should be used to document any changes, conditions, or hazard controls directed by DOE. Purely editorial issues (e.g., punctuation, misspelling) that do not change the meaning or technical content of the statement should not be handled through conditions of approval. Conditions of approval should not be used to approve DSAs with fundamental flaws. Large numbers of conditions of approval for a single DSA may indicate that the DSA is fundamentally flawed and should prompt a review of which issues should be corrected prior to approval of the DSA. DOE should not approve conditions of approval for extended periods of time. A defined closure date or milestone must be identified in the condition of approval. If a condition is intended to be applied for an extended period of time, the DSA should reflect that condition as part of the analysis. Conditions of approval may identify compensatory measures that are required for temporary periods until the conditions of approval are closed. The following criteria constitute a basis for rejection of the DSA and should not be addressed through conditions of approval: • There is insufficient information to document the conclusion that there is reasonable assurance of adequate protection of the worker, the public, and the environment. • The DSA does not meet the regulatory requirements of 10 CFR Part 830 and does not have an approved exemption in accordance with 10 CFR Part 820, Subpart E. • Significant issues were identified during the acceptance review that would prevent conducting a successful technical review. • The base information contained in the DSA is insufficient to describe the activities, processes, or systems to enable the hazard analyst to identify a complete set of hazards for the covered facility/activity/program. • The hazard analysis is incomplete (e.g., there are missing hazards; the response is incomplete, unavailable, or misapplied). • The accident analysis is incomplete (e.g., a scenario does not bound the hazard from the hazard analysis; there are incorrect calculations supporting the accident analysis conclusions). Conditions of approval cannot be used to allow the facility/activity/program to be outside of the approved safety basis or to be inconsistent with law or other requirements. Examples of situations where conditions of approval would be appropriate for DSAs are as follows: • Use of a fire watch where a fire barrier is needed per the safety analysis, but it has not yet been installed; and DOE-STD-1104-2009 15

• Use of personal protective equipment (e.g., respiratory protection) to mitigate any exposure to workers doing glovebox repackaging operations for a defined period until a design correction identified in the DSA can be completed. Fundamentally, the DSA must demonstrate that proposed activities have been thoroughly described and analyzed and that the hazards have been adequately identified. The DSA must establish the linkage between the individual hazards identified and the final control set that addresses each hazard. The functions of the controls that are relied upon for safety must be clearly documented and demonstrated to be adequate for the bounded hazards that they are intended to address. The selected controls must be documented as capable of providing the credited safety functions and appropriately captured in the TSRs. The DSA, TSRs, SER, and conditions of approval should provide an acceptable safety envelope for the facility/activity/program. While individual instances of a shortcoming in one of these areas, such as the need for an additional control, may be addressed in a condition of approval, a fundamental weakness in the processes used to perform the hazard analysis and accident analysis would render the DSA unacceptable. DOE-STD-1104-2009 16 3.0 APPROVAL BASIS FOR TECHNICAL SAFETY REQUIREMENTS 3.1 Management and Coordination DOE reviews of TSRs are generally conducted in coordination with DSA reviews and by many of the same team members. This provides an economy of effort because team members, by virtue of their familiarity with the DSA, have an understanding of the commitments made in the DSA that need to be reflected in the TSR. The discussions in Section 1 of this Standard relative to management and coordination of DSA reviews are equally applicable to the TSR review process. The management plan should address both DSA and TSR reviews. Because the TSRs must implement commitments made in the DSA, approvals and implementation of both the DSA and TSRs must be coordinated. 3.2 Approval Bases The approval bases for the TSR document are the TSR provisions. These TSR provisions may be design features, safety limits, operating limits (i.e., limiting control settings and limiting conditions of operation), surveillance requirements, or administrative controls (primarily commitments to implement safety management programs according to the facility-specific characteristics described in the DSA). The approval bases for a TSR document include a disciplined analysis and tracing of commitments to hazard controls through appropriate provisions that implement these controls in a TSR document. In some cases the specific treatment of safety controls in the TSR is committed to in the DSA; in other cases, it is a judgment call as to the appropriate TSR treatment. Determining the adequacy of the TSR provisions generally entails being able to conclude that: • Hazard controls discussed in the DSA are faithfully translated into TSR provisions; and • TSR provisions are appropriate and consistent with the DSA. The sources of information in a DSA regarding these provisions are the hazards analysis (including description of hazard controls); the description of safety SSCs; the classification of these SSCs as safety class, safety significant, or other important defense-in-depth SSCs; the description of the functional requirements for the safety SSCs; the description and functional requirements for SACs; the derivation of TSRs; and the descriptions of the safety management programs.

3.2.1 Hazards Analysis A hazards analysis will include a disciplined analysis of all hazards within the scope of the DSA, including a listing of applicable preventative and mitigative hazard controls. These controls may include safety SSCs, design features, SACs, and provisions of various safety management programs. These controls should be regarded as DSA commitments. They should be traced through DSA documentation to specific TSR provisions. DOE-STD-1104-2009 17 3.2.2 Safety SSC Safety SSCs must be described in sufficient detail in a DSA so that their functional requirements are defined and the bases for TSR requirements are derived. These safety SSCs will be either active or passive. If passive, they should also be considered for designation as “Design Features” in the TSR. These are features of facility design that may not be changed without DOE review and approval. A crosscheck between DSA-identified important design features and the Design Features section of the TSR should be conducted to ensure consistency. If active, safety class SSCs will usually have a safety limit and a limiting control setting associated with them, as well as a surveillance requirement. An active safety significant SSC may have a limiting condition of operation and surveillance requirement and/or specific provisions of a maintenance management program associated with it. In any case, safety SSCs must be addressed specifically in TSR provisions. Technical bases for limiting control settings and surveillance requirements in the Bases appendix of the TSR should be reviewed for adequacy. All of these provisions are directed at ensuring that the safety function of the SSC will be protected. 3.2.3 Specific Administrative Controls When SACs are used, they must be controlled through the TSR. DOE-STD-1186 specifies the methodologies that are acceptable to use for SACs. The first involves using the conventions for limiting conditions for operation and associated surveillance requirements. The second method available to incorporate SACs into a TSR document is to identify the specific requirement/action in a special section in the Administrative Control section of the TSR. This format may be appropriate when it is essential that the SAC be performed every time and without any delay when called upon (e.g., hoisting limits for nuclear explosives, material-at-risk limits, or expected responses during criticality safety infractions not covered by a limiting conditions for operation) or when definitive program requirements for specific activities can be established. 3.2.4 Other Important Defense-In-Depth SSCs As discussed in Section 2.7, DOE line management can identify conditions of approval in the SER for the DSA. The conditions of approval may include the identification of additional important defense-in-depth items and administrative controls. Furthermore, although not preferred, DOE may require additional important defense-in-depth items and administrative controls, independent of safety analysis. If important defense-in-depth items and administrative controls are identified, the review team should ensure that TSRs have been developed to provide assurance of the identified safety function as appropriate. 3.2.5 Safety Management Programs

