DOE-STD-1228-2019, Preparation of Documented Safety Analysis for Hazard Category 3 DOE Nuclear Facilities

NOT MEASUREMENT SENSITIVE DOE-STD-1228-2019 May 2019 DOE STANDARD PREPARATION OF DOCUMENTED SAFETY ANALYSIS FOR HAZARD CATEGORY 3 DOE NUCLEAR FACILITIES U.S. Department of Energy AREA SAFT Washington, DC 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. DOE-STD-1228-2019 ii FOREWORD 1. This Department of Energy (DOE) Standard (STD) has been approved to be used by DOE, including the National Nuclear Security Administration, and their contractors. 2. Beneficial comments (recommendations, additions, and deletions), as well as any pertinent data that may be of use in improving this document, should be emailed to nuclearsafety@hq.doe.gov or addressed to: Office of Nuclear Safety (AU-30) Office of Environment, Health, Safety and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 Phone: (301) 903-2996 Facsimile: (301) 903-6172 3. Title 10 of the Code of Federal Regulations (CFR.) Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements, establishes requirements for the documented safety analyses (DSA) for nuclear facilities. Title 10 C.F.R. § 830.204(a) provides that DOE contractors “responsible for a hazard category 1, 2, or 3 DOE nuclear facility must obtain approval from DOE for the methodology used to prepare the documented safety analysis for the facility unless the contractor uses a methodology set forth in Table 2 of Appendix A” of 10 C.F.R. Part 830, Subpart B. Table 2, item 8, permits the use of “the methods in Chapters 2, 3, 4, and 5 of DOE-STD-3009, Change Notice No. 1, January 2000, or successor document” to develop DSAs for DOE Hazard Category 3 (HC-3) nonreactor nuclear facilities. This Standard provides an acceptable DOE-approved methodology for meeting the 10 CFR Part 830 requirements for the preparation of DSAs for HC-3 nonreactor nuclear facilities. DOE deems this Standard to be an acceptable “successor document” to DOE-STD- 3009, Change Notice 1, January 2000, for the purposes of developing DSAs for HC-3 nonreactor nuclear facilities. As such, this Standard may be used as an acceptable safe harbor methodology as set forth in Appendix A to 10 CFR 830 Subpart B. The principal purpose of this Standard is to clarify the graded approach with respect to 10 CFR Part 830 as it applies to development of DSAs for HC-3 nuclear facilities. 4. There is no requirement or need for an existing, approved HC-3 DSA to be revised or revisited in light of the issuance of this Standard. However, if a facility, site, or program office chooses to use this DOE-STD-1228-2019 for revising an existing DSA, then this Standard requires that all applicable “shall” statements be met if it is used as the safe harbor. DOE-STD-1228-2019 iii CONTENTS FOREWORD .................................................................................................................................. ii 1.0 INTRODUCTION ............................................................................................................... 1 1.1 Purpose ............................................................................................................................. 1 1.2 Applicability ..................................................................................................................... 1 1.3 Background/ Use of this Methodology ............................................................................ 1 1.4 Existing Hazard Category 3 Facilities with Approved DSAs .......................................... 2 1.5 Overview of the Standard ................................................................................................. 2

2.0 TERMINOLOGY ................................................................................................................ 3 2.1 Acronyms and Abbreviations ........................................................................................... 3 2.2 Shall, Should, and May .................................................................................................... 3 2.3 Definitions ........................................................................................................................ 3 3.0 DSA DEVELOPMENT ....................................................................................................... 7 3.1 Hazard Analysis ............................................................................................................... 7 3.1.1 Hazard Identification ................................................................................................ 7 3.1.2 Hazard Categorization and Standard Applicability .................................................. 8 3.1.3 Hazard Evaluation ..................................................................................................... 9 3.2 Hazard Controls Selection .............................................................................................. 11 4.0 DSA Format And Content ................................................................................................. 14 5.0 REFERENCES .................................................................................................................. 16 Appendix A: TECHNICAL GUIDANCE ON KEY DSA CONCEPTS ................................... A-1 A.1 Approach to Hazard Analysis And Hazard Control Selection For Facility Worker Protection .......................................................................................................... A-1 A.2 Hazard Evaluation Methods ................................................................................................ A-3 A.2.1 Guidance for Evaluating Offsite Consequences........................................................... A-3 A.2.2 Guidance on Scoping Calculations ............................................................................... A-6 A.2.3 Chemical Hazard Screening .......................................................................................... A-7 A.3 Hazard Controls Selection ............................................................................................... A-8 A.3.1 Risk Ranking/Binning .................................................................................................. A-8 A.3.2 Material at Risk (MAR) SAC ....................................................................................... A-9 A.3.3 Defense-in-Depth Strategy for HC-3 Nuclear Facilities ............................................... A-9 A.3.4 Major Contributors to Defense-in-Depth ................................................................... A-11 DOE-STD-1228-2019 1 1.0 INTRODUCTION 1.1 Purpose This Department of Energy (DOE) Standard (STD), DOE-STD-1228-2019, describes an acceptable methodology for preparing hazard category (HC) 3 nuclear facility Documented Safety Analyses (DSAs). This Standard is a DOE-approved methodology for meeting the requirements in Title 10 of the Code of Federal Regulations (CFR) Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements. DOE deems this Standard to be an acceptable “successor document” to the methods in Chapters 2, 3, 4, and 5 of DOE-STD–3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, Change Notice No. 1, January 2000, as referenced in Table 2 of Appendix A to Subpart B, for the purpose of preparing DSAs for HC-3 DOE nonreactor nuclear facilities. As such, this Standard may be used as an acceptable safe harbor methodology as set forth in Appendix A to 10 CFR 830 Subpart B.

1.2 Applicability This Standard applies to DOE HC-3 nonreactor nuclear facilities as referenced in 10 CFR Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements, Appendix A, Table 2. Application of this Standard is not appropriate, and shall not be used, when the potential for offsite radiological consequences exist such that Safety Class (SC) controls are necessary to prevent an accident or mitigate the consequences to the public from an accident. 1.3 Background/ Use of this Methodology Title 10 CFR Part 830, Subpart B, Section 830.204(a) requires that “The contractor responsible for a hazard category 1, 2, or 3 DOE nuclear facility must obtain approval from DOE for the methodology used to prepare the documented safety analysis for the facility unless the contractor uses a methodology set forth in Table 2 of Appendix A to this Part.” This Standard provides a DOE-approved methodology used to prepare the documented safety analysis for a DOE HC-3 nonreactor nuclear facility. Title 10 CFR § 830.7 prescribes the use of a graded approach to implement the requirements of 10 CFR Part 830, where appropriate, which includes the development of safety analyses and the associated documentation. Use of the graded approach in initial DSA preparation and subsequent updates, is particularly appropriate for HC-3 nuclear facilities given the lower magnitude of radiological hazards present than those present in HC-1 and HC-2 nuclear facilities. This Standard provides a DSA DOE-STD-1228-2019 2 methodology that is compliant with 10 CFR 830 requirements and graded to assure that a facility has acceptable safety provisions, without providing unnecessary information or overly conservative controls. The application of the graded approach allows for simpler analysis and documentation. However, a DSA is still required to provide a systematic evaluation of hazards and an appropriate set of controls commensurate with the results of the hazard evaluation. Given that DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, and DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook, provide the most complete, up-to-date description of the DOE’s general safety analysis approach, they may be used as a reference, as needed, for effective and acceptable methods for hazards analysis. The methodology described in this Standard is generally consistent with the methodology described in DOE-STD-3009-2014 and DOE-HDBK-1224-2018. Much of DOE-STD-3009- 2014 focuses on accident analysis and safety class controls; these are not applicable for HC-3 facilities. This Standard provides a streamlined methodology tailored to HC-3 facilities. It also provides additional guidance and examples that are most relevant for HC-3 DSAs such as those related to facility worker safety. 1.4 Existing Hazard Category 3 Facilities with Approved DSAs Table 2 in Appendix A of 10 CFR Part 830 Subpart B allows use of DOE-STD-3009, Change Notice No. 1, January 2000, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, July 1994, or successor document, as a safe harbor method for developing DSAs for non-reactor nuclear facilities. Contractors with existing HC-3 facilities that have DOE-approved DSAs may continue operations under those DSAs. There is no requirement or need for an existing, approved HC-3 DSA to be revised or revisited in light of the issuance of this Standard. However, if a Program Office chooses to use this Standard as a safe harbor for revising an existing DSA, then it shall be implemented in its entirety (i.e., all applicable “shall” statements are met).

