DOE-STD-1120-2005 Volume 1, Integration of Environment, of Environment, Safety, and Health Into Facility Disposition Activities, Volume 1 - Documented Safety Analysis for Decommissioning and Environmental Restoration Projects

DOE-STD-1120-2005 Volume 1 of 2 April 2005 DOE STANDARD INTEGRATION OF ENVIRONMENT, SAFETY, AND HEALTH INTO FACILITY DISPOSITION ACTIVITIES Volume 1 of 2: Documented Safety Analysis for Decommissioning and Environmental Restoration Projects U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. NOT MEASUREMENT SENSITIVE TS i This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (423) 576-8401. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 605-6000. DOE-STD-1120-2005/Vol. 1 ii FOREWORD Subsequent to the initial release of DOE-STD-1120-98, nuclear safety basis requirements were promulgated in 10 CFR 830, Subpart B. The standard was identified as a “safe harbor” approach for preparing a documented safety analysis (DSA) for decommissioning and environmental restoration activities. The May 1998 version of the standard was not explicit regarding compliance with safety basis requirements of Part 830. Therefore, Volume 1 of DOE-STD- 1120-98 has been revised to focus on DSA requirements. Volume 2 still retains a broad focus on integrated safety management and many of the appendices apply to all facility disposition activities including deactivation and long-term surveillance and maintenance. A number of topics previously covered in both volumes of STD- 1120-98 were either reconfigured or not retained in the current revision. A comparison of the topics covered in previous and current versions of the standard is provided in Table F-1. Rationale is provided for previously covered topics that are excluded from the revised standard. DOE-STD-1120-2005/Vol. 1 iii Table F-1. Comparison of Topics in Current and Previous Versions of Standard TOPICS CURRENT SECTION PREVIOUS SECTION Assessing the Adequacy of Existing Hazard Baseline Documentation Appendix C 3.3.5, Appendix C CERCLA/ES&H Integration Removed. No longer relevant to the scope of Volume 1. Topic retained in Volume 2. 3.1.1, Appendix D Change Control Process 2.5 3.4.2 Decommissioning Plans 2.2 3.1.1 DOE Office of Nuclear Safety Policy and Standards Guidance Memoranda Removed. No longer has official bearing on 10 CFR 830 requirements Appendix G Environmental Permits Appendix C 3.3.6, Appendix C ES&H Considerations for Facility Disposition by Privatization Removed. Not widely used at DOE field sites Appendix E ES&H Requirements Identification Appendix A 3.1.4, Appendix A Examples of Applying DOE-STD- 1120 Concepts Appendix B Appendix B Facility Disposition Phases 1.2 2.0 Facility and Work Description for Decommissioning Documented Safety Analysis 3.1 None Facility and Work Description for Environmental Restoration Documented Safety Analysis 4.1 None Facility Disposition ES&H Documentation 2.0, 3.0, 4.0 Appendix I Facility Hazard Analysis 3.2, 4.2, Appendix C 3.2.1, Appendix C Facility Safety Controls 2.5, 3.3, 4.3, Appendix C 3.3.2, Appendix C Feedback and Evaluation Appendix C 3.5, Appendix C Hazard and Accident Analysis for Decommissioning Documented Safety Analysis 3.2 None DOE-STD-1120-2005/Vol. 1 iv TOPICS CURRENT SECTION PREVIOUS SECTION Hazard and Accident Analysis for Environmental Restoration Documented Safety Analysis

4.2 None Hazard Analysis Techniques Removed. Topic is adequately covered in existing references (e.g., AIChE handbook) Appendix H Hazard Baseline Documentation Appendix C 3.3.4, Appendix G, Appendix I Hazard Categorization 2.1 3.1.4, 3.3.4, 3.4.1 Hazard Controls for Decommissioning Documented Safety Analysis 3.3 none Hazard Controls for Environmental Restoration Documented Safety Analysis 4.3 none Hazard Identification and Characterization Appendix C 3.1.3, Appendix C Health and Safety Plans Appendix C 3.1.3, 3.3.4, Appendix I Inactive Waste Site Criteria Appendix D none Identification of ARARs for Decommissioning Activities Removed. Topic adequately covered in existing DOE directives and environmental regulations Appendix D Integrating Environment, Safety and Health Considerations into Work Planning Activities Appendix C 3.1.1, Appendix C Management of Change Appendix C 3.4.2, Appendix C Management Plans 2.2, Appendix C 3.1.1, Appendix C Multi-disciplined Work Teams (Worker Involvement) Appendix C 3.1.3, 3.2.1, 3.2.2 National Environmental Policy Act (NEPA) Appendix A 3.2.1, Appendix A Natural Phenomena Hazards (NPH) 3.22, 4.2.2.2 3.2.1, 3.3.2, Appendix G Overview of the Work Smart Standards Process Appendix A Appendix F DOE-STD-1120-2005/Vol. 1 v TOPICS CURRENT SECTION PREVIOUS SECTION Privatization Removed. Not widely used at DOE field sites Appendix E Resource Planning Appendix C 3.1.2, Appendix C Readiness Evaluation Appendix C, Appendix F 3.41, Appendix C, Appendix J Resource Planning Appendix C 3.1.2, Appendix C Risk Binning Guidelines Appendix E none Safety Analysis Reports 3.0, 4.0 3.1.4, 3.3.4, Appendix I Specific Administrative Controls 2.4 none Subcontractor ES&H Activities Appendix C 3.1.1 Task Hazard Analysis and Work Control Process 2.3, Appendix C 3.2.2, Appendix C TSR Derivation for Decommissioning Documented Safety Analysis 3.3.1 none Uncertainties in Material Inventory Estimates or Facility Conditions Appendix C 3.3.3, Appendix C Use of Existing Hazard Baseline Documentation Appendix C 3.3.5, Appendix C Work Smart Standards Process Removed. Methodology adequately covered in other DOE directives. Appendix A retained as a supporting tool. Appendix F Work Packages Appendix C 3.2.2, 3.3.4 Worker Safety Controls Appendix C 3.3.1, Appendix C DOE-STD-1120-2005/Vol. 1 vi TABLE OF CONTENTS Volume 1 Documented Safety Analysis for Decommissioning and Environmental Restoration Projects Page 1.0 INTRODUCTION ............................................................................................................. 1-1 1.1 Scope ..............................................................................................................1-1 1.2 Applicability .......................................................................................................1-1 1.3 Organization ......................................................................................................1-2 2.0 GENERAL SAFETY BASIS CONCEPTS........................................................................ 2-1 2.1 Hazard Categorization........................................................................................2-1 2.2 Decommissioning Plans ...................................................................................... 2-2

2.3 Work Control Process and Task-Level Hazard Analysis ....................................2-2 2.4 Specific Administrative Controls .........................................................................2-3 2.5 Change Control Process ....................................................................................2-5 3.0 DOCUMENTED SAFETY ANALYSIS FOR DECOMMISSIONING ................................ 3-1 3.1 Facility and Work Description.............................................................................3-2 3.1.1 Site Location .........................................................................................3-2 3.1.2 Systems, Structures and Components..................................................3-3 3.1.3 Operational History ...............................................................................3-3 3.1.4 Decommissioning Activities and Techniques ........................................3-3 3.2 Hazard and Accident Analysis............................................................................3-4 3.2.1 Methodology..........................................................................................3-4 3.2.2 Hazard Analysis Results .......................................................................3-5 3.2.3 Accident Analysis ..................................................................................3-7 3.3 Hazard Controls .................................................................................................3-8 3.3.1 TSR Derivation......................................................................................3-9 4.0 DOCUMENTED SAFETY ANALYSIS FOR ENVIRONMENTAL RESTORATION ........ 4.1 4.1 Restoration Project and Site Description...........................................................4-1 4.1.1 Site Location .........................................................................................4-1 4.1.2 Site History............................................................................................4-2 4.1.3 Restoration Project Activities and Techniques......................................4-2 4.2 Hazard and Accident Analysis............................................................................4-3 4.2.1 Methodology..........................................................................................4-3 4.2.2 Hazard Evaluation Results....................................................................4-4 4.2.3 Accident Analysis ..................................................................................4-7 4.3 Hazard Controls .................................................................................................4-7 DOE-STD-1120-2005/Vol. 1 vii Volume 2 Appendices Appendix A Environment, Safety, and Health Directives Applicable to Facility Disposition Activities ............................................................................................................ A-1 Appendix B Examples of Applying DOE-STD-1120-98 Concepts ........................................ B-1 Appendix C ISMS Guidance ................................................................................................. C-1 Appendix D Inactive Waste Site Criteria ............................................................................... D-1 Appendix E Risk Binning Guidelines .................................................................................... E-1 Appendix F Readiness Evaluation Checklist .........................................................................F-1

