DOE-STD-3009-94 Chg Notice 3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses

NOT MEASUREMENT SENSITIVE DOE-STD-3009-94 July 1994 CHANGE NOTICE NO.1 January 2000 CHANGE NOTICE NO. 2 April 2002 CHANGE NOTICE NO. 3 March 2006 DOE STANDARD PREPARATION GUIDE FOR U.S DEPARTMENT OF ENERGY NONREACTOR NUCLEAR FACILITY DOCUMENTED SAFETY ANALYSES U.S. Department of Energy AREA SAFT Washington, DC 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. DOE-STD-3009-94 Page ii This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from ES&H Technical Information Services, U.S. Department of Energy, (800) 473-4375, fax: (301) 903-9823. DOE-STD-3009-94 Page iii Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses Table of Changes Section Change Foreword Updated contact information Guiding Principles Added paragraph on Specific Administrative Controls Definitions Added SAC definition Abbreviations and Acronyms Added SAC acronym Introduction Revised to include SAC information, including Figures I-1 and I-2 Chapter 3: Purpose Purpose of Chapter 3 - Added “SACs” to the second item under the fourth bullet Chapter 3 section 3.3 Revised Figure 3-1 to include SAC in process Chapter 3 section 3.3.2.3 Revised Figure 3-2 to include SAC in worker safety evaluation Chapter 3 section 3.3.2.3.2 Added “SACs” Added new last paragraph in this section. Chapter 3 section 3.3.2.3.3 Added “and SACs” in bullet statement on top of the page. Second paragraph, changed “two” to “three” Added second bullet statement “specific administrative controls” Added new fifth paragraph in this section on SACs (“Identify specific administrative controls . . .”) Chapter 3 section 3.4 Added “SACs” in third paragraph Revised Figure 3-4 to include SAC Chapter 3 section 3.4.2.X.5 Added “SACs” to title of this section, and inserted “(or equivalent SAC)” in the first sentence of this section. Chapter 4 Introduction Revised to include SAC information. Chapter 4 section 4.5 Added new section 4.5 Specific Administrative Controls Chapter 5 Purpose Added “(SACs)” Chapter 5 Application of the Graded Approach Added last paragraph to address SACs. Chapter 5 section 5.3 Added “or SACs” in three places. Chapter 5 section 5.5.X.3 Added last sentence in the section regarding SACs Change Notice No. 3 DOE-STD-3009-94 March 2006 DOE-STD-3009-94 Page iv Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses Table of Changes Section Change Whole document Requirements from DOE Order 5480.23 were replaced by those from 10 CFR 830. Whole document Terminology was made consistent with 10 CFR 830. Whole document References to DOE Orders 5480.21, 5480.22, and 5480.23 were replaced by references to 10 CFR 830. Whole document References to specific revision numbers of documents were deleted since most recent edition of the document applies. Whole document References to other documents were updated. Whole document The term “Evaluation Guidelines” was changed to “Evaluation Guideline”. Foreword National Nuclear Security Administration was added as an applicable organization. Foreword Address for beneficial comments was changed. 13 / Table I-1 Table I-1 was deleted because it refers to the 5480.23 Order, rather than the 10 CFR 830 rule. Change Notice No. 2 DOE-STD-3009-94 April 2002 DOE-STD-3009-94 Page v Change Notice No. 1 DOE-STD-3009-94 January 2000

Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports Section Change Table of Contents Appendix A information inserted. Definitions Appendix A referenced under Evaluation guidelines. Introduction Appendix A referenced under Accident Analysis. Introduction Appendix A referenced at the end of Safety-class structures, systems, and components. Chapter 3 Appendix A referenced in 3.3.2.3.5 Accident Selection, relating to Figure 3-4, Flowchart for performing an accident analysis. p. A-1 / Appendix A Insert Appendix A in back of document DOE-STD-3009-94 Page vi Foreword 1. This Department of Energy (DOE) Standard (STD) has been approved for use by the Department of Energy, including the National Nuclear Security Administration (NNSA), and its contractors. Any reference to a document (e.g., DOE standards, orders, and guides) refers to the most current version.) 2. Beneficial comments (recommendations, additions, and deletions) and any pertinent data that may be of use in improving this document should be addressed to either one or both of the following: Richard Englehart Office of Nuclear and Facility Safety Policy EH22, 270 CC U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 Phone: (301) 903-3718 Facsimile: (301) 903-6172 Email: Richard.Englehart@eh.doe.gov Richard Black Office of Nuclear and Facility Safety Policy EH-22, 270 CC U. S. Department of Energy 19901 Germantown Road Germantown, MD 20874 Phone: (301) 903-0078 Facsimile: (301) 903-6172 Email: Richard.Black@eh.doe.gov 3. The 10 CFR Part 830 Rule imposes requirements for nuclear facility documented safety analyses (DSAs). The Department of Energy recognizes a benefit from guidance on the interpretation and implementation of this Order to provide safety assurance for all relevant facilities. This Standard represents a “safe harbor” for the preparation of a DSA. The Department of Energy safety management approach is built on a hierarchy of documents. At the top are safety policies. Next come safety requirements (Orders and Rules). Below these are safety guides that clarify the requirements. Technical standards, such as this document, support the guides by providing additional guidance into how the requirements should be met. DOE-STD-3009, “Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses,” was prepared to be consistent with the Rule requirements. To ensure that DSA developments will be used in compliance with the Rule, it is advised that this Standard be used in conjunction with the Rule. DOE-STD-3009-94 Page vii Guiding Principles This Standard incorporates and integrates many different approaches regarding DSA format and content. To ensure a consistent application of this Standard among users, the following guiding principles are provided. • The focus of this Standard is primarily on Hazard Category 2 and Hazard Category 3 facilities. • Hazard analysis and accident analysis are merged into one chapter (Chapter 3) to ensure that the proper emphasis is placed on identification and analysis of hazards. The hazard analysis distinguishes when accident analysis is required as a function of potential offsite consequence. Guidance for hazard and accident analysis is not based on probabilistic risk assessment (PRA). • Defense in depth, worker safety, and environmental issues are identified • Defense in depth as discussed in this Standard, consists of two components:

- Equipment and administrative features providing preventive or mitigative functions so that multiple features are relied on for prevention or mitigation to a degree proportional to the hazard potential. - Integrated safety management programs that control and discipline operation. • Guidance is provided for evaluating the safety of a facility for which documentable, deterministic design basis accidents (DBAs) do not exist in order to establish bounding accidents (derivative design basis accidents) that envelope the safety of existing facilities. Guidance is also provided on the treatment of beyond design basis accidents. • Distinction is made between “safety-class (SC) structures, systems, and components (SSCs),” and “safety-significant (SS) structures, systems, and components,” and the balance of facility structures, systems, and components. Safety-class structures, systems, and components are related to public protection and are defined by comparison with the numerical Evaluation Guideline (EG). (See Appendix A of this Standard for additional guidance.) Safety-significant structures, systems, and components are identified for specific aspects of defense in depth and worker safety as determined by the hazard analysis. Specific definitions are provided for these two terms. • Guidance is provided identifying Administrative Controls that are major contributors to defense in depth, which are designated as Specific Administrative Controls (SAC). This Standard, along with DOE-STD-1186 Specific Administrative Controls, provides guidance applicable to these types of controls. SACs provide preventive and/or mitigative functions for specific potential accident scenarios, which also have safety importance equivalent to engineered controls that would be classified as safety-class or safety- DOE-STD-3009-94 Page viii significant if the engineered controls were available and selected. • Consequences from normal operations are addressed in the Radiation Protection, Hazardous Material Protection, and Waste Management chapters. • Guidance is provided in each chapter on the application of the graded approach. • A common DSA format (chapter, title, and organization) for all nonreactor nuclear facilities is desirable but not essential. A table is to be provided by the preparer that indicates where the DSA requirements of 10 CFR 830 are addressed. Content needs to be flexible to allow for different facility types, hazard categories, and other grading factors. • Facility descriptive material is intentionally split to emphasize structures, systems, and components of major significance: - Chapter 2, “Facility Description,” provides a brief, integrated overview of the facility structures, systems, and components. - Chapter 4, “Safety Structures, Systems, and Components,” provides detailed information only for those structures, systems, and components that are safety class and safety significant. This application of the graded approach will provide for a significant reduction of DSA volume, while maintaining a focus on safety. • The programmatic chapters, including Chapter 6-17 provide a summary description of the key features of the various safety programs as they related to the facility being analyzed. These chapters are not meant to be used as the vehicle for the determination of adequacy of these programs. DOE-STD-3009-94 Page ix Contents

List of Figures ............................................................................................................ xvii List of Tables .............................................................................................................. xvii Definitions ................................................................................................................. xviii Abbreviations and Acronyms .................................................................................... xxiv Introduction to DOE-STD-3009 Purpose of DOE-STD-3009 ........................................................................................... 1 DSA Preparation Conceptual Basis and Process ............................................................ 2 Worker Safety .................................................................................................... 6 Defense in Depth ................................................................................................ 7 Safety Management Programmatic Commitments ............................................ 8 TSR and SSC Commitments .............................................................................. 9 Hazard Analysis ........................................................................................................... 11 Accident Analysis ........................................................................................................ 14 Application of Graded Approach ................................................................................. 14 DSA Preparation Guidance Executive Summary Purpose ......................................................................................................................... 16 Application of the Graded Approach ........................................................................... 16 Content Guidance E.1 Facility Background and Mission ................................................................... 16 E.2 Facility Overview ............................................................................................ 17 E.3 Facility Hazard Categorization ........................................................................ 17 E.4 Safety Analysis Overview ............................................................................... 17 E.5 Organizations .................................................................................................. 17 E.6 Safety Analysis Conclusions ........................................................................... 17 E.7 DSA Organization ........................................................................................... 17 CHAPTER ONE Site Characteristics Purpose ......................................................................................................................... 18 Application of the Graded Approach ........................................................................... 19 Content Guidance 1.1 Introduction ..................................................................................................... 19 1.2 Requirements ................................................................................................... 19 1.3 Site Description ............................................................................................... 19 DOE-STD-3009-94 Page x 1.3.1 Geography ........................................................................................................ 19 1.3.2 Demography .....................................................................................20