1.5 Overview of the Standard Section 2 describes the terminology used in the Standard, including acronyms and abbreviations, requirement and recommendation statements, and definitions. Section 3 provides specific requirements for implementing this Standard and guidance for implementing the fundamental aspects of hazard analysis and control selection. Section 4 describes format and content of the DSA. Section 5 provides references. DOE-STD-1228-2019 3 Appendix A provides additional guidance on specific topics. 2.0 TERMINOLOGY 2.1 Acronyms and Abbreviations CFR Code of Federal Regulations DOE Department of Energy DSA Documented Safety Analysis FGE Fissile Gram Equivalent G Guide HC Hazard Category HDBK Handbook MAR Material at Risk MOI Maximally-exposed Offsite Individual NPH Natural Phenomena Hazards O Order QA Quality Assurance SAC Specific Administrative Control SME Subject Matter Expert SMP Safety Management Program SC SSC Safety-Class Structures, Systems, and Components SS SSC Safety-Significant Structures, Systems, and Components SSCs Structures, Systems, and Components STD Standard TSR Technical Safety Requirement 2.2 Shall, Should, and May The word “shall” denotes a requirement; the word “should” denotes a recommendation; and the word “may” denotes permission, neither a requirement nor a recommendation. 2.3 Definitions The definitions presented below are provided for understanding and consistency among the various safe harbor methodologies. The origins of the definitions are indicated by references shown in square brackets [ ]. Other definitions related to hazards analysis may be found in DOE-STD-3009-2014, or in DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook. DOE-STD-1228-2019 4 Documented Safety Analysis (DSA). A documented analysis of the extent to which a nuclear facility can be operated safely with respect to workers, the public, and the environment, including a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety. [10 CFR § 830.3] Fissionable materials. A nuclide capable of sustaining a neutron-induced chain reaction (e.g., uranium-233, uranium-235, plutonium-238, plutonium-239, plutonium-241, neptunium-237, americium-241, and curium-244). [10 CFR § 830.3] Graded Approach. The process of ensuring that the level of analysis, documentation, and actions used to comply with a requirement in this Standard is commensurate with: • The relative importance to safety, safeguards, and security; • The magnitude of any hazards involved; • The life cycle stage of a facility; • The programmatic mission of a facility; • The particular characteristics of a facility; • The relative importance of radiological and non-radiological hazards; and • Any other relevant factor. [10 CFR § 830.3] Hazard. A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to a person or damage to a facility or to the environment (without regard to the likelihood or credibility of accident scenarios or consequence mitigation). [10 CFR § 830.3] Hazard Analysis. The identification of materials, systems, processes, and plant characteristics that can produce undesirable consequences (hazard identification), followed by the assessment of hazardous situations associated with a process or activity (hazard evaluation). Qualitative techniques are usually employed to pinpoint weaknesses in design or operation of the facility that could lead to accidents. The hazard evaluation includes an examination of the complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to radioactive and other hazardous materials. [DOE-STD-3009- 2014]

Hazard Categorization. Evaluation of the consequences of unmitigated radiological releases to categorize facilities in accordance with the requirements of 10 CFR Part 830. Note: 10 CFR Part 830 requires categorization consistent with DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, Change Notice 1. [DOE-STD-3009-2014] DOE-STD-1228-2019 5 Hazard Controls. Measures to eliminate, limit, or mitigate hazards to workers, the public, or environment, including: (1) physical design, structural, and engineering features; (2) safety structures, systems, and components; (3) safety management programs; (4) technical safety requirements; and (5) other controls necessary to provide adequate protection from hazards. [10 CFR § 830.3] Note: “hazard controls” include “specific administrative controls.” [DOE-STD- 3009-2014] Hazard scenario. An event or sequence of events associated with a specific hazard, having the potential to result in undesired consequences identified in the hazard evaluation. [DOE-STD- 3009-2014] Mitigative control. Any structure, system, component, or administrative control that serves to mitigate the consequences of a release of radioactive or other hazardous materials in a hazard or accident scenario. [DOE-STD-3009-2014] Nonreactor Nuclear Facility. Nonreactor nuclear facility means those facilities, activities or operations that involve, or will involve, radioactive and/or fissionable materials in such form and quantity that a nuclear or a nuclear explosive hazard potentially exists to workers, the public, or the environment, but does not include accelerators and their operations and does not include activities involving only incidental use and generation of radioactive materials or radiation such as check and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and X-ray machines. [10 CFR § 830.3] Nuclear Facility. A reactor or a nonreactor nuclear facility where an activity is conducted for or on behalf of DOE and includes any related area, structure, facility, or activity to the extent necessary to ensure proper implementation of the requirements established by 10 CFR Part 830. [10 CFR § 830.3] Preventive control. Any structure, system, component, or administrative control that eliminates the hazard; terminates the hazard scenario or accident; or reduces the likelihood of a release of radioactive and/or hazardous materials. [DOE-STD-3009-2014] Public. All individuals outside the DOE site boundary. [DOE-STD-3009-2014] Risk. The quantitative or qualitative expression of possible loss that considers both the likelihood that an event will occur and the consequences of that event. [DOE-STD-3009- 2014] Safety Basis. The documented safety analysis and hazard controls that provide reasonable assurance that a DOE nuclear facility can be operated safely in a manner that adequately protects workers, the public, and the environment. [10 CFR § 830.3] DOE-STD-1228-2019 6 Safety Class structures, systems, and components (SC SSCs). Structures, systems, or components, including portions of process systems, whose preventive or mitigative function is necessary to limit radioactive hazardous material exposure to the public, as determined from safety analyses. [10 CFR § 830.3]

Safety management program (SMP). A program designed to ensure that a facility is operated in a safe manner that adequately protects workers, the public, and the environment by covering a topic such as quality assurance; maintenance of safety systems; personnel training; conduct of operations; inadvertent criticality protection; emergency preparedness; fire protection; waste management; or radiological protection of workers, the public, and the environment. [10 CFR § 830.3] Safety Significant Structures, Systems, and Components (SS SSCs). Structures, systems, and components which are not designated as safety class SSCs, but whose preventive or mitigative function is a major contributor to defense-in-depth and/or worker safety as determined from safety analyses. [10 CFR § 830.3] Safety structures, systems, and components (safety SSCs). Both safety class structures, systems, and components, and safety significant structures, systems, and components. [10 CFR § 830.3] Site boundary. For the purpose of implementing this Standard, the DOE site boundary is a geographic boundary within which public access is controlled and activities are governed by DOE and its contractors, and not by local authorities. A public road or waterway traversing a DOE site is considered to be within the DOE site boundary if DOE or the site contractor has the capability to control, when necessary, the road or waterway during accident or emergency conditions. [DOE-STD-3009-2014] Specific Administrative Control (SAC). An administrative control that is identified to prevent or mitigate a hazard or accident scenario and has a safety function that would be safety significant or safety class if the function were provided by a structure, system or component. Note: DOE-STD-1186-2016, Specific Administrative Controls, or successor document, provides additional information about SACs. [DOE-STD-3009-2014] Technical Safety Requirements (TSRs). The limits, controls, and related actions that establish the specific parameters and requisite actions for the safe operation of a nuclear facility and include, as appropriate for the work and the hazards identified in the DSA for the facility: safety DOE-STD-1228-2019 7 limits, operating limits, surveillance requirements, administrative and management controls, use and application provisions, and design features, as well as a bases appendix. [10 CFR § 830.3] 3.0 DSA DEVELOPMENT This Standard provides a safe harbor methodology to develop DSAs for HC-3 nonreactor nuclear facilities in compliance with 10 CFR Part 830, Subpart B. Many of the requirements for compliance with this Standard are drawn from DOE-STD-3009-2014, which also provides detailed guidance on interpreting these requirements. Rather than extend the length of this Standard by reprinting that guidance, the user of this Standard may refer to DOE-STD-3009- 2014, as necessary, for effective and acceptable methods for hazards analysis (e.g., standard industrial hazard screening, unmitigated analysis) and control selection. Although all elements of the DSA preparation are important, two elements—hazard analysis and hazard control selection—are fundamental for HC-3 facilities, because they determine the hazard controls needed to provide protection for workers, the public (from chemical release), and the environment. This section provides detailed criteria and guidance for performing these two elements. Additional discussion describing a general approach to hazard analysis and hazard control selection for facility worker protection is provided in Section A.1 of the Appendix of this Standard.

