DOE-STD-1120-2016, Preparation of Documented Safety Analysis for Decommissioning and Environmental Restoration Activities

NOT MEASUREMENT SENSITIVE DOE-STD-1120-2016 March 2016 DOE STANDARD PREPARATION OF DOCUMENTED SAFETY ANALYSIS FOR DECOMMISSIONING AND ENVIRONMENTAL RESTORATION ACTIVITIES U.S. Department of Energy AREA SAFT Washington, DC 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. DOE-STD-1120-2016 ii FOREWORD 1. This Department of Energy (DOE) Standard (STD) has been approved to be used by DOE, including the National Nuclear Security Administration, and their contractors. 2. Beneficial comments (recommendations, additions, and deletions), as well as any pertinent data that may be of use in improving this document, should be addressed to: Office of Nuclear Safety (AU-30) Office of Environment, Health, Safety and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 Phone: (301) 903-2996 Facsimile: (301) 903-6172 3. Title 10 of the Code of Federal Regulations (C.F.R.) Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements, establishes requirements for the documented safety analyses (DSA) for nuclear facilities. This Standard provides an acceptable methodology for meeting the 10 C.F.R. Part 830 requirements for the preparation of DSAs prepared for decommissioning or environmental restoration activities as described in Table 2 of the regulation. 4. This Standard is a significant revision of DOE-STD-1120-2005, Integration of Environment, Safety, and Health into Facility Disposition Activities, and a successor document to DOE-STD- 1120-98, Integration of Environment, Safety, and Health into Facility Disposition Activities. The principal purpose of the revision is to clearly identify actions necessary for satisfying this methodology for DSA preparation. The revision also updates this DSA methodology to reflect experience, lessons learned, and the changes in DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis. 5. Throughout this Standard, the word “shall” denotes actions that are required to satisfy this Standard. The word “should” is used to indicate recommended practices. The use of “may” with reference to application of a procedure or method indicates that the use of the procedure or method is optional. To use this Standard as an acceptable methodology for meeting 10 C.F.R. Part 830 requirements for preparing DSAs, all applicable “shall” statements need to be met. 6. The goal of this revised Standard is to provide clearer criteria and guidance to support effective and consistent DSAs based upon lessons learned in implementing DOE-STD-1120-2005. DOE-STD-1120-2016 iii CONTENTS FOREWORD .................................................................................................................................. ii DEFINITIONS ............................................................................................................................... iv ACRONYMS ............................................................................................................................... viii 1.0 INTRODUCTION ............................................................................................................... 1

1.1 Purpose ............................................................................................................................. 1 1.2 Applicability ..................................................................................................................... 1 1.3 Use of this DSA Preparation Methodology ...................................................................... 2 1.4 Application of the Graded Approach Principles .............................................................. 3 1.5 Overview of the Changes in this Revision ....................................................................... 4 1.6 Overview of the Standard ................................................................................................. 4 2.0 HAZARD CATEGORIZATION ......................................................................................... 4 2.1 Final Hazard Categorization............................................................................................. 5 2.2 Inactive Waste Sites ......................................................................................................... 6 3.0 DSA DEVELOPMENT REQUIREMENTS ....................................................................... 7 3.1 Hazard Identification and Evaluation ............................................................................... 8 3.2 Accident Analysis .......................................................................................................... 10 3.3 Hazard Controls Selection .............................................................................................. 12 3.4 DSA Format and Content ............................................................................................... 15 3.5 Disposition Plans ............................................................................................................ 16 4.0 REFERENCES .................................................................................................................. 17 APPENDIX A: GUIDANCE FOR DECOMMISSIONING ACTIVITIES .............................. A-1 A.1 Facility Description ...................................................................................................... A-1 A.2 Hazard and Accident Analysis and Control Selection ................................................. A-3 A.3 Safety Structures, Systems and Components ............................................................... A-7 A.4 Derivation of Technical Safety Requirements ............................................................. A-9 A.5 Safety Management Programs ................................................................................... A-10 APPENDIX B: GUIDANCE FOR ENVIRONMENTAL RESTORATION ACTIVITIES ..... B-1 B.1 Facility Description ...................................................................................................... B-1 B.2 Hazard and Accident Analysis and Control Selection ................................................. B-3 B.3 Safety Systems, Structures and Components ............................................................... B-5 DOE-STD-1120-2016 iv DEFINITIONS The definitions presented below are provided for understanding and consistency among the various safe harbor methodologies. The origins of the definitions are indicated by references shown in square brackets [ ]. If no reference is listed, the definition originates in this Standard.

Accident analysis. The process of deriving a set of formalized design/evaluation basis accidents from the hazard evaluation and determining their consequences. Accident analysis results are used to identify the need to designate safety class and safety significant controls. [DOE-STD-3009-2014] Beyond Design/Evaluation Basis Accident (BDBA/BEBA). An accident that exceeds the severity of the design/evaluation basis accident. [DOE-STD-3009-2014] Deactivation. The process of placing a facility in a stable and known condition, including the removal of hazardous and radioactive materials. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Decommissioning. Those actions taking place after deactivation of a nuclear facility to retire it from service, and includes surveillance and maintenance, decontamination, and/or dismantlement. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Decontamination. The removal or reduction of residual radioactive and hazardous materials by mechanical, chemical, or other techniques to a stated objective or end condition. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Design Basis. The set of requirements that bound the design of structures, systems, and components within the facility. Some, but not necessarily all, aspects of the design basis are important to safety. [DOE-STD-3009-2014] Design Basis Accidents (DBAs). Accidents explicitly considered as part of the facility design for a new facility (or major modifications) for the purpose of establishing functional and performance requirements for safety class and/or safety significant controls. [DOE-STD-3009- 2014] Disposition. Those activities that follow completion of program missions, including, but not limited to, preparation for reuse, surveillance, maintenance, deactivation, decommissioning, and long-term stewardship. [DOE O 430.1B, Attachment 3] Documented Safety Analysis (DSA). A documented analysis of the extent to which a nuclear facility can be operated safely with respect to workers, the public, and the environment, DOE-STD-1120-2016 v including a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety [10 C.F.R. § 830.3] Environmental Restoration Activities. The process by which contaminated sites and facilities are identified and characterized and by which existing contamination is contained, or removed and disposed. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Evaluation basis accidents (EBAs). When an adequate set of design basis accidents does not exist, the representative and unique accidents evaluated in the accident analysis for the purposes of determining the need for safety class and safety significant controls in an existing facility where design basis accidents were not used for this purpose. [DOE-STD-3009-2014] Evaluation guideline (EG). The criterion for the dose of ionizing radiation that the safety analysis evaluates against. The EG is established for the purpose of identifying the need for and evaluating safety class controls. [DOE-STD-3009-2014] Graded Approach. The process of ensuring that the level of analysis, documentation, and actions used to comply with a requirement in this Standard is commensurate with: • The relative importance to safety, safeguards, and security; • The magnitude of any hazards involved; • The life cycle stage of a facility; • The programmatic mission of a facility; • The particular characteristics of a facility; • The relative importance of radiological and non-radiological hazards; and • Any other relevant factor.

[10 C.F.R. § 830.3] Hazard. A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to a person or damage to a facility or to the environment (without regard to the likelihood or credibility of accident scenarios or consequence mitigation). [10 C.F.R. § 830.3] Hazard Analysis. The identification of materials, systems, processes, and plant characteristics that can produce undesirable consequences (hazard identification), followed by the assessment of hazardous situations associated with a process or activity (hazard evaluation). Qualitative techniques are usually employed to pinpoint weaknesses in design or operation of the facility that could lead to accidents. The hazard evaluation includes an examination of the complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to radioactive and other hazardous materials. [DOE-STD-3009- 2014] DOE-STD-1120-2016 vi Hazard Categorization. Evaluation of the consequences of unmitigated radiological releases to categorize facilities in accordance with the requirements of 10 C.F.R. Part 830. Note: 10 C.F.R. Part 830 requires categorization consistent with DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports. [DOE-STD-3009-2014] Hazard Controls. Measures to eliminate, limit, or mitigate hazards to workers, the public, or environment, including: (1) physical design, structural, and engineering features; (2) safety structures, systems, and components; (3) safety management programs; (4) technical safety requirements; and (5) other controls necessary to provide adequate protection from hazards. [10 C.F.R. § 830.3] Note: “hazard controls” include “specific administrative controls.” Interim Operations. Activities conducted during a nuclear facility’s life cycle phase that involves: (1) limited operational life; (2) deactivation; or (3) transition surveillance and maintenance. Life Cycle. The life of an asset from planning through acquisition, maintenance, operation, remediation, disposition, long-term stewardship, and disposal. [DOE O 430.1B, Attachment 3] Long-Term Stewardship. The physical controls, institutions, information and other mechanisms needed to ensure protection of people and the environment at sites where DOE has completed or plans to complete cleanup (e.g., landfill closures, remedial actions, removal actions, and facility stabilization). This concept includes land-use controls, monitoring, maintenance, and information management. [DOE O 430.1B, Attachment 3] Nuclear Facility. A reactor or a nonreactor nuclear facility where an activity is conducted for or on behalf of DOE and includes any related area, structure, facility, or activity to the extent necessary to ensure proper implementation of the requirements established by this Part. [10 C.F.R. § 830.3] Safety Basis. The documented safety analysis and hazard controls that provide reasonable assurance that a DOE nuclear facility can be operated safely in a manner that adequately protects workers, the public, and the environment. [10 C.F.R. § 830.3] Safety Class Structures, Systems, and Components (SC SSCs). Structures, systems, or components, including portions of process systems, whose preventive or mitigative function is necessary to limit radioactive hazardous material exposure to the public, as determined from safety analyses. [10 C.F.R. § 830.3]

DOE-STD-1120-2016 vii Safety Significant Structures, Systems, and Components (SS SSCs). Structures, systems, and components which are not designated as safety class SSCs but whose preventive or mitigative function is a major contributor to defense-in-depth and/or worker safety as determined from safety analyses. [10 C.F.R. § 830.3] Safety Structures, Systems, and Components (safety SSCs). Both safety class structures, systems, and components, and safety significant structures, systems, and components. [10 C.F.R. § 830.3] Specific Administrative Control. An administrative control that is: 1) identified in a DSA as a control needed to prevent or mitigate an accident scenario, and 2) has a safety function that would be safety significant or safety class if the function were provided by a structure, system, or component. [DOE-STD-1186-2004] Technical Safety Requirements (TSRs). The limits, controls, and related actions that establish the specific parameters and requisite actions for the safe operation of a nuclear facility and include, as appropriate for the work and the hazards identified in the DSA for the facility: safety limits, operating limits, surveillance requirements, administrative and management controls, use and application provisions, and design features, as well as a bases appendix. [10 C.F.R. § 830.3] Transfer of Facilities. Transferring programmatic and financial responsibility of land and/or facilities from one program office to another. [DOE O 430.1B, Attachment 3] Transition Surveillance and Maintenance Activities. Activities conducted when a facility is not operating or during deactivation, decontamination, and decommissioning operations when surveillance and maintenance are the predominant activities being conducted at the facility. These activities are necessary for satisfactory containment of hazardous materials and protection of workers, the public, and the environment. These activities include providing periodic inspections, maintenance of structures, systems, and components, and actions to prevent the alteration of hazardous materials to an unsafe state. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Note: Transition surveillance and maintenance activities may occur at any of the following transitions between life cycle phases: (1) transition from operations to deactivation or decommissioning; (2) transition from deactivation to decommissioning; and (3) transition from decommissioning to environmental restoration. DOE-STD-1120-2016 viii ACRONYMS CERCLA Comprehensive Environmental Response, Conservation, and Liability Act C.F.R. Code of Federal Regulations DOE Department of Energy DSA Documented Safety Analysis EG Evaluation Guideline EPA Environmental Protection Agency ER Environmental Restoration HA Hazard Analysis HC Hazard Category HAZWOPER Hazardous Waste Operations and Emergency Response IWS Inactive Waste Site NCS Nuclear Criticality Safety NDA Non-Destructive Assay NPH Natural Phenomena Hazards O Order RCRA Resource Conservation and Recovery Act SAC Specific Administrative Control S&H Safety and Health SC Safety Class SMP Safety Management Program SS Safety Significant SSC Structure, System, and Component STD Standard TED Total Effective Dose TSR Technical Safety Requirement USQ Unreviewed Safety Question DOE-STD-1120-2016 1 1.0 INTRODUCTION 1.1 Purpose