1.4 Environmental Description .............................................................................20 1.4.1 Meteorology .....................................................................................20 1.4.2 Hydrology .........................................................................................20 1.4.3 Geology ............................................................................................20 1.5 Natural Event Accident Initiators ...................................................................21 1.6 Man-made External Accident Initiators ..........................................................21 1.7 Nearby Facilities .............................................................................................21 1.8 Validity of Existing Environmental Analysis .................................................21 CHAPTER TWO Facility Description Purpose .........................................................................................................................22 Application of the Graded Approach ...........................................................................22 Content Guidance 2.1 Introduction .....................................................................................................23 2.2 Requirements ..................................................................................................23 2.3 Facility Overview ............................................................................................23 2.4 Facility Structure .............................................................................................23 2.5 Process Description .........................................................................................23 2.6 Confinement Systems .....................................................................................23 2.7 Safety Support Systems ..................................................................................24 2.8 Utility Distribution Systems ...........................................................................24 2.9 Auxiliary Systems and Support Facilities .......................................................24 CHAPTER THREE Hazard and Accident Analyses Purpose .........................................................................................................................25 Application of the Graded Approach ...........................................................................26 Content Guidance 3.1 Introduction .....................................................................................................28 3.2 Requirements ..................................................................................................28 3.3 Hazard Analysis ..............................................................................................28 3.3.1 Methodology ....................................................................................31 3.3.1.1 Hazard Identification .....................................................31 3.3.1.2 Hazard Evaluation..........................................................32 3.3.2 Hazard Analysis Results ...................................................................32 3.3.2.1 Hazard Identification .....................................................32 3.3.2.2 Hazard Categorization ...................................................32 3.3.2.3 Hazard Evaluation .........................................................33 DOE-STD-3009-94

Page xi 3.3.2.3.1 Planned Design and Operational Safety Improvements .................................................................38 3.3.2.3.2 Defense in Depth .............................................38 3 .3.2.3.3 Worker Safety .................................................42 3.3.2.3.4 Environmental Protection ................................43 3.3.2.3.5 Accident Selection ...........................................45 3.4 Accident Analysis ...........................................................................................48 3.4.1 Methodology ....................................................................................51 3.4.2 Design Basis Accidents ....................................................................51 3.4.2.X [Applicable DBA] ...............................................................52 3.4.2.X.1 Scenario Development ..................................53 3.4.2.X.2 Source Term Analysis ...................................53 3.4.2.X.3 Consequence Analysis ..................................53 3.4.2.X.4 Comparison to the Evaluation Guideline……53 3.4.2.X.5 Summary of Safety-Class SSCs and TSR Controls ......................................................53 3.4.3 Beyond Design Basis Accidents .....................................................54 CHAPTER FOUR Safety Structures, Systems, and Components Purpose .........................................................................................................................55 Application of the Graded Approach ...........................................................................55 Content Guidance 4.1 Introduction .....................................................................................................57 4.2 Requirements ...................................................................................................57 4.3 Safety-class Systems, Structures, and Components.........................................57 4.3.X [Applicable Safety-class System, Structure, or Component] ............57 4.3.X.1 Safety Function .....................................................................57 4.3.X.2 System Description ...............................................................58 4.3.X.3 Functional Requirements ......................................................58 4.3.X.4 System Eva luation ................................................................59 4.3.X.5 Controls (TSRs) ....................................................................59 4.4 Safety-significant Structures, Systems, and Components ...............................59 4.4.X [Applicable Safety-significant System, Structure, or Component] ........60 4.4.X.1 Safety Function .....................................................................60 4.4.X.2 System Description ...............................................................60 4.4.X.3 Functional Requirements ......................................................61 4.4.X.4 System Evaluation ................................................................61 4.4.X.5 Controls (TSRs) ....................................................................61 4.5 Specific administrative controls ......................................................................62 4.5.X [Applicable Specific Administrative Control] .......................................62

4.5.X.1 Safety Function .....................................................................62 4.5.X.2 SAC Description ...................................................................62 4.5.X.3 Functional Requirements ......................................................63 4.5.X.4 SAC Evaluation ....................................................................63 DOE-STD-3009-94 Page xii 4.5.X.5 Controls (TSR) ......................................................................64 CHAPTER FIVE Derivation of Technical Safety Requirements Purpose .........................................................................................................................65 Application of the Graded Approach ...........................................................................65 Content Guidance 5.1 Introduction .....................................................................................................66 5.2 Requirements ...................................................................................................66 5.3 TSR Coverage .................................................................................................66 5.4 Derivation of Facility Modes ..........................................................................67 5.5 TSR Derivation ...............................................................................................67 5.5.X [Applicable Hazard / Feature / TSR “X”] .............................................67 5.5.X.1 Safety Limits, Limited Control Settings, and Limiting Conditions for Operation .....................................................68 5.5.X.2 Surveillance Requirements .................................................68 5.5.X.3 Administrative Controls ......................................................68 5.6 Design Features ...............................................................................................69 5.7 Interface with TSRs from Other Facilities ......................................................69 CHAPTER SIX Prevention of Inadvertent Criticality Purpose .........................................................................................................................70 Application of the Graded Approach ...........................................................................70 Content Guidance 6.1 Introduction ......................................................................................................71 6.2 Requirements ....................................................................................................71 6.3 Criticality Concerns ..........................................................................................71 6.4 Criticality Controls ...........................................................................................71 6.4.1 Engineering Controls ........................................................................71 6.4.2 Administrative Controls ...................................................................72 6.4.3 Application of Double Contingency Principle .................................72 6.5 Criticality Safety Program ................................................................................72 6.5.1 Criticality Safety Organization .........................................................72 6.5.2 Criticality Safety Plans and Procedures ...........................................73 6.5.3 Criticality Safety Training ................................................................73 6.5.4 Determination of Operational Nuclear Criticality Limits .................73 6.5.5 Criticality Safety Inspections/Audits ...............................................73 6.5.6 Criticality Infraction Reporting and Follow-Up ...............................74

6.6 Criticality Instrumentation ...............................................................................74 DOE-STD-3009-94 Page xiii CHAPTER SEVEN Radiation Protection Purpose .........................................................................................................................75 Application of the Graded Approach ...........................................................................75 Content Guidance 7.1 Introduction .....................................................................................................76 7.2 Requirements ...................................................................................................76 7.3 Radiation Protection Program and Organization ............................................76 7.4 ALARA Policy and Program ..........................................................................76 7.5 Radiation Protection Training .........................................................................76 7.6 Radiation Exposure Control ............................................................................76 7.6.1 Administrative Limits ......................................................................77 7.6.2 Radiological Practices.......................................................................77 7.6.3 Dosimetry .........................................................................................77 7.6.4 Respiratory Protection ......................................................................77 7.7 Radiological Monitoring .................................................................................77 7.8 Radiological Protection Instrumentation .........................................................78 7.9 Radiological Protection Record Keeping ........................................................78 7.10 Occupational Radiation Exposures .................................................................78 CHAPTER EIGHT Hazardous Material Protection Purpose .........................................................................................................................79 Application of the Graded Approach ...........................................................................79 Content Guidance 8.1 Introduction .....................................................................................................80 8.2 Requirements ...................................................................................................80 8.3 Hazardous Material Protection Program and Organization .............................80 8.4 The ALARA Policy and Program ...................................................................80 8.5 Hazardous Material Training ..........................................................................80 8.6 Hazardous Material Exposure Control ............................................................81 8.6.1 Hazardous Material Identification Program .....................................81 8.6.2 Administrative Limits ......................................................................81 8.6.3 Occupational Medicine Programs .....................................................81 8.6.4 Respiratory Protection ......................................................................81 8.7 Hazardous Material Monitoring ......................................................................81 8.8 Hazardous Material Protection Instrumentation .............................................82 8.9 Hazardous Material Protection Record Keeping .............................................82 8.10 Hazard Communication Program ....................................................................82 8.11 Occupational Chemical Exposures ..................................................................82

DOE-STD-3009-94 Page xiv CHAPTER NINE Radioactive and Hazardous Waste Management Purpose ......................................................................................................................... 83 Application of the Graded Approach ........................................................................... 83 Content Guidance 9.1 Introduction ...................................................................................................... 84 9.2 Requirements .................................................................................................... 84 9.3 Radioactive and Hazardous Waste Management Program and Organization... 84 9.4 Radioactive and Hazardous Waste Streams and Sources ................................. 84 9.4.1 Waste Management Process ............................................................. 84 9.4.2 Waste Sources and Characteristics ................................................... 85 9.4.3 Waste Handling or Treatment Systems ............................................ 85 CHAPTER TEN Initial Testing, In-Service Surveillance, and Maintenance Purpose ......................................................................................................................... 86 Application of the Graded Approach ........................................................................... 86 Content Guidance 10.1 Introduction .......................................................................................................... 86 10.2 Requirements ........................................................................................................ 86 10.3 Initial Testing Program ......................................................................................... 87 10.4 In-Service Surveillance Program ......................................................................... 87 10.5 Maintenance Program .......................................................................................... 87 CHAPTER ELEVEN Occupational Safety Purpose ......................................................................................................................... 88 Application of the Graded Approach ........................................................................... 89 Content Guidance 11.1 Introduction .......................................................................................................... 89 11.2 Requirements ........................................................................................................ 89 11.3 Conduct of Operations ......................................................................................... 90 11.4 Fire Protection ...................................................................................................... 90 11.4.1 Fire Hazards ............................................................................................... 90 11.4.2 Fire Protection Program and Organization ................................................ 90 11.4.3 Combustible Loading Control ................................................................... 91 11.4.4 Fire Fighting Capabilities .......................................................................... 91 11.4.5 Fire Fighting Readiness Assurance ........................................................... 91 DOE-STD-3009-94 Page xv CHAPTER TWELVE Procedures and Training

Purpose ......................................................................................................................... 92 Application of the Graded Approach ........................................................................... 92 Content Guidance 12.1 Introduction .......................................................................................................... 93 12.2 Requirements ........................................................................................................ 93 12.3 Procedure Program ............................................................................................... 93 12.3.1 Development of Procedures ....................................................................... 93 12.3.2 Maintenance of Procedures ........................................................................ 93 12.4 Training Program ................................................................................................. 94 12.4.1 Development of Training ........................................................................... 94 12.4.2 Maintenance of Training ............................................................................ 94 12.4.3 Modification of Training Materials ........................................................... 94 CHAPTER THIRTEEN Human Factors Purpose ......................................................................................................................... 95 Application of the Graded Approach ........................................................................... 96 Content Guidance 13.1 Introduction .......................................................................................................... 96 13.2 Requirements ........................................................................................................ 96 13.3 Human Factors Process ........................................................................................ 96 13.4 Identification of Human-Machine Interfaces ....................................................... 97 13.5 Optimization of Human-Machine Interfaces ........................................................ 97 CHAPTER FOURTEEN Quality Assurance Purpose ......................................................................................................................... 98 Application of the Graded Approach ........................................................................... 98 Content Guidance 14.1 Introduction .......................................................................................................... 98 14.2 Requirements ........................................................................................................ 99 14.3 Quality Assurance Program Organization ............................................................ 99 14.4 Quality Improvement ........................................................................................... 99 14.5 Documents and Records ....................................................................................... 99 14.6 Quality Assurance Performance ........................................................................... 99 14.6.1 Work Processes .......................................................................................... 99 14.6.2 Design ........................................................................................................ 99 DOE-STD-3009-94 Page xvi