3.1 Hazard Analysis The hazard analysis systematically identifies and evaluates facility hazards and forms the basis for selecting controls. The hazard evaluation focuses on evaluating the complete spectrum of hazards and hazard scenarios. This largely qualitative effort forms the basis for the entire safety analysis and the identification of safety controls. The primary elements of the hazard analysis process are hazard identification, hazard categorization, and hazard evaluation. Note: DOE’s regulations at 10 CFR Part 851, Worker Safety and Health Program, also require DOE contractors identify and assess workplace hazards. 3.1.1 Hazard Identif ication 3.1.1.1 The methodology used for hazard identification shall ensure comprehensive identification of the hazards associated with the full scope of facility processes, associated operations, such as handling of radioactive materials and hazardous materials, and work activities covered by the DSA. The methodology shall include characterization of hazardous materials (radiological and non-radiological) and energy sources, in terms of quantity, form, and location. Commercial industry practices for hazard identification, such as those described in the Center for Chemical DOE-STD-1228-2019 8 Process Safety’s Guidelines for Hazard Evaluation Procedures (Third Edition, Wiley/American Institute of Chemical Engineers, 2008), may be used. 3.1.1.2 Bounding inventory values of radiological or hazardous materials shall be used, consistent with the maximum quantities of material that are stored and used in facility processes. Inventory data may be obtained from flowsheets, vessel sizes, contamination analyses, maximum historical inventories, and similar sources. Other possible sources of information supporting hazard identification include fire hazard analyses, emergency planning hazard assessments, health and safety plans, job safety analyses, and occurrence reporting histories. 3.1.1.3 Although the hazard identification process is comprehensive for all radiological and non- radiological hazards, DSAs are not intended to analyze and provide controls for standard industrial hazards, such as burns from hot surfaces, electrocution, and falling objects. These hazards are adequately analyzed and controlled in accordance with 10 CFR Part 851, Worker Safety and Health Program, and are analyzed as part of the hazard scenario in a DSA only if they can be an event initiator (for example, 115-volt wiring as initiator of a fire), a contributor to a significant uncontrolled release of radioactive or other hazardous material, result from radiological hazards (for example, when an explosion is caused by radiolysis inside a tank), or are considered a unique facility worker hazard. The basis for any identified hazards excluded from further evaluation shall be provided. DOE-STD-3009-2014, Section A.1, “Standard Industrial Hazards,” provides additional discussion on screening of standard industrial hazards. DOE-HDBK-1224-2018, Section 2.2.4, “Exclusion of Standard Industrial Hazards and Other Hazardous Materials,” provides additional discussion on screening standard industrial hazards.

3.1.1.4 The DSA is not intended to evaluate releases of hazardous chemicals, when such chemicals are determined to be adequately managed by the hazardous material protection program and do not impact nuclear safety (i.e. can be screened out of the DSA hazard evaluation). A determination of whether DSA evaluation is warranted should consider whether the hazardous chemicals: (1) are not addressed by a hazardous material protection program (e.g. unique hazards), that could cause harm to workers, the public or the environment; (2) can cause or exacerbate a release of radioactive materials; (3) have the potential to compromise the ability of facility safety SSCs to perform their safety functions or impact personnel’s ability to implement a SAC; (4) have the potential for significant health effects to the public; or (5) are simply stored within the facility footprint and have no potential to interact with nuclear materials. Section A.2.3, “Chemical Hazard Screening,” provides additional discussion on chemical hazards and screening criteria. 3 .1 .2 Hazard Categorization and Standard Applicabi l i ty 3.1.2.1 Hazard identification provides the basis for hazard categorization. The facility hazard category is determined consistent with the methods of DOE-STD-1027-92, Hazard DOE-STD-1228-2019 9 Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, Change Notice 1, September 19971. The bounding inventory values of radiological materials shall be consistent with DOE-STD-1027 requirements for HC-3 facilities. 3.1.2.2 A bounding estimate of the unmitigated radiological consequences to the Maximally- Exposed Offsite Individual (MOI) shall be performed to confirm applicability of this Standard as described in Section 1.2. Additional guidance on acceptable methods is provided in Section A.2.1 of the Appendix.2 3.1.3 Hazard Evaluation 3.1.3.1 The hazard evaluation shall provide (a) an assessment of the facility hazards associated with the full scope of planned operations covered by the DSA and (b) the identification of controls that can prevent or mitigate these hazards or hazardous conditions. The hazard evaluation shall analyze normal operations (e.g., startup, facility activities, shutdown, and testing and maintenance configurations) as well as abnormal and accident conditions.. In addition to the process-related hazards identified during the hazard identification process, the hazard evaluation shall also address natural phenomena and man-made external events that can affect the facility. Hazard scenarios that may be excluded from the hazard evaluation include operational events deemed not plausible3, natural phenomena initiators of greater magnitude than those required by DOE O 420.1C, Facility Safety, (or applicable successor documents); and man-made external events with a cutoff likelihood of 10-6/yr, conservatively determined. 3.1.3.2 Elaborate hazard evaluation methods are not envisioned. A hazard evaluation technique such as “What-If” or “What-If/Checklist Analysis” is appropriate for analyzing many HC-3

1 DOE-STD-1027-2018, Hazard Categorization of DOE Nuclear Facilities, Change Notice 1, is consistent with the methods of DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, Change Notice 1, September 1997. 2 The MOI is located either at the shortest distance to the DOE site boundary (directionally independent), or at the site boundary location with the highest directionally-dependent dose based on a ground level release. A simple bounding unmitigated offsite dose estimate will provide assurance that this potential does not exist, and no safety class controls are necessary to prevent an accident or mitigate the consequences of an accident to the public. 3 Events that are “operational” (i.e., not NPH or man-made external events) may not be plausible and therefore can be excluded from evaluation if the event is either: 1) a process deviation that consists of a sequence of many unlikely human actions or errors for which there is no reason or motive. In evaluating this criterion, a wide range of possible motives, short of intent to cause harm, should be considered. Necessarily, no such sequence of events may ever have actually happened in any nonreactor nuclear facility; or 2) a process deviation for which there is a convincing argument, given physical laws, that it is not possible. The criterion cannot be used if the argument depends on any feature of the design or materials controlled by the facility’s safety features or administrative controls (ACs). [DOE-STD-3009-2014] DOE-STD-1228-2019 10 facilities. However, where operations are complex, the rationale supporting the selected hazard evaluation technique(s) should be discussed in the DSA. A discussion of hazard evaluation techniques, and recommendations on their selection, can be found in Part I of the Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures. Section 2.4, “Hazard Evaluation Methods,” of DOE-HDBK-1224-2018 provides additional discussion on hazard evaluation techniques. 3.1.3.3 As part of the hazard evaluation, an unmitigated hazard scenario shall be evaluated for each initiating event4 by assuming the absence of preventive and mitigative controls. The consequences and the likelihood of the unmitigated hazard scenario shall be estimated (using qualitative and/or semi-quantitative techniques) to address potential effects on facility workers,5 co-located workers, and the public, consistent with the consequence and likelihoods levels described in Tables 1 and 2, respectively, of DOE-STD-3009-2014. Qualitative evaluation of the consequences and likelihood of the unmitigated hazard scenarios is generally sufficient to provide a basis for comparison to the criteria in Table 1 and 2. Quantitative or semi-quantitative analysis may be performed to determine impacts to co-located workers and the public (for chemical hazards) when consequences have the potential to exceed safety significant (SS) control selection criteria. Section 3.2.2, “Unmitigated Analysis,” of DOE-STD-3009-2014 provides additional guidance for establishing physically meaningful unmitigated hazard scenarios. 3.1.3.4 Initial conditions may be necessary to define the unmitigated evaluation; further guidance is provided in Section A.3 of Appendix A of DOE-STD-3009-2014. If necessary in defining the unmitigated evaluation, the initial conditions and assumptions shall be identified. It is not appropriate to credit administrative controls or SMP controls as initial conditions. An exception is that Material at Risk (MAR) values may be considered initial conditions if addressed by a Specific Administrative Control (SAC).