DOE-STD-1120-2005/Vol. 1 viii ACRONYMS AC Administrative Control CFR Code of Federal Regulations DOE Department of Energy DP Decommissioning Plan EG Evaluation Guideline EPA Environmental Protection Agency ER Environmental Restoration ES&H Environment, Safety, and Health HA Hazard Analysis HASP Health and Safety Plan HAZWOPER Hazardous Waste Operations and Emergency Response ISMS Integrated Safety Management System IWS Inactive Waste Site MAR Material At Risk NPH Natural Phenomena Hazards PPE Personal Protective Equipment SAC Specific Administrative Control S&H Safety and Health SMP Safety Management Program SSC Structures, Systems, or Components TSR Technical Safety Requirement USQ Unreviewed Safety Question DOE-STD-1120-2005/Vol. 1 1-1 1.0 INTRODUCTION 1.1 Scope The original release of DOE-STD-1120-98 provided integrated safety management guidance for enhancing worker, public, and environmental protection during all facility disposition activities. Volume One of this Standard has been revised to provide a Department of Energy (DOE) approved methodology for preparing a Documented Safety Analysis (DSA) for decommissioning of nuclear facilities, as well as environmental restoration activities that involve work not done within a permanent structure. Methodologies provided in this Standard are intended to be compliant with Title 10 of the Code of Federal Regulations (CFR) Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements. As described in Appendix A, Table 2 of this regulation, contractors may prepare a DSA by using the method described in DOE-STD- 1120-98, or successor document, and the provisions of 29 CFR 1910.120 or 29 CFR 1926.65, Hazardous Waste Operations and Emergency Response (HAZWOPER). Derivation of controls is also necessary for facility decommissioning projects that involve more than “low level residual fixed radioactivity.” DSAs must be compliant with the general requirement of 10 CFR 830.204, Documented Safety Analysis, which requires: (1) a facility and work description; (2) a systematic identification of natural and man-made hazards associated with the facility; (3) a evaluation of normal, abnormal and accident conditions; (4) a derivation of hazard controls; and (5) a description of safety management program characteristics, including criticality safety. HAZWOPER requirements specifically focus on provisions for developing a Safety and Health (S&H) program and site-specific health and safety plan. HAZWOPER applies to all worker hazards, including physical hazards posed by deconstruction or environmental restoration work (e.g., use of heavy equipment, excavations, confined space entry, and hot work). As stated in DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, “it is not the intention of the DSA to cover safety as it relates to the common industrial hazards that make up a large portion of basic OSHA regulatory compliance.” Therefore, in the context of Subpart B requirements of Part 830, the scope of HAZWOPER is taken to include those hazards, associated controls, and S&H programs that must be identified and maintained within a Hazard Category 1, 2, or 3 facility’s safety basis.

Existing S&H programs that are in place to meet DOE directives and standards, as implemented through the Integrated Safety Management (ISM) process, may be acceptable mechanisms for meeting HAZWOPER S&H program requirements. Where applicable to the safety basis, these programs should be described in the DSA. However, compliance with ISM mechanisms or this Standard should not be construed as automatically satisfying all health and safety plan (HASP) provisions of HAZWOPER. Volume Two of the Standard is much broader in scope than Volume One and satisfies several purposes. Integrated safety management expectations are provided in accordance with facility disposition requirements contained in DOE O 430.1B, Real Property Asset Management. The collection of appendices in Volume Two also provides additional guidance that supplements various practices described in Volume One. DOE-STD-1120-2005/Vol. 1 1-2 1.2 Applicability Volume One of this Standard applies to hazard category 2 or 3 environmental restoration activities and decommissioning projects as defined in 10 CFR 830, Subpart B. Volume One does not apply to facility life-cycles that are subject to the safe harbor provisions of DOE-STD- 3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports or DOE-STD-3011, Guidance for Preparation of Basis for Interim Operation (BIO) Documents (i.e., deactivation including material stabilization campaigns such as processing of reactive liquids and any long-term surveillance and maintenance). Since Volume Two has a broader focus than safety basis requirements it does apply to all phases of facility disposition (i.e., facility deactivation, surveillance and maintenance, and decommissioning). 1.3 Organization The Standard consists of two volumes. Volume 1: Documented Safety Analysis for Decommissioning and Environmental Restoration Projects, has four sections, including this introductory section. Section 2 discusses general safety basis concepts that have a direct or indirect impact on the DSA. Section 3 provides guidance on preparing DSAs and TSRs that are compliant with 10 CFR 830, Subpart B requirements and associated methodology for decommissioning of a nuclear facility. Section 4 provides guidance on preparing DSAs and TSRs that are compliant with 10 CFR 830, Subpart B requirements and associated methodology for environmental restoration activities involving work not performed within a permanent structure. Volume 2: Appendices, complements other sections of the Standard with additional environment, safety and health (ES&H) information. Appendix A provides a set of candidate DOE ES&H directives and external regulations, organized by hazard types that may be used to identify potentially applicable directives to a specific facility disposition activity. Appendix B offers examples and lessons learned that illustrate implementation of ES&H approaches discussed in Section 3 of Volume 1. Appendix C contains Integrated Safety Management guidance that applies to all facility disposition projects. Appendix D provides supplemental safety basis guidance related to inactive waste sites. Appendix E provides example risk binning guidelines that can be used to support control selection. Appendix F provides guidance for readiness evaluations. DOE-STD-1120-2005/Vol. 1 2-1 2.0 GENERAL SAFETY BASIS CONCEPTS 2.1 Hazard Categorization

DOE-STD-1027-92 describes an initial and final hazard categorization process that is necessary to determine applicability of 10 CFR 830, Subpart B requirements. The initial hazard categorization is based strictly on the total radionuclide inventory as compared with Threshold Quantities of DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, as well as consideration of criticality mass limits for fissile materials (i.e., per the asterisk to Table A.1 of the standard). It is recognized that many retired facilities subject to decommissioning, as well as environmental restoration projects, may not have adequate records or process knowledge available to predict material inventory with 100% certainty. Various characterization methods may be employed such as employee interviews, intrusive sampling, and non-destructive assay (NDA) techniques of soil, surface and groundwater, and contaminated equipment and structures. These methods are appropriate for hazard categorization provided they are sufficiently bounding. For example, NDA techniques should fully account for instrument error. Some facilities may not exceed Hazard Category 2 threshold quantities, but may contain fissile materials in quantities greater than the theoretical mass limits for criticality specified in Attachment 1 of DOE-STD-1027-92. These facilities are considered Hazard Category 2, unless facility segmentation or the nature of the facility process precludes the potential for a criticality. “Segmentation” as considered for purposes of determining criticality potential, means that it is not physically possible to gather into one place the fissile material needed to achieve criticality. The “Nature of the process” means there are no events that could conceivably lead to the formation of a critical mass of fissile material, and no criticality controls are needed on any parameter of the process to prevent a criticality accident. A Nuclear Safety Technical Position, NSTP-2002-2 (Methodology for Final Hazard Categorization of Nuclear Facilities from Category 3 to Radiological) describes an acceptable methodology for a final hazard categorization of a Hazard Category 3 (HC3) nuclear facility. The HC3 threshold values may be revised based on the physical and chemical form and available dispersive energy sources, if the credible release fractions can be shown to be significantly different than the values used in the Environmental Protection Agency (EPA) Technical Background Document. A facility or activity may be downgraded below HC3 if inventory is below threshold quantities as modified by these factors (i.e., physical/chemical form of material and available energy sources). The base information associated with a hazard categorization should provide adequate information to: (1) identify the bounding radionuclide inventories at a facility; (2) substantiate any assumptions used in calculating inventories; and (3) provide a defensible basis to support hazard analysis associated with final hazard categorization. For facilities that have an initial or final categorization above HC3, the basis and assumptions should be described within the DSA as required by 10 CFR 830, Subpart B. Final hazard categorizations that result in a determination of “below Hazard Category 3” based on a hazard analysis will require DOE DOE-STD-1120-2005/Vol. 1 2-2