Hazards analyses may invoke particular aspects of safety management programs, such as emergency preparedness, criticality safety, procedures, and training. Any particular provisions of these programs unique to the facility should have been described in the DSA. The administrative controls section of the TSR should include commitments to implement those programs identified in the DSA as important to the facility safety basis. DOE-STD-1104-2009 18 4.0 SAFETY EVALUATION REPORTS The review process results in the generation of an SER integral to the facility’s authorization basis. The SER for a given facility or operation documents (1) the conduct of an appropriate review of the PDSA, DSA, or TSRs; and (2) the bases for approving these documents and any conditions of approval. Approval signifies that DOE has accepted these documents as appropriately documenting the safety basis of a facility and as serving as the basis for operational controls (e.g., TSRs or programmatic control) necessary to maintain an acceptable operating envelope. TSR DSA Safety Evaluation Report (SER) PDSA Then document the evaluation in a … If it is a… The SER is developed specifically to document acceptance of the PDSA, DSA, and TSRs. Therefore, significant issues concerning these documents are typically resolved and incorporated in the PDSA, DSA, and TSRs before the final SER is prepared. An analysis that was not performed during preparation of the PDSA, DSA, and TSRs, but is determined to be required to complete the review is also documented independently of the SER. Only statements pertinent to accepting the facility basis are included in the SER. In accomplishing this, informed judgment and discretion are used to focus the SER on facts that clearly reflect the actual conditions of the facility safety basis. The SER does not need to repeat in wholesale fashion material contained in the PDSA, DSA, and TSRs The SER is intended to provide an overall summary of the methodology, assumptions, bases, conclusions, and commitments in the PDSA, DSA, and TSRs rather than a total reanalysis (i.e., independent verification and validation) of those activities addressed in these documents. During the review process, selected limited independent verification and validation can be performed; for example, in cases where (1) there may be significant questions about the validity of the original analysis, (2) where the risks are significant, and/or (3) the analysis is critical to the overall conclusions in the DSA and TSRs. However, significant discrepancies should be resolved as part of the development effort for the DSA and TSRs and, if deemed appropriate, only briefly documented in the SER. The resolution of such significant discrepancies should not be deferred to conditions of approval. The SER clearly states any conditions of approval that impose additional commitments to which facility management must adhere beyond those already documented in the DSA and TSRs. In general, conditions that could be incorporated into the body of these documents are so incorporated during the review process as prompted by issue DOE-STD-1104-2009 19 resolution (as opposed to being addressed in the SER and potentially invalidating portions of the DSA and TSRs). See Section 2.7 and Section 4.12 for additional discussion of conditions of approval.

Approval statements addressing specific areas of the safety basis are augmented with brief summaries of the most significant facility-specific points in those areas to provide a basic context to understand what is being approved. In stating the adequacy of the approval bases, it may also prove advantageous and/or warranted for the SER to discuss areas of concern or issues with significant ramifications for facility operations. Generally, these issues will have been resolved and any inquiries into them will have been completed during the review process. Any discussion of issues in the SER should be on a summary level and directed towards clarifying some specific aspect of approval or demonstrating understanding of some aspect of the facility safety basis. In the case of DSAs and TSRs, if the SER imposes a condition of approval (e.g., additional compensatory measures, alterations of stated commitments) on the facility safety basis documented in the DSA and TSRs, then the SER necessarily modifies that facility safety basis. In such cases, conditions cited in the SER become part of the facility safety basis. Therefore, a facility safety basis is composed of an approved DSA and TSRs, modified as necessary by the SER to reflect DOE-imposed conditions of approval. The SER or memorandum stating the conditions is subsequently appended to the DSA and TSRs. Specification of conditions in the SER not currently in place in these documents should identify an expected schedule for completion. The SER for a PDSA may also direct changes to the PDSA as well as add conditions of approval, although this should be done only when absolutely necessary. The purpose of the PDSA and its revisions is to keep DOE engaged in the design activities of the project and aware of any significant changes to the design as they occur to ensure DOE is in agreement with current and proposed design activities. Revisions of DSAs and TSRs, including DSA annual updates, undergo review and approval by DOE. Review and approval of revisions are a matter of endorsing the incorporation of changes in the safety basis since the last approval rather than performing a new assessment of the previously approved safety basis documents. Modifications to the facility operations not encompassed by the safety basis as documented in a DSA and TSRs invoke the USQ process. Therefore, revisions are generally administrative and/or editorial in nature in that they incorporate final disposition of USQs, conditions of approval stated in the existing SER, and/or minor changes that clarify the safety basis documentation. For this reason, administrative and editorial revisions determined not to involve a USQ can be performed by the facility contractor at any time without prior DOE approval. It is recommended that the facility contractor provide a copy of the revision, with a discussion of the changes, to the SBAA within 30 days of implementing the changes for subsequent DOE review and approval. Review and approval of revisions of DSAs and TSRs do not typically warrant a significant new effort (e.g., detailed review plan, formal review team) and may be as simple as merely indicating the latest revision numbers for simple administrative and/or editorial changes. SERs document the bases for approving revisions, including annual updates of DSAs and TSRs. An SER for a revision typically does not provide the complete basis of approval for that DSA and TSRs and only provides the basis of approving changes in the provisions resulting from the revision. Therefore, SERs for revisions are appended to the SER, documenting the last