3.1.3.5 For each of the unmitigated hazard scenarios, the controls (structures, systems, and components (SSCs); administrative; and programmatic) that can prevent or mitigate the hazard scenario shall be identified. 3.1.3.6 Risk ranking/binning may be used to support the selection of hazard controls. Section A.4, “Hazard Evaluation and Risk Ranking,” of DOE-STD-3009-2014 and Section A.3.1 of the Appendix to this Standard provide additional guidance on risk ranking/binning. 4 Initiating event includes plausible operational events/accidents, natural phenomena hazards, man-made external events. 5 See DOE-STD-3009-2014, Section 3.1.3.1, “Hazard Evaluation-General,” and DOE-HDBK-1224-2018, Section 2.6.1.2, “Facility Worker Consequences,” for information regarding qualitative evaluation of facility worker consequences. DOE-STD-1228-2019 11 3.1.3.7 Consequence determinations used for co-located workers in the hazard evaluation shall be supported by an adequate technical basis such as scoping calculations and/or engineering judgment. Conservatism is assured by the use of a conservative analysis methodology and the selection of bounding source term and input parameters that are consistent with that methodology. Scoping calculations shall be made based on technically justified input parameters and underlying assumptions6 such that the overall consequence evaluation is conservative. Additional guidance on scoping calculations is provided in Section A.2.2 of the Appendix to this Standard. 3.1.3.8 An atmospheric dispersion coefficient, χ/Q, value of 3.5 x 10-3 seconds per cubic meter (sec/m3) shall be used for ground-level radiological or chemical release evaluation at the 100 meter receptor location, unless an alternate onsite χ/Q value is justified. This value may not be appropriate for certain unique situations, such as operations not conducted within a physical structure7. When an alternate value is used, the DSA shall provide a technical basis supporting the need for the alternate value and the value selected. Section A.2.1 of the Appendix to this Standard provides guidance on acceptable methods for dispersion analysis for determining offsite impacts from chemical releases. 3.1.3.9 A mitigated hazard evaluation shall be performed to determine the effectiveness of SS controls by estimating hazard scenario likelihood with preventive controls and consequences with mitigative controls. This evaluation should be the same as the unmitigated evaluation except that hazard scenario likelihood is estimated with preventive controls available, and consequences are estimated with mitigative controls available. 3.1.3.10 Worker safety issues are the primary focus of hazard evaluations in HC-3 nuclear facilities. Although the potential for large-scale environmental contamination is unlikely, the hazard evaluation should ensure that no additional preventive and mitigative controls are necessary to protect the environment. These controls are typically the same as those necessary to protect the workers or public. 3.2 Hazard Controls Selection The typical control strategy for HC-3 facilities is heavily reliant on safety management programs 6 Section 3.2.4, “Consequence Calculation,” of DOE-STD-3009-2014, and Chapter 5, “Source Term Analysis,” of DOE-HDBK-1224-2018, provide detailed discussion on the derivation and selection of source term and input parameters.

7 Operating Experience Level 3, Atmospheric Dispersion Parameter (χ/Q) for Calculation of Co-located Worker Dose, dated April 2015, and associated technical report, NSRD-2015-TD01, Technical Report for Calculations of Atmospheric Dispersion at Onsite Locations for Department of Energy Nuclear Facilities, conclude that the default χ/Q value may not be appropriate for releases if a building is not present, or from a small building. http://energy.gov/ehss/downloads/operating-experience-level-3-atmospheric-dispersion-parameter-xq-calculation-co http://energy.gov/ehss/downloads/operating-experience-level-3-atmospheric-dispersion-parameter-xq-calculation-co http://energy.gov/ehss/downloads/nsrd-2015-td01-technical-report-calculations-atmospheric-dispersion-onsite-locations http://energy.gov/ehss/downloads/nsrd-2015-td01-technical-report-calculations-atmospheric-dispersion-onsite-locations DOE-STD-1228-2019 12 (SMPs), as well as SACs that protect initial conditions and assumptions at the facility, e.g. MAR inventory control. Safety management programs provide an important part of the overall strategy for protecting facility workers. In some cases, SS controls (SSCs or SACs) are necessary based on hazard evaluation results (i.e. those hazards not screened out during hazard identification) that indicate the potential for significant worker consequences, or public consequences (for chemical hazards). Preventive or mitigative controls are selected using a judgment-based process considering a hierarchy of controls that gives preference to: (1) passive engineered safety features over active features; (2) engineered safety features over administrative controls or SACs; and (3) preventive over mitigative controls. Discussion describing a general approach to facility worker protection and control selection is provided in Section A.1 of the Appendix to this Standard. 3.2.1 The initial conditions and assumptions of the unmitigated hazard evaluation shall be reviewed to determine if controls are needed to maintain the validity of the evaluation8. If the presence of an assumed passive SSC prevents significant consequences, it shall be classified as SS in accordance with Section 3.2.3. MAR and fissionable material inventory SACs should be used as the preferred control(s) for limiting hazardous material quantities. Section A.3.2 of the Appendix to this Standard provides additional guidance on MAR SACs and fissionable material inventory. 3.2.2 The DSA shall describe the facility’s approach to defense-in-depth for protection of workers, the public, and environment from the release of radioactive or other hazardous material. Section A.3.3 of the Appendix to this Standard provides for additional guidance on defense-in- depth. 3.2.3 SS control designation shall be made on the basis of the control’s contribution to: (1) protection of facility workers from fatality, serious injury, or significant radiological or chemical exposure, (2) protection of co-located workers from hazardous chemicals and radioactive materials, (3) protection of the public from release of hazardous chemicals, and (4) defense-in- depth. SS designation for major contributors to defense-in-depth is not typical for HC-3 facilities and is only a consideration when an SS control has already been designated and additional protection for prevention or mitigation is deemed warranted. Section A.1 of the Appendix provides a general approach to facility worker protection and control selection for HC- 3 facilities, including examples. Additional guidance on major contributors to defense-in-depth is provided in Section A.3.4 of the Appendix to this Standard.

8 Nuclear criticality is not expected to occur in a HC-3 nuclear facility (i.e., consistent with the hazard potential for HC-3 as given in DOE-STD-1027-92, Chg. Notice 1). However, if the final hazard categorization was dependent on key assumptions to preclude criticality (such as important attributes in nature of the facility process or segmentation, or prohibitions/limitations on the introduction of fissionable material), these analytical assumptions should be identified in the DSA and protected. DOE-STD-1228-2019 13 3.2.3.1 In designating SS controls (SSCs or SACs) for facility worker protection, the term “serious injury” refers to an injury requiring medical treatment for immediately life-threatening or permanently disabling injury such as the loss of an eye or limb. Facility worker consequences, due solely to a standard industrial hazard or hazardous chemicals, do not need to be addressed in the hazard evaluation if screened out per Section 3.1.1.3 or 3.1.1.4. 3.2.3.2 In designating SS controls (SSCs or SACs) for co-located worker protection for radiological hazards, an unmitigated dose of 100 rem TED to a receptor located at 100 meters from the point of release is used as the threshold. If the mitigated dose to the co-located worker exceeds 100 rem, the DSA shall provide a technical basis for the acceptance of the mitigated analysis results, including the reasons why other controls were not credited to reduce consequences below 100 rem. SS designation9 for protection of co-located workers from chemical releases is based on a peak 15-minute time-weighted average air concentration at the receptor location that exceeds PAC-310. 3.2.3.3 SS designation of controls (SSCs or SACs) for protection of the public from chemical releases is based on a peak 15 minute time-weighted average air concentration, measured at the receptor location that exceeds PAC-2 (AEGL-2, ERPG-2, and/or TEEL-2). 3.2.4 When the hierarchy of controls is not used for situations requiring SS controls (e.g., a SAC is selected over an available SSC), the DSA shall provide a technical basis that supports the controls selected. 3.2.5 In some cases, SS SSCs rely upon supporting SSCs to perform their intended safety function. For new facilities and major modifications, Attachment 311 of DOE O 420.1C requires that support SSCs be designed as SS SSCs if their failures prevent safety-SSCs or SACs from performing their safety functions. For existing facilities, support SSCs shall be designated at the same classification (SS) as the safety controls they support, or else compensatory measures shall be established to assure that the supported SS SSC can perform its safety function when called upon. SSCs whose failure would result in losing the ability to complete an action required by a SAC are similarly identified and designated as SS based on the SAC safety function, or 9 SS designation only applies to chemicals determined to be within the scope of the DSA hazard evaluation (e.g. not screened out per Section 3.1.1.4). 10 DOE’s Protective Action Criteria are defined in “Protective Action Criteria (PAC): Chemicals with AEGLs, ERPGs, & TEELs,” Rev 29A, June 2018, or successor version. This is available at: https://sp.eota.energy.gov/pac/. 11 Attachment 3 of DOE O 420.1C, does not apply to nuclear deactivation or decontamination and decommissioning activities at end-of-facility-life, if the safety analysis demonstrates that adequate protection is provided consistent with the requirements of 10 CFR Part 830 through alternate means and it is not cost-beneficial to apply the provisions of this attachment for the limited remaining life of the activity. .