This Department of Energy (DOE) Standard (STD), DOE-STD-1120-2016, describes a methodology for preparing a Documented Safety Analysis (DSA) for decommissioning of hazard category (HC) 1, 2, or 3 nuclear facilities, as well as HC-2 or HC-3 environmental restoration (ER) activities that involve work not done within a permanent structure or the decommissioning of a facility with only low-level residual fixed radioactivity. 1.2 Applicability The Code of Federal Regulations (C.F.R.) in 10 C.F.R. Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements, Section 830.204(a) requires that “[T]he contractor responsible for a hazard category 1, 2, or 3 DOE nuclear facility must obtain approval from DOE for the methodology used to prepare the documented safety analysis for the facility unless the contractor uses a methodology set forth in Table 2 of Appendix A to this Part.” As described in Appendix A, Table 2 of this regulation, contractors may prepare a DSA for decommissioning a DOE nuclear facility or for an environmental restoration activity by using the method described in DOE-STD-1120-98, Integration of Environment, Safety, and Health into Facility Disposition Activities, or successor document, and the provisions of 29 C.F.R. Part 1910.120 or 29 C.F.R. Part 1926.65, Hazardous Waste Operations and Emergency Response (HAZWOPER). In addition, the table also requires decommissioning projects involving more than “low level residual fixed radioactivity” to derive hazard controls based on the Safety and Health Programs, Work Plans, Health and Safety Plans and Emergency Response Plans. This Standard does not apply to facility life-cycles that are subject to the safe harbor provisions of DOE-STD-3009-2014, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, or DOE-STD-3011-2016, Preparation of Documented Safety Analysis for Interim Operations at DOE Nuclear Facilities (i.e., deactivation including material stabilization campaigns such as processing of reactive liquids and any long-term surveillance and maintenance). As a DOE nuclear facility transitions from operations through the decommissioning process, the facility undergoes many life cycle changes and the safety basis is required to be maintained whenever the hazard category is 1, 2, or 3. The following sequential phases are described for this transition: DOE-STD-1120-2016 2 1. Deactivation. The process of placing a facility in a stable and known condition including the removal of hazardous and radioactive materials to ensure adequate protection of the worker, public health and safety, and the environment, thereby limiting the long-term cost of surveillance and maintenance. Actions include the removal of fuel, draining and/or de-energizing nonessential systems, removal of stored radioactive and hazardous materials, and related actions. Deactivation may not include all decontamination necessary for the dismantlement and demolition phase of decommissioning, e.g., removal of contamination remaining in the fixed structures and equipment after deactivation. 2. Decommissioning. Takes place after deactivation and includes surveillance and maintenance, decontamination and/or dismantlement. These actions are taken at the end of the life of a facility to retire it from service with adequate regard for the health and safety of workers and the public and for the protection of the environment. The ultimate goal of decommissioning is unrestricted release or restricted use of the site.

3. Decontamination. The removal or reduction of residual chemical, biological, or radiological contaminants and hazardous materials by mechanical, chemical or other techniques to achieve a stated objective or end condition. 4. Demolition. Destruction and removal of physical facilities or systems. This Standard may be used for facilities conducting activities as described in Steps 2-4 above, as well as ER activities not conducted in a permanent structure. Although activities may involve changes to existing structures, decommissioning and ER projects do not typically apply safety basis documentation requirements of DOE-STD-1189, Integration of Safety into the Design Process, unless they involve new design and construction and are determined to be a major modification of the facility. 1.3 Use of this DSA Preparation Methodology The methodology provided in this Standard is intended to be compliant with 10 C.F.R. Part 830, Subpart B. DSAs prepared for decommissioning or ER activities should use the latest revision of the Standard, not previous versions, as they have been revised to provide clearer criteria and guidance to support effective and consistent DSAs based upon lessons learned from implementation. If a DOE contractor chooses to use this DOE-STD-1120 revision for updating an existing DSA, then the applicable sections of this Standard are required to be implemented completely; unless DOE approves use of an alternate methodology due to the deviations from this Standard. For all safe harbor approaches, DSAs are required to be compliant with the general requirement of 10 C.F.R. § 830.204, Documented Safety Analysis, which requires: (1) a facility and work description; (2) a systematic identification of natural and man-made hazards associated with the facility; (3) an evaluation of normal, abnormal and accident conditions; (4) a derivation of hazard controls; and (5) a description of safety management program characteristics, including criticality safety. DOE-STD-1120-2016 3 This Standard provides a safe harbor methodology to develop DSAs in compliance with10 C.F.R. Part 830, Subpart B, for decommissioning and ER activities. Many (but not all) of the requirements for compliance with this Standard are drawn from DOE-STD- 3009-2014, which also provides detailed guidance on interpreting these requirements. Rather than extend the length of this Standard by reprinting that guidance, the user of this Standard should refer to DOE-STD-3009-2014, as necessary, for effective and acceptable methods for hazards and accident analysis (e.g., standard industrial hazard screening, unmitigated analysis, dispersion and consequence analysis). Title 10 C.F.R. Part 851, Worker Safety and Health Program, specifically focuses on provisions for developing a Safety and Health (S&H) Program and a site-specific health and safety plan, which incorporates HAZWOPER requirements (29 C.F.R. Part 1910.120 or 29 C.F.R. Part 1926.65). HAZWOPER applies to all worker hazards, including physical hazards posed by decommissioning or ER work (e.g., use of heavy equipment, excavations, confined space entry, and hot work). Some of these worker hazards, such as chemical hazards and unique hazards that can affect multiple workers, are within the scope of the DSA. Although HAZWOPER is specified in Table 2 of Appendix A to 10 C.F.R. Part 830, Subpart B for ER or decommissioning projects, it is not within the scope of the DSA to establish controls related to the common industrial hazards that make up a large portion of basic Occupational Safety and Health Administration regulatory compliance. Therefore, in the context of Subpart B requirements of Part 830, the HAZWOPER program is taken to be an important safety management program that is identified, described, and maintained within a HC-1, 2, or 3 facility’s safety basis.

1.4 Application of the Graded Approach Principles Section 830.7 of 10 C.F.R. Part 830 prescribes the use of a graded approach for the effort expended in safety analysis and the level of detail presented in the associated documentation. The graded approach, applied to initial DSA preparation and subsequent updates, is intended to produce an effective and efficient safety analysis and a DSA that is sufficient to assure DOE that a facility has acceptable safety provisions, without providing unnecessary information. As described in 10 C.F.R. § 830.3, the graded approach adjusts the magnitude of the preparation effort to the characteristics of the subject facility based on: • The relative importance to safety, safeguards, and security; • The magnitude of any hazard involved; • The life cycle stage of a facility; • The programmatic mission of a facility; • The particular characteristics of a facility; • The relative importance of radiological and non-radiological hazards; and • Any other relevant factor (e.g., short operational life). DOE-STD-1120-2016 4 The application of the graded approach may allow for much simpler analysis and documentation for some facilities. However, the DSA is still required to provide a systematic evaluation of hazards and an appropriate set of controls commensurate with the results of the hazard evaluation. 1.5 Overview of the Changes in this Revision This revision of DOE-STD-1120-2005, Integration of Environment, Safety, and Health Into Facility Disposition Activities, and successor document to DOE STD-1120-98, Integration of Environment, Safety, and Health Into Facility Disposition Activities, updates the Standards’ provisions to reflect experience and lessons learned from implementation. This revision also reflects pertinent changes to other key DOE documents, such as DOE Order (O) 420.lC, Facility Safety, and DOE-STD-3009-2014 which have been revised since this Standard was last issued. DOE contractors may choose to use this revision to update a facility’s DSA. If a DOE contractor chooses to use this revision of DOE-STD-1120 to update an existing DSA, then the applicable sections of this Standard are required to be implemented completely, unless DOE approval for use of an alternate methodology is obtained [See 10 C.F.R. § 830.204(a)]. This revision clearly identifies which of its provisions are mandatory for use of this Standard in order to meet the requirements of 10 C.F.R. § 830.204. 1.6 Overview of the Standard Section 2 provides the general approach for hazard categorization for decommissioning and ER. Section 3 provides specific requirements for implementing this Standard. Section 4 provides references. Appendix A provides additional guidance for decommissioning of a nuclear facility. Appendix B provides additional guidance for ER activities. Appendix C provides additional guidance for implementation of DSA. 2.0 HAZARD CATEGORIZATION This section provides initial and final hazard categorization requirements and guidance that are applicable for decommissioning and ER projects. 10 C.F.R. § 830.202, Safety basis, requires that “(b) In establishing the safety basis for a hazard category 1, 2, or 3 DOE nuclear facility, the contractor responsible for the facility must: . . . (3) Categorize the facility consistent with DOE- STD-1027-92 ("Hazard Categorization and Accident Analysis Techniques for compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports," Change Notice 1, September 1997)”. DOE-STD-1027-92 describes an initial and final hazard categorization process that is necessary to determine applicability of Part 830, Subpart B requirements. This process has particular relevance to decommissioning and ER. The decommissioning phase of a nuclear facility operational life cycle takes place after much of the facility inventory has been removed. ER activities typically involve buried waste that is not readily dispersible; such conditions may be