approval, but may be developed and submitted separate from a DSA that may have otherwise been required. 2.2 Decommissioning Plans DOE O 430.1B, Real Property Asset Management, and its implementation guides require a project plan for each distinct phase of facility disposition (i.e., Deactivation Plan, S&M Plan, and Decommissioning Plan) prior to the execution of work. The purpose of these plans is to describe the work that will be performed and the methods that will be used to accomplish it. An obvious characteristic of a decommissioning project is that the facility state changes progressively as work proceeds. For this reason, it is important that the facility state to which a DSA applies is clearly defined and articulated in the DSA, and that the scope of planned activities is consistent with the Decommissioning Plan. . A Decommissioning Plan should define such matters as decommissioning strategy, sequence of decommissioning tasks and the scope of work at each phase, as these are the key inputs that the safety analyst needs from the project so that representative analyses can be carried out. It is also important that the Decommissioning Plan and the DSA be consistent, so any changes to work plans as defined in the Decommissioning Plan may be considered for potential impacts to the DSA. DOE O 430.1B requires that a plan demonstrate how environment, safety and health requirements are integrated into disposition activities. As also required by DOE P 450.2A, Identifying, Implementing and Complying with Environment, Safety and Health Requirements, and 48 CFR 970.5204-78 (DEAR clause on laws, regulations, and DOE directives), information resulting from planning and hazard identification activities should be used to determine the set of ES&H directives applicable to the planned facility disposition activity. The list of directives in Appendix A of this Standard can be used to support this determination. These directives are organized by hazard type (i.e., hazardous substances and physical hazards) and a “crosscutting” category that references directives applicable to all missions and hazard types. The decommissioning plan conveys the set of ES&H requirements that are applicable to a decommissioning project. This set is not intended to replace or usurp the List A or List B contractual set of requirements (see DEAR clauses 970.5204-2 and 770.5223-1) that might be established for a broader contract that encompasses more than just decommissioning. Rather, the intent is that a Decommissioning Plan conveys the tailored set of ES&H requirements applicable at the project level, and based on the anticipated hazards and work scope. 2.3 Work Control Process and Task-Level Hazard Analysis Environmental restoration and decommissioning projects generally consist of multiple work tasks that must be evaluated throughout the life of the project as specific tasks are planned and scheduled. The work control process assures that each project task will be conducted in a safe manner in accordance with all pertinent requirements and controls. Work control activities such as task-level planning and analysis should be integrated with the Unreviewed Safety Question (USQ) process to ensure that project tasks are conducted within the safety envelope analyzed by the DSA. The process for linking work control and the USQ process should be described in the DOE-STD-1120-2005/Vol. 1 2-3 DSA.

Task hazard analyses should be conducted throughout the life of the project as disposition tasks are planned and scheduled. The following guidelines should be used when conducting a task hazard analysis: • The DSA should be used as the basis and an input for performing a task hazard analysis. The DSA analysis and control set provides an umbrella for all other work activities and provides controls at the project or facility level. • The analysis should evaluate each step in the task’s work instruction for hazards in the workplace and those introduced from chosen work methods. This process is accomplished most effectively by performing a walkdown of the work area, as needed, feasible, and permissible, based on existing facility hazards (e.g., high radiation areas), using the workers who will perform the task. The analysis should review task steps and evaluate hazardous substances and physical hazards. This typically provides the basis for selecting the appropriate immediate worker protection measures such as Personal Protective Equipment (PPE) or local monitoring. DOE 440.1 and its implementation guide DOE G 440.1-1, Worker Protection Management for DOE Federal and Contractor Employees Guide, provides further guidance on evaluation of worker hazards. • The analysis should involve a multi-disciplinary team with the appropriate subject matter experts. • Tasks should be screened against the DSA to ensure planned work is within the analyzed safety basis and to determine whether updates to documentation are necessary. This screening is accomplished consistent with the change control process discussed in Section 2.4. The extent of work planning efforts and associated task hazard analysis will vary depending on experience and familiarity in conducting the task. Detailed work planning is necessary to support many work tasks, but the extent of these efforts can be graded where appropriately justified. For example, a work task such as a previously conducted maintenance activity that is documented in current procedures and well understood, may rely on a review of task steps and a simple hazard checklist. Whereas, a task that is new and unfamiliar to workers may warrant a more detailed task hazard analysis and prescriptive process instructions. 2.4 Specific Administrative Controls The purpose of this section is to provide guidance on specific administrative controls (e.g., inventory control limits, directed employee actions, combustible control limits, etc.) that is germane to decommissioning or environmental restoration projects. Specific administrative controls (SACs) provide a safety function that is of a similar level of importance as safety structures, systems or components (SSCs). Guidance provided in DOE-STD-1186-2004, Specific Administrative Controls, should be followed for establishing specific administrative controls, together with additional guidance provided in this Standard. SACs are an integral and important part of the safety basis for decommissioning and DOE-STD-1120-2005/Vol. 1 2-4 environmental restoration activities. The nature of these activities is such that engineered safety features may not be available, reliable or comprehensive in controlling many worker hazards. In some cases, a particular facility safety system may physically interfere with further project activities and require removal before hazardous materials can be fully removed.

In cases where safety SSCs are either unavailable or unreliable because of aging or degradation, facility safety and operations personnel must weigh the potential safety benefit of installing or upgrading safety SSCs versus reliance on specific administrative controls. Primary consideration should be given to the duration of a facility disposition activity (e.g., it may be acceptable to conduct short duration tasks using a fire watch rather than upgrading an unreliable sprinkler system or installing a new system), and the capability of existing SSCs in preventing or mitigating hazards (e.g., would the SSC have a dramatic effect on reducing worker or public risk). Costs associated with the SSC installation, upgrade, operation, and maintenance are also a valid consideration, but shouldn’t be the primary determining factor. The reliability and effectiveness of candidate SACs being considered in lieu of safety SSCs is also an important consideration that should be explained in the DSA along with the rationale for its selection (i.e., TSR derivation information on which accidents are being prevented or mitigated by the SAC, how does the SAC prevent or mitigate hazards, and how will its effectiveness be assured). Functioning safety SSCs should not be retired prematurely from service in favour of SACs simply to eliminate the need to maintain the control. SACs should only be considered when safety SSCs are not reliable or cannot be maintained. Appropriate subject matter experts should be involved in these determinations. Some administrative controls may take on prominence during specific project tasks, because of the nature of the work. For example, tasks that involve hot work to dismantle equipment or flammable solvents to decontaminate equipment may increase fire hazards, which can be compensated through additional administrative controls, such as more rigorous combustible controls, or increased fire response capabilities. Another example is the increased risk of worker exposure during intrusive radiological/hazardous material removal, which may necessitate additional radiation protection and industrial hygiene measures such as PPE, site controls, or increased air monitoring. The specificity of administrative controls (e.g., operator actions, limits) can vary depending on the severity of hazards, the level of importance given to the administrative control and the availability of other controls. Administrative controls may also be needed to protect important initial conditions assumed in the hazard analysis (e.g., assumption on combustible loading). Figure 1 provides guidelines for determining the appropriate level of specificity needed for administrative controls. Administrative controls should ensure that safety management programs emphasize key elements that are relied on for controlling hazards. As the severity of hazards increases and the availability or reliability of safety SSCs decrease, it is important to emphasize specific attributes such as administrative limits and specific actions that will be controlled through the limits, controls and conditions. Additionally, where safety management programs are relied on as the primary means of controlling significant hazards, the defense in depth considerations built into these programs should be discussed (e.g., management of uncertainties, redundant samples or DOE-STD-1120-2005/Vol. 1 2-5 independent readings, and assurances that calculations needed within administrative controls are independently verified).

Specificity of Administrative Controls→ General More Specific Very Specific Description of administrative control General Commitment to Implement a Safety Management Program Defined safety management program activities or elements and/or Operational Parameters Defined Limits and commitments When To Apply SSCs are available and used to control the hazard SSCs are available, but are not completely effective in controlling a hazard SSCs are unavailable or not cost beneficial (i.e., short duration decommissioning) and only administrative controls are used to control the hazard Level of Importance of administrative control- ACs contribute to safety by ensuring programmatic elements are available Important to safety; needed to protect an initial condition in the hazard analysis or selected from the hazard/accident analysis to supplement other mitigative/preventive features Primary or contributing control selected from the hazard/accident analysis as a major mitigative/preventive feature(s) “A combustible control program shall be established for the facility” “The fire protection program shall ensure that combustible wastes are removed daily during TRU waste packaging activities” “Combustible wastes shall be maintained below 100 pounds in the facility” Example Severity of Hazards→ Figure 1. Specificity of Administrative Controls 2.5 Change Control Process During the performance of decommissioning work, changes may be necessary to facility systems or work plans that are not anticipated. In order to ensure that the safety basis is current, adequate, and documented, it is important that a change control process be developed that considers the significance of proposed changes and links to the USQ process to determine if DOE approval of the change will be necessary. Unanticipated changes or discovery of new information may also affect a condition, parameter, or assumption that helped support the basis for downgrading a facility below hazard category 3. Such changes should be subjected to a management of change process to evaluate potential impact on the approved safety basis that supported a downgrade. Violation of certain assumptions and controls could invalidate the downgrade such as changes in radionuclide material inventory, form of material, dispersibility (e.g., changes in container storage or energy DOE-STD-1120-2005/Vol. 1 2-6 sources), interaction with available energy sources, segmentation assumptions, or nature of the process assumptions that may affect criticality safety. Facility changes will also occur throughout a decommissioning project that are anticipated and described within the decommissioning plan and DSA. These changes should be reviewed as part of the work control process. However, changes which are already analyzed and approved as part of the existing safety basis will typically not require a USQ evaluation. Whether anticipated or not, facility changes should be subject to a real time configuration management process. Drawings or one line diagrams, schematics, and equipment lists that illustrate SSCs and system boundaries described in the DSA should be current at implementation. A single authority (often the shift manager or configuration control authority) should be designated to maintain these drawings and lists as the facility changes, or systems and components are removed.