DOE-STD-1104-2009 20 comprehensive determination of the basis of approval of the DSA and TSRs. Collectively, an SER and its appendices provide the complete basis of approval for any given DSA and TSRs. An SER without appendices is generated upon the next comprehensive determination and documentation of the basis of approval for that DSA and TSRs or at the discretion of the SBAA. The remainder of this chapter provides the recommended format and content for an SER. The SER addresses only those issues that are germane to documenting the basis of acceptance of the PDSA or the DSA and TSRs; therefore, the SER is subject to the graded approach. Summaries of material already contained in a PDSA or a DSA and TSRs should be brief but sufficient to provide a knowledgeable reader a basic understanding of the basis of approving these documents. 4.1 Title Page The title page provides the unique identifier information for the PDSA, DSA, and TSRs and the SER. Minimum information consists of the following: (1) SER title, revision number, and date issued; (2) title, revision number, and date issued for the PDSA or DSA and TSRs; (3) facility name and identification number, if any; (4) site; and (5) DOE contractor’s name and appropriate contract number. 4.2 Signature Page The signature page provides the identification and signature of the SBAA, and the approval date of the PDSA or DSA and TSRs. Other signatures may be provided at the discretion of the SBAA. 4.3 Executive Summary This section presents summary information regarding the basis of approval of the PDSA or the DSA and TSRs. The introduction contains the following information, which is briefly summarized: (1) clear identification of the facility for which approval is being granted and its hazard category; (2) statement of the facility mission and scope of operations encompassed by the facility mission; (3) summary of the major facility hazards and dominant accident scenarios; (4) discussion of pertinent exemptions and/or consent agreements impacting the approval; (5) discussions of major mission- and project-related influences impacting the decision to authorize operation; and (6) any conditions of approval and/or open issues raised with regard to the approval bases, including schedules for completion (if applicable). The executive summary concludes with a statement on the acceptability of the PDSA or the DSA and TSRs indicating that these documents have undergone an appropriate review and: • For the PDSA, that it provides a reasonable basis for the preliminary conclusion that the nuclear facility can be operated safely based on the following: (1) the nuclear safety design criteria in DOE O 420.1B have been satisfied; (2) a safety analysis meeting DOE O 420.1B and DOE-STD-1189-2008 requirements to support the design has been performed; and (3) an initial listing is provided of the safety management programs that must be developed to address operational safety considerations. DOE-STD-1104-2009 21 • For the DSA and TSRs, that the facility safety basis as documented is acceptable with stated conditions of approval, if any. 4.4 Review Process

This section provides a brief description of the review process the PDSA or the DSA and TSRs have undergone and its basis. Because there is no generic level of review effort required, this section is more the historical top-level documentation of the review process and the rationale for level of effort and detail. Typical information summarized includes the following: (1) basic premises of review, particularly those representing some consensus with the preparer of the PDSA or the DSA or TSRs; (2) summation of the review effort; (3) key participants in the review process; and (4) scope of special efforts, if any (e.g., selected independent calculations, walkthroughs). Discussion should be brief, but still sufficient to provide an understanding of the thoroughness of the review process and its basis. This section does not provide a documented record of the details of the review (e.g., issue resolution files). 4.5 Base Information This section documents the bases of approving the adequacy of base information, including any conditions of approval imposed. A statement of adequacy is generally focused and brief. This may entail nothing more than a paragraph stating that the PDSA or the DSA and TSRs contain sufficient background and fundamental information to support the review of the more technical aspects of the documents (i.e., review of the remaining approval bases). The majority of any inadequacies in the base information will require revision to the DSA or the TSRs prior to SER preparation or may be sufficiently minor that they can be resolved in a future revision of the DSA or TSRs. In addition to bases of acceptance, this SER section provides a brief synopsis of major site, facility, and operational process features. This information is intended for the sole purpose of providing a minimal, facility-specific context for SER bases of approval such that an elementary understanding of the operational envelope can be gleaned from the SER. The SER does not, however, attempt to repeat detailed safety basis information contained in the PDSA, DSA, or TSRs. 4.6 Hazard and Accident Analyses This section documents the bases for approving the hazard and accident analyses, including any conditions of approval imposed. Such documentation focuses on the completeness of the analysis and the consistency of the logic used throughout the analysis process. In addition to bases of acceptance, this SER section provides (1) a brief synopsis of hazards identified; (2) fundamental aspects of defense in depth, worker safety, and environmental protection; (3) dominant accident potentials; and (4) accident consequences relative to the DOE-STD-3009-94, Change Notice No. 3, Evaluation Guideline. The purpose of summarizing DOE-STD-1104-2009 22 this information is not to recapture detailed information already present in the PDSA, DSA, or TSRs. The summary provides the reader with an elementary understanding of the major facility hazards. In summarizing this information, the SER does not repeat the details of the DSA assumptions or calculations. The SER may, however, discuss essential aspects of important issues resolved during the review process. 4.7 Safety Structures, Systems, and Components This section documents the bases for approving the designation of safety SSCs and their associated safety functions, functional requirements, system evaluations, and potential TSR coverage, including any conditions of approval imposed. Focus is on the consistency of the logic developed in hazard and accident analyses being carried through to the identification of safety SSCs and the definitions and descriptions provided for these SSCs.

In addition to bases of acceptance, this SER section provides a brief synopsis of safety SSCs and their safety functions as determined in the hazard and accident analyses. The purpose of summarizing this information is not to recapture detailed information already presented in the PDSA or DSA. The summary provides a reader with an elementary understanding of the safety SSCs and the bases of their designation in hazard and accident analyses. The SER may, however, discuss essential aspects of important issues resolved during the review process. 4.8 Specific Administrative Controls This section documents the bases for approving the SACs, as well as their associated safety functions, functional requirements, system evaluations, and potential TSR coverage, including any conditions of approval imposed. The basis for acceptance of SACs is the same as that for safety SSCs, except that the discussion in the safety analysis for SACs should justify the use of SACs over engineered features (i.e., safety SSCs). It is not expected that SACs will be developed in detail at final design (for the PDSA). However the safety function of SACs must be clearly defined so that the decision to use an SAC rather than a safety SSC can be evaluated. Expectations regarding SACs are defined in DOE-STD-1186-2004 and expectations for the discussion of SACs in the PDSA are discussed in Appendix I of DOE-STD-1189-2008. 4.9 Derivation of Technical Safety Requirements This section documents the bases for approving the derivation of TSRs, including any conditions of approval imposed. Such documentation focuses on the consistency of the logic developed in the hazard and accident analyses, safety SSC, and SAC chapters being carried through to the derivation of TSRs. The TSRs required by 10 CFR 830.205 are not specified in a DSA, which is only required to provide the basis of their derivation. In addition to bases of acceptance, the SER section provides a brief synopsis of the derivation of TSRs as a function of the hazard and accident analyses. This information is intended for the sole purpose of providing minimal, facility-specific context for SER bases of approval, such that an elementary understanding of the operational envelope can be gleaned from the SER. The SER does not, however, attempt to repeat detailed information contained in the DSA. DOE-STD-1104-2009 23 4.10 Safety Management Program Characteristics This section documents the bases of approving safety management program characteristics, including any conditions of approval imposed. These bases do not relate to compliance with regulatory requirements, but to identification of the basic capability and awareness of fundamental provisions needed for maintaining the adequacy of the facility safety basis. This approval simply documents that the basic elements of the institutional safety management programs depended on for ensuring facility safety basis are adequate and that these elements can and will be implemented. A list of these programs briefly noting their general significance to defense in depth, worker safety, and/or dominant accident scenarios is provided, but no summary of the information from each programmatic chapter is needed. The PDSA may have little or no detail provided for the safety management programs, which may rely heavily on separately developed documents. Consequently, this section of the SER for the PDSA may be little more than recognition of the need for such programs in the DSA.