14.6.3 Procurement ............................................................................................. 100 14.6.4 Inspection and Testing for Acceptance .................................................... 100 14.6.5 Independent Assessment .......................................................................... 100 CHAPTER FIFTEEN Emergency Preparedness Program Purpose ....................................................................................................................... 101 Application of the Graded Approach ......................................................................... 101 Content Guidance 15.1 Introduction ........................................................................................................ 102 15.2 Requirements ...................................................................................................... 102 15.3 Scope of Emergency Preparedness .................................................................... 102 15.4 Emergency Preparedness Planning .................................................................... 102 15.4.1 Emergency Response Organization ......................................................... 102 15.4.2 Assessment Actions ................................................................................. 103 15.4.3 Notification .............................................................................................. 103 15.4.4 Emergency Facilities and Equipment ...................................................... 103 15.4.5 Protective Actions..................................................................................... 103 15.4.6 Training and Exercises ............................................................................ 103 15.4.7 Recovery and Reentry............................................................................... 103 CHAPTER SIXTEEN Provisions for Decontamination and Decommissioning Purpose ....................................................................................................................... 104 Application of the Graded Approach ......................................................................... 104 Content Guidance 16.1 Introduction ........................................................................................................ 105 16.2 Requirements ...................................................................................................... 105 16.3 Description of Conceptual Plans ........................................................................ 105 CHAPTER SEVENTEEN Management, Organization, & Industrial Safety Provisions Purpose ....................................................................................................................... 106 Application of the Graded Approach ......................................................................... 106 DOE-STD-3009-94 Page xvii Content Guidance 17.1 Introduction ........................................................................................................107 17.2 Requirements ......................................................................................................107 17.3 Organizational Structure, Responsibilities and Interfaces .................................107 17.3.1 Organization Structure .............................................................................107 17.3.2 Organizational Responsibilities ...............................................................107 17.3.3 Staffing and Qualifications ......................................................................107

17.4 Safety Management Policies and Programs ........................................................108 17.4.1 Safety Review and Performance Assessment ..........................................108 17.4.2 Configuration and Document Control .....................................................108 17.4.3 Occurrence Reporting ..............................................................................108 17.4.4 Safety Culture ..........................................................................................108 Appendix A, Evaluation Guideline A.1 Introduction ........................................................................................................ A-2 A.2 Evaluation Guideline .......................................................................................... A-2 A.3 Dose Comparison Calculation ............................................................................ A-3 A.3.1 Scenario Definition .................................................................................... A-4 A.3.2 Source Term Calculation ........................................................................... A-5 A.3.3 Dose Estimation ........................................................................................ A-6 A.4 Functional Classification Process ....................................................................... A-8 A.5 Additional Considerations .................................................................................. A-8 List of Figures Fig. I-1 DSA scope and integration ......................................................................................3 Fig. I-2 DSA preparation process .........................................................................................5 Fig. 3-1 Flowchart for performing a hazard analysis ............................................................30 Fig. 3-2 Worker safety evaluation .........................................................................................37 Fig. 3-3 A three-by-three likelihood and consequence ranking matrix for hazard evaluation ………………….44 Fig. 3-4 Flowchart for performing an accident analysis ……………………...50 List of Tables Table 3-1 Example process hazard analysis worksheet ...........................................................35 Table 3-2 Hazard analysis worksheet based on failure modes and effects analysis ………………………………………………………………36 Table 3-3 Qualitative severity classification table ……………………………..46 Table 3-4 Qualitative likelihood classification table ...............................................................46 Table 3-5 Qualitative ranking ................................................................................................47 DOE-STD-3009-94 Page xviii Definitions Notes: Origins of the definitions are indicated by references shown in “[ ]” (brackets). If no reference is listed, the definition originates in this Preparation Guide and is unique to its application. Accident. An unplanned sequence of events that results in undesirable consequences. Accident analysis. Accident analysis has historically consisted of the formal development of numerical estimates of the expected consequence and probability of potential accidents associated with a facility. For the purposes of implementing this Standard, accident analysis is a follow-on effort to the hazard analysis, not a fundamentally new examination requiring extensive original work. As such, it requires documentation of the basis for assignment to a given likelihood of occurrence range in hazard analysis and performance of a formally documented consequence analysis. Consequences are compared with the Evaluation Guideline to identify safety-class structures, systems, and components.

Administrative controls (ACs). Provisions relating to organization and management procedures, record keeping, assessment, and reporting necessary to ensure the safe operation of a facility. [10 CFR 830] Organization and management, procedures, recordkeeping, assessment, and reporting necessary to ensure safe operation of a facility consistent with the technical safety requirement. In general, the administrative controls section addresses (1) the requirements associated with administrative controls, (including those for reporting violations of the technical safety requirement); (2) the staffing requirements for facility positions important to safe conduct of the facility; and (3) the commitments to the safety management programs identified in the documented safety analysis as necessary components of the safety basis for the facility. [10 CFR 830 Appendix A] Beyond design basis accident. An accident of the same type as a design basis accident (e.g., fire, earthquake, spill, explosion, etc.) but defined by parameters that exceed in severity the parameters defined for the design basis accident. The same correlation applies to beyond derivative design basis accidents with regard to derivative design basis accidents. Decommissioning. Those actions taking place after deactivation of a nuclear facility to retire it from service and includes surveillance and maintenance, decontamination, and dismantlement. [10 CFR 830] Decontamination. The removal or reduction of residual radioactive and other hazardous materials by mechanical, chemical, or other techniques to achieve a stated objective or end condition. [10 CFR 830] Design basis. The set of requirements that bound the design of systems, structures, and components within the facility. These design requirements include consideration of safety, plant availability, efficiency, reliability, and maintainability. Some aspects of the design basis are important to safety, although others are not. DOE-STD-3009-94 Page xix Evaluation Guideline (EG). The radioactive material dose value that the safety analysis evaluates against. The Evaluation Guideline is established for the purpose of identifying and evaluating safety-class structures, systems, and components. On-site Evaluation Guidelines are not required for adequate documentation of a safety basis utilizing the overall process of this Standard. The Evaluation Guideline is discussed separately in Appendix A. Facility. Any equipment, structure, system, process, or activity that fulfills a specific purpose. Examples include accelerators, storage areas, fusion research devices, nuclear reactors, production or processing plants, coal conversion plants, magnetohydrodynamics experiments, windmills, radioactive waste disposal systems and burial grounds, environmental restoration activities, testing laboratories, research laboratories, transportation activities and accommodations for analytical examinations of irradiated and nonirradiated components. For the purpose of implementing this Standard, the definition most often refers to buildings and other structures, their functional systems and equipment, and other fixed systems and equipment installed therein to delineate a facility. However, specific operations and processes independent of buildings or other structures (e.g., waste retrieval and processing, waste burial, remediation, groundwater or soil decontamination, decommissioning) are also encompassed by this definition. The flexibility in the definition does not extend to subdivision of physically concurrent operations having potential energy sources that can seriously affect one another or which use common systems fundamental to the operation (e.g., a common glovebox ventilation exhaust header).

Fissionable materials. A nuclide capable of sustaining a neutron- induced chain reaction (e.g., uranium-233, uranium-235, plutonium-238, plutonium-239, plutonium-241, neptumium-237, americium-241, and curium-244). [10 CFR 830] Graded approach. The process of ensuring that the level of analysis, documentation, and actions used to comply with a requirement in this part are commensurate with: (1) The relative importance to safety, safeguards, and security; (2) The magnitude of any hazards involved; (3) The life cycle stage of a facility; (4) The programmatic mission of a facility; (5) The particular characteristics of a facility; (6) The relative importance of radiological and nonradiological hazards; and (7) Any other relevant factor. [10 CFR 830] Hazard. A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to personnel or damage to an operation or to the environment (without regard for the likelihood or credibility of accident scenarios or consequence mitigation). [10 CFR 830] DSAs specifically examine those hazards inherent in processes and related operations that can result in uncontrolled release of hazardous material (i.e., chemical or radiological) or process-unique energy sources (e.g., high pressure autoclave). Standard industrial hazards do not require DSA coverage. Standard industrial hazards such as burns from hot objects, electrocution, falling objects, etc., are of concern only to the DOE-STD-3009-94 Page xx degree that they can be a contributor to a significant uncontrolled release of hazardous material (e.g., 115-volt wiring as initiator of a fire) or major energy sources such as explosive energy. Hazard analysis. The determination of material, system, process, and plant characteristics that can produce undesirable consequences, followed by the assessment of hazardous situations associated with a process or activity. Largely qualitative techniques are used to pinpoint weaknesses in design or operation of the facility that could lead to accidents. The hazards analysis examines the complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to hazardous materials. Hazard categorization. Evaluation of the consequences of unmitigated releases to categorize facilities or operations into the following hazard categories: 1. Hazard Category 1: The hazard analysis shows the potential for significant offsite consequences. 2. Hazard Category 2: The hazard analysis shows the potential for significant onsite consequences. 3. Hazard Category 3: The hazard analysis shows the potential for only significant localized consequences. [10 CFR 830] DOE-STD-1027 provides guidance and radiological threshold values for determining the hazard category of a facility. DOE-STD-1027 interprets Hazard Category 1 facilities as Category A reactors and other facilities designated as such by the Program Secretarial Officer. Hazardous material. Any solid, liquid, or gaseous material that is toxic, explosive, flammable, corrosive, or otherwise physically or biologically threatening to health. Candidate hazards include radioactive materials, hazardous chemicals as defined by OSHA in 29 CFR 1910.1200 and 29 CFR 1910.1450; any material assigned a reportable quantity value in 40 CFR 302, Table 302.4; threshold planning quantities in 40 CFR 355 Appendix A; threshold planning quantities in 29 CFR 1910.119; level of concern quantities in EPA’s “Technical Guidance for Hazard Analysis—Emergency Planning for Extremely Hazardous Substances”; or materials rated as 3 or 4 in National Fire Protection Association 704 “Identification of the Fire Haza rds of Materials.”