Proposed changes to configuration are typically evaluated as a part of the work planning process. Requisite reviews, such as engineering, fire protection, nuclear safety, environmental, etc. approve the change through the planning process. The configuration control authority verifies system status prior to authorizing work, and records system changes once the work is authorized. Affected safety management programs may periodically review the accuracy of drawings and lists to ensure status and configurations are current as a part of their self assessment program. The configuration control authority should serve as the single point reference for the facility’s status and condition at any given point in time. Log keeping, upkeep of status boards, and timely documentation of changes is vital to ensuring the work remains within the evaluated scope. DOE-STD-1120-2005/Vol. 1 3-1 3.0 DOCUMENTED SAFETY ANALYSIS FOR DECOMMISSIONING As described in 10 CFR 830, Subpart B, Appendix A, Table 2, contractors may prepare a DSA by using the method described in DOE-STD-1120-98, or successor document, and the provisions of 29 CFR 1910.120 or 29 CFR 1926.65, Hazardous Waste Operations and Emergency Response (HAZWOPER). Derivation of controls is also necessary for facility decommissioning projects that involve more than “low level residual fixed radioactivity.” DSAs must also be compliant with the general requirement of 10 CFR 830.204, Documented Safety Analysis, which require (1) facility and work description; (2) systematic identification of natural and man-made hazards associated with the facility; (3) evaluation of normal, abnormal and accident conditions; (4) derivation of hazard controls; and (5) description of safety management program characteristics, including criticality safety. As explained in Section 1.1 of this Standard, the DSA isn’t expected to address the full scope of standard industrial hazards and controls typically covered by HAZWOPER. An acceptable DSA format and content that meets the requirements of 10 CFR 830.204 and the provisions described in 10CFR 830, Subpart B, Appendix A, Table 2 is described according to the sections given below. An overview of the DSA format is shown in Figure 2. While these topics may be described in a HAZWOPER health and safety plan, it is recommended that information be presented in a separately prepared DSA, providing a clearer distinction of facility safety basis information that is subject to the Unreviewed Safety Question process. Decommissioning projects that have only low level residual fixed radioactivity are not expected to have the potential for accidents involving significant radiological consequences. This is reflected in 10 CFR 830.205(c), which states that Technical Safety Requirements (TSRs) are not required for this type of activity. The DSA format for this type of decommissioning activity may exclude topics related to accident analysis (Section 3.2.3), safety SSCs (Section 3.3) and TSR derivation (Section 3.3.1). DOE-STD-1120-2005/Vol. 1 3-2 Introduction Facility and Work Description (Section 3.1) • Site Location • SSCs • Operational History • Decommissioning Activities and Techniques Hazard and Accident Analysis (Section 3.2) • Methodology • Hazard Analysis Results (includes hazards identification, categorization, evaluation) • Accident Analysis (Hazard Category 2 facilities with accidents that potentially challenge the Evaluation Guideline)* Hazard Controls (Section 3.3)

• Safety SSCs (includes safety functions, functional requirements, system evaluation)* • Safety Management Programs • Specific Administrative Controls • Derivation of TSRs* *Not required for Decommissioning that involves only Low Level Fixed Residual Radioactivity Figure 2. Simplified DSA Format for Decommissioning Project 3.1 Facility and Work Description A description of the facility and the decommissioning work activities should be presented to the extent needed to facilitate an understanding of the hazard analysis. Some of this information will be available in DSAs prepared during previous operational phases of the facility. It is important that this section of the DSA be consistent with information presented in Decommissioning Plans (DP). Contractors may choose to incorporate the DP into the safety basis by reference, rather than repeating the information within the DSA. This chapter of the DSA should include descriptions of site location, systems, structures and components, facility operational history, and decommissioning activities and techniques. 3.1.1 Site Location The location of the facility and its relationship to nearby structures is important data for understanding potential on or off-site impacts from decommissioning operations. Nearby facilities, structures and buildings in which there may be persons or equipment that could be affected by events occurring during the decommissioning project, and their physical relationship to the facility being decommissioned, should be listed. The locations of potentially affected members of the public near the site should also be given. Transportation routes for equipment and materials, both off-site and within the site, should also be described. Analytical data that is used for atmospheric dispersion of airborne releases including meteorological data and distances and directions to potential receptors may be simplified within the DSA commensurate with the level of rigor necessary in the hazard and accident analysis. This information is not needed within HC3 facility DSAs that only require qualitative hazard analysis. DOE-STD-1120-2005/Vol. 1 3-3 3.1.2 Systems, Structures and Components A description of SSCs which are being decommissioned, including a description of buried structures that will be remediated, should be presented. This information should include the existing configuration and interdependencies of SSCs, and in particular any degradation or other changes that may have occurred relative to the original design. A description of new or temporary SSCs which may be needed to prevent or contain the spread of radioactive or hazardous materials during decommissioning should also be provided. Interdependencies among SSCs should be described to the extent they will be affected by the decommissioning, and to the extent necessary to facilitate an adequate understanding of the hazard analysis. Equipment being dismantled may be structurally linked to safety SSCs that are not planned for retirement until a subsequent phase of decommissioning. The means by which integrity of the remaining structures will be assured should be described. To the extent possible at the time of DSA preparation, it is important that SSC changes anticipated during the course of the decommissioning project be described in the DSA to reduce the potential activities that must be separately evaluated in accordance with the USQ process. Additionally, the timing of SSC changes within the overall project work scope should be stated to support proposed rationales for retiring safety controls.

3.1.3 Operational History Information from the operational history of the facility, which is important in understanding the hazards and state of SSCs should be compiled. Information on previous modifications to the design that may have an impact on the safety of decommissioning should be presented. Operational information about previous facility processes and the location of radioactive contamination, both as a result of normal operation and resulting from incidents or accidents, should be also presented. 3.1.4 Decommissioning Activities and Techniques Since the decommissioning activities themselves, by their nature, can be a source of accident initiators, it is important that decommissioning equipment and processes be sufficiently described to the extent necessary to support the hazard analysis and control selection. At the highest level, this description should include the major phases of decommissioning including the removal of remaining hazardous material inventory; the removal of fixed contamination from surfaces and equipment; dismantling of systems and equipment; demolition of major structures; or other defined end-states for the facility. Where sequencing of these activities is important, this information should also be presented. Decommissioning techniques should also be described. The requirements for power, cooling water, and other external supplies to the equipment used to carry out these techniques should be documented. Hazardous chemicals, heat or ignition sources, combustible or flammable materials, or other types of hazards that could be introduced in the facility as a result of the chosen decommissioning techniques should be described. The expected quantities and location DOE-STD-1120-2005/Vol. 1 3-4 of radioactive, hazardous and mixed wastes expected to be generated during the decommissioning process should be described. Any temporary storage of generated or packaged waste should also be described. These activities may require additional hazard analysis and controls, as well as special permitting. 3.2 Hazard and Accident Analysis Overall, this section of the DSA should present the methodology used to identify and evaluate hazards, as well as the results of these efforts. The hazard and accident analysis approach and format presented in DOE-STD-3009-94, Chapter 3, should be applied to decommissioning operations, with additional clarifications noted in the following subsections below. Hazard analysis activities that support Subpart B requirements of Part 830, as well as HAZWOPER and other directives and regulations, may be integrated. This is a recommended practice that is discussed in DOE-HDBK-1063-2003, Integration of Multiple Hazard Analysis Requirements and Activities. Integration supports a common baseline of hazards information and assumptions and encourages communication between various safety, environmental, security and operations personnel. 3.2.1 Methodology 3.2.1.1 Hazard Identification