DOE-STD-1120-2016 5 appropriate for downgrading facilities below Hazard Category 3 (HC-3) using the initial and final hazard categorization process described in DOE-STD-1027-92. The initial hazard categorization is based strictly on the total radionuclide inventory as compared with the threshold quantities of DOE-STD-1027-92, as well as consideration of criticality mass limits for fissile materials (i.e., per the asterisk to Table A.1 of the standard). Estimating the total radionuclide inventory may be challenging for decommissioning and ER projects because of poor quality records and/or lack of process knowledge needed to accurately determine material inventory quantities. Characterization methods that are typical to the environmental cleanup projects should be employed to improve process knowledge such as employee interviews, intrusive sampling, and non-destructive assay (NDA) techniques of soil, surface and groundwater, and contaminated equipment and structures. These methods are appropriate for hazard categorization provided they are sufficiently bounding. For example, NDA techniques should fully account for instrument error and intrusive sampling plans should reflect the potential for radioactive material to be distributed unevenly. Some DOE facilities or restoration projects may initially be categorized as a HC-2 or HC-3 based on DOE-STD-1027-92, but subsequently, based on the results of a facility-specific hazard analysis (HA) and final categorization (performed in accordance with the provisions of DOE- STD-1027-92), the facility may be determined by the contractor to be a “Below Hazard Category 3” (or radiological) nuclear facility. 2.1 Final Hazard Categorization Nuclear Safety Technical Position, NSTP-2002-2, Methodology for Final Hazard Categorization of Nuclear Facilities from Category 3 to Radiological, describes an acceptable methodology that may be used as guidance for how a HC-3 facility can be demonstrated to be below HC-3 in final hazard categorization, consistent with DOE-STD-1027-92. The HC-3 threshold values may be revised based on the physical and chemical form and available dispersive energy sources, if the credible release fractions can be shown to be significantly different than the values used in the Environmental Protection Agency (EPA), Technical Background Document to Support Final Rulemaking Pursuant to Section 102 of the Comprehensive Environmental Response, Compensation, and Liability Act: Radionuclides. A facility or activity may be downgraded below HC-3 if inventory is below threshold quantities as modified by these factors (i.e., physical/chemical form of material and available energy sources). Though unlikely; the conditions, parameters, and assumptions that form the basis for the initial hazard category of the facility also need to be evaluated to determine whether the hazard categorization could be increased. ER activities typically involve radioactive or hazardous materials (i.e., hazardous substances, wastes or other constituents) that may be distributed unevenly over a large area. The cumulative DOE-STD-1120-2016 6

total of material inventory will often exceed HC-3 threshold quantities because of the large area being considered. However, waste materials or contamination is buried in the ground at many of these sites and not subject to dispersive forces until exhumed. Additionally, exhumed material may not be readily dispersible due to physical form or the method of extraction. It may also be possible to demonstrate through segmentation that certain intrusive ER activities can not physically exhume sufficient quantities of material at risk to trigger HC-3 threshold values based on a final hazard categorization (material is dispersed, mixed with soils). For intrusive ER activities, segmentation arguments used in final hazard categorizations should consider and account for planned staging or storage of exhumed material that could collocate significant inventory that could be acted upon by a common accident-initiating energy source. It may be a simple matter to qualitatively demonstrate in a final hazard categorization that non-intrusive ER activities (e.g., soil capping) pose no dispersive energy sources. Facilities that are being decommissioned may also have valid arguments for facility hazard categorization downgrades in cases where remaining materials are in the form of surface contamination that is fixed or embedded and non-dispersible based on the planned scope of decommissioning activities. However, potential holdup of radionuclide inventory with process piping or ventilation systems should not be overlooked as potentially significant contributors to inventory quantities. For facilities that have an initial hazard categorization at or above HC-3, the DSA basis and assumptions are required to demonstrate compliance with Part 830, Subpart B. Consistent with the intent of DOE-STD-1027-92, hazard categorization information shall include: (1) the bounding radionuclide inventories at a facility; (2) discussion of any assumptions used in calculating inventories; and (3) a defensible HA associated with a final hazard categorization. Final hazard categorizations that result in a determination of “below Hazard Category 3” based on a HA will require DOE approval in accordance with final hazard categorization determinations described in DOE-STD-1104-2014, Review and Approval of Nuclear Facility Safety Basis and Safety Design Basis Documents, but may be developed and submitted separate from a DSA that may have otherwise been required. 2.2 Inactive Waste Sites Inactive waste sites (IWS) are a special category of facilities that involve radioactive material buried in a soil matrix and not planned to be exhumed for an extended period of time. These facilities are simplistic in nature, and share similar safety features, operational characteristics, and hazard potential. Following the methodology of DOE-STD-1027-92, a final hazard categorization determination has been established that concludes these facilities may be DOE-STD-1120-2016 7 downgraded below HC-31. This determination may be used for facilities meeting the following definitions and criteria: a) An IWS shall be covered with soil or other engineered barrier as required by Resource Conservation and Recovery Act (RCRA) and/or Comprehensive Environmental Response, Conservation, and Liability Act (CERCLA) requirements and subject to physical access control as required by HAZWOPER and 10 C.F.R. Part 835, Occupational Radiation Protection. Hazardous or radioactive material may be in a general soil matrix as a result of liquid discharge or spill, legacy burial grounds, or in areas that contain contaminated equipment, pipes, or other items disposed of at the waste site. Physical features (i.e., soil overburden or engineered cap) shall preclude the introduction of an energy source capable of dispersing the radioactive material.

b) The following items shall not be permitted within an IWS: • Above-ground structures or containers with radioactive inventory, • Below-grade facilities/structures with human access or active provision of services (e.g., electricity, ventilation, steam), including tanks, • Any intrusive activity at the waste site (e.g., waste sampling, waste acceptance or retrieval), • Above-ground remediation activities (e.g., pump and treat facilities), • Evaporation ponds or sludges, • Waste sites that could contain fissile material such that there is a potential for a criticality hazard because of water intrusion or material rearrangement, • Waste sites that could contain explosives, or chemicals that might react with sufficient energy to cause a significant release, • Unvented tanks, unless demonstrated that there is no potential to exceed tank bursting limits from overpressurization. The final hazard categorizations will result in a determination of “below Hazard Category 3” and will require DOE approval in accordance with final hazard categorization determinations described in DOE-STD-1104-2014. Verification that the IWS requirements have been met shall be included in this final hazard categorization determination. 3.0 DSA DEVELOPMENT REQUIREMENTS Although all elements of the DSA preparation are important, three elements—hazard analysis, accident analysis, and hazard control selection—are fundamental, because they 1 See DOE-STD-1120-2005, Vol. 2, Appendix D, Inactive Waste Site Criteria, for additional background. DOE-STD-1120-2016 8 determine the hazard controls needed to provide protection for workers, the public, and the environment. This section provides detailed criteria and guidance for performing these three elements. Hazard analysis and accident analysis are performed to identify specific controls and improvements that feed back into overall safety management. Consequence and likelihood estimates obtained from this process also form the bases for selecting the level of detail and control needed in key elements of specific safety management programs, using a graded approach. The result is documentation of the safety basis that emphasizes the hazard controls needed to maintain safe operation of a facility. 3.1 Hazard Identification and Evaluation The initial analytical effort for all facilities is a hazard analysis that systematically identifies and evaluates facility hazards, potential accidents, and controls. The hazard evaluation focuses on evaluating the complete spectrum of hazards and accidents. This largely qualitative effort forms the basis for the entire safety analysis, including the identification of worker hazard controls and the subset of accidents to be analyzed. Note: DOE’s 10 C.F.R. Part 835 and 10 C.F.R. Part 851 also require DOE contractors to conduct hazard identification and evaluation which may aid analysts in DSA development. 3.1.1 The methodology used for hazard identification shall ensure comprehensive identification of the hazards associated with the full scope of facility processes, associated operations, such as handling of fissionable materials and hazardous waste, and work activities covered by the DSA. The methodology shall include characterization of hazardous materials (radiological and non- radiological) and energy sources, in terms of quantity, form, and location. Commercial industry practices for hazard identification, such as those described in the Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures (Third Edition, Wiley/American Institute of Chemical Engineers, 2008), may be used.

3.1.2 Bounding inventory values of radiological or hazardous materials shall be used, consistent with the maximum quantities of material that are stored and used in facility processes. Inventory data may be obtained from flowsheets, vessel sizes, contamination analyses, maximum historical inventories, and similar sources. Other possible sources of information supporting hazard identification include fire hazard analyses, health and safety plans, job safety analyses, and occurrence reporting histories, and safety basis documents from other sites with pertinent activities or histories. 3.1.3 The hazard evaluation shall provide (a) an assessment of the facility hazards associated with the full scope of planned operations covered by the DSA and (b) the identification of controls that can prevent or mitigate these hazards or hazardous conditions. The hazard evaluation shall analyze normal operations (e.g., startup, facility activities, shutdown, and testing DOE-STD-1120-2016 9 and maintenance configurations) as well as abnormal and accident conditions. In addition to the process-related hazards identified during the hazard identification process, the hazard evaluation shall also address natural phenomena and man-made external events that can affect the facility. 3.1.4 As part of the hazard evaluation, an unmitigated hazard scenario shall be evaluated for each initiating event by assuming the absence of preventive and mitigative controls. Initial conditions may be necessary to define the unmitigated evaluation; further guidance is provided in Section A.3 of Appendix A of DOE-STD-3009-2014. The consequences and the likelihood of the unmitigated hazard scenario shall be estimated (using qualitative and/or semi-quantitative techniques) to address potential effects on facility workers2, co-located workers, and the public (maximally-exposed offsite individuals [MOIs]), consistent with the likelihoods and consequence levels described in Tables 1 and 2 of DOE-STD-3009-2014. 3.1.5 Consequence determinations used for co-located workers in the hazard evaluation shall be supported by an adequate technical basis such as scoping calculations. Alternately, the quantitative evaluation of co-located worker consequences used to compare to DOE-STD-3009- 2014 Table 1 thresholds may be performed in the accident analysis and reported in the DSA. 3.1.6 Risk ranking/binning may be used to support the selection of Design Basis Accidents (DBAs)/ Evaluation Basis Accidents (EBAs) and hazard controls3. If risk ranking/binning is used, the consequence and likelihood thresholds in DOE-STD-3009-2014 Tables 1 and 2 shall be used. 3.1.7 For each of the unmitigated hazard scenarios, the controls (structures, systems, and components [SSCs], administrative and/or programmatic) that can prevent or mitigate the hazard scenario shall be identified. A mitigated hazard evaluation shall be performed to determine the effectiveness of safety significant (SS)4 controls (following the preferred hierarchy as described in Section 3.3 of this Standard) by estimating hazard scenario likelihood with preventive controls and consequences with mitigative controls. 3.1.8 The analysis should include SS controls for hazard scenarios having high estimated chemical consequences to the public, or high radiological or chemical consequences to workers (i.e., as defined by Table 1 of DOE-STD-3009-2014). This information, along with safety