Limiting conditions for operation (LCO). The limits that represent the lowest functional capability or performance level of safety-related structures, systems, and components required for safe operations. [10 CFR 830] Limiting control settings (LCSs). Settings on safety systems that control process variables to prevent exceeding a safety limit. [10 CFR 830] Mitigative feature. Any structure, system, or component that serves to mitigate the consequences of a release of hazardous materials in an accident scenario. [DOE-STD- 1027] Nonreactor nuclear facility. Those facilities, activities, or operations that involve, or will involve, radioactive and/or fissionable materials in such form and quantity that a nuclear or nuclear explosive hazard potentially exists to workers, the public, or the environment, but does not include accelerators and their operations and does not include activities involving DOE-STD-3009-94 Page xxi only incidental use and generation of radioactive materials or radiation such as check and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and X-ray machines. [10 CFR 830] Nuclear facility. A reactor or a nonreactor nuclear facility where an activity is conducted for or on behalf of DOE and includes any related area, structure, facility, or activity to the extent necessary to ensure proper implementation of the requirements established by 10 CFR 830. [10 CFR 830] Process Safety Management (PSM). A process or activity involving the application of management principles as defined in 29 CFR 1910.119, “Process Safety Management of High Hazardous Chemicals.” Programmatic. Reference to facility specific programs or site-wide programs necessary to ensure the safe operation of a facility. Radiation protection, hazardous material protection, quality assurance, training, document control, and emergency preparedness are examples of programs that provide programmatic controls to ensure safe operations. Preventive feature. Any structure, system, or component that serves to prevent the release of hazardous material in an accident scenario. [DOE-STD-1027] Public. All individuals outside the DOE site boundary. Risk. The quantitative or qualitative expression of possib le loss that considers both the probability that an event will occur and the consequences of that event. Safety analysis. A documented process: (1) to provide systematic identification of hazards within a given DOE operation; (2) to describe and analyze the adequacy of the measures taken to eliminate, control, or mitigate identified hazards; and (3) to analyze and evaluate potential accidents and their associated risks. Safety basis. The documented safety analysis and hazard controls that provide reasonable assurance that a DOE nuclear facility can be operated safely in a manner that adequately protects workers, the public, and the environment. [10 CFR 830] Safety-class structures, systems, and components (SC SSCs). Structures, systems, or components including portions of process systems, whose preventive and mitigative function is necessary to limit radioactive hazardous material exposure to the public, as determined from the safety analyses. [10 CFR 830] Safety limits (SLs). Limits on process variables associated with those safety-class physical barriers, generally passive, that are necessary for the intended facility functions and which are required to guard against the uncontrolled release of radioactive materials. [10 CFR 830]

Safety-significant structures, systems, and components (SS SSCs). Structures, systems, and components which are not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to defense in depth and/or worker safety as determined from safety analyses. [10 CFR 830] As a general rule of thumb, safety-significant SSC designations based on worker safety are limited to those systems, structures, or components whose failure is estimated to result in a prompt worker fatality or serious injuries or significant radiological or chemical exposures to workers. The term, serious injuries, as used in this definition, DOE-STD-3009-94 Page xxii refers to medical treatment for immediately life-threatening or permanently disabling injuries (e.g., loss of eye, loss of limb). The general rule of thumb cited above is neither an evaluation guideline nor a quantitative criterion. It represents a lower threshold of concern for which safety-significant SSC designation may be warranted. Estimates of worker consequences for the purpose of safety-significant SSC designation are not intended to require detailed analytical modeling. Considerations should be based on engineering judgment of possible effects and the potential added value of safety-significant SSC designation. [DOE G 420.1-1] [Note: Safety-significant SSC as used in this Standard distinguishes a specific category of SSCs other than safety-class SSCs. It should not be confused with the generic modifier “safety significant” used in DOE orders.] Safety structures, systems, and components (safety SSCs). The set of safety-class structures, systems, and components, and safety-significant structures, systems, and components for a given facility. [10 CFR 830] Site boundary. A well-marked boundary of the property over which the owner and operator can exercise control without the aid of outside authorities. For the purpose of implementing this Standard, the DOE site boundary is a geographic boundary within which public access is controlled and activities are governed by DOE and its contractors, and not by local authorities. A public road traversing a DOE site is considered to be within the DOE site boundary if, when necessary, DOE or the site contractor has the capability to control the road during accident or emergency conditions. Standard industrial hazards. Hazards that are routinely encountered in general industry and construction, and for which national consensus codes and/or standards (e.g., OSHA, transportation safety) exist to guide safe design and operation without the need for special analysis to design safe design and/or operational parameters. Specific administrative control (SAC). An administrative control is designated as a SAC if (1) it is identified in the documented safety analysis as a control needed to prevent or mitigate an accident scenario, and (2) it has a safety function that would be safety- significant or safety-class if the function were provided by an SSC. Technical safety requirements (TSRs). The limits, controls, and related actions that establish the specific parameters and requisite actions for the safe operation of a nuclear facility and include, as appropriate for the work and the hazards identified in the documented safety analysis for the facility: Safety limits, operating limits, surveillance requirements, administrative and management controls, use and application provisions, and design features, as well as a bases appendix. [10 CFR 830]

To satisfy the intent of this Standard, he administrative equivalent of TSRs should also be assigned for the conditions, the safe boundaries, and the management of administrative controls necessary to ensure the safe operation of the facility and to reduce the potential risk to the public and facility workers from uncontrolled releases of nonradiological hazardous material or energy. Such equivalents designated for control of nonradiological hazards are considered as important to safety as radiological TSRs, and are needed to satisfy the overall process outlined in this Standard for controlling the broad spectrum of hazards in accordance with the requirements of 10 CFR 830. Distinguishing between the DOE-STD-3009-94 Page xxiii radiological TSRs and their nonradiological equivalents may be necessary due to the potentially different regulatory enforcement structures associated with each. However, such distinction is beyond the scope of this Standard as the DSA only provides information to derive these controls, not formally define them. Accordingly, for the purposes of this Standard, no distinction is made between radiological TSRs and their nonradiological equivalents, and the term TSRs refers to both. TSRs for radiological hazards are formally defined in the separate TSR document required by 10 CFR 830. DOE-STD-3009-94 Page xxiv Abbreviations and Acronyms AC Administrative Controls ALARA As Low as Reasonably Achievable ARF Airborne Release Fraction ARR Airborne Release Rate CFR Code of Federal Regulations CSE Criticality Safety Evaluation D&D Decontamination and Decommissioning DBA Design Basis Accidents DOE U.S. Department of Energy DOE-STD DOE Standard DR Damage Ratio DSA Documented Safety Analysis EG Evaluation Guideline EH Office of Environment, Safety and Health EIS Environmental Impact Statement EM Office of Environmental Management EPA Environmental Protection Agency EPP Emergency Preparedness Plan ERPG Emergency Response Planning Guideline ES&H Environment, Safety, and Health FHA Fire Hazards Analysis FMEA Failure Modes and Effects Analysis G Guide HASP Health and Safety Plan HAZOP Hazard and Operational Analysis HDBK Handbook HEPA High Efficiency Particulate Air LCO Limiting Conditions for Operation LCS Limiting Control Setting LPF Leakpath Factor MAR Material at Risk MOI Maximally-exposed Offsite Individual DOE-STD-3009-94 Page xxv NEPA National Environmental Policy Act NFPA National Fire Protection Association NNSA Nationa l Nuclear Security Administration NRC Nuclear Regulatory Commission OSHA Occupational Safety and Health Administration OSR Operational Safety Requirement P&ID Process and Instrument Drawing PDSA Preliminary Documented Safety Analysis PHA Preliminary Hazard Analysis PRA Probabilistic Risk Assessment PrHA Process Hazards Analysis PSM Process Safety Management QAP Quality Assurance Program RF Respirable Fraction SAC Specific Administrative Control SC Safety Class SL Safety Limit SR Surveillance Requirement SRID Standards and Requirements Identification Documents SS Safety Significant SSC Structures, Systems, and Components STD Standard TEDE Total Effective Dose Equivalent TSR Technical Safety Requirements USQ Unreviewed Safety Question DOE-STD-3009-94 Page 1 Introduction This introduction addresses the following major topics related to implementing the requirements of 10 CFR 830. • Purpose of DOE-STD-3009—Indicates scope and general applicability of this Standard.

• DSA Preparation Conceptual Basis and Process – Ensures consistent and appropriate treatment of all DSA requirements for the variety of DOE nonreactor nuclear facilities. • Hazard Analysis—Provides final facility hazard categorization and considers and incorporates into programmatic requirements measures to protect workers, the public, and the environment from hazardous and accident conditions. Technical Safety Requirements and safety-significant structures, systems, and components, that are major contributors to worker safety and defense in depth, are identified in the hazard analysis. • Accident Analysis—Designates safety-class structures, systems, and components and safety controls (i.e., TSRs) as a function of the Evaluation Guideline (see Appendix A). • Application of the Graded Approach—Provides a consistent and measured treatment of this concept, including guidance on the minimum acceptable DSA content. PURPOSE OF DOE-STD-3009 This Standard describes a DSA preparation method that is acceptable to the DOE as delineated for those specific facilities listed in Table 2 of Appendix A, “General Statement of Safety Basis Policy”, to Subpart B, “Safety Basis Requirements”, of 10 CFR 830. It was developed to assist Hazard Category 2 and 3 facilities in preparing SARs that will satisfy the requirements of 10 CFR 830. Hazard Category 1 facilities are typically expected to be Category A reactors for which extensive precedents for SARs already exist. Guidance provided by this Standard is generally applicable to any facility required to document its safety basis in accordance with 10 CFR 830. For new facilities in which conceptual design or construction activities are in progress [i.e., Preliminary Documented Safety Analysis (PDSAs)] elements of this guidance may be more appropriately handled as an integral part of the overall design requirements process (e.g., preliminary design to design criteria). The methodology provided by this Standard focuses more on characterizing facility safety (i.e., back-end approach) with or without well-documented information than on the determination of facility design (i.e., front end approach). Accordingly, contractors for facilities that are documenting conceptual designs for PDSAs should apply the process and format of this Standard to the extent it is judged to be of DOE-STD-3009-94 Page 2 benefit. Beyond conceptual design and construction, the methodology in this Standard is applicable to the spectrum of missions expected to occur over the lifetime of a facility (e.g., production, shutdown/standby, decontamination and decommissioning). As the phases of facility life change, suitable methodology is provided for use in updating an existing DSA and in developing a new DSA if the new mission is no longer adequately encompassed by the existing DSA (e.g., a change from production operations to decontamination and decommissioning). This integration of the DSA with changes in facility mission and associated updates should be controlled as part of an overall safety management plan. A unique element of DSA documentation is the required provisions for decontamination and decommissioning (D&D) as discussed in Chapter 16 of this Standard. This forward looking aspect of facility operations is independent of facility mission and is intended to be a means of ensuring that current facility operations take into account D&D operations that will occur in the future.