This subsection of the DSA should identify the method used by analysts to identify hazardous material inventories and energy sources that could initiate or contribute to a potential release of hazardous substances, hazardous waste or radiological materials. The dynamic nature of decommissioning and potential for unknown hazards requires a thorough identification of hazards. Consideration should be given to the remaining hazardous materials (e.g. material quantity, form, and location) and energy sources that exist or will be introduced as a result of decommissioning activities. New fire ignition sources or flammable materials, as well as the potential accumulation of combustible wastes are all hazards that can be introduced or worsened because of decommissioning activities. Hazards related to the physical state and degradation of SSCs should also be identified. As an example, the scabbling of degraded concrete structures could decrease structural stability and increase the risk of failing a material confinement barrier. Hazardous material inventory and facility design information (e.g., drawings, design criteria, instrumentation diagrams) may be unavailable or in poor condition at some facilities. This will necessitate the use of “process knowledge” and/or intrusive or non-intrusive characterization, depending on the level of hazards information needed to support a defensible analysis. The following activities should be conducted to support a thorough identification of hazards: • Assess existing facility status and hazards information by collecting and reviewing available facility operating records and existing safety analysis information for previous phases of facility operation (e.g., DSAs, Safety Analysis Reports, Fire Hazards Analysis). • Interview past and present employees, as necessary, regarding facility operating history DOE-STD-1120-2005/Vol. 1 3-5 (e.g., location of hazardous materials and previous spills or releases). • Assess existing facility conditions and identify inherent hazards by performing a facility walkdown using a multidisciplined team that includes appropriate subject matter experts. • Review and consider applicable lessons learned reports and DOE Occurrence Reporting and Processing System database events for the facility, as well as for similar facilities. The need for intrusive characterization activities (e.g., sampling and analysis) should be determined based on the collection and evaluation of facility information, the remaining level of uncertainty regarding existing hazardous substances (i.e., radiological materials, hazardous chemicals, or hazardous wastes), and the existing facility condition. Consider characterization activities if there is insufficient knowledge of hazards to understand the hazardous substance types, quantities, forms, potential exposures, and locations. Hazard identification data, and its subsequent use in the facility hazard categorization and analysis, may rely on various characterization results provided that data is sufficiently bounding. For example, non-destructive examination techniques should fully account for instrument error when used to estimate material inventory. 3.2.1.2 Hazard Evaluation

This subsection should present the approach used to identify and evaluate hazards, including hazard evaluation techniques and methods used to qualitatively estimate accident consequences and likelihood. Ranking or binning schemes applied to hazardous events should also be described, and where used, should be considerate of all receptors (i.e., public, onsite personnel, and facility workers). An example of risk binning guidelines is presented in Appendix E that may be applied to decommissioning projects. A comprehensive discussion of hazard evaluation methods appropriate for decommissioning can be found in Chapters 4 and 5 of Guidelines for Hazard Evaluation, prepared by the Center for Chemical Process Safety of the American Institute of Chemical Engineers. The presentation of hazard and accident analysis (where required) should be consistent with the types and anticipated progression of decommissioning activities. For example, if dispersible radioactive materials are scheduled to be removed prior to initiation of dismantling activities involving plasma torches, then associated fire hazards may not present a potential accident initiator at the time when radioactive materials are still in the building. Thus, hazard and accident analysis information should be consistent with the anticipated types and sequences of decommissioning activities discussed in Chapter 2 of the DSA. 3.2.2 Hazard Analysis Results The results of hazard identification and analysis efforts should be presented in this section of the DSA. The format and guidance provided in Section 3.3.2 of DOE-STD-3009-94 should be followed, and should be inclusive of subsections related to hazard identification, categorization, and evaluation. Additional considerations related to the hazard evaluation process for decommissioning are presented below. DOE-STD-1120-2005/Vol. 1 3-6 In general, existing DSAs that were prepared for a previous phase of a facility’s life cycle are a good source of hazard identification and analysis information. Analysts should consider this information for applicability to decommissioning. Fire hazards analyzed for previous operational phases can be increased during decommissioning because of intrusive activities and from equipment, chemicals and techniques introduced during the decommissioning project. This may increase worker hazards and require more robust fire protection measures than needed during a facility’s operational phase. Hazards such as natural phenomena will have similar applicability during decommissioning and should be retained for analysis. Hazard and accident analysis information from previous facility operations is appropriate for inclusion into decommissioning DSAs if it was previously approved by DOE as compliant with 10 CFR 830, Subpart B, and is bounding and representative of activities anticipated during decommissioning (NOTE: Decommissioning may introduce new hazards and energy sources). The facility-level hazard analysis supports the safety basis for decommissioning operations and provides an envelope against which day-to-day work planning and associated task level analysis are measured. As described in DOE-STD-3009, the level of analysis is driven by the simplicity of operations and hazard potential. Qualitative analysis will typically suffice for the majority of decommissioning projects, because operations have been deactivated and hazardous material inventory has been reduced.

A decommissioning hazard analysis should be considerate of the type of decommissioning activities, as well as work techniques and sequencing of activities to be employed. The HA should also be forward looking to capture the expected decommissioning activities and anticipated facility changes. This includes anticipated changes in control designation as the project proceeds. Retiring safety SSCs or eliminating SACs should be at the appropriate point when material inventory or hazardous conditions no longer exist. The HA should be supportive of these decisions. There may be cases when hazardous material inventories could be made more dispersible during decommissioning, thereby requiring new and/or temporary safety SSCs not originally identified during the initiation of decommissioning. An example of this is the decontamination of a piece of equipment (e.g., glovebox or furnace) at a facility located close to a site boundary (MEOI location) with fixed 238Pu contamination. During the decontamination activities, the system may be breached and mechanical means may be used to remove or reduce the contamination to levels that allow for disposal of the equipment. Such decontamination activities may result in the potential increase of dispersible material that could be released to the environment, even potentially challenging the Evaluation Guideline (EG) of DOE-STD-3009. Therefore, designating temporary ventilation as safety SSC may be necessary until the hazard is no longer present. Facilities entering into a decommissioning phase typically have performed an evaluation of natural phenomena hazards (NPH) based on a previous 10 CFR 830 compliant DSA. These evaluations can be utilized in the decommissioning DSA unless significant structural or equipment modifications are planned that invalidate the conclusions in the previous DSA (e.g., DOE-STD-1120-2005/Vol. 1 3-7 seismic response is affected by reduction in structural load capacity). Additionally, decommissioning may introduce activities that were not addressed in the previous DSA. The impact of any new activities on the existing NPH evaluation should also be considered when determining if the existing evaluation is adequate for decommissioning operations. Where such an evaluation does not exist or is less than adequate, conservative assumptions can be made in the decommissioning DSA without the need for further NPH analysis. Any NPH evaluation performed in support of decommissioning should be inclusive of all applicable natural phenomena, and should be sufficient to allow DOE to understand potential consequences to workers, the public, and environment. Typically, very qualitative evaluations should be sufficient, given that facilities undergoing decommissioning have a short remaining life when compared to the facility’s operational phase, and material at risk is being constantly reduced with a resultant reduction in consequences from postulated NPH accident events. For instance, in a seismic scenario, a worst case assumption that the building will collapse may be made in lieu of detailed seismic response calculations. In this case, the consequences of the building collapse may be acceptable to DOE, provided appropriate controls such as emergency plans/procedures are clearly understood and referenced in the DSA. The facility undergoing decommissioning will still be required to meet 29 CFR 1926 to protect life safety during work activities that require habitation of the facility, but will not be required to meet the performance criteria indicated by DOE-STD-1020.

Other external low probability, high consequence events (e.g., aircraft crash) may be treated similar to NPH events as described above (i.e, use of previous analysis, qualitative evaluation, etc). Some external events may present a higher probability of occurrence during decommissioning such as external vehicle impacts as a result of heavy equipment, or increased waste transportation activities. During decommissioning activities within a facility, administrative processes and safety management programs normally are of utmost importance for protecting workers from hazards. However, there are times when active and passive safety SSCs are necessary until certain hazards are eliminated. An example of such an SSC would be the criticality accident alarm system at facilities that still have fissile material present in sufficient quantities that a criticality hazard exists. For operating facilities, the ability of the Safety SSC to survive DBAs from NPH events would need to be demonstrated through analysis and documented in the SSC’s system evaluation (see Chapter 4 of STD-3009 and DOE O 420.1A 4.4). In the case of decommissioning, the SSC may not be capable of surviving NPH DBAs. Where NPH analysis is not available from the previous DSA to demonstrate NPH qualification, or where facility modifications may invalidate the qualification, failure of the Safety SSC can be assumed rather than performing further NPH analysis. A priority should be placed on expediently reducing the hazards and risks to the point where the SSC is no longer required. Consideration should also be given to establishing post-NPH event procedures that ensure the Safety SSC is still capable of performing its’ safety function following NPH events that may be of lesser magnitude and higher frequency than DBAs. When DOE-STD-1120-2005/Vol. 1 3-8 assuming failure of Safety SSC during NPH, specific administrative controls may be needed to augment or supplement the Safety SSC. 3.2.3 Accident Analysis The vast majority of decommissioning projects are not expected to require detailed analysis and quantification of accidents, given the magnitude of remaining radionuclide inventory and associated consequences (i.e., typically well below the Evaluation Guideline). However, for those HC2 facilities undergoing decommissioning that have potential scenarios with consequences that could challenge or exceed the EG, an accident analysis should be provided with explicit calculations for both the source term and consequences sections (i.e., in accordance with sections 3.4.2.X.2 and 3.4.2.X.3, using DOE-STD-3009 safe harbor format). Unmitigated source terms and consequences should also be considered for points in time in which anticipated step-out conditions will apply. These step-out conditions could be decreased hazardous materials inventories and/or changes in material forms that are likely to be present during the decommissioning activity. This can then serve as the bases for the change in safety control designation or elimination of controls. 3.3 Hazard Controls A summary of the controls that require TSR coverage based on the hazard/accident analysis results should be presented according to the type of control being established (safety SSC, SAC, or safety management program). Controls should be linked to specific hazards and accidents identified in the DSA and considerate of the spectrum of activities anticipated during the entire decommissioning project. Since fire ranks among the predominate hazards of concern, the criteria specified in Section 10 of DOE-G 440.1-5 should be applied when determining appropriate controls for fire hazards. Specific administrative controls should be established based on considerations given in Section 2.4 of this Standard and DOE-STD-1186.