2 See DOE-STD-3009-2014, Section 3.1.3.1, for information regarding qualitative evaluation of facility worker consequences. 3 See DOE-STD-3009-2014 Appendix A, Section A.4 for information on risk ranking/binning. 4 Since unmitigated high or moderate radiological consequences to the public could challenge the Evaluation Guideline and are required by Section 3.2 to be evaluated as Design Basis Accidents, or as representative or unique Evaluation Basis Accidents, a mitigated analysis for the public is optional for the DSA hazard evaluation. DOE-STD-1120-2016 10 functions for these controls, shall be included in the hazard evaluation, unless determined as part of the accident analysis (see Section 3.2). 3.1.9 An inadvertent criticality accident represents a special case for hazard evaluation. The criticality safety program requirements5 are derived from the hazard analysis process established in the American National Standards Institute/American Nuclear Society (ANSI/ANS)-8 series of national standards, which require a documented criticality safety evaluation demonstrating that operations with fissionable material remain subcritical under both normal and credible abnormal conditions (see Appendix A, Section A.5 of DOE-STD-3009-2014 for details). In addition, the DSA hazard evaluation shall include: • Events where consequences (from the criticality itself or subsequent impact to hazardous material) exceed the high radiological consequence thresholds for either the co-located workers or the MOI in Table 1 unless it has been determined that an unmitigated criticality accident is not credible; and, • Situations where an active engineered control(s) is required by the Nuclear Criticality Safety (NCS) analysis to ensure subcriticality. 3.1.10 If the NCS program requires a criticality accident alarm system, then the criticality accident alarm system shall be discussed in the hazard evaluation and carried forward to evaluation in accordance with Section 3.3 of this Standard. 3.2 Accident Analysis Accident analysis entails the formal characterization of a limited subset of accidents, referred to as Design Basis Accidents (DBAs)/Evaluation Basis Accidents (EBAs)6 and the determination of consequences and hazard controls associated with these events. Accident analysis is not necessary for facilities with unmitigated offsite consequences that do not have the potential to challenge the evaluation guideline (EG). Scoping calculations performed during hazard evaluation may be used to show that accident analysis is not needed. For the purpose of identifying safety class (SC) SSCs, estimated consequences to the MOI are compared to the EG. For identification of SS SSCs, an evaluation of co-located worker consequences and offsite chemical consequences is performed as part of either: (1) the hazard evaluation as described in Sections 3.1 of this Standard or (2) the accident analysis addressed in 5 Criticality safety program requirements are established in DOE O 420.1C. This Order states that DOE-STD- 3007-2007, Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Non-Reactor Nuclear Facilities, is the required method for performing criticality safety evaluations, unless DOE approves an alternate method. 6 DOE-STD-3009-2014 Appendix A, Section A.6 discusses the concept of EBAs. DOE-STD-1120-2016 11

this section and compared to the applicable quantitative and qualitative criteria in Section 3.3 for the various categories of affected persons. The need for SS controls to protect the facility worker is determined by the qualitative hazard evaluation discussed in Section 3.1.3.1 of DOE-STD- 3009-2014. 3.2.1 EBAs are derived from the spectrum of hazard scenarios developed in the hazard evaluation. Two types of EBAs shall be defined for further analysis: representative and unique. Representative EBAs bound a number of accidents with a similar control set (e.g., the worst fire, for a number of similar fires). At least one bounding accident from each of the major types determined from the hazard evaluation that have the potential to challenge the EG (fire, explosion, spill, etc.) shall be selected. Unique EBAs are those events that may be bounded by other events but have their own unique control set or other hazard/accident characteristics. 3.2.2 Representative EBAs shall be defined such that: • The control(s) applicable to the EBA are similar and will perform the same function as the controls of the represented hazard scenarios; and • The accident environment associated with the EBA envelopes the environment expected from the represented hazard scenarios. 3.2.3 Both the hazard evaluation and the accident analysis require an unmitigated analysis of the consequences and likelihood of accidents (note: the term “accident” as used in this subsection also includes “hazard scenarios”). An unmitigated consequence analysis shall be performed for plausible operational accident scenarios7, natural phenomena hazards events, and external events. 3.2.4 The unmitigated source term should characterize both the release fractions and the energies driving the release in accordance with the physical realities of the accident phenomena at a given facility, activity, or operation. As a result, some additional assumptions may be necessary in order to define a meaningful accident scenario8, and such assumptions may also affect the magnitude of the resultant consequences. An assumption that an SSC exists does not automatically require SC or SS designation. However, assumptions shall be protected at a level commensurate with their importance. 3.2.5 A mitigated analysis shall be performed to determine the effectiveness of SS and SC controls to protect co-located workers and the public. This analysis should be the same as the unmitigated analysis except that accident likelihood is estimated with preventive controls available, and consequences are estimated with mitigative controls available. 7 See DOE-STD-3009-2014, Section 3.2.1 for further discussion of plausible accidents. 8 Section 3.2.2 of DOE-STD-3009-2014 provides additional guidance for unmitigated analysis assumptions of plausible accident scenarios. DOE-STD-1120-2016 12 3.2.6 Where preventive controls are credited as SS or SC, the DSA shall evaluate the effectiveness of the controls to either eliminate the hazard or terminate the accident and prevent a release of radioactive or other hazardous materials. If hazard elimination or accident termination cannot be accomplished, the effectiveness of the credited controls is evaluated in terms of the overall reduction in the likelihood of the accident.

3.2.7 A mitigated consequence analysis is required if the credited preventive controls do not eliminate the hazard or terminate the accident. This analysis shall demonstrate how SC mitigative SSC(s) and/or specific administrative controls (SACs) reduce consequences below the EG and how SC (if identified) and SS mitigative SSCs and/or SACs reduce co-located worker consequences below 100 rem Total Effective Dose (TED) (i.e., as representative of the co- located worker). In circumstances where no viable control strategy exists in an existing facility to prevent or mitigate the consequence of one or more of the accident scenarios from exceeding the EG, the DSA shall provide the information as described in DOE-STD-3009-2014, Section 3.3.1, Safety Class Controls. 3.2.8 Calculations shall be made based on technically-justified input parameters9 and underlying assumptions such that the overall consequence calculation is conservative. Conservatism is assured by the selection of bounding accident scenarios, the use of a conservative analysis methodology, and the selection of source term and input parameters that are consistent with that methodology. 3.2.9 A χ/Q value of 3.5 x 10-3 sec/m3 shall be used for ground-level radiological or chemical release evaluation at the 100 meter receptor location, unless an alternate onsite χ/Q value is justified. This value may not be appropriate for certain unique situations, such as operations not conducted within a physical structure10. When an alternate value is used, the DSA shall provide a technical basis supporting the need for the alternate value and the value selected. 3.3 Hazard Controls Selection If a SC or SS control is found necessary, all preventive and mitigative controls associated with the sequence of failures that result in a given release scenario are candidates for consideration. Preventive or mitigative controls are selected using a judgment-based process considering a hierarchy of controls that gives preference to passive engineered safety features over active ones; 9 Section 3.2.4 of DOE-STD-3009-2014 provides detailed discussion on the derivation and selection of accident analysis source term and input parameters. 10 Operating Experience Level 3, Atmospheric Dispersion Parameter (χ/Q) for Calculation of Collocated Worker Dose, dated April 2015, and associated technical report, NSRD-2015-TD01, Technical Report for Calculations of Atmospheric Dispersion at Onsite Locations for Department of Energy Nuclear Facilities, conclude that the default χ/Q value may not be appropriate for releases from small facilities (i.e., those with dimensions less than 10 m tall by 36 m wide). http://energy.gov/ehss/downloads/operating-experience-level-3-atmospheric-dispersion-parameter-xq-calculation-co http://energy.gov/ehss/downloads/operating-experience-level-3-atmospheric-dispersion-parameter-xq-calculation-co http://energy.gov/ehss/downloads/nsrd-2015-td01-technical-report-calculations-atmospheric-dispersion-onsite-locations http://energy.gov/ehss/downloads/nsrd-2015-td01-technical-report-calculations-atmospheric-dispersion-onsite-locations DOE-STD-1120-2016 13 engineered safety features over administrative controls or SACs; and preventive over mitigative controls. 3.3.1 When the hierarchy of controls is not used for situations requiring SC/SS controls (e.g., a SAC is selected over an available SSC), the DSA shall provide a technical basis that supports the controls selected.

Following efforts to minimize hazardous materials, this control selection strategy translates into the following hierarchy of controls11, listed from most preferred to least preferred: (1) SSCs that are preventive and passive (2) SSCs that are preventive and active (3) SSCs that are mitigative and passive (4) SSCs that are mitigative and active (5) Administrative controls that are preventive (6) Administrative controls that are mitigative 3.3.2 In some cases, safety-SSCs rely upon supporting SSCs to perform their intended safety function. For new facilities, Attachment 3 of DOE O 420.1C requires that support SSCs be designed as SC or SS SSCs if their failures prevent safety-SSCs or specific administrative controls from performing their safety functions. For existing facilities, support SSCs shall be designated at the same classification (SC or SS) as the safety controls they support, or else compensatory measures shall be established to assure that the supported safety-SSC can perform its safety function when called upon. SSCs whose failure would result in losing the ability to complete an action required by a SAC are similarly identified and designated as SC or SS based on the SAC safety function, or justification provided if not so designated. 3.3.3 If the unmitigated release consequence for a DBA/EBA exceeds the EG, SC controls shall be applied to prevent the accident or mitigate the consequences to below the EG. If unmitigated off-site doses between 5 rem and 25 rem are calculated (i.e., challenging the EG), SC controls should be considered, and the rationale should be described for decisions on whether or not to classify controls as SC. 3.3.4 SS control designation shall be made on the basis of: (1) major contribution to defense- in-depth; (2) protection of the public from release of hazardous chemicals; (3) protection of co- located workers from hazardous chemicals and radioactive materials; and, (4) protection of facility workers from fatality, serious injury, or significant radiological or chemical exposure. 11 An exception to this hierarchy is for confinement of radioactive materials. See Section A.8 in DOE-STD-3009- 2014. DOE-STD-1120-2016 14 3.3.5 SS designation of controls for protection of the public from chemical releases shall be based on a peak 15 minute time-weighted average air concentration, measured at the receptor location that exceeds Protective Action Criteria (PAC) level 2. 3.3.6 For radiation hazards, a conservatively calculated unmitigated dose of 100 rem TED to a receptor located at 100 meters from the point of release shall be used as the threshold for designation of SS controls. The methodology used to determine consequences shall be consistent with that described in Section 3.2. SS designation for protection of co-located workers from chemical releases shall be based on a peak 15 minute time-weighted average air concentration at the receptor location that exceeds PAC-3. 3.3.7 Safety management programs provide an important part of the overall strategy for protecting facility workers. However, SS controls (SSCs or SACs) shall be selected for cases where a fatality, serious injury, or significant radiological or chemical exposure to a facility worker may occur. The term “serious injury” refers to an injury requiring medical treatment for immediately life-threatening or permanently disabling injury such as the loss of an eye or limb. SS controls are not designated solely to address standard industrial hazards (see Section 3.1.3.1 and Appendix A.1 of DOE-STD-3009-2014). Examples of conditions that warrant consideration of SS designation include:

• High concentrations of radioactive or chemically toxic materials in areas where a facility worker could be present; • Explosions or over-pressurizations within process equipment or confinement/containment structures or vessels, where serious injury or death to a facility worker may result from the fragmentation of structures or vessels; and • Unique hazards that could result in asphyxiation or significant chemical/thermal burns. 3.3.8 The Criticality Safety Program ensures that operations remain subcritical under normal and credible abnormal conditions. NCS controls derived in accordance with the DOE-approved NCS Program are required to be implemented in accordance with 10 C.F.R. Part 830, Subpart A, Quality Assurance Requirements, commensurate with the importance of the safety functions performed. Explicit criticality controls required as a result of hazard evaluation criteria established in Section 3.1 shall be documented in the DSA and classified in accordance with requirements of this Section. 3.3.9 If hazard controls are anticipated to be removed or downgraded during the interim operations, step-out criteria shall be documented in the DSA. Unmitigated source terms and consequences should be considered, and supported by the hazard analysis, and accident analysis if necessary, for points in time in which anticipated step-out criteria will apply. The following criteria should be used when determining if it is appropriate to retire a control from the safety basis: DOE-STD-1120-2016 15 • Hazardous condition being controlled is no longer present. • Hazardous substance’s physical form has changed to a less dispersible form. • Hazardous substance quantities are no longer present or have been reduced to the point where the consequences of releases are no longer a concern. 3.4 DSA Format and Content Criteria and guidance for the format and content of each of the chapters in the DSA are provided in this section. The DSA format and content shall address the DSA sections and subsections described below (Sections that are distinct to either decommissioning or ER projects are noted in parenthesis). The DSA may include addenda for short-term evolutions (e.g., activities that may be conducted only once) provided the addenda meet the requirements of this Standard. • DSA [Executive Summary] • DSA [Chapter 1: Introduction] o Rationale for DSA Methodology • DSA [Chapter 2: Facility Description] o Facility and Work Description (Decommissioning) o Restoration Project and Site Description (ER) o Site Location o Systems, Structures, and Components (Decommissioning) o Operational History (Decommissioning) o Site History (ER) o Decommissioning Activities and Techniques (Decommissioning) o Restoration Project Activities and Techniques (ER) • DSA [Chapter 3: Hazard and Accident Analysis and Control Selection] o Hazard Evaluation and Safety Significant Control Selection o Hazard Categorization o Accident Analysis and Safety Class Control Selection o Beyond Design/Evaluation Basis Accident Consideration • DSA [Chapter 4: Safety Structures, Systems and Components] o Safety Class Systems, Structures, and Components  Safety Function, Functional Requirements, System Evaluation, and TSR Requirements o Safety Significant Systems, Structures, and Components  Safety Function, Functional Requirements, System Evaluation, and TSR Requirements o Specific Administrative Controls  Safety Function, Functional Requirements, SAC Evaluation, and TSR Requirements

DOE-STD-1120-2016 16 • DSA [Chapter 5: Derivation of Technical Safety Requirements] o TSR Coverage o Derivation of Facility Modes o TSR Derivation o Design Features • DSA [Chapter 6: Prevention of Inadvertent Criticality] o Criticality Safety Program • DSA [Chapter 7: Safety Management Programs] o Radiation Protection o Fire Protection o Maintenance o Procedures o Training o Conduct of Operations o Quality Assurance o Emergency Preparedness o Waste Management Appendices A and B provide guidance that is explicit to decommissioning and ER activities and should be considered when developing each DSA chapter. 3.5 Disposition Plans The guidance provided in this Standard addresses only the preparation of a DSA for decommissioning and ER activities. In the development of a DSA, it is helpful to understand the process for developing a disposition plan that the DSA will support. It also important that the DSA and disposition plan be consistent in term of the scope of planned decommissioning activities. DOE O 430.1B, Real Property Asset Management (which superseded DOE O 430.1A, Life-Cycle Asset Management) requires the development of a disposition plan along with specifics of what the disposition plan needs to cover. The use of the terms “disposition” and “disposition plan,” refers to activities that follow completion of the facility’s mission including, but not limited to, surveillance and maintenance, the deactivation and decommissioning phases, and long-term stewardship. Guidance that is relevant to the decommissioning phase is provided in DOE G 430.1-4, Decommissioning Implementation Guide, dated 9-2-99. DOE-STD-1120-2016 17 4.0 REFERENCES [1] 10 C.F.R. Part 830, Nuclear Safety Management [2] 10 C.F.R. Part 835, Occupational Radiation Protection [3] 10 C.F.R. Part 851, Worker Safety and Health Program [4] 29 C.F.R. Part 1910, Occupational Safety and Health Standards [5] 29 C.F.R. Part 1926, Safety and Health Regulations for Construction [6] 40 C.F.R. Part 68, Chemical Accident Prevention Provisions [7] DOE O 414.1D, Quality Assurance, April 2011 [8] DOE O 420.1C, Chg. 1, Facility Safety, February 2015 [9] DOE O 430.1B, Chg. 1, Real Property Asset Management, February 2008 [10] DOE O 440.1B, Chg. 2, Worker Protection Program for DOE (Including the National Nuclear Security Administration) Federal Employees, March 2013 [11] DOE G 430.1-2, Implementation Guide for Surveillance and Maintenance during Facility Transition and Disposition, dated 9-29-99 [12] DOE G 430.1-3, Deactivation Implementation Guide, dated 9-29-99 [13] DOE G 430.1-4, Decommissioning Implementation Guide, dated 9-2-99 [14] DOE G 430.1-5, Transition Implementation Guide, dated 4-24-01 [15] DOE G 440.1‐1B, Chg. 1, Worker Safety and Health Program for DOE (including the National Nuclear Security Administration) Federal and Contractor Employees, March 2013 [16] DOE-STD-1020-2012, Natural Phenomena Hazards Analysis and Design Criteria for DOE Facilities, December 2012 [17] DOE-STD-1027-92, Chg. 1, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, September 1997DOE-STD-1104-2014, Review and Approval of Nuclear Facility Safety Basis and Safety Design Basis Documents, December 2014 [18] DOE-STD-1120-2005, Integration of Environment, Safety and Health into Facility Disposition Activities, Volumes 1 and 2, April 2005 [19] DOE-STD-1186-2004, Specific Administrative Controls, August 2004

[20] DOE-STD-1189-2008, Integration of Safety into the Design Process, March 2008 [21] DOE-STD-3007-2007, Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Nonreactor Nuclear Facilities, February 2007 http://www.ecfr.gov/cgi-bin/text-idx?SID=a30696673e0c7c5091301f1fd49a469c&mc=true&tpl=/ecfrbrowse/Title10/10cfr830_main_02.tpl http://www.ecfr.gov/cgi-bin/text-idx?SID=a30696673e0c7c5091301f1fd49a469c&mc=true&tpl=/ecfrbrowse/Title10/10cfr835_main_02.tpl http://www.ecfr.gov/cgi-bin/text-idx?SID=a30696673e0c7c5091301f1fd49a469c&mc=true&tpl=/ecfrbrowse/Title10/10cfr851_main_02.tpl http://www.ecfr.gov/cgi-bin/text-idx?SID=a30696673e0c7c5091301f1fd49a469c&mc=true&tpl=/ecfrbrowse/Title29/29cfr1910b_main_02.tpl http://www.ecfr.gov/cgi-bin/text-idx?SID=a30696673e0c7c5091301f1fd49a469c&mc=true&tpl=/ecfrbrowse/Title29/29cfr1926_main_02.tpl http://www.ecfr.gov/cgi-bin/text-idx?SID=a30696673e0c7c5091301f1fd49a469c&mc=true&tpl=/ecfrbrowse/Title40/40cfr68_main_02.tpl https://www.directives.doe.gov/directives-documents/400-series/0414.1-BOrder-d-admchg1 https://www.directives.doe.gov/directives-documents/400-series/0420.1-BOrder-C-chg1 https://www.directives.doe.gov/directives-documents/400-series/0430.01-BOrder-b-chg2 https://www.directives.doe.gov/directives-documents/400-series/0440.1-BOrder-b-chg2 https://www.directives.doe.gov/directives-documents/400-series/0430.1-EGuide-2 https://www.directives.doe.gov/directives-documents/400-series/0430.1-EGuide-3 https://www.directives.doe.gov/directives-documents/400-series/0430.1-EGuide-4 https://www.directives.doe.gov/directives-documents/400-series/0430.1-EGuide-5 https://www.directives.doe.gov/directives-documents/400-series/0440.1-EGuide-1B-admchg1 http://energy.gov/ehss/downloads/doe-std-1020-2012 http://energy.gov/ehss/downloads/doe-std-1027-92 http://energy.gov/ehss/downloads/doe-std-1120-2005 http://energy.gov/ehss/downloads/doe-std-1186-2004 http://energy.gov/ehss/downloads/doe-std-1189-2008 http://energy.gov/ehss/downloads/doe-std-3007-2007 DOE-STD-1120-2016 18 [22] DOE-STD-3009-94, Change Notice NO.3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, March 2006 [23] DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, November 2014 [24] DOE-STD-3011-2016, Preparation of Documented Safety Analysis for Interim Operations at DOE Nuclear Facilities, January 2016 [25] DOE-STD-3014-2006, Accident Analysis for Aircraft Crash into Hazardous Facilities, May 2006 [26] DOE-HDBK-1163-2003, Integration of Multiple Hazard Analysis Requirements and Activities, October 2003 [27] Nuclear Safety Technical Position, NSTP-2002-2, Methodology for Final Hazard Categorization of Nuclear Facilities from Category 3 to Radiological, November 2002 [28] Technical Background Document to Support Final Rulemaking Pursuant to Section 102 of the Comprehensive Environmental Response, Compensation, and Liability Act: Radionuclides, U.S. Environmental Protection Agency, February 1989 [29] Guidelines for Hazard Evaluation Procedures, Center for Chemical Process Safety, Third Edition, Wiley/American Institute of Chemical Engineers, 2008 [30] Memorandum from Roberson, Hazard Categorization of EM Inactive Waste Sites as Less Than Hazard Category 3, September 17, 2002 [31] Operating Experience Level 3, Atmospheric Dispersion Parameter (χ/Q) for Calculation of Collocated Worker Dose, April 2015