For facilities transitioning into D&D, the safety basis of the D&D operations is documented throughout a DSA. This DSA, of which the principal emphasis is on the D&D operations themselves, provides the necessary analysis and supporting information to describe the facilities as they undergo shutdown, deactivation, decontamination, and decommissioning or dismantlement. The facility consists of the physical building, its constituent components, and the actual processes of D&D being performed. Physical buildings and constituent components targeted for D&D are briefly described in Chapter 2, “Facility Description.” Detailed descriptions are reserved for the actual D&D processes, which are the focus of evaluation in Chapter 3, “Hazard and Accident Analysis,” and Chapter 4, “Safety Structures, Systems, and Components,” for each stage of major configuration change. Also included are the temporary engineering and administrative controls used to maintain the safety basis. This description and evaluation would envelop major configurations during the D&D operations for which the authorization basis is sought. This is consistent with the intent of DSAs for operating facilities where all operations conducted are not detailed in the DSA. DSAs for D&D describe in Chapter 16, “Provisions for Decontamination and Decommissioning,” assurances that the D&D operations for which approval is being sought are effectively planned and will not result in future, unnecessary D&D activities (e.g., inadequate labeling of characterized hazardous material). DSA PREPARATION CONCEPTUAL B ASIS AND PROCESS The safety management programmatic requirements identified in 10 CFR 830, and illustrated in Figure I-1, form the boundaries within which the safety analysis is performed and represent the means of assuring safe operation of the facility. Hazard analysis and accident analysis are performed to identify specific controls and improvements that feed back into overall safety management. Consequence and likelihood estimates obtained from this process also form the bases for grading the level of detail and control needed in specific programs. The result is documentation of the safety basis that emphasizes the controls needed to maintain safe operation of a facility. DOE-STD-3009-94 Page 3 Figure I-1 DSA scope and integration DOE-STD-3009-94 Page 4 The DSA preparation process is illustrated in Figure I-2. The level of detail provided in the DSA depends on numerous factors. Applying the guidance for the graded approach in this Standard will assist the preparer in establishing an acceptable level of detail. The foundation for effectively preparing a DSA is the assembly and integration of an experienced preparation team. The size and makeup of the team depend on the magnitude and type of facility hazards and the complexity of the processes that are required to be addressed in the DSA. In determining the makeup of the preparation team, careful consideration should be given to the key hazard analysis activity. In general, the safety analysis base team should include, as a minimum, individuals experienced in process hazard and accident analyses, facility systems engineers, and process operators. Individuals with experience in specific subject matter such as nuclear criticality, radiological safety, fire safety, chemical safety, or process operations may be needed in the hazard analysis on a regular or as needed basis. Such individuals will typically be necessary in the development of programmatic DSA chapters as well. Consistent, accurate exchange of information among the team members is at least as important as the makeup of the team itself. This can be assured through meaningful integration of the required tasks.

Once team makeup is determined, base information needed to support DSA development is gathered. Maximum advantage should be taken of pertinent existing safety analyses and design information (i.e., requirements and their bases) that are immediately available, or can be retrieved through reasonable efforts. Other information arises from existing sources such as process hazards analyses (PrHAs), fire hazards analyses (FHAs), explosive safety analyses, health and safety plans (HASPs), environmental impact statements (EISs), etc. The need for additional or specific information becomes apparent throughout the hazard analysis process. The remaining key steps for efficient completion of the safety analysis and the DSA development process are: • Identify the DSA project functions using project information and ensure the team matches the functions that are required. • Perform hazard analysis to provide facility hazard classification, evaluate worker safety and defense in depth, and identify unique and representative accidents to be carried forward to accident analysis. Safety-significant SSCs, SACs and TSRs are designated in hazard analysis as well, with a preference given to safety-related SSCs over SACs. • Perform an accident analysis and assess the results to identify any safety-class SSCs, SACs and accident specific TSRs based on comparison of accident consequences to the Evaluation Guideline. • Develop the chapters for the DSA by providing information necessary to support the results of the safety analysis. These chapters detail the results of the analysis, describe the facility and the safety SSCs, and the safety management programs that relate to the facility safety basis. • Prepare the Executive Summary. DOE-STD-3009-94 Page 5 Figure I-2. DSA preparation process DOE-STD-3009-94 Page 6 The process of developing a DSA is a process that may require numerous iterations depending on the complexity of the facility and the level of detail required. The hazard and accident analyses (hazard analysis is adequate for Category 3 facilities) are the central elements of this process. The results of the hazard analysis form the basis for grading the level of detail necessary to ensure an acceptable DSA. The hazard analysis specifically identifies safety-significant SSCs and SACs for defense in depth and worker safety, and TSR controls. The results of the accident analysis form the basis for determining additional safety controls imposed on the facility (e.g., safety-class SSCs and TSRs) as a function of the Evaluation Guideline. These specific controls are then factored into overall safety management programs that ensure the operational discipline required by the hazards identified is maintained. Several specific topics are directly relevant to understanding the conceptual basis of this Standard. These topics are worker safety, defense in depth, programmatic commitments, SSC and TSR commitments, and correlation of this Standard to 10 CFR 830 requirements. The remainder of this section discusses each of these topics in discrete subsections. Worker Safety Workers, typically those in close proximity to operations, are the population principally at risk from potential consequences associated with Hazard Category 2 and 3 facilities. The DOE recognizes, via 10 CFR 830, the importance of including worker safety in safety analyses by specifically noting the worker as a population of concern. Developing a conceptual basis for the methodology used in this Standard requires answering the fundamental question of how worker safety is most appropriately addressed in the DSA.

The Occupational Health and Safety Administration (OSHA) has published 29 CFR 1910.119, “Process Safety Management of Highly Hazardous Chemicals.” OSHA defines the purpose of this regulation in summary fashion as, “Employees have been and continue to be exposed to the hazards of toxicity, fires, and explosions from catastrophic releases of highly hazardous chemicals in their workplaces. The requirements in this standard are intended to eliminate or mitigate the consequences of such releases.” Many of the topics requiring coverage in this federal regulation, such as design codes and standards, process hazard analysis, human factors, training, etc., are directly parallel to the requirements in 10 CFR 830. DOE O 440.1 and the OSHA standard address the issue of worker safety from process accidents by requiring the performance of hazards analyses for processes (exclusive of standard industrial hazards) in conjunction with implementation of basic safety programs that discipline operations and ensure judgments made in hazard analyses are supported by actual operating cond itions. These requirements effectively integrate programs and analyses into an overall safety management structure without requiring quantitative risk assessment. This integration and the basic concepts of Process Safety Management (PSM) described by OSHA regulations and the manuals and codes of practice described in DOE O 440.1 are philosophically accepted as appropriate for DSAs. This Standard effectively merges PSM principles with traditional DSA precepts. DOE-STD-3009-94 Page 7 Defense in Depth Defense in depth as an approach to facility safety has extensive precedent in nuclear safety philosophy. It builds in layers of defense against release of hazardous materials so that no one layer by itself, no matter how good, is completely relied upon. To compensate for potential human and mechanical failures, defense in depth is based on several layers of protection with successive barriers to prevent the release of hazardous material to the environment. This approach includes protection of the barriers to avert damage to the plant and to the barriers themselves. It includes further measures to protect the public, workers, and the environment from harm in case these barriers are not fully effective. The defense- in-depth philosophy is a fundamental approach to hazard control for nonreactor nuclear facilities even though they do not possess the catastrophic accident potential associated with nuclear power plants. In keeping with the graded-approach concept, no requirement to demonstrate a generic, minimum number of layers of defense in depth is imposed. However, defining defense in depth as it exists at a given facility is crucial for determining a safety basis. Operators of DOE facilities need to use the rigorous application of defense-in-depth thinking in their designs and operations. Such an approach is representative of industrial operations with an effective commitment to public and worker safety and the minimization of environmental releases. For high hazard operations, there are typically multiple layers of defense in depth. The inner layer of defense in depth relies upon a high level of design quality so that important systems, structures, and components will perform their required functions with high reliability and high tolerance against degradation. The inner layer also relies on competent operating personnel who are well trained in operations and maintenance procedures. Competent personnel translate into fewer malfunctions, failures, or errors and, thus, minimize challenges to the next layer of defense.