https://sp.eota.energy.gov/pac/ DOE-STD-1228-2019 14 justification provided if not so designated. 3.2.6 Few SS SSCs are expected for HC-3 nuclear facilities. However, if selected, an engineering evaluation shall be performed to determine the performance capability of the SS SSCs and SACs to meet or exceed performance criteria (i.e., operational responses and capabilities) for the controls to ensure designated functional requirements are met under postulated hazard scenario conditions such as elevated pressures and temperatures. If performance criteria cannot be met, the evaluation shall identify noted deficiencies and any compensatory measures necessary to ensure the safety function of the controls. For existing facilities, the evaluation should include discussion of the relevant SSC design capabilities, including the code of record, to the extent known, and augment as needed with other performance tests, calculations or reliability information that is available. The engineering evaluation may be qualitative (e.g. engineering judgment) when it is sufficient to demonstrate adequacy of the SSC performance capability. 4.0 DSA FORMAT AND CONTENT Criteria and guidance for the format and content of each of the chapters in the DSA are provided in this section. For HC-3 facilities with low inventory of radiological and chemical hazards, the DSA should be simple and short. At a minimum, the scope of a DSA for a HC-3 facility shall address the following three elements in a simplified fashion: • Basic description of the facility and its operations; • A qualitative hazard analysis; and • The hazard controls (including SS SSCs, inventory limits and safety management programs, and their bases). The DSA format and content should address the DSA sections and subsections described below as relevant based on the facility’s hazard characteristics. Additional guidance on DSA organization and content is provided in Section 4, “DSA Format and Content,” of DOE-STD- 3009-2014. The DSA may include addenda for short-term evolutions (e.g., activities that could be conducted once or for a short period of time with respect to overall facility operations) provided the addenda meet the requirements of this Standard. • [Executive Summary] • [Chapter 1: Introduction] o Basic Site Description o Natural Event Initiators o Man-made External Initiators DOE-STD-1228-2019 15 o Nearby Facilities • [Chapter 2: Facility Description] o Facility Overview and Mission o Facility Structure o Process and Work Description • [Chapter 3: Hazard Analysis and Control Selection] o Hazard Analysis Methodology o Hazard Categorization o Hazard Analysis Results o Defense-in-Depth Approach o Facility Worker Safety o Safety Significant Control Selection o Environmental Protection o Planned Design and Operational Safety Improvements • [Chapter 4: Safety Structures, Systems and Components] o Safety Significant Systems, Structures, and Components  Safety Function, System Description, Functional Requirements, System Evaluation, and TSR Requirements o Specific Administrative Controls  Safety Function, SAC Description, Functional Requirements, SAC Evaluation, and TSR Requirements • [Chapter 5: Derivation of Technical Safety Requirements] o TSR Coverage o Derivation of Facility Modes o TSR Derivation o Design Features • [Chapter 6: Safety Management Programs12] o Radiation Protection o Fire Protection o Maintenance o Procedures o Training o Conduct of Operations o Quality Assurance o Emergency Preparedness o Waste Management

12 Section 830.204(b)(5) of 10 C.F.R. Part 830 identifies nine safety management programs required to be addressed where applicable. Other programs may be important for individual facilities, and addressed in additional subsections appended to the above list. DOE-STD-1228-2019 16 5.0 REFERENCES [1] 10 CFR Part 830, Nuclear Safety Management [2] ANSI/ANS-8.1-2014, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors, April 2014 [3] ANSI/ANS-8.15-2014, Nuclear Criticality Control of Selected Actinide Elements, October 2014 [4] DOE O 420.1C, Chg 2, Facility Safety, February 2018 [5] DOE Guide 420.1-1A, Nonreactor Nuclear Safety Design Guide for Use with DOE O 420.1C, Facility Safety, December 2012. [6] DOE-STD-1027-92, Change Notice No. 1, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, September 1997 [7] DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, November 2014 [8] Guidelines for Hazard Evaluation Procedures, Center for Chemical Process Safety, Third Edition, Wiley/American Institute of Chemical Engineers, 2008 [9] DOE O 151.1D, Comprehensive Emergency Management System, August 2016 [10] DOE O 414.1D, Chg 1, Quality Assurance, May 2013 [11] DOE-STD-1186-2016, Specific Administrative Controls, December 2016 [12] DOE-STD-1189-2016, Integration of Safety into the Design Process, December 2016 [13] DOE-STD-1027-2018, Change Notice 1, Hazard Categorization of DOE Nuclear Facilities, January 2019 [14] DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook, July 2018 [15] Protective Action Criteria (PAC): Chemicals with AEGLs (Acute Exposure Guideline Level), ERPGs (Emergency Response Planning Guidelines), & TEELs (Temporary Emergency Exposure Limit), Revision 29A, June 2018, or successor version. [16] NRC Regulatory Guide 1.145, Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants, November 1982 [17] AU-30-RPT-01, Standardized χ/Q Values for Offsite Consequence Assessments to Support STD-1228-2019, Preparation of Documented Safety Analyses for Hazard Category 3 DOE Nuclear Facilities, Office of Nuclear Safety, U.S. Department of Energy, Washington, DC, January 2019. DOE-STD-1228-2019 A-1 APPENDIX A: TECHNICAL GUIDANCE ON KEY DSA CONCEPTS A.1 APPROACH TO HAZARD ANALYSIS AND HAZARD CONTROL SELECTION FOR FACILITY WORKER PROTECTION Section 830.7 of 10 CFR Part 830 requires the use of a graded approach, where appropriate to implement the requirements of the regulation, including in performing safety analysis and developing the level of detail presented in the associated documentation, but excluding implementation of Technical Safety Requirements. As described in 10 CFR § 830.3, the graded approach means the process of ensuring that the level of analysis, documentation, and actions used to comply with a requirement in 10 CFR Part 830, Subpart B are commensurate with: • The relative importance to safety, safeguards, and security; • The magnitude of any hazard involved; • The life cycle stage of a facility; • The programmatic mission of a facility; • The particular characteristics of a facility; • The relative importance of radiological and non-radiological hazards; and • Any other relevant factor (e.g., short operational life).