4.11 Technical Safety Requirements This section documents the basis of approving the TSRs. It should be verified that all the commitments for safety controls that are made in the DSA are carried through to TSR provisions. Judgment needs to be exercised in the specifics of the form of TSR treatment (e.g., limiting condition of operations or administrative controls). The technical bases for these judgments should be documented as part of the review and summarized in this section of the SER. The SER for the PDSA should address the review of the bases for TSRs in the PDSA consistent with the hazard and accident analyses, as well as a summary table for the TSRs. The TSR safety limits, limiting control settings, limiting conditions of operation, surveillance requirements, administrative controls, and design features should be listed in the PDSA consistent with the hazard and accident analyses. 4.12 Conditions of Approval Conditions of approval should be written in such a manner that the conditions required to be met and the actions required to be implemented are clearly articulated. Durations, implementation periods, and/or completion dates should also be specified so that it is clear when compliance with the condition of approval is expected to occur. The reason for including any conditions of approval should be clearly stated in the SER, as well as the basis for the conclusion that continued operation under the condition of approval is acceptable and consistent with adequate protection of workers and the public. Whenever a compensatory measure is needed to ensure appropriate safety levels are maintained while a temporary condition of approval is in effect, that compensatory measure should be clearly articulated in the SER and it becomes part of the facility safety basis. DOE-STD-1104-2009 24 4.13 Records This section provides references to the essential records, documentation, and information generated throughout the review process. This may include reference to records of the following: (1) the review plan and schedule; (2) minutes of review meetings, including meeting with the facility contractor; (3) dates and the results of facility walkthroughs; (4) submittal of issues and their disposition; (5) documentation generated in resolution of issues; and (6) documentation regarding commitments made by the facility contractor for approval of the PDSA, DSA and TSRs. References should be complete and accurate enough to locate necessary information during future revision and review activities, if needed. DOE-STD-1104-2009 25 5.0 SAFETY DESIGN BASIS DOCUMENTS The interactive process between safety analysis and design should begin as early as possible so that safety is effectively integrated into the design process. This is consistent with the Integrated Safety Management System process. The following sections address the review of documents that support the safety-in-design concepts defined in greater detail in DOE-STD-1189-2008. Familiarity with DOE-STD-1189-2008 is essential to properly apply this Standard (DOE-STD-1104). In particular, this Standard provides expectations for the review of the SDS, CSDR, the PSDR and the PDSA. These documents (referred to in this Standard as safety design basis documents) are progressive documents for the design phases of a project that lead to the development of the DSA and the TSR. Review and approval of these documents during the design phases ensure communication between DOE and its contractors regarding facility design, as well as ensuring that safety design is incorporated early in the design process. The relationship of these documents and the order of their development are as follows:

1. The SDS provides a roadmap for strategizing how important safety issues will be addressed in the design and in the tailoring in the development of key safety documentation. 2. The CSDR summarizes the hazards analysis efforts and safety-in-design decisions incorporated into the conceptual design, along with any identified project risks associated with the selected strategies. 3. The PSDR updates the information in the CSDR, adding design detail. 4. The PDSA demonstrates the adequacy of the design from the safety prospective to support construction of the facility. 5. The DSA evolves from the PDSA and reflects the as-built design. 6. The TSR is developed, based upon the DSA. 5.1 Safety Design Strategy, Review Teams, and Approvals DOE O 413.3A, Chg 1 (or successor document) defines the roles and responsibilities for DOE in managing a project, including who assigns the responsibility for reviewing and approving safety design basis documents submitted to DOE. When a new project enters the conceptual design phase, DOE-STD-1189-2008 calls for the development of an SDS as one of the first safety documents to be generated. The SDS is discussed in Section 2.3 of DOE-STD-1189-2008, and the expectations for the SDS are defined in Appendix E of DOE-STD-1189-2008. The DOE expectations for safety-in-design developed during the preconceptual phase evolve into the SDS during the conceptual phase. The SDS is updated in the preliminary and final design phases. As the initial project safety management integration tool, the SDS provides the preliminary information to gauge the scope of significant hazards and the general strategy for DOE-STD-1104-2009 26 addressing those hazards. In addition, for projects that do not follow the traditional project cycle, the SDS provides a vehicle to describe how requirements for safety documentation will be tailored to that particular project approach while satisfying DOE O 413.3A, Chg 1 (or successor document). DOE-STD-1189-2008 anticipates that the final safety basis documents for the facility being constructed or modified will be based on the format and content of DOE-STD- 3009-94, Change Notice No. 3. If a different methodology will be applied to these documents, the SDS should identify that methodology and define the resulting changes to the format of the safety design basis and safety basis documents. The SDS, at the conceptual design phase, is prepared by the Safety Design Integration Team (SDIT)4 (or the contractor safety lead in the absence of an SDIT) from the DOE expectations for the execution of safety activities during design. The SDS is approved by DOE SBAA and the Federal Project Director, with the advice of the Chief of Nuclear Safety or the Chief of Defense Nuclear Safety, as appropriate. As stated earlier, DOE O 413.3A, Chg 1, assigns the authority to designate the SBAA to the PSO for the project. Updates to the SDS should be focused on the major safety decisions that influence project cost (e.g., seismic design criteria, confinement ventilation, safety functional classification, and safety and design strategies). Interim SDS updates provide a means by which all parties are kept informed of important changes due to safety in design evolution between Critical Decision points.