[32] NSRD-2015-TD01, Technical Report for Calculations of Atmospheric Dispersion at Onsite Locations for Department of Energy Nuclear Facilities, April 2015 http://energy.gov/ehss/downloads/doe-std-3009-94 http://energy.gov/ehss/downloads/doe-std-3009-2014 http://energy.gov/ehss/downloads/doe-std-3011-2016 http://energy.gov/ehss/downloads/doe-std-3014-2006 http://energy.gov/ehss/downloads/doe-hdbk-1163-2003 http://energy.gov/ehss/downloads/technical-position-nstp-2002-2 http://energy.gov/ehss/downloads/operating-experience-level-3-atmospheric-dispersion-parameter-xq-calculation-co http://energy.gov/ehss/downloads/nsrd-2015-td01-technical-report-calculations-atmospheric-dispersion-onsite-locations DOE-STD-1120-2016 A-1 APPENDIX A: GUIDANCE FOR DECOMMISSIONING ACTIVITIES As described in Table 2 of Appendix A to 10 C.F.R. Part 830, Subpart B, contractors may prepare a DSA for facilities being decommissioned by using the method described in DOE-STD- 1120-98, or successor document, and the provisions of 29 C.F.R. Part 1910.120 or 29 C.F.R. Part 1926.65, Hazardous Waste Operations and Emergency Response (HAZWOPER) without obtaining DOE approval for use of that methodology. Derivation of controls is also necessary for facility decommissioning projects that involve more than “low level residual fixed radioactivity.” As explained in Section 1.3 of this Standard, the DSA is not expected to address the full scope of standard industrial hazards and controls typically covered by 10 C.F.R. Part 851 and HAZWOPER. An acceptable DSA format and content that meets the requirements of 10 C.F.R. § 830.204 and the provisions described in Table 2 of Appendix A to 10 C.F.R. Part 830, Subpart B is described according to the sections given below. While these topics may be described in a HAZWOPER health and safety plan, it is recommended that information be presented in a separately prepared DSA, providing a clearer distinction of facility safety basis information that is subject to the Unreviewed Safety Question (USQ) process. Decommissioning projects that have only low level residual fixed radioactivity are not expected to have the potential for accidents involving significant radiological consequences. This is reflected in 10 C.F.R. § 830.205(c), which states that Technical Safety Requirements (TSRs) are not required for this type of activity. The DSA format for this type of decommissioning activity may exclude topics related to accident analysis, safety SSCs and TSR derivation, unless such controls are warranted because of significant consequences. A.1 Facility Description A.1.1 Faci l i ty and Work Description A description of the facility and the decommissioning work activities should be presented to the extent needed to facilitate an understanding of the HA. Some of this information will be available in DSAs prepared during previous operational phases of the facility. It is important that this section of the DSA be consistent with information presented in Decommissioning Plans. DOE O 430.1B, Real Property Asset Management, requires a project plan for each distinct phase of facility disposition (i.e., Deactivation Plan, S&M Plan, and Decommissioning Plan) prior to the execution of work. The purpose of these plans is to describe the work that will be performed and the methods that will be used to accomplish it. An obvious characteristic of a decommissioning project is that the facility state changes progressively as work proceeds. For this reason, it is important that the facility state to which a DSA applies is clearly defined and

DOE-STD-1120-2016 A-2 articulated in the DSA, and that the scope of planned activities is consistent with the Decommissioning Plan. A Decommissioning Plan defines such matters as decommissioning strategy, sequence of decommissioning tasks and the scope of work at each phase, as these are the key inputs that the safety analyst needs from the project so that representative analyses can be carried out. It is also important that the Decommissioning Plan and the DSA be consistent, so any changes to work plans as defined in the Decommissioning Plan may be considered for potential impacts to the DSA. A.1.2 Site Location The location of the facility and its relationship to nearby structures is important data for understanding potential on or off-site impacts from decommissioning operations. Nearby facilities, structures and buildings in which there may be persons or equipment that could be affected by events occurring during the decommissioning project, and their physical relationship to the facility being decommissioned, should be listed. The locations of potentially affected members of the public near the site should also be given. Transportation routes for equipment and materials, both off-site and within the site, should also be described. Analytical data that is used for atmospheric dispersion of airborne releases including meteorological data and distances and directions to potential receptors may be simplified within the DSA commensurate with the level of rigor necessary in the hazard and accident analysis. A.1.3 Systems, Structures and Components Description A description of SSCs which are being decommissioned, including a description of buried structures that will be remediated should be presented. This information should include the existing configuration and interdependencies of SSCs, and in particular any degradation or other changes that may have occurred relative to the original design. A description of new or temporary SSCs which may be needed to prevent or contain the spread of radioactive or hazardous materials during decommissioning should also be provided. Interdependencies among SSCs should be described to the extent they will be affected by the decommissioning, and to the extent necessary to facilitate an adequate understanding of the HA. Equipment being dismantled may be structurally linked to safety SSCs that are not planned for retirement until a subsequent phase of decommissioning. The means by which integrity of the remaining structures will be assured should be described. To the extent possible at the time of DSA preparation, it is important that SSC changes anticipated during the course of the decommissioning project be described in the DSA to reduce DOE-STD-1120-2016 A-3 the potential activities that would need to be separately evaluated in accordance with the USQ process. Additionally, the timing of SSC changes within the overall project work scope should be stated to support proposed rationales for retiring hazard controls. A.1.4 Operational History Information from the operational history of the facility, which is important in understanding the hazards and state of SSCs should be described. Information on previous modifications to the design that may have an impact on the safety of decommissioning should be presented. Operational information about previous facility processes and the location of radioactive contamination, both as a result of normal operation and resulting from incidents or accidents, should be also presented.

A.1.5 Decommissioning Activit ies and Techniques Since the decommissioning activities themselves, by their nature, can be a source of accident initiators, decommissioning equipment and processes should be described to the extent necessary to support the HA and control selection. This description should include the major phases of decommissioning including the removal of remaining hazardous material inventory; the removal of fixed contamination from surfaces and equipment; dismantling of systems and equipment; demolition of major structures or other defined end-states for the facility. Where sequencing of these activities is important, this information should also be presented. Decommissioning techniques that are planned should also be described. The requirements for power, cooling water, and other external supplies to the equipment used to carry out these techniques should be documented. Hazardous chemicals, heat or ignition sources, combustible or flammable materials, or other types of hazards that could be introduced in the facility as a result of the chosen decommissioning techniques should be described. The expected quantities and location of radioactive, hazardous and mixed wastes expected to be generated during the decommissioning process should be described. Any temporary storage of generated or packaged waste should also be described. These activities may require additional hazard analyses and controls, as well as special permitting. A.2 Hazard and Accident Analysis and Control Selection Overall, this section of the DSA should present the methodology used to identify and evaluate hazards, as well as the results of these efforts. The hazard and accident analysis approaches described in Sections 3.1 and 3.2 of DOE-STD-3009-2014 should be applied to decommissioning operations, with additional clarifications noted in the following subsections below. DOE-STD-1120-2016 A-4 A.2.1 Methodology A.2.1.1 Hazard Identification This subsection of the DSA should identify the method used by analysts to identify hazardous material inventories and energy sources that could initiate or contribute to a potential release of hazardous substances, hazardous waste or radiological materials. The dynamic nature of decommissioning and potential for unknown hazards requires a thorough identification of hazards. Consideration should be given to the remaining hazardous materials (e.g. material quantity, form, and location) and energy sources that exist or will be introduced as a result of decommissioning activities. New fire ignition sources or flammable materials, as well as the potential accumulation of combustible wastes are all hazards that can be introduced or worsened because of decommissioning activities. Hazards related to the physical state and degradation of SSCs should also be identified. As an example, the scabbling of degraded concrete structures could decrease structural stability and increase the risk of failing a material confinement barrier. Hazardous material inventory and facility design information (e.g., drawings, design criteria, instrumentation diagrams) may be unavailable or in poor condition at some existing facilities being decommissioned. This will necessitate the use of “process knowledge” and/or intrusive or non-intrusive characterization, depending on the level of hazards information needed to support a defensible analysis. The following activities should be conducted and described in the DSA to support a thorough identification of hazards:

• Assess existing facility status and hazards information by collecting and reviewing facility operating records and existing safety analysis information for previous phases of facility operation (e.g., DSAs, Safety Analysis Reports, Fire Hazards Analysis). • Interview past and present employees, to the extent available, regarding facility operating history (e.g., location of hazardous materials and previous spills or releases). • Assess existing facility conditions and identify inherent hazards by performing a facility walkdown using a multidisciplined team that includes appropriate subject matter experts. • Review of applicable lessons learned reports and DOE Occurrence Reporting and Processing System database events for the facility, as well as for similar facilities. The need for intrusive characterization activities (e.g., sampling and analysis) should be determined based on the collection and evaluation of facility information, the remaining level of uncertainty regarding existing hazardous substances (i.e., radiological materials, hazardous chemicals, or hazardous wastes), and the existing facility condition. Consider characterization activities if there is insufficient knowledge of hazards to understand the hazardous substance types, quantities, forms, potential exposures, and locations. DOE-STD-1120-2016 A-5 Hazard identification data, and its subsequent use in the facility hazard categorization and analysis, may rely on various characterization results provided that data is sufficiently bounding. For example, non-destructive examination techniques should fully account for instrument error when used to estimate material inventory and intrusive sampling plans should reflect the potential for radioactive material to be distributed unevenly. A.2.1.2 Hazard Evaluation The hazard evaluation should be consistent with the types and anticipated progression of decommissioning activities. For example, if dispersible radioactive materials are scheduled to be removed prior to initiation of dismantling activities involving plasma torches, then associated fire hazards may present a potential accident initiator until radioactive materials are removed from the building or system. Thus, hazard and accident analysis information should be consistent with the anticipated types and sequences of decommissioning activities discussed in Chapter 2 of the DSA. A.2.2 Hazard Analysis Results The results of hazard identification and evaluation efforts should be presented in this section of the DSA. In general, existing DSAs that were prepared for a previous phase of a facility’s life cycle are a good source of hazard identification and evaluation information. Analysts should consider this information for applicability to decommissioning. Fire hazards analyzed for previous operational phases can be increased during decommissioning because of intrusive activities and from equipment, chemicals and techniques introduced during the decommissioning project. This may increase worker hazards and require more robust fire protection measures than needed during a facility’s operational phase. Hazards such as natural phenomena will have similar applicability during decommissioning and should be retained for analysis. Hazard and accident analysis information from previous facility operations is appropriate for inclusion into decommissioning DSAs (NOTE: Decommissioning may introduce new hazards and energy sources).

The facility-level HA supports the safety basis for decommissioning operations and provides an envelope against which day-to-day work planning and associated task level analysis are measured. Consistent with DOE-STD-3009, the level of analysis is driven by the simplicity of operations and hazard potential. Qualitative analysis will typically suffice for the majority of decommissioning projects, because operations have been deactivated and hazardous material inventory has been reduced. A decommissioning HA should consider the type of decommissioning activities, as well as work techniques and sequencing of activities to be employed. The HA should also be forward looking DOE-STD-1120-2016 A-6 to capture the expected decommissioning activities and anticipated facility changes. This includes anticipated changes in control designation as the project proceeds. Retiring safety SSCs or eliminating SACs should be at the appropriate point when material inventory or hazardous conditions no longer exist. The HA should support these decisions. There may be cases when hazardous material inventories could be made more dispersible during decommissioning, thereby requiring new and/or temporary safety SSCs not originally identified during the initiation of decommissioning. An example of this is the decontamination of a piece of equipment (e.g., glovebox or furnace) at a facility located close to a site boundary with fixed Pu-238 contamination. During the decontamination activities, the system may be breached and mechanical means may be used to remove or reduce the contamination to levels that allow for disposal of the equipment. Such decontamination activities may result in the potential increase of dispersible material that could be released, even potentially challenging the Evaluation Guideline (EG) of DOE-STD-3009-2014. Therefore, designating temporary ventilation as safety SSC may be necessary until the hazard is no longer present. Facilities entering into a decommissioning phase typically have performed an evaluation of natural phenomena hazards (NPH) based on a previous 10 C.F.R. Part 830, Subpart B, compliant DSA. These evaluations can be utilized in the decommissioning DSA unless significant structural or equipment modifications are planned that invalidate the conclusions in the previous DSA (e.g., seismic response is affected by reduction in structural load capacity). Additionally, decommissioning may introduce activities that were not addressed in the previous DSA. The impact of any new activities on the existing NPH evaluation should also be considered when determining if the existing evaluation is adequate for decommissioning operations. Where such an evaluation does not exist or is less than adequate, conservative assumptions can be made in the decommissioning DSA without the need for further NPH analysis. Any NPH evaluation performed in support of decommissioning should be inclusive of all applicable natural phenomena to allow DOE to understand potential consequences to workers, the public, and environment. Typically, very qualitative evaluations will be sufficient, given that facilities undergoing decommissioning have a short remaining life when compared to the facility’s operational phase, and material at risk is being constantly reduced with a resultant reduction in consequences from postulated NPH accident events. For instance, in a seismic scenario, a worst case assumption that the building will collapse may be made in lieu of detailed seismic response calculations. In this case, the consequences of the building collapse may be acceptable to DOE, provided appropriate controls such as emergency plans/procedures are clearly understood and referenced in the DSA. The facility undergoing decommissioning will still be required to meet 29 C.F.R. Part 1926 to protect life safety during work activities that require habitation of the facility, but will not be required to meet the performance criteria indicated by DOE-STD-1020-2012, Natural Phenomena Hazards Analysis and Design Criteria