DOE-STD-1027-92, CN1, defines a HC-3 facility as having the potential for “only local significant consequences,” as opposed to significant onsite and offsite radiological consequences. Three of the seven grading factors listed above bear on this definition. The relative importance to safety is primarily localized to the facility itself, which means that the magnitude of any radiological hazards involved is limited. These two factors support grading. The third factor, relative importance of radiological and non-radiological hazards, is a cautionary factor when considering grading for a HC-3 facility. The hazard categorization process in DOE-STD-1027-92 does not address non-radiological hazards, therefore this factor needs to be accounted for if such non-radiological hazards can have significant consequences. The expectation for HC-3 facilities is that they will not have radiological hazards presenting significant offsite impacts. As stated in Section 1.2 of this Standard, “[a]pplication of this Standard is not appropriate, and shall not be used, when the potential for offsite radiological consequences exist such that Safety Class (SC) controls are necessary to prevent an accident or mitigate the consequences to the public from an accident.” If high offsite consequences exist, it is likely because of unusual circumstances such as the presence of significant chemical hazards. In most cases, the hazard evaluation process will identify preventive or mitigative controls that do not rise to the level of SS but still enhance the safety of the facility. These controls would be DOE-STD-1228-2019 A-2 identified in the hazard evaluation, but not explicitly credited with a SS designation. Such controls are maintained in accordance with SMPs. For hazards involving only localized consequences affecting the facility worker, appropriate control of the hazard is often provided by an SMP. SMPs have been developed and codified from decades of experience. These programs thus constitute an important means of facility worker protection for HC-3 facilities. The protection provided by SMPs is augmented as appropriate with specific administrative controls (SACs) that protect initial conditions of operations (e.g., maximum facility inventory and material forms allowed), or that are derived for high consequence events. The preferred hazard control strategy is always to eliminate a hazard where possible or prevent hazardous conditions with existing engineered controls where available. Examples of Control Designation Example 1: If multiple operations occur in a HC-3 facility, such as a research and development (R&D) laboratory, it is not necessary to have a SAC material limit for every individual activity. Generally, a HC-3 DSA will include a SAC for overall facility inventory to assure material quantities used in hazard categorization are not exceeded. The DSA might also include material limit SACs for individual activities of elevated concern (e.g. activities involving potential significant onsite radiological or chemical consequences, or off-site chemical consequences). Example 2: In the case where a glovebox has been installed to provide basic contamination control, absent some specific event of concern determined by the hazard evaluation, there is no need to consider designating the glovebox as safety significant. Existing requirements govern the need for contamination control and reduction of facility worker dose during normal operation. SMPs, such as radiation protection and maintenance SMPs, ensure such requirements are met. Considering designation of safety significant SSCs is reserved for non-routine facility worker risks (e.g., high energy events that can render a large amount of hazardous material airborne quickly).

Example 3: When analysis leads to the conclusion that it is necessary to credit an SSC control to arrive at an acceptable mitigated result, multiple control options may be available. For the typical HC-3 case, controls are being credited to reduce consequence or likelihood of events having a potentially significant effect on facility workers only. In such cases, a graded approach can support crediting a single effective control as opposed to crediting a suite of available controls (e.g. as compared to attempting to prevent or mitigate large hazardous material releases with significant downwind consequences). Similarly, the effectiveness of a control may demonstrate for some situations that it is appropriate to deviate from the preferred hierarchy (e.g., a highly reliable alarm that gives a worker rapid response to a hazard rather than an existing passive barrier providing limited confinement or whose performance can’t be verified because of degradation or lack of available design records). A justification for a deviation from the DOE-STD-1228-2019 A-3 hierarchy would be presented in the DSA. A.2 HAZARD EVALUATION METHODS Chapter 2, “Hazard Analysis,” of DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook, provides extensive discussions on the hazard analysis process. The handbook describes hazard analysis techniques for the identification and evaluation of hazards, and the identification of controls to prevent or mitigate accidents. A.2.1 Guidance for Evaluating Offsite Consequences Offsite consequences may need to be evaluated in the following cases: (1) to evaluate applicability of this Standard as described in Section 1.2, or (2) to evaluate consequences from chemical hazards included in the hazard evaluation. Guidance for performing consequence analysis for the public (maximally-exposed offsite individuals [MOIs]) is provided in Section 3.2.4, “Consequence Calculation”, of DOE-STD-3009-2014. DOE-HDBK-1224-2018 provides additional discussion on conservative consequence calculations. Although accident analysis is not required for HC-3 nuclear facilities, a similar methodology is useful for a scoping calculation to meet the requirement in Section 3.1.2.2 for confirming applicability of this Standard. Hazardous chemicals not screened out during the hazard identification could have the potential for consequences that meet the SS control selection criteria for the public. Such chemical hazards are evaluated during the hazard evaluation against the consequence levels described in Table 1 of DOE-STD-3009-2014 and criteria provided in Section 3.2.3.3. DOE guidance for performing chemical consequence analysis can be found in Section 3.2.4.3, “Chemical Source Term and Consequence”, of DOE-STD-3009-2014, and in DOE-HDBK-1224-2018, Section 5.3, “Chemical Release Source Terms,” and Chapter 9, “Chemical Dispersion and Consequence Analysis.” For HC-1 and -2 nuclear facilities, consequence calculations for the MOI can be extensive, particularly because the atmospheric dispersion analysis typically involves the use of sophisticated computer codes. For HC-3 facilities, where offsite consequence analysis is warranted (i.e., potential for high chemical consequences or to confirm applicability of this Standard), it is acceptable to simplify scoping calculations and the offsite χ /Q analysis from those options presented in STD-3009-2014, Section 3.2.4.2, “Radiological Dose Consequence”, while still using a technically defensible value. This can be accomplished using a variety of acceptable methods, including:

• Using a χ /Q value previously calculated and approved for use in a DSA for a nearby facility or at a facility with similar site conditions, including meteorology (or constant weather, such as F-stability and 1 m/s wind speed), surface roughness, deposition DOE-STD-1228-2019 A-4 velocity, and plume release conditions. If the site boundary distances are not consistent, a conservative distance can be interpolated from the available data. • Performing a simple hand calculation for χ/Q using the equation described in Nuclear Regulatory Commission Regulatory Guide 1.145, Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants, using constant meteorology (F-stability and 1 m/s wind speed) and standard rural dispersion coefficients such as those provided by the Reg. Guide. An example of this methodology is provided in Section 9.8.3, “Screening Method For Maximally-Exposed Offsite Individual (MOI) High Consequence”, of DOE-HDBK-1224-2018. • Using a χ /Q value previously calculated and approved for use in a DSA using conservative dispersion modeling assumptions such as those presented in Option 2 in STD-3009-2014 which includes a set of prescribed parameter values intended to provide a conservative result when used together. The χ/Q values should be based on conservative meteorology for the site or use constant meteorology: F-stability and 1 m/s wind speed. The following table of χ/Q values was generated using input parameters generally consistent13 with “Option 2” in DOE-STD-3009-2014: • Non-buoyant, ground level, point source release; • Plume centerline concentrations for calculation of dose consequences; • Eimutus-Konicek rural dispersion coefficients; • A deposition velocity of 0.1 cm/sec for unfiltered release of particles (1-10 µm Aerodynamic Equivalent Diameter), • A surface roughness of 3 cm; • Constant weather assumptions: wind speed of 1 m/s, F-stability class; • No plume meander • Building wake credit consistent with the building dimensions used to generate the 100 meter χ/Q (e.g., release is from a building with a size that is at least 10 x 36 meters). An option with no building wake credit is also provided14. 13 Although Option 2 in DOE-STD-3009-2014 does not recommend crediting a building wake, in cases where a building structure is present, the building wake credit is appropriate for more technically-defensible modeling, particularly when evaluating offsite consequences at facilities with short site boundary distances. Building dimensions consistent with those used to generate the 100 meter default χ/Q value (10 x 36 meter building) were used. 14 Operating Experience Level 3, Atmospheric Dispersion Parameter (χ/Q) for Calculation of Collocated Worker Dose, dated April 2015, and associated technical report, NSRD-2015-TD01, Technical Report for Calculations of Atmospheric Dispersion at Onsite Locations for Department of Energy Nuclear Facilities, conclude that the default χ/Q value may not be appropriate for releases if a building is not present, or from a small building.). http://energy.gov/ehss/downloads/operating-experience-level-3-atmospheric-dispersion-parameter-xq-calculation-co http://energy.gov/ehss/downloads/operating-experience-level-3-atmospheric-dispersion-parameter-xq-calculation-co http://energy.gov/ehss/downloads/nsrd-2015-td01-technical-report-calculations-atmospheric-dispersion-onsite-locations http://energy.gov/ehss/downloads/nsrd-2015-td01-technical-report-calculations-atmospheric-dispersion-onsite-locations