As the name suggests, the SDS lays out the strategy for the safety design of the project; hence, it defines the framework of a number of the project safety documents to be approved by DOE, including the CSDR, the PSDR, the PDSA, the DSA, and the TSRs. The SDS, CSDR, the PSDR, the PDSA, the DSA, and the TSRs are approved by the SBAA. In reviewing an SDS, the reviewer should evaluate whether the topics described in DOE-STD-1189, Appendix E, have been addressed and provide an adequate basis to proceed with design efforts. DOE should appoint a senior staff person qualified to lead a safety basis review team (SBRT) for those documents that require DOE approval. The SBRT is expected to review the SDS and other safety design basis documents submitted for DOE approval and to prepare the CSVR for the CSDR, the PSVR for the PSDR and the SER for the PDSA. The SBRT lead should maintain communication with the Federal Integrated Project Team (IPT)5 and the SDIT as the design progresses to ensure that the IPT is kept up to date with respect to safety design. The SBRT should attend design review meetings and review and comment on the SDS; however, it should be careful to remain independent of the development of the CSDR, PSDR, and PDSA to ensure independence in the review of those documents. As discussed earlier, the safety basis design documents are progressive documents drawing from the analyses and information in the previous document and evolving with the design of the facility. Consequently it is important staff to the SBRT with members who can stay with the 4 See DOE-STD-1189-2008 or successor document for additional information on the SDIT. 5 See DOE O 413.3A, Chg 1, and DOE-STD-1189-2008 or successor documents for requirements and additional information on the IPT. DOE-STD-1104-2009 27 review process as it progresses. Having long-term team members adds efficiency to the team effort as they carry the history of the safety design bases documents with them. Over time, some team members may change due to attrition, promotions, the need to add individuals to the review team to include specific technical skills, or the decision to drop certain individuals whose skills are no longer needed. However, it is most important that there is continuity of the SBRT team leader, so that individual should be chosen with this in mind. The conceptual design phase of a project presents a key opportunity for the safety analysis to influence the design. Because many important preliminary analyses and safety design decisions are decided during this period, it is important for the SBRT to be actively involved in the review process. The SBRT lead should identify and assign Subject Matter Experts (SMEs) in the review of safety-in-design issues as they are identified. These SMEs should become members of the SBRT. The team lead should make use of all available resources. For example, Defense Nuclear Facilities Safety Board (DNFSB) reviews of the project (or other projects) may identify design issues that should be addressed early in the design process (some of which may be captured in staff reports posted on the DNFSB website). 5.2 Review Bases for Conceptual Safety Design Reports

DOE O 413.3A, Chg 1, requires a CSDR as a part of the approval package for the Critical Decision-1 (CD-1) phase of a project. DOE-STD-1189-2008 provides details on DOE’s expectations for the CSDR. In particular, DOE-STD-1189-2008, Appendix H, provides a format and content guide for the CSDR. The CSDR must reflect the project configuration at conceptual design; however, the design at this phase is not fully defined and the CSDR may (1) propose more than one possible approach to some aspects of the design and (2) identify some areas that will need more research and development at later stages. Consequently, a comprehensive safety assessment at the conceptual design stage is not expected. Further, the CSDR may be the first opportunity for the reviewer to see and review the SDS. Although some of the decisions and selections may be preliminary at this phase of design, the CSDR reviewer must confirm that the following are adequate and sufficiently conservative to proceed from the conceptual design phase to the preliminary design phase: • Selected hazard categorization (hazard category-1, -2 or -3) of the facility; • Preliminary identification of the facility Design Basis Accidents (DBAs); • Assessment of the need for safety class and safety-significant facility-level safety controls based on the analysis of the DBAs; • Preliminary assessment of the appropriate seismic design criteria for the facility; and • Positions taken with respect to compliance with the safety design criteria of DOE O 420.1B, Facility Safety, or any alternate criteria proposed. DOE-STD-1104-2009 28 The reviewer should refer to DOE-STD-1189-2008, Appendix H, for detailed guidelines on the expected contents for a CSDR. These contents may vary somewhat based on the individual project, as documented in the SDS. As part of the review of the CSDR, the reviewer must: 1. Assess whether the identified facility level DBAs appear to be a complete set; 2. Determine if the safety function classifications from Appendices A and B of DOE-STD-1189-2008 were appropriately applied, including natural phenomena hazards (NPH) classifications, such as seismic design category; 3. Assess the adequacy of the preliminary hazard analysis against the expectations in Section 4.2 of DOE-STD-1189-2008; 4. Evaluate the basis of the chosen confinement strategy if a confinement strategy other than active ventilation was adopted (e.g., passive confinement); in general, an active safety class or safety- significant confinement system is preferred for hazard category 1 and 2 nuclear facilities unless otherwise indicated by the safety analyses; 5. Review the risk and opportunity assessment6 to confirm that the technical uncertainties related to safety are identified; 6. Confirm that the current safety design basis is reasonably conservative and the risk of significant redesign related to major or costly changes in safety controls is minimized or properly documented in the CSDR and addressed as discussed in items 7 and 8; 7. Confirm that the CSDR contains a summary of the risks and opportunities associated with the safety design basis strategies; 8. Confirm that the CSDR identifies risk handling strategies that bound each identified risk; 9. Confirm that the hazard analysis is complete to the degree appropriate for the stage of development; 10. Confirm that the process in DOE-STD-1189-2008, as tailored in the SDS, was used for the selection of safety controls at the facility level;