In the event that the inner layer of defense in depth is compromised from either equipment malfunction (from whatever cause) or operator error and there is a progression from the normal to an abnormal range of operation, the next layer of defense in depth is relied upon. It can consist of: (1) automatic systems; or (2) means to alert the operator to take action or manually activate systems that correct the abnormal situation and halt the progression of events toward a serious accident. Mitigation of the consequences of accidents is provided in the outer layer of defense in depth. Passive, automatically or manually activated features (e.g., containment or confinement system, deluge systems, filtered exhaust), and/or safety management programs (i.e., emergency response) minimize consequences in the event that all other layers have been breached. The contribution of emergency response actions to minimizing consequences of a given accident cannot be neglected as they represent a truly final measure of protection for releases that cannot be prevented. Structures, systems, or components that are major contributors to defense in depth are designated as safety-significant SSCs. Additionally, this Standard provides guidance on grading the safety management programs (e.g., radia tion protection, hazardous material protection, maintenance, procedures, training) that a facility must commit to compliance in order to establish an adequate safety basis. The discipline imposed by safety DOE-STD-3009-94 Page 8 management programs goes beyond merely supporting the assumptions identified in the hazard analysis and is an integral part of defense in depth. Administrative Controls (AC) that are major contributors to defense in depth are designated as Specific Administrative Controls (SAC) that are required for safety because they are the basis for validity of the hazard or accident analyses, or they provide the main mechanisms for hazard control. This Standard, along with DOE-STD-1186, “Specific Administrative Controls,” provides guidance applicable to these types of controls. SACs provide preventive and/or mitigative functions for specific potential accident scenarios, which also have safety importance equivalent to engineered controls that would be classified as safety-class or safety-significant if the engineered controls were available and selected. The established hierarchy of hazard controls requires that engineering controls with an emphasis on safety-related SSCs be preferable to ACs or SACs due to the inherent uncertainty of human performance. SACs may be used to help implement a specific aspect of a program AC that is credited in the safety analysis and therefore has a higher level of importance. In accordance with nuclear safety precepts, a special level of control is provided through use of TSRs. DOE Guide 423.1-1, “Implementation Guide for Use in Developing Technical Safety Requirements,” provides screening criteria for converting existing Technical Specifications and Operational Safety Requirements (OSRs) into TSRs. For the purposes of this Standard, the screening criteria are considered a generally reasonable set of criteria to designate TSRs for defense in depth. The safety items identified in the hazard analysis are examined against those criteria to identify a subset of the most significant controls that prevent uncontrolled release of hazardous materials and nuclear criticality. These TSR controls may be captured in operational limits or in administrative controls, including those on safety management programs. This collection of TSRs formally acknowledges features that are of major significance to defense in depth.

Safety Management Program Commitments Sections 10 CFR 830.204(b)(5) and 830.204(b)(6) of the Rule require that the DSA define the characteristics of the safety management programs necessary to ensure the safe operation of the facility. Program commitments (e.g., radiation protection, maintenance, quality assurance) encompass a large number of details that are more appropriately covered in specific program documents (e.g., plans and procedures) external to the DSA. The cumulative effect of these details, however, are recognized as being important to facility safety, which is the rationale for a top level program commitment becoming part of the safety basis. As appropriate to the hazard, the safety basis may identify specific controls (e.g., hazardous material inventory limits) that are required for safety. These controls should be considered for designation as a SAC as discussed in this Standard and DOE-STD-1186. The importance of the program commitments, which can be incorporated in TSRs as administrative controls, cannot be overestimated. The safety basis, however, includes only the top- level summary of program elements, not the details of the program or its governing documents. Inspection discrepancies in a program would not constitute violation of the safety basis unless the discrepancies were so gross as to render premises DOE-STD-3009-94 Page 9 of the summary invalid. By virtue of application of the graded approach, the majority of the engineered features in a facility will not be identified in the categories of safety-class or safety-significant SSCs even though they may perform some safety functions. However, such controls noted as a barrier or preventive or mitigative feature in the hazard and accident analyses must not be ignored in managing operations. Such a gross discrepancy would violate the safety basis documented in the DSA even if the controls are not designated safety-class or safety-significant, because programmatic commitments extend to these SSCs as well. For example, the commitment to a maintenance program means that the preventive and mitigative equipment noted as such in the DSA hazard analysis is included in the facility maintenance program. As a minimum, all aspects of defense in depth identified must be covered within the relevant safety management programs (e.g., maintenance, quality assurance) committed to in the DSA. The details of that coverage, however, are developed in the maintenance program as opposed to in the DSA. Facility operators are expected to have noted the relative significance of these engineered features and have provided for them in programs, in keeping with standard industrial practice, based on the importance of the equipment. It is the fact of coverage that is relevant to the facility safety basis. The details of this programmatic coverage (i.e., exact type of maintenance items and associated periodicities) are not developed in or part of the DSA. An overall commitment made in a DSA is that the contractor will not change the facility configuration underlying the documented safety basis without implementing and completing the unreviewed safety question (USQ) process. However, situations do occur where a USQ process is not necessary. For example, a stipulation to have a radiation protection program in the administrative control section of the TSR is a commitment; however, changes to specific program provisions do not require going through the USQ process. Further clarification of such interpretations can be found in DOE G 424.1-1, “Implementation Guide for Use in Addressing Unreviewed Safety Question (USQ) Requirements”.

DOE facilities that use and rely on site-wide, safety support services, organizations, and procedures, may summarize the applicable site-wide documentation provided its interface with the facility is made clear. The DSA then notes whether the reference applies to a specific commitment in a portion of the referenced documentation or is a global commitment to maintaining a program for which a number of details may vary without affecting the global commitment. Any documents referenced in the DSA are to be made available upon request. TSR and SSC Commitments In order to comply with 10 CFR 830, specific safety controls are to be developed in the DSA. In keeping with the graded-approach principle, distinctions are made to avoid wasting effort by providing detailed descriptions of all facility SSCs. While a basic descriptive model of the facility and its equipment must be provided in Chapter 2, “Facility Description,” highly detailed descriptions are reserved for two categories of SSCs comprising the most crucial aspects of facility safety. These two categories are safety-class SSCs and safety-significant SSCs. DOE-STD-3009-94 Page 10 Detailed descriptions are provided for safety-class and safety-significant SSCs and SACs in Chapter 4 of the DSA because of the importance of their safety functions. Descriptions result in the definition of functional requirements and associated performance criteria used to derive TSRs. TSRs are safety controls developed in accordance with the precepts of 10 CFR 830. TSR and SSC commitments encompass the following: Technical safety requirements. TSRs comprise: (1) safety limits (SLs); (2) operational limits consisting of limiting control settings (LCSs) and limiting conditions for operation (LCOs) and associated surveillance requirements (SRs); (3) ACs, (4) SACs, (5)use and application provisions, (6) design features, and (7) Bases Appendix. Based on the results of hazard and accident ana lysis TSRs are designated for: (1) safety-class SSCs and controls established on the basis of application of the Evaluation Guideline; (2) safety-significant SSCs; (3) defense in depth in accordance with the screening criteria of DOE G 423.1-1; and (4) safety management programs for defense in depth or worker safety. The Bases Appendix provides the linkage to the DSA. It is important to develop TSRs judiciously. TSRs should not be used as a vehicle to cover the many procedural and programmatic controls inherent in any operation. Excessive use of TSR limits to manage operations will result in distortion of the regulatory structure DOE is attempting to develop and will dilute the emphasis intended for the most critical controls. SLs should be limited in number and designated with caution. In accordance with Table 4 of Appendix A to Subpart B of 10 CFR 830, SLs are generally reserved for limits on process variables associated with those safety-class physical barriers, generally passive, that are necessary for the intended facility function and that are required to guard against the uncontrolled release of radioactive materials. The associated operating limits apply to active SSCs that prevent exceeding SLs. The only candidates for SLs should be safety-class SSCs and any non-SSC controls established on the basis of the application of the Evaluation Guideline. Nuclear industry precedent is that only a limited subset of safety-class SSCs, if any, require definition of associated SLs, which are intended to prevent significant accidents as opposed to mitigating their effects.

TSRs assigned for defense in depth or safety-significant SSCs do not have SLs and are not required to use operational limits (i.e., LCSs, LCOs). They should, however, receive coverage in the administrative control section of TSRs as a minimum. Judgment should be used to determine what controls warrant use of operational limits. When TSR administrative controls are used for purposes other than generic coverage of safety management programs (e.g., SAC), descriptions should be sufficiently detailed that a basic understanding is provided of what is controlled and why. Beyond safety-significant SSCs designated for worker safety and their associated TSR coverage, additional worker safety issues should be covered in TSRs only by administrative controls on overall safety management programs. Safety-class structures, systems, and components. The Rule defines safety-class designation for SSCs that are established on the basis of application of the Evaluation Guidelines. This designation carries with it the most stringent requirements (e.g., enhanced inspection, testing and maintenance, and special instrumentation and DOE-STD-3009-94 Page 11 control systems). Appendix A provides guidance for implementing the Evaluation Guideline to classify SSCs as safety-class SSCs. Safety-significant structures, systems, and components. This category of SSCs is provided to ensure that important SSCs will be given adequate attention in the DSA and facility operations programs. Safety-significant SSCs are those of particular importance to defense in depth or worker safety as determined in hazard analysis. Control of such SSCs does not require meeting the level of stringency associated with safety-class SSCs. The Evaluation Guideline is not used for designating safety-significant SSCs. Safety-class SSCs are designated to address public risk, which makes a dose guideline at the site boundary a useful tool. Safety-significant SSCs address risk for all individuals within the site boundary as well as additional defense in depth for the public, making a dose guideline at any one point an artificial distinction distorting the process of systematically evaluating SSCs. TSRs covering SSCs ensuring defense in depth should generally correlate with safety-significant SSC designation for defense in depth, but exact one-to-one correlation is not required. Specific administrative controls. This category of ACs is provided to ensure that controls important to safety that are needed to prevent or mitigate an accident scenario will be given equivalent attention in the safety basis documents had that safety function been provided by a safety-class or safety- significant SSC. Safety analyses shall establish the identification and functions of SACs and the significances to safety of the functions of the SAC. The established hierarchy of hazard controls requires that engineering controls with an emphasis on safety-related SSCs be preferable to ACs or SACs due to the inherent uncertainty of human performance. SACs may be used to help clarify and implement an AC. HAZARD ANALYSIS

The initial analytical effort for all facilities is a hazard analysis that systematically identifies facility hazards and accident potentials through hazard identification and hazard eva luation. The focus of the hazard analysis is on thoroughness and requires evaluation of the complete spectrum of hazards and accidents. This largely qualitative effort forms the basis for the entire safety analysis effort, including specifically addressing defense in depth and protection of workers and the environment. Basic industrial methods for hazard analysis, its interface with more structured quantitative evaluations, and the basis for both have been described in references such as the American Institute of Chemical Engineers Guidelines for Hazard Evaluation Procedures (1992). OSHA has accepted these guidelines as the standard for analytical adequacy in characterizing commercial chemical processes that perform the same type of unit operations conducted at DOE nonreactor nuclear facilities. Appropriately applied, they help fulfill the requirements of DSAs for Hazard Category 2 and 3 facilities as specified in 10CFR830. DOE-STD-3009-94 Page 12 The largely qualitative techniques described in the above reference on hazard ana lysis provide methodologies for comprehensive definition of the accident spectrum for workers and the public. The basic identification of hazards inherent in the process provides a broad, initial basis for identification of safety programs needed (e.g., radiation protection, hazardous chemical protection). The hazard analysis then moves beyond basic hazard identification to evaluation of the expected consequences and estimation of likelihood of accidents, an activity that in no way connotes the level of effort of a probabilistic or quantitative risk assessment. Throughout the evaluation process, preventive and mitigative SSCs, and SACs and pertinent elements of programmatic controls are identified. This identification also establishes functional requirements, which will subsequently delineate the technical information (i.e., response parameters) needed to establish performance criteria. The DSA summarizes these requirements and criteria for safety-class and safety-significant SSCs and SACs only. Refinement of the information obtained in hazard evaluation leads to overall definition of defense in depth, worker safety, and environmental protection. The most significant aspects of defense in depth and worker safety are subject to designation as safety-significant SSCs and coverage by TSRs. Other items noted are encompassed by the details of safety management programs (e.g., procedures, training, maintenance, quality assurance), which can be captured in top- level fashion in TSR administrative controls. However, programmatic administrative controls should not be used to provide preventive or mitigative functions for accident scenarios identified in the safety basis where the safety function has importance similar to, or the same as the safety function of safety-class or safety-significant SSCs. The classification of SAC was specifically created for this safety function. The hazard evaluation conducted to assess the accident spectrum associated with hazards germane to the DSA indicates the adequacy of programmatic efforts and provides input to programmatic activities whose discipline provides a significant margin of safety.