A listing of safety management programs (SMPs) and any references to site-wide programs and facility-specific characteristics may be presented in summary or table form, rather than individual chapters as specified in DOE-STD-3009. SMPs that must be considered based on applicability are provided in items 5 and 6 of 10 CFR 830.204 (b). At a minimum, 10 CFR 830, Subpart B, Table 2, requires that facility decommissioning address emergency preparedness. Similarly, decommissioning activities with only low-level residual fixed radioactivity must at least address emergency preparedness, conduct of operations, training and qualification, and maintenance management. The control hierarchy presented in Appendix A of DOE-STD-3009 should be followed for decommissioning (as appropriate based on deconstruction activities), which gives priority to engineered safety features over administrative controls, and preventive over mitigative controls. Where safety SSCs are needed, information consistent with DOE-STD-3009, Chapter 4 should be presented. In some cases, decommissioning activities may benefit from the use of temporary SSCs because existing systems may not be reliable or the nature of decommissioning may involve some physical alterations of the existing systems. The use of functional criteria may be appropriate, rather than providing detailed design requirements and system descriptions for specific SSCs. This will facilitate accomplishment of the safety function using either a DOE-STD-1120-2005/Vol. 1 3-9 permanent or temporary SSC where necessary to support certain decommissioning actions. For example, a concrete vault (i.e., design feature) that provides shielding to workers from radiation may require penetrations during decommissioning to remove equipment. Temporary shielding may be used during these operations and still provide adequate worker protection in accordance with 10 CFR 835. As another example, active ventilation may only require protection of the differential pressure and filter efficiency parameters. The number of fans required to provide the requisite pressure differential will change as individual glovebox loads are removed. In this case, the TSR targets the function, maintaining differential pressure, rather than specifying the number of fans and interlocks. There will be some balancing required to determine when engineered controls can be replaced or supplemented by administrative controls. For example, an old fire suppression system that has not been maintained per code may not have sufficient reliability and therefore may not be an adequate safety basis control without considerable upgrades to the system. It may be appropriate to replace or supplement this control with certain administrative controls such as combustible material limits or ignition source controls. These decisions should consider factors such as system availability and reliability and the effectiveness of selected administrative controls. The final control strategy should maintain a level of defense in depth such that no single layer is relied on to prevent or mitigate significant hazards. By the very nature of decommissioning, facility equipment and systems will be removed. It is expected that there will be less reliance on safety systems and other TSR controls as the project progresses and as hazardous substances are reduced. For example, the operational limits imposed on a SSC to prevent a release of hazardous substance are no longer valid if the material has been removed. Care should be taken to ensure that safety controls are not retired prematurely or that administrative controls are selected in lieu of available, functioning engineered safety features.

Trigger points, or the conditions that allow step-out of a control should be supported by the hazard analysis and described in the DSA. The following criteria should be used when determining if it is appropriate to retire a control from the safety basis: • Hazardous condition being controlled is no longer present. • Hazardous substance’s physical form has changed to a less dispersible form. • Hazardous substance quantities are no longer present or have been reduced to the point where the consequences of releases are no longer a concern. . Stepping out of a control does not necessarily mean that the control may be de-energized, as it still may be needed to satisfy life safety or emergency response requirements. It simply means that a control may be retired from the safety basis without formally revising the DSA and TSR and re-submitting for DOE approval. The use of this process requires pre-negotiated step-out criteria that are reviewed and approved by DOE during the DSA/TSR review process. DOE-STD-1120-2005/Vol. 1 3-10 Once step-out criteria are satisfied, contractor verification of the condition and DOE notification is necessary to allow the contractor to retire the control. When using this approach, the TSR should (1) use explicit TSR definitions that define terms and conditions used in retiring controls; (2) incorporate step-out conditions into LCO applicability statements; (3) provide administrative controls that formalize the process for stepping out of a control, as well as further safety measures necessary once a control is retired; and (4) provide TSR Bases that support the established points for stepping out of controls. There may be unanticipated situations in which a retired facility safety control is needed to perform its past safety function. For example, if unknown dispersible radiological materials are discovered during the course of a decommissioning activity, it may be necessary to reactivate the building ventilation system to provide a confinement function. In these cases, the operability, maintainability, reliability, and availability of the reactivated control should be verified prior to placing the control back into service. 3.3.1 TSR Derivation The derivation of controls within the DSA should be consistent with expectations provided in Chapter 5 of DOE-STD-3009. This applies to the entire suite of TSR controls, including specific administrative controls. This information may be integrated together with the presentation and description of controls as described in the DSA. For example, the derivational basis for specific administrative controls may consist of brief logic statements that can be presented in tabular form along side the listing of such controls. Where specific administrative controls are selected in lieu or support of an engineered feature, the derivational basis should justify why administrative controls by themselves or in combination with other systems provide adequate protection against the accident consequences. For example, certain administrative controls such as combustible material limits or ignition source controls may be necessary to supplement an existing fire sprinkler system that is unreliable. In this case, derivation of the administrative control should include discussion of the specific reliability issues associated with the sprinkler system and justify how the selected administrative controls ensure adequate protection against fire hazards. DOE-STD-1120-2005/Vol. 1

4-1 4.0 DOCUMENTED SAFETY ANALYSIS FOR ENVIRONMENTAL RESTORATION Environmental restoration activities that are not performed within permanent structures are subject to the requirements of 10 CFR 830, Subpart B1. It is anticipated that many of these activities, especially non-intrusive environmental restoration, may not present significant nuclear or chemical risks to workers or members of the public. Chapter 4 of this Standard is applicable to the small subset of environmental restoration projects that require a DSA, based on the results of a final hazard categorization performed in accordance DOE-STD-1027-92. As described in 10 CFR 830, Appendix A, Table 2, contractors may prepare a DSA by using the method described in DOE-STD-1120-98, or successor document, and the provisions of 29 CFR 1910.120 or 29 CFR 1926.65, Hazardous Waste Operations and Emergency Response (HAZWOPER). DSAs must also be compliant with the general requirement of 10 CFR 830.204, Documented Safety Analysis, which require (1) facility and work description; (2) systematic identification of natural and man-made hazards associated with the facility; (3) evaluation of normal, abnormal and accident conditions; (4) derivation of hazard controls; and (5) description of safety management program characteristics, including criticality safety. As explained in Section 1.1 of this Standard, the DSA isn’t expected to address the full scope of standard industrial hazards and controls typically covered by HAZWOPER. An acceptable DSA format and content that meets the requirements of 10 CFR 830.204 and the provisions described in 10 CFR 830, Subpart B, Appendix A, Table 2 is described according to the sections below. An overview of the DSA format is show in Figure 3. While these topics may be described in a HAZWOPER health and safety plan, it is recommended that information be presented in a separately prepared DSA, providing a clearer distinction of facility safety basis information that is subject the Unreviewed Safety Question process. 4.1 Restoration Project and Site Description Background information on the environmental restoration site and planned restoration-related activities should be presented to the extent necessary to facilitate an understanding of the hazard analysis. It is important that this section of the DSA be consistent with the scope of planned activities as agreed upon with federal and authorized State environmental regulators. 4.1.1 Site Location The location of the facility and its relationship to nearby structures is important data for understanding potential on-site or off-site impacts from environmental restoration operations. Nearby facilities, structures and buildings in which there may be persons or equipment that could be affected by events occurring during the environmental restoration project, and their physical relationship to the facility being decommissioned, should be listed. The locations of potentially affected members of the public near the site should also be given. Transportation routes for 1. These activities are also subject to regulation under the Resource Conservation and Recovery Act and/or the Comprehensive Environmental Response, Compensation, and Liability Act, as well as requirements specified in federal facility agreements and agreements with authorized States. DOE-STD-1120-2005/Vol. 1 4-2 equipment and materials, both off-site and within the site, should also be described. Introduction Restoration Project and Site Description (Section 4.1)