DOE-STD-1228-2019 A-5 The values in Table A-115 may be used for scoping calculations for HC-3 nuclear facilities and to simplify the evaluation of offsite consequences. Table A-1: Offsite χ/Q Versus Distance Receptor Distance (Meters) 10x36m Building Wake χ/Q (s/m3) No Building Wake χ/Q (s/m3) 100 3.5E-03 2.8E-02 200 2.6E-03 8.3E-03 300 1.8E-03 4.1E-03 400 1.3E-03 2.5E-03 500 1.0E-03 1.7E-03 600 8.2E-04 1.2E-03 700 6.7E-04 9.6E-04 800 5.6E-04 7.6E-04 900 4.8E-04 6.2E-04 1000 4.1E-04 5.2E-04 1100 3.6E-04 4.4E-04 1200 3.2E-04 3.8E-04 1300 2.9E-04 3.3E-04 1400 2.6E-04 2.9E-04 1500 2.4E-04 2.6E-04 1600 2.2E-04 2.3E-04 1700 2.0E-04 2.1E-04 1800 1.8E-04 1.9E-04 1900 1.7E-04 1.8E-04 2000 1.6E-04 1.7E-04 3000 9.1E-05 9.0E-05 4000 6.1E-05 5.9E-05 5000 4.5E-05 4.3E-05 6000 3.5E-05 3.3E-05 7000 2.8E-05 2.6E-05 8000 2.3E-05 2.2E-05 9000 2.0E-05 1.8E-05 10000 1.7E-05 1.6E-05 11000 1.5E-05 1.4E-05 12000 1.3E-05 1.2E-05 13000 1.2E-05 1.1E-05 15 The calculation for Table A-1 values is documented in AU-30-RPT-01, Standardized χ/Q Values for Offsite Consequence Assessments to Support STD-1228-2019, Preparation of Documented Safety Analyses for Hazard Category 3 DOE Nuclear Facilities, Office of Nuclear Safety, U.S. Department of Energy, Washington, DC, January 2019. DOE-STD-1228-2019 A-6 Receptor Distance (Meters) 10x36m Building Wake χ/Q (s/m3) No Building Wake χ/Q (s/m3) 14000 1.1E-05 9.6E-06 15000 9.5E-06 8.7E-06 A.2.2 Guidance on Scoping Calculations Scoping calculations may be used to inform the hazard evaluation process and to assess consequences to the co-located worker or to the public as discussed in Section A.2.1 of this Appendix. Initial scoping calculations provide a basis for assigning consequence bins associated with a particular hazard scenario (i.e., high, moderate, or low). This in turn helps to determine whether SS SSCs are required, as discussed in Section A.3. Section 2.6.1, “Qualitative Consequences,” of DOE-HDBK-1224-2018 provides insights for the use of scoping estimates to help inform judgments on the magnitude of consequences to various receptors. This process may rely on a simplified quantitative basis involving bounding source term estimates and calculation of “unit release” consequences at any distance of concern. Hazard scenarios can then be compared to these estimates to provide insights on whether receptor thresholds associated with various consequence bins are exceeded. Scoping calculations used to support the evaluation may use broad assumptions that are conservative and are not necessarily based on a plausible operational accident scenario, design basis natural phenomena, or man-made external events that would be evaluated for the DSA. For example, a scoping calculation might provide an insight related to a bounding event that impacts 100 percent of MAR to demonstrate that consequences are not significant. However, scoping calculations should be consistent with the requirements and guidance for unmitigated hazard evaluation as specified in Section 3.1.3 of this Standard. This includes the appropriate use of initial conditions and assumptions (e.g., no credit given to active safety features or operator intervention). Section 9.8, “Toxic Chemical Consequence Scoping Methodology to Exceed PAC/TEEL Value”, of DOE-HDBK-1224-2018 provides guidance for performing a quantitative evaluation of toxic chemical consequences when a qualitative basis is not sufficient for comparing to the consequence thresholds of Table 1 in STD-3009-2014. As discussed in Section A.2.1 of this Appendix, when a facility specific χ/Q is not available, there are other ways to obtain a technically defensible value without undergoing extensive modeling.

DOE-STD-1228-2019 A-7 A.2.3 Chemical Hazard Screening DOE-STD-3009-2014, Appendix A.2, “Chemical Hazards”, describes screening criteria for chemicals that may be excluded from DSA hazard evaluations. It is possible that chemicals exceeding these criteria may also be screened out if adequately managed by a hazardous material protection program. Table 9-1 of Section 9.3, “Chemical Screening Criteria”, of DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook, presents additional considerations regarding screening criteria. The use of these screening criteria may be an initial step in the screening process. Chemicals that do not meet those screening criteria thresholds may be screened against the discussion in the introduction of DOE-STD-3009-2014 Section A.2, which states: “The DSA is not intended to deal extensively with chemicals that can be safely handled by implementation of a hazardous material protection program. Therefore, a screening process is established to select for DSA evaluation only those chemicals of concern (i.e., type and quantity that have the potential for significant health effect on the facility worker, co-located worker, or public) that are present in the facility or activity and present hazard potentials outside the routine scope of the hazardous material protection program.” Therefore, if the chemical hazard potential is adequately evaluated and controlled by the routine scope of the hazardous material protection program, meeting the requirements of 10 CFR Part 851, Worker Safety and Health Program, the chemical may be screened out from further hazard evaluation in the DSA. However, there still may be other considerations that warrant further evaluation of the chemical in the DSA hazard evaluation. DOE-HDBK-1224-2018 Section 2.2.4, “Exclusion of Standard Industrial Hazards and Other Hazardous Materials,” provides these additional clarifications. Section 2.2.4 includes guidance regarding chemical screening and guidance for evaluating chemicals that have not been screened in the hazard evaluation. This includes a screening example of a large outside storage tank, guidance for unmitigated consequence assessment for facility workers, and the need to address the unique hazard of asphyxiation as discussed in DOE- STD-3009-2014 Section A.1. In addition, per DOE-STD-3009-2014 Section A.2, chemicals “that could otherwise be screened out, but have the potential to be an accident initiator involving radioactive or hazardous material releases, or could compromise the ability of the facility operators to safely manage the facility, are retained as part of the DSA hazard evaluation.” Lastly, DOE-HDBK-1224-2018 Section 2.3.3, “Chemical Hazard Evaluation”, provides additional guidance to the discussion in DOE-STD-3009-2014 Section 3.1.3.4, “Chemical Hazards”, regarding further qualitative hazard evaluation. That Handbook section also references DOE-STD-1228-2019 A-8 other sections regarding a quantitative assessment as discussed in the DOE-STD-3009-2014 Section 3.2.3.4, “Chemical Source Term and Consequence”, and Appendix A.2, which provides a method to estimate exposure concentration for comparison to safety significant thresholds for control selection. For facilities where the hazardous material protection program is an important element of adequate protection for worker safety (because of the type and quantity of hazardous chemicals that could cause harm to workers if not adequately controlled), these hazardous material protection programs should be identified and described as safety management programs in the facility DSA. Specific program elements should be included based on hazard evaluation results.