DOE-STD-1120-2016 A-7 for DOE Facilities. Other external low probability, high consequence events (e.g., aircraft crash) may be treated similar to NPH events as described above (i.e., use of previous analysis, qualitative evaluation, etc.). Some external events may present a higher probability of occurrence during decommissioning such as external vehicle impacts as a result of heavy equipment, or increased waste transportation activities. During decommissioning activities within a facility, administrative processes and safety management programs normally are of utmost importance for protecting workers from hazards. However, there are times when active and passive safety SSCs are necessary until certain hazards are eliminated. An example of such an SSC would be the criticality accident alarm system at facilities that still have fissile material present in sufficient quantities that a criticality hazard exists. A priority should be placed on expediently reducing the hazards and risks to the point where safety SSCs are no longer required. Consideration should also be given to establishing post- NPH event procedures that ensure the Safety SSC is still capable of performing its’ safety function following NPH events that may be of lesser magnitude and higher frequency than DBAs. A.2.3 Accident Analysis The vast majority of decommissioning projects are not expected to require detailed analysis and quantification of accidents, given the magnitude of remaining radionuclide inventory and associated consequences (i.e., typically well below the Evaluation Guideline). However, for those HC2 facilities undergoing decommissioning that have potential scenarios with consequences that could challenge or exceed the EG, an accident analysis is required with explicit calculations for both the source term and consequences sections in accordance with Section 3.2 of this Standard (and DOE-STD-3009-2014, as necessary). Unmitigated source terms and consequences should also be considered for points in time in which anticipated step- out conditions will apply. These step-out conditions could involve changes in material forms that are likely to be present during the decommissioning activity. This can then serve as the bases for the change in safety control designation or elimination of controls. A.3 Safety Structures, Systems and Components A summary of the controls that require TSR coverage based on the hazard/accident analysis results is required to be presented according to the type of control being established (safety SSC, SAC, or safety management program). Controls should be linked to specific hazards and accidents identified in the DSA and considerate of the spectrum of activities anticipated during DOE-STD-1120-2016 A-8 the entire decommissioning project. Specific administrative controls should be established, as necessary, in accordance with DOE-STD-1186, Specific Administrative Controls.

The control hierarchy presented in Section 3.3.1 should be followed for decommissioning (as appropriate based on deconstruction activities), which gives priority to engineered safety features over administrative controls, and preventive over mitigative controls. In some cases, decommissioning activities may benefit from the use of temporary SSCs because existing systems may not be reliable or the nature of decommissioning may involve some physical alterations of the existing systems. The use of functional criteria may be appropriate, rather than providing detailed design requirements and system descriptions for specific SSCs. This will facilitate accomplishment of the safety function using either a permanent or temporary SSC where necessary to support certain decommissioning actions. For example, a concrete vault (i.e., design feature) that provides shielding to workers from radiation may require penetrations during decommissioning to remove equipment. Temporary shielding may be used during these operations and still provide adequate worker protection in accordance with 10 C.F.R. Part 835. As another example, active ventilation may only require protection of the differential pressure and filter efficiency parameters. The number of fans required to provide the requisite pressure differential will change as individual glovebox loads are removed. In this case, the TSR targets the function, maintaining differential pressure, rather than specifying the number of fans and interlocks. There will be some balancing required to determine when engineered controls can be replaced or supplemented by administrative controls. For example, a fire suppression system that has not been maintained per code may not have sufficient reliability and therefore may not be an adequate safety basis control without considerable upgrades to the system. It may be appropriate to replace or supplement this control with certain administrative controls such as combustible material limits or ignition source controls. These decisions should consider factors such as system availability and reliability and the effectiveness of selected administrative controls. The final control strategy should maintain a level of defense in depth such that no single layer is relied on to prevent or mitigate significant hazards that warrant safety controls. By the very nature of decommissioning, facility equipment and systems will be removed. It is expected that there will be less reliance on safety systems and other TSR controls as the project progresses and as hazardous substances are reduced. For example, the operational limits imposed on a SSC to prevent a release of hazardous substance are no longer valid if the material has been removed. Care should be taken to ensure that hazard controls are not retired prematurely or that administrative controls are selected in lieu of available, functioning engineered safety features. Trigger points, or the criteria that allow step-out of a control should be supported by the HA and DOE-STD-1120-2016 A-9 described in the DSA. The criteria in Section 3.3.9 should be used when determining if it is appropriate to retire a control from the safety basis. Stepping out of a control does not necessarily mean that the control may be de-energized, as it still may be needed to satisfy life safety or emergency response requirements. It simply means that a control may be retired from the safety basis without formally revising the DSA and TSR and re-submitting for DOE approval. The use of this process should include pre-negotiated step- out criteria that are reviewed and approved by DOE during the DSA/TSR review process.

Once step-out criteria are satisfied, contractor verification of the condition and DOE notification is necessary to allow the contractor to retire the control. When using this approach, the TSR should: (1) use explicit TSR definitions that define terms and conditions used in retiring controls; (2) incorporate step-out conditions into Limiting Conditions of Operation applicability statements; (3) provide administrative controls that formalize the process for stepping out of a control, as well as further safety measures necessary once a control is retired; and (4) provide TSR Bases that support the established points for stepping out of controls. There may be unanticipated situations in which a retired facility safety control is needed to perform its past safety function. For example, if unknown dispersible radiological materials are discovered during the course of a decommissioning activity, it may be necessary to reactivate the building ventilation system to provide a confinement function. In these cases, the operability, maintainability, reliability, and availability of the reactivated control should be verified prior to placing the control back into service. A.4 Derivation of Technical Safety Requirements The derivation of controls within the DSA should be consistent with expectations provided in Section 4 of DOE-STD-3009-2014 for Chapter 5 of a DSA. This applies to the entire suite of TSR controls, including specific administrative controls. This information may be integrated together with the presentation and description of controls as described in the DSA. For example, the derivational basis for specific administrative controls may consist of brief logic statements that can be presented in tabular form alongside the listing of such controls. Where specific administrative controls are selected in lieu or support of an engineered feature, the derivational basis should justify why administrative controls by themselves or in combination with other systems provide adequate protection against the accident consequences. For example, certain administrative controls such as combustible material limits or ignition source controls may be necessary to supplement an existing fire sprinkler system that is unreliable. In this case, derivation of the administrative control should include discussion of the specific reliability issues associated with the sprinkler system and justify how the selected administrative controls ensure adequate protection against fire hazards. DOE-STD-1120-2016 A-10 A.5 Safety Management Programs A listing of safety management programs (SMPs) and any references to site-wide programs and facility-specific characteristics may be presented in summary or table form, consistent with provisions in DOE-STD-3009-2014. SMPs that are required to be considered based on applicability are provided in items 5 and 6 of 10 C.F.R. § 830.204 (b). At a minimum, Table 2 in Appendix A of 10 C.F.R. Part 830, Subpart B, requires that facility decommissioning address emergency preparedness, if the listed safe harbor is used for DSA development without obtaining DOE approval for use of an alternate methodology. Similarly, decommissioning activities with only low-level residual fixed radioactivity would typically address at least emergency preparedness, conduct of operations, training and qualification, and maintenance management. DOE-STD-1120-2016 B-1 APPENDIX B: GUIDANCE FOR ENVIRONMENTAL RESTORATION ACTIVITIES

Environmental restoration activities that are not performed within permanent structures are subject to the requirements of 10 C.F.R. Part 830, Subpart B. It is anticipated that many of these activities, especially non-intrusive ER, may not present significant nuclear or chemical risks to workers or members of the public. Chapter 3 of this Standard is applicable to the small subset of ER projects that require a DSA, based on the results of a final hazard categorization performed in accordance DOE-STD-1027-92 and provisions described in Chapter 2 of this Standard. As described in 10 C.F.R. Part 830, Subpart B, Appendix A, Table 2, contractors may prepare a DSA by using the method described in DOE-STD-1120-98, or successor document, and the provisions of 29 C.F.R. Part 1910.120 or 29 C.F.R. Part 1926.65, Hazardous Waste Operations and Emergency Response (HAZWOPER). As explained in Section 1.3 of this Standard, the DSA is not expected to address the full scope of standard industrial hazards and controls typically covered by 10 C.F.R. Part 851 and HAZWOPER. An acceptable DSA format and content that meets the requirements of 10 C.F.R. § 830.204 and the provisions described in Table 2 of Appendix A to 10 C.F.R. Part 830, Subpart B, is provide in Section 3.4 of this Standard. While these topics may be described in a HAZWOPER health and safety plan, Section 3.4 requires that information be presented in a separately prepared DSA, providing a clearer distinction of facility safety basis information that is subject the Unreviewed Safety Question process. B.1 Facility Description B.1.1 Restoration Project and Site Description Background information on the ER site and planned restoration-related activities should be presented to the extent necessary to facilitate an understanding of the HA. It is important that this section of the DSA be consistent with the scope of planned activities as agreed upon with federal and authorized State environmental regulators. B.1.2 Site Location The location of the facility and its relationship to nearby structures is important data for understanding potential on-site or off-site impacts from ER operations. Nearby facilities, structures and buildings in which there may be persons or equipment that could be affected by events occurring during the ER project, and their physical relationship to the facility being decommissioned, should be listed. The locations of potentially affected members of the public near the site should also be given. Transportation routes for equipment and materials, both off- DOE-STD-1120-2016 B-2 site and within the site, should also be described. Analytical data that is used for atmospheric dispersion of airborne releases including meteorological data and distances and directions to potential receptors may be simplified within the DSA commensurate with the level of rigor necessary in the hazard and accident analysis. B.1.3 Site History Background information should be presented on activities that led to the condition requiring restoration. Previous waste disposal activities should be described in terms of the types and quantities of radioactive and hazardous materials and methods used for treatment and disposal (i.e., container burial, seepage ponds, direct injection). Other details that are important to the analysis include the estimated condition of any waste containers being exhumed, design details of disposal trenches or wells that were used, characterization and sampling activities performed and the resulting estimated contamination levels that are expected.