• Site Location • Site History • Restoration Project Activities and Techniques Hazard and Accident Analysis (Section 4.2) • Methodology • Hazard Analysis Results (includes hazards identification, categorization, evaluation) • Accident Analysis (Hazard Category 2 facilities with accidents that potentially challenge the Evaluation Guideline)* Hazard Controls (Section 4.3) • Safety SSCs (includes safety functions, functional requirements, system evaluation)* • Safety Management Programs • Specific Administrative Controls *Typically not expected for vast majority of environmental restoration projects Figure 3. Simplified DSA Format for Environmental Restoration Projects 4.1.2 Site History Background information should be presented on activities that led to the condition requiring restoration. Previous waste disposal activities should be described in terms of the types and quantities of radioactive and hazardous materials and methods used for treatment and disposal (i.e., container burial, seepage ponds, direct injection). Other details that are important to the analysis include the estimated condition of any waste containers being exhumed, design details of disposal trenches or wells that were used, characterization and sampling activities performed and the resulting estimated contamination levels that are expected. 4.1.3 Restoration Project Activities and Techniques The scope of the restoration activity should be presented in sufficient detail that is commensurate with the expected hazards and complexity of the project. The description should include the regulatory driver for restoration, planned characterization activities, primary operational phases that comprise the project, any work sequencing requirements and parallel work activities, and the anticipated final state upon completion of the restoration activity. Temporary or permanent SSCs that are part of the project should also be presented. Restoration techniques should also be described, including the requirements for power, cooling water and other external supplies to the equipment used to carry out activities. Soil restoration techniques generally fall into one of four categories: • Soil Capping and Ground Penetrations to Support Monitoring Activities – installation of soil capping and/or minor intrusive activity into the waste matrix for monitoring the effectiveness of an environmental cap, e.g., ground water wells, piezometer well installation, or some other means of environmental effectiveness measurement. DOE-STD-1120-2005/Vol. 1 4-3 • Waste Stabilization (e.g., grout injection) in soil – waste matrix stabilization where the form of the matrix is modified to a less dispersible form through the addition of grout or similar stabilizing material • Waste Exhumation and Elimination (retrieval and shipment to a different location for processing, treatment, storage and/or final disposal) – eliminates the retrieved waste from the restoration site inventory. • Ground or Surface Water Restoration (collection and/or treatment of contaminated soil, surface and ground water)- activities and processes that clean-up existing contaminants from industrial or waste management sources or minimize the spread of contaminants resulting from releases of hazardous waste, hazardous constituents, or radiological contaminants to surface and/or ground water, and soils.

There is also the possibility to have combinations of these restoration approaches, which can add to the complexity of the activity. In-situ vitrification is not a restoration technique that is considered within the scope of environmental restoration projects discussed in this standard. This process involves the addition of substantive energy and introduces potential dispersive mechanisms that are better suited to evaluation using DOE-STD-3009. 4.2 Hazard and Accident Analysis Overall, this section of the DSA should present the methodology used to identify and evaluate hazards, as well as the results of these efforts. The hazard and accident analysis approach presented in DOE-STD-3009-94, Chapter 3, should be applied to environmental restoration projects with additional clarifications provided in the following subsections below. 4.2.1 Methodology 4.2.1.1 Hazard Identification This subsection of the DSA should identify the methods used by analysts to identify hazardous material inventories and energy sources that could initiate or contribute to accidents impacting workers, the public or environment. Identifying the hazards is an output from the work/scope description. The identified hazards will be used in the Hazard Categorization and also in the Hazard Evaluation that develops the hazard controls applicable to the project. Hazard constituents include radionuclides, chemical substances (hazardous, toxic, reactive or flammable elements, compounds, and or mixtures), and energy sources (chemical, mass/motion, fire ignition sources radiant, thermal, radiation/radiolysis, etc.). Consideration of fire hazards should include intrinsic hazards associated with remaining hazardous or radioactive inventory, as well as those introduced by equipment and techniques used in the process. Hazardous constituents and sources need to be identified early in the safety basis process. Depending on the availability of process and/or historical data and the confidence in that data, there may need to be an early phase of investigation/sampling to develop a hazard inventory/energy listing that will bound and represent all activities to be conducted in the various phases of the restoration. Hazardous material inventory data may be unavailable or incomplete for many restoration projects. This will necessitate intrusive or non-intrusive characterization, depending on the level of hazards information available to support a defensible analysis. The need for intrusive DOE-STD-1120-2005/Vol. 1 4-4 characterization activities (e.g., sampling and analysis) should be determined based on the collection and evaluation of facility information, the remaining level of uncertainty regarding existing hazardous substances (i.e., radiological materials, hazardous chemicals, or hazardous wastes), and the existing facility condition. Consider characterization activities if there is insufficient knowledge of hazards to understand the hazardous substance types, quantities, forms, potential exposures, and locations. 4.2.1.2 Hazard Evaluation This subsection should present the approach used to identify and evaluate hazards, including hazard evaluation techniques and methods used to qualitatively estimate accident consequences and likelihood. Ranking or binning schemes applied to hazardous events should also be described, and where used, should be considerate of all receptors (i.e., public, onsite personnel, and facility workers). An example of risk binning guidelines is presented in Appendix E that may be applied to environmental restoration projects. A discussion of hazard evaluation methods appropriate for environmental restoration can be found in Chapters 4 and 5 of Guidelines for Hazard Evaluation, prepared by the Center for Chemical Process Safety of the American Institute of Chemical Engineers.

4.2.2 Hazard Analysis Results The results of hazard identification and analysis efforts should be presented in this section of the DSA. The format and guidance provided in Section 3.3.2 of DOE-STD-3009-94 should be followed and should be inclusive of subsections related to hazard identification, categorization and evaluation. Additional considerations for environmental restoration are presented below. Hazard analysis activities that support Subpart B requirements of Part 830, as well as HAZWOPER and other directives and regulations, may be integrated. This is a recommended practice that is discussed in DOE-HDBK-1063-2003, Integration of Multiple Hazard Analysis Requirements and Activities. Integration supports a common baseline of hazards information and assumptions and encourages communication between various safety, environmental, security and operations personnel. 4.2.2.1 Hazard Identification and Categorization Environmental restoration activities typically involve radioactive or hazardous materials (i.e., hazardous substances, wastes or other constituents) that may be distributed unevenly over a large area. The cumulative total of material inventory will often exceed HC3 threshold quantities because of the large area being considered. However, waste materials or contamination is buried in the ground at many of these sites and not subject to dispersive forces until exhumed, or exhumed material may not be readily dispersible due to physical form or the method of extraction. These activities are likely candidates to be downgraded below HC3 based on a simple qualitative hazard analysis and final hazard categorization. The Hazard Categorization process uses the total inventory in the project or project segment (if segmentation is used in accordance with DOE-STD-1027-92) to categorize the environmental restoration project. Soil, surface and groundwater contaminants are typically described in terms DOE-STD-1120-2005/Vol. 1 4-5 of chemical form and concentrations. However, it is the total quantity that determines the initial hazard categorization. For large area soil restoration sites where the material is dispersed throughout the soil, surface, and groundwater matrices, historical process knowledge of the material and types of activities that created the soil contamination may provide an initial baseline for deriving the restoration activity inventory. However, in nearly all cases, the process knowledge will have to be supplemented by survey data collection and analysis in order to reduce the conservatism that is required if historical process knowledge is the only source of information. Typically, a single “worst case” sample concentration, when multiplied out by the volume, provides ultra conservative bounding inventory that can be reduced by consideration of the process knowledge, available survey data, and available sample data. Only in the case where statistically valid sampling shows a highly uniform distribution, should average concentration values be used as the basis for the inventory. The basis for the inventory estimates needs to be described in sufficient detail to allow reviewers to follow the methodology and arrive at a conclusion of acceptability.