A.3 HAZARD CONTROLS SELECTION A.3.1 Risk Ranking/Binning As discussed in Section 3.3, “Hazard Evaluation”, of this Standard, risk ranking/binning is a structured process that may be used to support the selection of hazard controls, although its other purpose is to aid in the selection of representative evaluation basis accidents for formal accident analysis. Additional information on the implementation of risk ranking/binning can be found in DOE-STD-3009-2014 Appendix A, Section A.4, "Hazard Evaluation and Risk Ranking”, and in DOE-HDBK-1224-2018, Section 10.1.1.3, “Use of Risk Matrices for Control Selection.” Risk ranking/binning at HC-3 facilities for offsite and onsite receptors will generally result in conclusions from the unmitigated analysis that are predominantly situations of minor concern for which safety management programs are sufficient and not requiring safety significant controls (e.g., commensurate with Risk Bin III of typical risk class matrix). Additionally, risk ranking/binning is not as valuable when judging facility worker impacts, because low or moderate consequence threshold bins are not established in Table 1 of DOE-STD-3009-2014. Facility worker impacts are the primary hazard potential at most HC-3 facilities. For the limited cases at HC-3 facilities where significant radiological or chemical hazards exist for the co-located worker, or where significant chemical hazards exist offsite, risk ranking/binning can be beneficial, particularly during the mitigated analysis of hazard scenarios. This involves judging the degree to which a hazard control is effective in performing its preventive or mitigative safety function as illustrated by comparison to a risk class matrix and movement to lower frequency and/or consequence bins as controls are applied. This establishes a basis for demonstrating a sufficient number of preventive and/or mitigative controls are selected that ensure adequate protection. For example, adequate protection could be demonstrated in the mitigated analysis by achieving “Risk Bin III” in a typical risk class matrix.. DOE-STD-1228-2019 A-9 A.3.2 Material at Risk (MAR) SAC The basic and most effective means of controlling the hazards inherent in the facility is the restriction of inventories and forms of radioactive and/or hazardous materials. Attachment 2, Chapter I of DOE O 420.1C, Facility Safety, requires emphasis to be placed on limiting the quantity and form of radioactive and/or hazardous materials in both process and storage areas consistent with mission needs. Materials can be rendered less hazardous by maintaining them in more stabilized and less dispersible forms. In many nuclear facilities, the MAR is a major analytic assumption underlying the hazard and accident analyses. In such cases, a MAR inventory greater than assumed in the DSA would place the facility in an unanalyzed condition. As such, MAR assumptions need to be verified in a highly reliable manner and inventories must be maintained consistent with those assumptions. This is especially true if SACs related to fissionable MAR are necessary to preclude criticality. Otherwise, increases or changes in MAR may be required to be analyzed pursuant to the Unreviewed Safety Question process and the DSA may be required to be updated to reflect the changes in MAR.

Given the lower levels of material inventory at HC-3 facilities, it is expected that most HC-3 facilities will not have many, if any, SS SSCs for control of radiological consequences. Specific administrative controls will typically be used to protect MAR assumptions. For many HC-3 DSAs, the most important control is a SAC related to MAR, which is fundamental to the facility’s hazard control strategy. This SAC provides added focus to the facility operators to ensure that the key assumptions remain valid in the facility’s hazard evaluation and determination of final hazard categorization. When a facility is HC-3 and there is no potential for offsite consequences, then no detailed accident analysis is needed, and none is performed. If the underlying basis for this decision is invalidated (by bringing in material types and quantities in excess of analyzed amounts), then a different type of analysis may be needed and a completely different set of controls may be required. DOE-STD-1186-2016, Specific Administrative Controls, provides guidance on the selection and design of administrative controls. In Section 1.7, that Standard states: “Where necessary and feasible, SACs should be used to control or limit material-at-risk (MAR) and other important physical attributes, such as waste acceptance criteria on radiological or fissile concentrations, by establishing material inventory limits for a given facility.” DOE-STD-1186-2016, Section 4.3, “Developing A Material At Risk (MAR) TSR Control,” describes considerations for developing a MAR SAC or TSR control. A.3.3 Defense-in-Depth Strategy for HC-3 Nuclear Facilities Defense-in-depth is a fundamental strategy for nuclear facility safety. Defense-in-depth provides layers of defense against the release of hazardous materials so that no one layer by itself is DOE-STD-1228-2019 A-10 completely relied upon. All safety activities, whether organizational, behavioral, or equipment- related, are subject to layers of overlapping provisions, so that if a failure should occur it would be compensated for or corrected without causing harm to individuals or the public at large. When properly applied, the defense-in-depth strategy ensures that no single human or mechanical failure would lead to injury to individuals or to the public, or even combinations of failures that are only remotely possible would lead to little or no injury. The strategy for defense-in-depth is twofold: first, to prevent accidents, and second, if prevention fails, to limit the potential consequences of accidents and to prevent their evolution to more serious conditions. DOE Order 420.1C, Facility Safety, requires defense-in-depth as part of the design of all nuclear facilities. Specifically, the Order requires the following elements to be addressed (see Attachment 2, Chapter I): • choosing an appropriate site; • minimizing the quantity of material-at-risk; • applying conservative design margins; • applying quality assurance (see DOE O 414.1D, Quality Assurance, and 10 CFR 830, Subpart A, Quality Assurance Requirements); • using successive/multiple physical barriers for protection against radioactive releases; • using multiple means to ensure safety functions are met by (1) controlling processes, (2) maintaining processes in safe status, (3) providing preventive and/or mitigative controls for accidents with the potential for radiological releases, and, (4) providing means for monitoring facility conditions to support recovery from upset or accident conditions;

• using equipment in combination with administrative controls that (1) restrict deviation from normal operations; (2) monitor facility conditions during and after an event; and, (3) provide for response to accidents to achieve a safe condition; • providing means to monitor accident releases as required for emergency response, and • establishing emergency plans for minimizing the effects of an accident (see DOE O 151.1D, Comprehensive Emergency Management System, for detailed requirements). In accordance with 10 CFR § 830.204(b), the DSA is required to, as appropriate for the complexities and hazards associated with the facility, describe the facility, including relevant physical characteristics and exposure to natural phenomena hazards, which should drive much of the design of facility structures. The basic and most effective means of controlling the hazards inherent in the facility is the restriction of inventories and forms of radioactive and/or hazardous materials. Multiple barriers to prevent hazardous radioactive releases should be considered and graded based on the overall potential consequences and risks involved. Physical barriers can include hazardous materials containers, gloveboxes, passive facility structural elements, and confinement ventilation systems. HC-3 DSAs will likely describe multiple barriers being used to provide hazardous material control. The general strategy for defense-in-depth is described in DOE-STD-1228-2019 A-11 more detail in DOE Guide 420.1-1A, Nonreactor Nuclear Safety Design Criteria for Use with DOE O 420.1C, Facility Safety. A.3.4 Major Contributors to Defense-in-Depth DOE-STD-3009-2014, Section 3.3.2, “Safety Significant Controls,” requires that SSCs providing major contributions to defense-in-depth be identified as safety significant controls, and provides specific criteria to be considered for such SSCs. This is clearly more relevant to HC-2 facilities with potential offsite impacts, but may also apply if there are significant impacts to the co- located worker. It could potentially be relevant to HC-3 facilities but generally it is not expected that HC-3 facilities would identify a significant number of SSCs that are major contributors to defense-in-depth. Many HC-3 DSAs identify appropriately no safety significant SSCs for the primary functions of public chemical safety, co-located worker radiological/chemical safety, or facility worker safety, so no safety significant SSCs for defense-in-depth would need to be considered. Where high or moderate consequence impacts are possible, and an SS SSC has been identified, the DSA should consider whether another SSC significantly reduces the likelihood or consequences of the applicable hazard scenarios and should be designated safety significant as well. Designation of the major contributors to defense-in-depth is made following selection of at least one other SS control to address co-located worker radiological/chemical releases, offsite chemical releases, and facility worker safety. The SS controls used for defense-in-depth should be independent from each other and any controls they support. It should be shown qualitatively that multiple SS SSC failures would not occur in the same hazard scenario. FOREWORD 1.0 INTRODUCTION 1.1 Purpose 1.2 Applicability 1.3 Background/ Use of this Methodology 1.4 Existing Hazard Category 3 Facilities with Approved DSAs 1.5 Overview of the Standard

2.0 Terminology 2.1 Acronyms and Abbreviations 2.2 Shall, Should, and May 2.3 Definitions 3.0 DSA DEVELOPMENT 3.1 Hazard Analysis 3.1.1 Hazard Identification 3.1.2 Hazard Categorization and Standard Applicability 3.1.3 Hazard Evaluation 3.2 Hazard Controls Selection 4.0 DSA Format and Content 5.0 REFERENCES Appendix A: TECHNICAL GUIDANCE ON KEY DSA CONCEPTS A.1 Approach to HAZARD ANALYSIS AND HAZARD CONTROL SELECTION FOR Facility Worker Protection A.2 Hazard Evaluation Methods A.2.1 Guidance for Evaluating Offsite Consequences A.2.2 Guidance on Scoping Calculations A.2.3 Chemical Hazard Screening A.3 Hazard Controls Selection A.3.1 Risk Ranking/Binning A.3.2 Material at Risk (MAR) SAC A.3.3 Defense-in-Depth Strategy for HC-3 Nuclear Facilities A.3.4 Major Contributors to Defense-in-Depth