11. Evaluate the decisions made with respect to the safety classification of the safety controls and associated functions; 12. Ensure that any safety issues that require further study are identified in the CSDR; 6 See DOE-STD-1189-2008, Appendix F, for information on expectation for the risk and opportunity assessment. DOE-STD-1104-2009 29 13. Confirm that the safety design aspects of the project are acceptable such that the project is ready to move to the preliminary design phase; and 14. Evaluate the CSDR to ensure that the hazard controls were selected consistent with the principles of the hierarchy of hazard controls7: • passive engineering features, • active engineering features, • administrative controls, and • personal protective equipment. DOE documents the results of the review of the CSDR in a CSVR for approval by the SBAA. In accordance with DOE O 413.3A, Chg 1, approval of the CSVR is a prerequisite to CD-1; therefore, the Federal Project Director concurs on the CSVR. Detailed expectations for the preparation of an SVR are provided in Section 5.5. 5.3 Review Bases for Preliminary Safety Design Reports The PSDR evolves from and expands upon the CSDR adding design detail from the preliminary design phase of a project. The PSDR is a part of the approval package for the CD-2 phase of a project. DOE-STD-1189-2008 provides details on DOE’s expectations for the PSDR. In particular, Appendix I of DOE-STD-1189-2008 provides a format and content guide for the PSDR and the PDSA. As stated in Section 5.1, DOE-STD-1189-2008 anticipates that the final safety basis documents for the facility being constructed or modified will be based on the format and content of DOE-STD-3009-94, Change Notice No. 3. If a different methodology will be applied to these documents, the SDS should identify that methodology and define the resulting changes to the format of the safety design basis and safety basis documents. The format and content expectations should be tailored to the design and safety analysis maturity at the preliminary design phase. The reviewer should refer to DOE-STD-1189-2008, Appendix I, for detailed guidelines on the expected contents for a PSDR. The contents may vary somewhat based on the individual project as documented in the SDS. The reviewer of the PSDR must also confirm that it adequately addresses the following safety design basis aspects for the preliminary design phase: 1. The nuclear facility design requirements of DOE O 420.1B; 2. A viable design solution (e.g., safety SSCs) to provide the safety functions assessed to be necessary by the hazard analysis, as follows: a. The unmitigated accident consequence assessment properly indicates the required functional classification (i.e., safety class versus safety significant) and seismic 7 See Guiding Principle 2 in DOE-STD-1189-2008. DOE-STD-1104-2009 30 and other NPH design requirements (i.e., the proper seismic design criteria for seismic design and performance criteria for other NPH design). b. The analysis of DBAs identifies the functional requirements that the safety SSCs and SACs must perform and the conditions (e.g., normal and accident) under which these functions must be performed. c. The safety systems can meet the functional requirements and any unique technology development that may be needed has been identified. 3. Appropriate supplemental design criteria (DOE G 420.1-1, Chapter 5 and DOE-STD-1186) as specified for safety SSCs and SACs, as follows:

a. General requirements for safety class and safety significant SSCs and for SACs are specified (e.g., conservative design features, design against single-point failure, environmental qualification, safe failure modes, as appropriate). b. Based on the functional classification and the safety SSC design function, appropriate codes and standards are specified and tailored, as needed, or alternate codes and standards are identified and justified. 4. Descriptions of the technical studies needed to complete the safety design. 5. Safety design risks and risk mitigation strategies for the final design phase. The PSDR must demonstrate the adequacy of the hazard analyses and the selection and classification of the safety controls, including consideration of the application of the principles associated with the hierarchy of controls.8 The information in the PSDR should be sufficient to conclude, that if the commitments made in the PSDR and design documents are met, the result should be a final design and a constructed facility that could be approved for operation without significant modifications. The detail in the PSDR should be more complete than the information provided in the CSDR, even though the design may not be complete. The reviewer should confirm that the PSDR identifies (1) viable engineered safety solutions that address the recognized hazards and (2) an acceptable set of safety design requirements to address the hazards. The PSDR should identify any SSCs that are intended to become design features in operational TSRs. It is not necessary that the full details of consensus design codes and standards be listed in the PSDR. These details should be in the documents available for the design reviews and should be fully scrutinized during design reviews by safety personnel participating in those reviews. 8 See DOE-STD-1189-2008, Guiding Principle 2. DOE-STD-1104-2009 31 If a format and content other than that defined in Appendix I of DOE-STD-1189-2008 are used to develop the PSDR, the reviewer should verify that the PSDR follows the expectations defined in the SDS. DOE documents the review of the PSDR in a Preliminary SVR (PSVR) for approval by the SBAA. In accordance with DOE O 413.3A, Chg 1, approval of the PSVR is a prerequisite to CD-2; therefore, the Federal Project Director concurs on the PSVR. Detailed expectations for the preparation of an SVR for the PSDR are provided in Section 5.5 of this Standard. 5.4 Approval Bases for Preliminary Documented Safety Analyses Title 10 CFR 830.206 requires a PDSA for new facilities and major modifications initiated after December 11, 2000, and it defines the PDSA as follows: Preliminary documented safety analysis means documentation prepared in connection with the design and construction of a new DOE nuclear facility or a major modification to a DOE nuclear facility that provides a reasonable basis for the preliminary conclusion that the nuclear facility can be operated safely through the consideration of factors such as: (1) The nuclear safety design criteria to be satisfied; (2) A safety analysis that derives aspects of design that are necessary to satisfy the nuclear safety design criteria; and (3) An initial listing of the safety management programs that must be developed to address operational safety considerations.

One purpose of the PDSA is to ensure that DOE and the contractor agree that safety has been adequately integrated into the design before the construction phases of new hazard category 1, 2, or 3 nuclear facilities or a major modification to such facilities. The 10 CFR 830.206 Rule requires that DOE approve the nuclear safety design criteria used to prepare the PDSA unless the contractor uses the design criteria in DOE O 420.1B. The PDSA is revised as needed to reflect design changes. When a PDSA is required, it must be approved by DOE before the contractor can procure materials or components or begin construction, unless DOE provides relief under the provisions of the Rule9. The PDSA evolves from the PSDR and follows the same format and content expectations as the PSDR, as defined in Appendix I of DOE-STD-1189-2008. As stated in Section 5.1, DOE-STD-1189-2008 anticipates that the final safety basis documents for the facility being constructed or modified will be based on the format and content of DOE-STD-3009-94, Change Notice No. 3. If a different methodology will be applied to these documents, the SDS should identify that methodology and define the resulting changes to the format of the safety design 9 Guidance on this relief process is provided in DOE G 421.1-2 and the relief process is documented in 10 CFR Part 820, Subpart E. DOE-STD-1104-2009 32 basis and safety basis documents. The format and content expectations are tailored to the design and safety analysis maturity at the final design stage. The PDSA must identify any changes that were made to the decisions and commitments in the PDSR. Furthermore, while the CSDR should include a facility-level hazards analysis and the PSDR should include a process-level hazards analysis, the PDSA is expected to address activity-level hazards and hazard controls and evaluate facility/process hazards. This should be confirmed during the review of the PDSA. The PDSA is typically submitted for approval during the Final Design Phase of a project. The review of the PDSA should confirm that the PDSA addresses the following safety design basis information for the Final Design Phase: 1. Completion of the design safety analysis demonstrating the adequacy of the design from the safety perspective. The PDSA does not need to show the progression of the design that led to the final choices, only the final choices and the justification for their adequacy. 2. Demonstration that the safety design requirements specified at the end of the preliminary design have been met. 3. Mature hazards and accident analysis consistent with DOE-STD-1189-2008, Section 4.4. 4. Description of the final design of the facility with respect to safety SSCs and safety design features. 5. Identification of safety SSCs, SACs, and other hazard controls and clear definition of their performance requirements. 6. Description of the safety controls selected to address the identified hazards and accidents and justification of their adequacy, as well as how they provide defense in depth, if warranted, based on mitigated accident frequency and on control reliability. 7. Initial list of safety management programs. 8. Description of how the selected controls adequately prevent and/or mitigate accidents and how they provide defense in depth, if warranted, based on mitigated accident frequency and on control reliability. 10 9. Description of how the nuclear safety design criteria of DOE O 420.1B have been satisfied by the design.