Inactive waste sites (IWS) that are subject to the Resource Conservation and Recovery Act or Comprehensive Environmental Restoration and Cleanup Liability Act, covered with soil or other engineered barrier, and don’t involve active restoration are not expected to pose significant localized, on-site or off-site consequences. These sites are simplistic in nature, and share similar safety features, operational characteristics, and hazard potential. Therefore, a generic HA and final hazard categorization has been performed by DOE for applicability to IWS operations across the DOE complex. The basis and results are provided in Appendix D and can be used as long as an IWS meets the definitions and conditions as specified. Other environmental restoration activities may also have a high likelihood of being downgraded to less than HC3 based on methodologies described in NSTP 2002-2. It may be a simple matter to qualitatively demonstrate in a final hazard categorization that non-intrusive environmental restoration activities (e.g., soil capping) pose no dispersive energy sources. It may also be possible to demonstrate through segmentation that certain intrusive environmental restoration activities can’t physically exhume sufficient quantities of material at risk to trigger HC3 threshold values based on a final hazard categorization. In any case, assumptions in a final hazard categorization require protection to maintain the DOE approved hazard categorization valid. This could include physical limits on material at risk, as well as any changes to assumptions on material form or dispersibility. Segmentation techniques, as permitted by DOE-STD-1027-92, may also be employed in final hazard categorization determinations, where physical structures or activities have independency. This may be the case for intrusive environmental restoration activities that have physical limitations on the Material at Risk (MAR) that can be exhumed at any one time. For example, removal of contaminated soil may be limited by the volume that can be transported to a designated treatment, storage, or disposal facility. 4.2.2.2 Hazard Evaluation The results of the hazard and accident analysis should present the accident events and initiators considered, estimated frequencies, unmitigated consequences and preventive/mitigative controls DOE-STD-1120-2005/Vol. 1 4-6 that are considered and credited. DOE-STD-3009 provides example approaches for tabulating and presenting this information. Generally, the controls needed for environmental restoration activities can be derived from qualitative hazard evaluation techniques such as what-if analysis or hazard checklists. The hazard evaluation provides the input and basis to support control selection. HA results should be documented in a hazard evaluation table that qualitatively shows the candidate controls as well as those specifically credited. This complete listing of candidate and credited controls helps clarify what was considered in the hazard evaluation. NPH and man-made external hazards must be considered in accordance with 10 CFR 830, Subpart B. Seismic hazards will not typically present a significant concern for restoration projects, unless buildings and structures are involved in processing or storing hazardous materials. Therefore, an evaluation of the impacts from seismic hazards may be a simple matter. Other NPH such as high winds, floods and lightning can be problematic for some environmental restoration projects which may not have protective barriers or facilities (i.e., open trenches with non-containerized combustible wastes). These events should be considered in the hazard analysis, as applicable.

Certain man-made external events can also be problematic for environmental restoration projects due to factors such as a high frequency of waste transports. For example, a vehicle impact and subsequent fire associated with staged or stored waste drums generated during environmental restoration should not be dismissed if the event is within frequency ranges discussed in Section 3.4 of DOE-STD-3009. Aircraft crashes must also be considered in accordance with DOE- STD-3014, Accident Analysis for Aircraft Crash into Hazardous Facilities, which has applicability to Hazard Category 1 or 2 facilities, as well as those projects where hazardous chemical inventory exceeds thresholds of 29 CFR 1910.119 or 40 CFR 68, Chemical Accident Prevention Provisions. HA information can also be found in Appendix D related to small aircraft crash impacts. The presentation of hazard and accident analysis information should be consistent with the types and anticipated progression of environmental restoration activities. Hazards from typical restoration activities that should be considered include: • Setup and mobilization needs to consider siting and accumulation of combustibles (fueling operations for equipment) or other fire hazards that could have an impact on subsequent phases of restoration. • Equipment operation may cause subsidence or compaction that creates a shift in packaged wastes (if present). • Monitoring well installation may create a pathway for release or re-distribution of packaged wastes (e.g., penetration of waste package and redistribution of reactive chemical to create an exothermic condition). • Trenching activities for diversion of surface water runoff could introduce a new pathway for impacting or relocating the waste matrix. DOE-STD-1120-2005/Vol. 1 4-7 • Exhumation (digging) operations could introduce dispersible energy for buried wastes or soil contamination. • Combustible fluids from operating equipment in proximity to exposed wastes, as well as fire hazards from equipment itself, could introduce fire hazards. • Packaging, repackaging, overpacking and waste staging/stacking could create potential for spills, accumulation/concentration of reactive materials or hazardous substances, waste or constituents, or re-distribution of fissile materials. • Movement/loading of waste materials introduces potential for vehicle accidents. • Inventories or high energy sources added by the restoration activity (e.g., any process chemicals, packing or fill material, or quantities of combustibles). 4.2.3 Accident Analysis The vast majority of environmental restoration projects are not expected to require detailed analysis and quantification of accidents given the expected magnitude of radionuclide inventory and associated consequences (i.e., well below the EG). However, for HC2 facilities that have potential scenarios with consequences that could challenge or exceed the EG, the accident analysis needs to present explicit calculations for both the source term and consequences sections (i.e., in accordance with sections 3.4.2.X.2 and 3.4.2.X.3, using DOE-STD-3009 safe harbor format). Unmitigated source terms and consequences should also be considered for points in time in which anticipated step-out conditions will apply. These step-out conditions could be decreased hazardous materials inventories and/or changes in material forms that are likely to be present during the restoration activity. This can then serve as the bases for the change in safety control designation or elimination of controls.

4.3 Hazard Controls As described in 10 CFR 830.205(c), TSRs are not required for environmental restoration projects2, which are subject to the provisions of HAZWOPER. This is consistent with the philosophy that environmental restoration activities are typically not expected to involve hazards that will necessitate active safety SSCs and associated TSRs. Although TSRs are not required, general requirements described in 10 CFR 830.204(b)(4) must still be met. This requires that hazard controls be derived, that adequacy of controls be demonstrated and that a process be defined for maintaining hazard controls current. Therefore, the focus of the “hazards control” section of the DSA should be on the essential SSCs and administrative controls that prevent or mitigate a release of radionuclides or hazardous chemicals. Safety management programs that are generally relied on for worker protection should also be presented. 2 TSRs and associated derivation within the DSA should be considered for the unlikely case where environmental restoration projects require active SSCs to provide for significant worker safety or protection of the public. DOE-STD-1120-2005/Vol. 1 4-8 Administrative controls and SSCs that are “essential” provide significant worker protection consistent with DOE-STD-3009 discussions of “safety-significant,” as well as provisions described in DOE-STD-1186-2004. These controls should be based on the results of the HA, and linked to accident events of concern (e.g., Risk Class I or II events as discussed in Appendix E). A brief description of these controls should be provided, along with the rationale supporting their selection (see Section 2.4 of this standard). The primary means for ensuring reliability of SSCs and administrative controls should be described. This may include a description of specific surveillance requirements or programs, as well as explicit personnel actions. DOE-STD-1186-2004, Specific Administrative Controls, provides additional guidance regarding dependability of SACs. This guidance is supplemented by Section 2.4 of this Standard. A listing of SMPs and any references to site-wide programs may be presented in summary or table form. Characteristics of these programs that are specific to environmental restoration should be the focus of the DSA (e.g., heavy reliance on contamination control element of Radiation Protection Program). SMPs that must be considered based on applicability are provided in items 5 and 6 of 10 CFR 830.204 (b). At a minimum, 10 CFR 830, Subpart B, Table 2, requires that environmental restoration activities address emergency preparedness, conduct of operations, training and qualification, and maintenance management. Safety SSCs should be described in sufficient detail to support an understanding of the safety functions being credited. The use of functional criteria may be used, rather than providing detailed design requirements for specific SSCs. This will facilitate the removal of individual components and replacement with temporary systems where necessary to facilitate environmental restoration. It is expected that there will be less reliance on facility design and administrative features as the project progresses and as hazardous substances are removed. For example, the operational limits imposed on a SSC to prevent a release of hazardous substance are no longer valid if the material has been removed. Care should be taken to ensure that safety controls are not retired prematurely or that administrative controls are selected in lieu of available, functioning engineered safety features.

Trigger points, or the conditions that allow step-out of a control should be supported by the hazard analysis and described in the DSA. The following criteria should be used when determining if it is appropriate to retire a control from the safety basis: • Hazardous condition being controlled is no longer present. • Hazardous substance’s physical form has changed to a less dispersible form. • Hazardous substance quantities are no longer present or have been reduced to the point where the consequences of releases are no longer a concern. A DOE pre-approved process for “stepping out of controls” allows the contractor to retire a control without formally revising the DSA and re-submitting for DOE approval. This process DOE-STD-1120-2005/Vol. 1 4-9 requires the use of pre-negotiated step-out criteria that are reviewed and approved by DOE during the DSA review process. Stepping-out of a control does not necessarily mean that the control may be de-energized, as it still may be needed to satisfy life safety or emergency response requirements. It simply means that a control be retired from the safety basis. Once the criteria are satisfied, only contractor verification that the condition is met, and that DOE is notified, is necessary to allow the contractor to retire the control. When using this approach, the DSA should use explicit terms and conditions that define the conditions and process for retiring controls, and provide administrative controls that describe the process for stepping out of a control, as well as further safety measures if necessary, once a control is retired (e.g., increased fire watch or lower combustible limits). DOE-STD-1120-2005/Vol. 1 4-10