B.1.4 Restoration Project Activit ies and Techniques The scope of the restoration activity should be presented in sufficient detail that is commensurate with the expected hazards and complexity of the project. The description should include the regulatory driver for restoration, planned characterization activities, primary operational phases that comprise the project, any work sequencing requirements and parallel work activities, and the anticipated final state upon completion of the restoration activity. Temporary or permanent SSCs that are part of the project should also be presented. Restoration techniques should also be described, including the requirements for power, cooling water and other external supplies to the equipment used to carry out activities. Soil restoration techniques generally fall into one of four categories: • Soil Capping and Ground Penetrations to Support Monitoring Activities – installation of soil capping and/or minor intrusive activity into the waste matrix for monitoring the effectiveness of an environmental cap, e.g., ground water wells, piezometer well installation, or some other means of environmental effectiveness measurement. • Waste Stabilization (e.g., grout injection) in soil – waste matrix stabilization where the form of the matrix is modified to a less dispersible form through the addition of grout or similar stabilizing material • Waste Exhumation and Elimination (retrieval and shipment to a different location for processing, treatment, storage and/or final disposal) – eliminates the retrieved waste from the restoration site inventory. DOE-STD-1120-2016 B-3 • Ground or Surface Water Restoration (collection and/or treatment of contaminated soil, surface and ground water)-activities and processes that clean-up existing contaminants from industrial or waste management sources or minimize the spread of contaminants resulting from releases of hazardous waste, hazardous constituents, or radiological contaminants to surface and/or ground water, and soils. There is also the possibility to have combinations of these restoration approaches, which can add to the complexity of the activity. B.2 Hazard and Accident Analysis and Control Selection Overall, this section of the DSA should present the methodology used to identify and evaluate hazards, as well as the results of these efforts. The hazard and accident analysis approach presented in DOE-STD-3009-2014, Chapter 3, should be applied to ER projects with additional clarifications provided in the following subsections below. B.2.1 Hazard Identif ication This subsection of the DSA should identify the methods used by analysts to identify hazardous material inventories and energy sources that could initiate or contribute to accidents impacting workers, the public or environment. Identifying the hazards is an output from the work/scope description. The identified hazards will be used in the Hazard Categorization and also in the Hazard Evaluation that develops the hazard controls applicable to the project. Hazard constituents include radionuclides, chemical substances (hazardous, toxic, reactive or flammable elements, compounds, and or mixtures), and energy sources (chemical, mass/motion, fire ignition sources radiant, thermal, radiation/radiolysis, etc.). Consideration of fire hazards should include intrinsic hazards associated with remaining hazardous or radioactive inventory, as well as those introduced by equipment and techniques used in the process. Hazardous constituents and sources need to be identified early in the safety basis process. Depending on the availability of process and/or historical data and the confidence in that data, there may need to be an early phase of investigation/sampling to develop a hazard inventory/energy listing that will bound and represent all activities to be conducted in the various phases of the restoration.

Hazardous material inventory data may be unavailable or incomplete for many restoration projects. This will necessitate intrusive or non-intrusive characterization, depending on the level of hazards information available to support a defensible analysis. The need for intrusive characterization activities (e.g., sampling and analysis) should be determined based on the collection and evaluation of facility information, the remaining level of uncertainty regarding existing hazardous substances (i.e., radiological materials, hazardous chemicals, or hazardous wastes), and the existing facility condition. Consider characterization activities if there is insufficient knowledge of hazards to understand the hazardous substance types, quantities, forms, DOE-STD-1120-2016 B-4 potential exposures, and locations. B.2.2 Hazard Analysis The results of the hazard and accident analysis should present the accident events and initiators considered, estimated frequencies, unmitigated consequences and preventive/mitigative controls that are considered and credited. DOE-STD-3009-2014 provides example approaches for tabulating and presenting this information. Generally, the controls needed for ER activities can be derived from qualitative hazard evaluation techniques such as what-if analysis or hazard checklists. The hazard evaluation provides the input and basis to support control selection. HA results should be documented in a hazard evaluation table that qualitatively shows the candidate controls as well as those specifically credited. This complete listing of candidate and credited controls helps clarify what was considered in the hazard evaluation. NPH and man-made external hazards are required to be considered in accordance with 10 C.F.R. Part 830, Subpart B. Seismic hazards will not typically present a significant concern for restoration projects, unless buildings and structures are involved in processing or storing hazardous materials. Therefore, an evaluation of the impacts from seismic hazards may be a simple matter. Other NPH such as high winds, floods and lightning can be problematic for some ER projects which may not have protective barriers or facilities (i.e., open trenches with non- containerized combustible wastes). These events should be considered in the HA, as applicable. Certain man-made external events can also be problematic for ER projects due to factors such as a high frequency of waste transports. For example, an external vehicle impact and subsequent fire associated with staged or stored waste drums generated during ER should be evaluated. Aircraft crashes may also be considered in accordance with DOE-STD-3014, Accident Analysis for Aircraft Crash into Hazardous Facilities, which has applicability to HC-1 or HC-2 facilities, as well as those projects where hazardous chemical inventory exceeds thresholds of 29 C.F.R. Part 1910.119 or 40 C.F.R. Part 68, Chemical Accident Prevention Provisions. The presentation of hazard and accident analysis information should be consistent with the types and anticipated progression of ER activities. Hazards from typical restoration activities that should be considered include: • Setup and mobilization needs to consider siting and accumulation of combustibles (fueling operations for equipment) or other fire hazards that could have an impact on subsequent phases of restoration. • Equipment operation may cause subsidence or compaction that creates a shift in DOE-STD-1120-2016 B-5

packaged wastes (if present). • Monitoring well installation may create a pathway for release or re-distribution of packaged wastes (e.g., penetration of waste package and redistribution of reactive chemical to create an exothermic condition). • Trenching activities for diversion of surface water runoff could introduce a new pathway for impacting or relocating the waste matrix. • Exhumation (digging) operations could introduce dispersible energy for buried wastes or soil contamination. • Combustible fluids from operating, maintaining, or refueling equipment in proximity to exposed wastes, as well as fire hazards from equipment itself, could introduce fire hazards. • Packaging, repackaging, overpacking and waste staging/stacking could create potential for spills, accumulation/concentration of reactive materials or hazardous substances, waste or constituents, or re-distribution of fissile materials. • Movement/loading of waste materials introduces potential for vehicle accidents. • Inventories or high energy sources added by the restoration activity (e.g., any process chemicals, packing or fill material, or quantities of combustibles). B.2.3 Accident Analysis The vast majority of ER projects are not expected to require detailed analysis and quantification of accidents given the expected magnitude of radionuclide inventory and associated consequences (i.e., well below the EG). However, for HC-2 facilities that have potential scenarios with consequences that could challenge or exceed the EG, the accident analysis needs to present explicit calculations for both the source term and consequences sections (i.e., in accordance with Sections 3.2 of this Standard and DOE-STD-3009-2014, as necessary). Unmitigated source terms and consequences should also be considered for points in time in which anticipated step-out criteria will apply. These step-out criteria could be decreased hazardous materials inventories and/or changes in material forms that are likely to be present during the restoration activity. This can then serve as the bases for the change in safety control designation or elimination of controls. B.3 Safety Systems, Structures and Components As provided in 10 C.F.R. § 830.205(c), “A contractor for an environmental restoration activity may follow [HAZWOPER provisions] to develop the appropriate hazard controls (rather than the provisions for technical safety requirements in paragraph (a) of [10 C.F.R. § 830.205]), provided the activity involves either: (1) Work not done within a permanent structure, or (2) The DOE-STD-1120-2016 B-6 decommissioning of a facility with only low-level residual fixed radioactivity.”12 This is consistent with the philosophy that ER activities are typically not expected to involve hazards that will necessitate active safety SSCs and associated TSRs. Although TSRs are not required, general requirements described in 10 C.F.R. § 830.204(b)(4) are still required to be met. This requires that hazard controls be derived, that adequacy of controls be demonstrated and that a process be defined for maintaining hazard controls current. Therefore, the focus of the “hazards control” section of the DSA should be on SSCs and SACs that prevent or mitigate a release of radionuclides or hazardous chemicals (see DOE-STD-3009-2014 and DOE-STD-1186-2004 for additional details). Safety management programs that are generally relied on for worker protection should also be presented.

It is expected that there will be less reliance on facility design and administrative features as the project progresses and as hazardous substances are removed. For example, the operational limits imposed on a SSC to prevent a release of hazardous substance are no longer valid if the material has been removed. Care should be taken to ensure that hazard controls are not retired prematurely or that administrative controls are not selected in lieu of available, functioning engineered safety features. Trigger points, or the criteria that allow step-out of a control should be supported by the HA and described in the DSA. The criteria in Section 3.3.9 should be used when determining if it is appropriate to retire a control from the safety basis. A DOE pre-approved process for “stepping out of controls” allows the contractor to retire a control without formally revising the DSA and re-submitting for DOE approval. This process requires the use of pre-negotiated step-out criteria that are reviewed and approved by DOE during the DSA review process. Stepping-out of a control does not necessarily mean that the control may be de-energized, as it still may be needed to satisfy life safety or emergency response requirements. It simply means that a control be retired from the safety basis. Once the criteria are satisfied, only contractor verification that the condition is met, and that DOE is notified, is necessary to allow the contractor to retire the control. When using this approach, the DSA should use explicit terms and conditions that define the conditions and process for retiring controls, and provide administrative controls that describe the process for stepping out of a control, as well as further safety measures if necessary, once a control is retired (e.g., increased fire watch or lower combustible limits). 12 TSRs and associated derivation within the DSA should be considered for the unlikely case where environmental restoration projects require active SSCs to provide for significant worker safety or protection of the public. FOREWORD DEFINITIONS ACRONYMS 1.0 INTRODUCTION 1.1 Purpose 1.2 Applicability 1.3 Use of this DSA Preparation Methodology 1.4 Application of the Graded Approach Principles 1.5 Overview of the Changes in this Revision 1.6 Overview of the Standard 2.0 HAZARD CATEGORIZATION 2.1 Final Hazard Categorization 2.2 Inactive Waste Sites 3.0 DSA DEVELOPMENT REQUIREMENTS 3.1 Hazard Identification and Evaluation 3.2 Accident Analysis 3.3 Hazard Controls Selection 3.4 DSA Format and Content 3.5 Disposition Plans 4.0 REFERENCES APPENDIX A: GUIDANCE FOR DECOMMISSIONING ACTIVITIES A.1 Facility Description A.1.1 Facility and Work Description A.1.2 Site Location A.1.3 Systems, Structures and Components Description A.1.4 Operational History A.1.5 Decommissioning Activities and Techniques A.2 Hazard and Accident Analysis and Control Selection A.2.1 Methodology A.2.2 Hazard Analysis Results A.2.3 Accident Analysis A.3 Safety Structures, Systems and Components A.4 Derivation of Technical Safety Requirements A.5 Safety Management Programs APPENDIX B: GUIDANCE for ENVIRONMENTAL RESTORATION ACTIVITIES B.1 Facility Description B.1.1 Restoration Project and Site Description B.1.2 Site Location B.1.3 Site History B.1.4 Restoration Project Activities and Techniques B.2 Hazard and Accident Analysis and Control Selection B.2.1 Hazard Identification B.2.2 Hazard Analysis B.2.3 Accident Analysis B.3 Safety Systems, Structures and Components