The process outlined above is self-grading for analytical effort. Analytical effort can be limited to a simple, resource efficient hazard analysis geared to facility needs, unless events are noted that are of sufficient complexity to require more detailed, quantitative evaluations to understand the basis for safety assurance. Implicit in this methodology is the statement of DOE-STD-1027 that the largely qualitative level of effort in hazard analysis is appropriate and sufficient for accident analysis of Hazard Category 3 facilities. It is again noted that the hazard analysis effort is not a quantitative risk assessment. Preparers (and subsequent reviewers) cannot expect the level of detail associated with a quantitative risk assessment in a hazard analysis, as the hazard analysis is focused on systematically assessing what can go wrong in a facility as opposed to deriving mathematical expressions of risk. The final purpose of hazard analysis is to identify a limited subset of accidents to be carried forward to accident analysis. Identification of DBAs in safety analysis and use of DBAs is appropriate in defining a facility safety basis. DBAs are accidents that are utilized to provide the design parameters for release barriers and mitigating systems. DBAs are a “front-end” device for designing individual equipment or systems to meet functional requirements, as evidenced by use of the phrase “utilized to provide the design parameters.” An accident can be defined as a DBA if relevant SSCs were specifically DOE-STD-3009-94 Page 13 designed to function during that accident and appropriate documentation of this fact exists. The range of accident scenarios analyzed in a DSA should be such that a complete set of bounding conditions to define the envelope of accident conditions to which the operation could be subjected are evaluated and documented. This necessitates the consideration of accidents other than DBAs for two cardinal reasons. First, even if DBAs exist, they may not adequately cover “the range of accident scenarios” needed to establish the facility safety basis. Secondly, DBAs may not cover a “complete set of bounding conditions.” Either of these conditions may arise for a number of reasons, such as the original design not being related to bounding conditions, the criteria for determining facility safety basis having significantly changed, operations or types of hazards having changed, or magnitude of hazards having increased. Any one of these reasons may make the DBA inadequate for determining a facility safety basis. The most obvious and extreme reason for examining accidents other than DBAs for existing facilities is a lack of design documentation. If appropriate design documentation is not available, postulated accidents are not DBAs. The front-end purpose of a DBA (i.e., “to provide the design parameters”) cannot be meaningfully addressed even if existing design parameters are estimated and used to develop an accident scenario. The reconstructed accident would not determine design parameters. It would be determined by them. The need to analyze a range of scenarios that bound conditions would not clearly be met by such an exercise. This potential lack of relevance is one of the reasons that the DSA is not the proper vehicle for formally filling gaps in existing design documentation.

Where DBAs do not exist, or do not adequately cover the range of scenarios or bounding conditions, surrogate evaluation bases are needed. These derivative DBAs are used to estimate the response of SSCs to “the range of accident scenarios” and stresses that bound “the envelope of accident conditions to which the facility could be subjected” in order to evaluate accident consequences. The derivative DBAs should take maximum advantage of the pertinent existing design information (i.e., requirements and bases) that is immediately available or can be retrieved through reasonable efforts. To the extent necessary, this information can be supplemented by testing, extrapolation, and engineering judgments. Existing facilities, like all industrial facilities, were generally built with standard process and utility SSCs with a high consideration for basic safety. For the majority of these facilities, adequate facility design and process information exist that, while not of the quality and detail expected for current conceptual design, is typical of many commercial processing operations, which comprise the majority of industrial practices. This information can be used in estimating SSC response to derivative DBAs whose evaluation will satisfy the requirements of safety analysis. For operational accidents, a derivative DBA is defined based on the physical possibility of phenomena as defined in the hazard analysis. Use of a lower binning threshold such as 10-6/yr is generally appropriate, but should not be used as an absolute cutoff for dismissing physically credible low probability operational accidents (e.g., red oil explosions) without any evaluation of preventive and mitigative features in hazard analysis. This distinction is made to prevent “pencil sharpening” at the expense of objective evaluation of hazards. Examples of a candidate derivative DBA would be an DOE-STD-3009-94 Page 14 ion exchange column or a red oil explosion at a facility where the phenomena is physically possible and documentation is not available substantiating ventilation and building confinement systems were specifically designed for such an occurrence. For natural event accidents, derivative DBAs are defined by a frequency of initiator based on DOE 420.1, “Facility Safety”, and its associated implementation standards. For external man-made accidents, derivative DBAs are assumed if the event can occur with a frequency >10-6/yr as conservatively estimated, or >10-7/yr as realistically estimated. Use of a frequency cutoff for external events represents a unique case for external events only, based on established Nuclear Regulatory Commission (NRC) precedents. For simplicity, use of the term DBA throughout this Standard is inclusive of both DBAs and derivative DBAs. ACCIDENT ANALYSIS The complete spectrum of accidents is examined in hazard analysis. A limited subset of accidents, (i.e., DBAs and derivative DBAs) that bound "the envelope of accident conditions to which the operation could be subjected" are carried forward to accident analysis where safety-class SSCs are designated by comparison of accident consequences to the Evaluation Guideline. These scenarios are the accidents requiring formal definition. Information obtained from specific accidents or representative accidents enveloping many small accidents is used to specify functional requirements for safety-class SSCs in Chapter 4.

An accident analysis is performed for the bounding accidents. Accident analysis in this Standard refers to the formal quantification (i.e., all assumptions identified and justified and individual computations presented or summarized) of accident consequences. The general binning estimates used in hazard analysis are adequate and representative of the level of effort desired for frequency determination. Accordingly, accident analysis need only document the basis used in hazard analysis for assigning accident likelihood to two- orders-of-magnitude bins. The quantified consequences are compared to the numerical Evaluation Guideline for the purpose of identifying safety-class SSCs and any accident specific assumptions requiring coverage by TSRs. APPLICATION OF THE GRADED APPROACH 10 CFR 830 prescribes the use of a graded approach for the effort expended in safety analysis and the level of detail presented in associated documentation. The graded approach applied to DSA preparation and updates is intended to produce cost efficient safety analysis and DSA content that provide adequate assurance to the DOE that a facility has acceptable safety provisions without providing unnecessary information. As described in 10 CFR 830, the graded approach adjusts the magnitude of the preparation effort to the characteristics of the subject facility based on seven factors: • The relative importance to safety, safeguards, and security; • The magnitude of any hazard involved; • The life cycle stage of a facility; DOE-STD-3009-94 Page 15 • The programmatic mission of a facility; • The particular characteristics of a facility; • The relative importance of radiological and nonradiological hazards; and • Any other relevant factor. The Rule provides for developing the DSA based on judgment of the facility in relation to these seven factors. For example, simple Hazard Category 3 facilities or facilities that have a short operational life may only require a limited but adequate analysis documented to a level less than that required for a Hazard Category 2 facility. In addition, facilities with short operational lives (or other compelling circumstances) should consider the appropriateness of using DOE-STD-3011 to meet the requirements of 10 CFR 830. On the opposite end of the spectrum, a complex Hazard Category 1 facility that is just going into operation requires extensive analysis and highly detailed documentation. The application of the graded approach may allow for much simpler analysis and documentation for some of these facilities. For facilities of little hazard, or hazards at the Hazard Category 3 level, for which only a modest reduction of risk is required, the DSA may be simple and short. In such cases all of the topics for the DSA listed in this Standard may not be necessary and with proper technical bases some topics may be omitted or reduced in the detail that would otherwise be required of Hazard Category 1 or 2 facilities. Thus, with application of the graded approach, DSAs for Hazard Category 3 facilities or facilities with short operational lives will normally require more simplified DSA analysis and documentation. Specific minimum levels of detail for these facilities are given in options #3 and #8 in Table 2 of Appendix A to 10 CFR 830 Subpart B and the graded approach section of each chapter in this Standard. As a minimum, a DSA would be found acceptable for a simple Hazard Category 3 facility if it used the methods in Chapters 2, 3, 4, and 5 of this Standard to address in a simplified fashion:

• The basic description of the facility and its operations, including safety structures, systems, and components; • A qualitative hazards analysis; and • The hazard controls (consisting primarily of inventory limits and safety management programs) and their bases. DOE-STD-3009-94 Page 16 Executive Summary PURPOSE. The DSA Executive Summary provides an overview of the facility safety basis and presents information sufficient to establish a top-level understanding of the facility, its operations, and the results of the safety analysis. It summarizes the facility safety basis as documented in detail in the remainder of the DSA. Expected products of this summary, as applicable based on the graded approach, include: • Summary of the facility background and mission. • Overview of the facility including location and boundaries. • Description of the facility hazard category. • Summary of the results of the facility safety analysis including operational hazards analyzed, DBAs, and significant preventive and mitigative features. • Summary of the acceptability of the facility safety basis. • Guide to the structure and content of the DSA (i.e., “road map”). APPLICATION OF THE GRADED APPROACH. This summary is intended as an overview of the facility safety basis and presents information sufficient to provide a basic understanding of the facility, operations, and results of safety analysis. It is prepared upon completion of all the other DSA chapters since it predominately draws upon the information in those chapters (see the Introduction and Figure 1-2). Information provided should be top- level in nature and avoid reproducing the details of material documented in subsequent chapters. CONTENT GUIDANCE FOR SECTIONS OF THE EXECUTIVE SUMMARY E.1 FACILITY BACKGROUND AND MISSION This section identifies the facility for which the DSA has been prepared and presents general information on the background of the facility as it relates to the stage of facility life cycle. Clearly present the current mission statement for which the DSA documents the safety basis (i.e., the purpose for which authorization is sought). Present any relevant information (e.g., short facility life cycle, anticipated future change in facility mission, approved DOE exemptions) impacting the extent of safety analysis documented in the DSA and briefly explain its impact in terms of application of the graded approach. DOE-STD-3009-94 Page 17 E.2 FACILITY OVERVIEW This section provides an overview of the facility, including the facility location, physical and institutional boundaries, relationship and interfaces with nearby facilities, facility layout, and significant external interfaces (e.g. utilities, fire support, and medical support). E.3 FACILITY HAZARD CATEGORIZATION This section provides a statement of the facility hazard category as determined in accordance with DOE-STD-1027. If determination of the hazard category relied upon segmentation of facility hazards, then provide a brief explanation of the technical basis for such segmentation. E.4 SAFETY ANALYSIS OVERVIEW This section provides an overview of the facility operations and the results of the facility safety analysis to include: • Description of the facility operations analyzed in the DSA. • Summary of the significant hazards associated with the facility processes including DBAs. • Summary of the main preventive and mitigative features relied upon in the facility safety basis. E.5 ORGANIZATIONS