10. Resolution of any technical issues that required performance of research or other data collection to finalize the design.11 10 This analysis should provide adequate understanding of the baseline mitigated consequences for the facility. The description should define the safety control effectiveness in the context of the potential accidents and provide the baseline safety analysis for the evaluation of changes as the facility DSA is developed for the transition to operation. 11 The technical issue(s) giving rise to the need for research or other data collection must be identified in the project DOE-STD-1104-2009 33 11. Documentation of preliminary approaches to startup and operations management. If format and content other than that defined in Appendix I of DOE–STD-1189-2008 are used to develop the PDSA, the reviewer should verify that the PDSA follows the expectations defined in the SDS. The expectations for integration of safety in design criteria defined in DOE-STD-1189-2008 still apply. In any event, the PDSA should be developed to support the development of a DSA that complies with the requirements of 10 CFR Part 830 to avoid problems during the review of the DSA. Prior to operations, the PDSA will evolve to a final DSA that reflects the facility as actually constructed. DOE does not expect PDSAs for activities that do not involve significant construction, such as environmental restoration activities, decontamination and decommissioning activities, specific nuclear explosives operations, or transition surveillance and maintenance activities. DOE documents the review and approval of the PDSA in an SER. The format and content expectations of the SER are described in Section 4 of this Standard. DOE reviewers for PDSAs should be mindful that the PDSA is based on the available knowledge of equipment to be procured after the PDSA is approved, particularly if early approval of the PDSA is requested to facilitate early construction and procurement. In such cases there may be a need for additional research and final data collection before the final safety analysis can be performed. Therefore, it is recommended that the DOE reviewer for the PDSA prepare the SER for the review and approval of the PDSA based on one of the following findings/evaluations: • Proposed design item/system/activity is completely reviewed and found acceptable (subject to any DOE-imposed changes); or • Proposed design item/system/activity is based on preliminary information and is accepted based on commitments to fully meet specific safety criteria in the final DSA (e.g., separation, redundancy, maintainability access). While it is most desirable for the reviewers to be able to make the first finding listed above, the design may not be sufficiently mature to reach that conclusion. Consequently, if the second finding is chosen, the PDSA will need to be revised and resubmitted for approval consistent with the changes made to the design as it progresses, until such time as it is superseded by a final DSA. In either case, significant changes to the design after PDSA approval may require that the PDSA be revised and resubmitted for approval in accordance with DOE-STD-1189, Section 6.4. DOE documents the review of the PDSA in an SER for approval by the SBAA. In accordance with DOE O 413.3A, Chg 1, approval of the PDSA is a prerequisite to CD-3; therefore the Federal Project Director concurs on the PDSA. Detailed expectations for the preparation of an SER for the PDSA are provided in Chapter 4 of this Standard.

Risk and Opportunity Assessment, including the plan and rationale for resolution of the issue(s). (See DOE-STD-1189, Section 3.2, and Appendix F.) DOE reviewers must evaluate the risk and opportunity evaluation to ensure that it is robust in identifying unknowns and potential technical issues related to the results of the hazard analysis; specifically, the selection of hazard controls. DOE-STD-1104-2009 34 5.5 Safety Validation Reports 5.5.1 General Discussion The SVR format is used to document the review of the early safety design basis submittal; namely, the CSDR and the PSDR. The SVR for the CSDR is the Conceptual SVR or CSVR; the SVR for the PSDR is the Preliminary SVR or the PSVR. Some of the fundamental information related to the project and documented in the SVR, such as the site and mission information, may be used later in the SERs used to document the reviews of the PDSA, DSA, and TSRs. However, the information provided in the early safety design basis documents reviewed in the SVR is by definition more preliminary than the later safety basis documents. The main purpose of the review of these early documents is to identify and raise any concerns with the design early in the process when changes are less expensive to make and to ensure that the safety design is sufficient to proceed to the next phase of design or construction. Ideally, the SVR will confirm that DOE agrees with the design concepts at these early phases. The following section provides guidance on the content and format for the SVR in reviewing the CSDR and the PSDR: PSDR Safety Validation Report (SVR) CSDR Then document the evaluation in a … If it is a… 5.5.2 Content and Format 5.5.2.1 Title Page The title page for the SVR is similar to the title page for the SER. It provides the unique identifier information for the CSDR or the PDSR, as applicable, and for the SVR. Minimum information consists of the following: (1) SVR title, revision number, and date issued; (2) Title, revision number, and date issued for the CSDR or the PDSR as applicable; (3) Facility name and identification number, if any; (4) Site; and (5) Name of the prime contractor for the facility and the contract number. DOE-STD-1104-2009 35 5.5.2.2 Signature Page The signature page provides the identification and signature of the SBAA and the date of the approval of the CSDR or the PDSR. Other signatures, such as the Federal Project Director, may be included on this page. 5.5.2.3 Executive Summary This section presents summary information regarding the basis of the review of the CSDR or the PDSR. The introduction or briefly summarizes the following: (1) Facility for which review is being conducted; (2) Facility hazard category; (3) NPH design criteria; (4) Facility mission and scope of operations; (5) Issues affecting the ability for the project to proceed; (6) Conditions for proceeding to the next stage of design; (7) Open issues raised in the SVR; (8) Significant risks or opportunities identified in the document reviewed; and (9) Significant outstanding studies or reviews identified in the document reviewed and the expected schedules. The Executive Summary concludes with a statement on the acceptability of the CSDR or the PDSR indicating that these documents have undergone an appropriate review and the design information is sufficient to continue the design process; or the design information is sufficient to proceed, but with any specified conditions; or with a statement that the project should not proceed to the next phase until specified actions are completed.

5.5.2.4 Review Process This section should provide a brief description of the process used to review the CSDR or the PDSR and provides the rationale for level of effort and detail. Typical information summarized includes: (1) Key participants in the review process; (2) How the review was done (e.g., verification of information, independent calculations, reading the report and comparing it to other documentation); and (3) Scope of the review (e.g., selected independent calculations and design reviews attended). DOE-STD-1104-2009 36 Discussion should be brief, but still sufficient to provide an understanding of the thoroughness of the review process and its basis. This section does not provide a documented record of the details of the review (e.g., issue resolution files). 5.5.2.5 Recommendation to Proceed This section documents the bases for review of the CSDR or the PSDR and the recommendations to proceed with the design and construction. The statement on the adequacy is generally focused and brief. This may entail nothing more than a paragraph stating that the CSDR or the PDSR contains sufficient background and fundamental information to support the progress of the design effort and contains no open issues or design flaws that would warrant holding or reversing the design progress. This does not mean that there are no inadequacies as the design is still immature, but rather that the reviewer believes these inadequacies will be resolved in the normal design process and the resolutions documented in the next design document (PDSR for the preliminary design phase and PDSA for the final design phase). If they are significant, the inadequacies should be documented in the SVR for the follow-up in later reviews, including methods and schedules for resolving them as soon as practicable. 5.5.2.6 Site and Facility Information This SVR section may provide a brief synopsis of major site, facility, and operational process features. This information is intended for the sole purpose of providing a minimal, facility- specific context for SVR bases of approval, such that an elementary understanding of the consideration of safety in the design process can be understood. The SVR does not, however, attempt to repeat detailed information contained in the CSDR or PSDR. This information may be used later to support the basis section of the SER for the PDSA or later documents. This section of the SVR is not essential and can be omitted if it is not needed to support the document. 5.5.2.7 Hazard Analysis For the CSVR (Conceptual Design Phase), this section must document how the hazard and accident analyses are consistent with DOE-STD-1189-2008, Section 4.2, and follow the format of Appendix H of that Standard or the format that is defined and approved in the SDS. For the PSVR (Preliminary Design Phase), this section must document how the hazard and accident analyses are consistent with DOE-STD-1189-2008, Section 4.3 and follow the format of Appendix I of that Standard or the format that is defined and approved in the SDS. 5.5.2.8 Hazard Categorization This section must identify the designated nuclear facility hazard category level (hazard category 1, 2 or 3) and assess whether the designated level is appropriate. This section must be used to address any issues related to any uncertainties in the nuclear facility hazard category level and the potential costs and opportunities if the level is revised at a later date. DOE-STD-1104-2009

37 5.5.2.9 Safety Structures, Systems and Components This section must address the identified safety SSCs in the CSDR or the PSDR, their bases and their functions, and any issues related to the identified set. 5.5.2.10 Specific Administrative Controls This section must address any identified SACs in the CSDR or the PSDR, their bases and their functions, and any issues related to the identified set. It is not expected that the SACs will be developed in detail for the PSDR and they may not be identified at all for the CSDR, as SACs are limited to any outstanding issues. 5.5.2.11 Hazard Controls This section must address any issues with the hazard controls identified in the CSDR or PSDR. 5.5.2.12 Design Codes and Standards This section must provide the basis for approval of the design codes and standard(s) identified in the CSDR or PSDR, including any exceptions to the design codes and standards listed in DOE O 420.1B, DOE G 420.1-1, and DOE G 420.1-2. This section does not constitute an exemption to the requirements of DOE O 420.1B, which must be requested separately if needed. 5.5.2.13 Safety Design Criteria This section should assess any crosswalk in the CSDR or PSDR to the design criteria in DOE O 420.1B. If the contractor used design criteria other than that documented in DOE O 420.1B, this section must document the evaluation of the alternate criteria and assess the acceptability of those criteria. 5.5.2.14 Conditions for Proceeding to the Next Stage of Design This section must document any conditions for proceeding to the next stage of design. The section must also document any recommendation that the project is not ready to proceed to the next phase of design. This section may also indicate whether SBAA (or the SBRT) has any fundamental problems with the developing design. Such problems should be elevated in a timely manner. The early identification and communication of fundamental problems is one of the key reasons for this incremental review of the design. Resolution of these issues at an early stage will reduce the cost to correct these problems at a later date, so it is important for the reviewer to make such issues known. 5.5.2.15 Conclusion This section must summarize the significant issues in the review and document whether the CSDR or the PSDR is acceptable. DOE-STD-1104-2009 38 Acronyms CD Critical Decision CFR Code of Federal Regulations CSDR Conceptual Safety Design Report CSVR Conceptual Safety Validation Report DBA Design Basis Accident DOE Department of Energy DNFSB Defense Nuclear Facilities Safety Board DSA Documented Safety Analysis FEM Field Element Manager G Guide IPT Integrated Project Team M Manual NNSA National Nuclear Security Administration NPH Natural Phenomena Hazard O Order PDSA Preliminary Documented Safety Analysis PSDR Preliminary Safety Design Report PSO Program Secretarial Officer PSVR Preliminary Safety Validation Report SAC Specific Administrative Control SBAA Safety Basis Approval Authority SBRT Safety Basis Review Team SDIT Safety Design Integration Team SDS Safety Design Strategy SER Safety Evaluation Report SME Subject Matter Expert SRP Safety Review Plan SSC Structures, Systems, and Components STD Standard DOE-STD-1104-2009 39 SVR Safety Validation Report TSR Technical Safety Requirements USQ Unreviewed Safety Questions DOE-STD-1104-2009 Concluding Page 1 CONCLUDING MATERIAL Review Activities Preparing Activity DOE HS-21 DOE Headquarters CTA-ESE & Science CTA-NNSA EE EM FE GC IM ME NA NE PO RW SC DOE Field BHSO BPA Carlsbad FO CTA- ESE CTA-NNSA Chicago Ops Office Fernald GFO GJPO Idaho SO KAO LSO LASO Mound NNSA Service Center NETL NETL-PGH Nevada SO ORO-EM Oak Ridge Ops Office Pantex SO Portsmouth/Paducah Princeton SO RL Sandia SO SR-NNSA SRO WAPA WVDP Y-12 SO Contractors Battelle/PNNL WIPP Fluor Hanford WSRC Bechtel Nevada LANL LLNL WSI-NV Pantex Sandia Natl Lab Y-12 INL-ICP-EM INL-NE Ames Lab Argonne Nat Lab BJC-OR BNL CH-Ames Group Fermi Nat Lab ORP ORAU PPPL SLAC TJNL Project Number SAFT-0114