This section identifies the prime contractors responsible for facility design and construction (e.g., architect-engineer), facility maintenance and operation, and any consultants, oversight groups, and outside service organizations with significant safety functions. This section should also identify participants, including consultants, participating in the DSA development process. E.6 SAFETY ANALYSIS CONCLUSIONS This section should provide a brief assessment of the appropriateness of the facility safety basis. As part of this summary, this section would identify any issues significant to the facility safety basis recognized by the facility operators to require further resolution, but for which delay in documenting the facility safety basis is not warranted or potential budgetary cons iderations require DOE involvement in a decision process requiring extensive study (e.g., backfit analysis). E.7 DSA ORGANIZATION This section provides a guide to the structure and content of the DSA, its chapters, and appendixes. If the main body of the DSA parallels the format delineated in this Standard, a simple statement to that effect will suffice. DOE-STD-3009-94 Page 18 Chapter 1 Site Characteristics PURPOSE. The purpose of this DSA chapter is to provide information necessary to support the safety basis requirements of 10 CFR 830. This chapter provides a description of site characteristics necessary for understanding the facility environs important to the safety basis. Information is provided to support and clarify assumptions used in the hazard and accident analyses to identify and analyze potential external and natural event accident initiators and accident consequences external to the facility. Expected products of this chapter, as applicable based on the graded approach, include: • Description of the location of the site, location of the facility within the site, its proximity to the public and to other facilities, and identification of the point where the Evaluation Guideline is applied. • Specification of population sheltering, population location and density, and other aspects of the surrounding area to the site that relate to assessment of the protection of the health and safety of the public. • Determination of the historical basis for site characteristics in meteorology, hydrology, geology, seismology, volcanology, and other natural events to the extent needed for hazard and accident analyses. • Identification of design basis natural events. • Identification of sources of external accidents, such as nearby airports, railroads, or utilities such as natural gas lines. • Identification of nearby facilities impacting, or impacted by, the facility under evaluation. • Validation of site characteristic assumptions common to safety analysis that were used in prior environmental analyses and impact statements, or of the need to revise and update such assumptions used in facility environmental impact statements. Existing supporting documentation is to be referenced. Include brief abstracts of referenced documentation with enough of the salient facts to provide an understanding of the referenced documentation and its relation to this chapter. DOE-STD-3009-94 Page 19

APPLICATION OF THE GRADED APPROACH. Hazard Category 3 facilities may not have the potential for resulting in significant radiological consequences beyond the immediate facility. Therefore, the description of site characteristics, as a minimum, locates the facility on the overall site, shows the facility boundaries, and identifies any other facilities that can significantly impact the facility being examined. For Hazard Category 3 facilities, onsite meteorological conditions, hydrology, population information, and offsite accident pathways are not typically required, since consequences are limited to the facility itself. Note, however, that if significant chemical hazards are present in a Hazard Category 3 facility that have the potential to cause significant offsite consequences, more information is necessary. For Hazard Category 2 facilities the emphasis of site characteristics description is focused within site boundaries unless hazards have the potential to cause offsite consequences of concern. For Hazard Category 2 facilities with the potential for an accident resulting in consequences of concern at the site boundary, site characteristics information is extended beyond the site boundary to support assessment of population dose, land contamination, and emergency planning external to the site. CONTENT G UIDANCE FOR SECTIONS OF CHAPTER 1 1.1 INTRODUCTION This section provides an introduction to the contents of this chapter based on the graded approach and includes objectives and scope specific to the chapter as developed. 1.2 REQUIREMENTS This section lists the design codes, standards, regulations, and DOE Orders that have been used for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. Standards and Requirements Identification Documents (SRIDs) may be referenced as appropriate. 1.3 SITE DESCRIPTION This section describes the site boundary and facility area boundary. 1.3.1 Geography This section provides basic geographic information, such as: • State and county in which the site is located. DOE-STD-3009-94 Page 20 • Location of the site relative to prominent natural and man-made features such as rivers, lakes, mountain ranges, dams, airports, population centers. • General location map to define the boundary of the site and show the correct distance of significant facility features from the site boundary. • Public exclusion areas and access control areas. • Identification of the point where the Evaluation Guideline is applied. • Additional detail maps, as needed, to present near plant detail, such as orientation of buildings, traffic routes, transmission lines, and neighboring structures. 1.3.2 Demography Population information based on recent census data is included to show the population distribution as a function of distance and direction from the facility. Demographic information emphasizes worker populations and nearby residences, major population centers, and major institutions such as schools, hospitals, etc., to the degree warranted by potential offsite consequences. The minimum area addressed is defined by the area significantly affected by the accidents analyzed in Chapter 3, “Hazard and Accident Analyses.” 1.4 ENVIRONMENTAL DESCRIPTION This section describes the site’s meteorology, hydrology, and geology.

1.4.1 Meteorology This section provides the meteorological information necessary to understand the regional weather phenomena of concern for facility operations and to understand the dispersion analyses performed. 1.4.2 Hydrology This section provides the hydrological information necessary to understand any regional hydrological phenomena of concern for facility operation and to understand any dispersion analyses performed. Include information on groundwater aquifers, drainage plots, soil porosity, and other aspects of the hydrological character of the site. Discuss or reference, to the degree necessary, the average and extreme conditions as determined by historical data to meet the intent of this section. 1.4.3 Geology This section provides the geological information necessary to understand any regional geological phenomena of concern for facility operation. Describe the nature of investigations performed and provide the results of the investigations. Include geologic history, soil structures, and other aspects of the geologic character of the site. DOE-STD-3009-94 Page 21 1.5 NATURAL EVENT ACCIDENT INITIATORS This section provides identification of specific natural events, such as design basis earthquakes considered to be potential accident initiators. Summarize assumptions supporting the analysis in Chapter 3, “Hazard and Accident Analyses.” 1.6 MAN-MADE EXTERNAL ACCIDENT INITIATORS This section provides identification of specific man-made external events associated with the site - events such as explosions from natural gas lines or accidents from nearby transportation activities - considered to be potential accident initiators, exclusive of sabotage and terrorism. Summarize assumptions supporting the analysis in Chapter 3, “Hazard and Accident Analyses.” 1.7 NEARBY FACILITIES This section identifies any nearby facilities that could be affected by accidents within the facility being evaluated. Conversely, this section also identifies any hazardous operations or facilities onsite or offsite that could adversely impact the facility under evaluation. Summarize assumptions supporting the analysis in Chapter 3, “Hazard and Accident Analyses.” 1.8 VALIDITY OF EXISTING ENVIRONMENTAL ANALYSES This section assesses the validity of site characteristic assumptions for existing environmental analyses and impact statements based on the more recent DSA effort. Simply state that no significant discrepancies exist or indicate the need to revise and update assumptions used in facility environmental statements through brief discussions summarizing major discrepancies. DOE-STD-3009-94 Page 22 Chapter 2 Facility Description PURPOSE. The purpose of this DSA chapter is to provide information necessary to support the safety basis requirements of 10 CFR 830. This chapter provides descriptions of the facility and processes to support assumptions used in the hazard and accident analyses. These descriptions focus on all major facility features necessary to understand the hazard analysis and accident analysis, not just safety SSCs. Expected products of this chapter, as applicable based on the graded approach, include: • Overview of the facility, its inputs and its outputs, including mission and history. • Description of the facility structure and design basis. • Description of the facility process systems and constituent components, instrumentation, controls, operating parameters, and relationships of SSCs. • Description of confinement systems.

• Description of the facility safety support systems. • Description of the facility utilities. • Description of facility auxiliary systems and support systems. Existing supporting documentation is to be referenced. Include brief abstracts of referenced documentation with enough of the salient facts to provide an understanding of the referenced documentation and its relation to this chapter. APPLICATION OF THE GRADED APPROACH. The development of this chapter for Hazard Category 2 and 3 facilities is an iterative process dependent on the development of the hazard and accident analyses. The facility description should provide a model of the facility that would allow an independent reader to develop an understanding of facility operations and an appreciation of facility structure and operations without extensive consultation of controlled references. The level of detail required in the facility description is based on the significance of preventive and mitigative features identified and the degree of facility context necessary to understand the analyses. For a Hazard Category 3 facility, provide a brief description of the facility, processes, and major SSCs. Grading will be based predominantly on complexity. This chapter does not include information at the level of functional requirements and performance criteria. That information is provided for safety SSCs only in Chapter 4. In the basic description of safety SSCs, their categorization as safety-class SSC or safety significant SSC should simply be noted. DOE-STD-3009-94 Page 23 CONTENT GUIDANCE FOR SECTIONS OF CHAPTER 2 2.1 INTRODUCTION This section provides an introduction to the contents of this chapter based on the graded approach and includes objectives and scope specific to the chapter as developed. 2.2 REQUIREMENTS This section lists the design codes, standards, regulations, and DOE Orders that are required for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. SRIDS may be referenced as appropriate. 2.3 FACILITY OVERVIEW This section includes a brief overview of the current and historical use of the facility, projected future uses, facility configuration, and the basic processes performed therein. 2.4 FACILITY S TRUCTURE This section provides an overview of the basic facility buildings and structures, including construction details such as basic floor plans, equipment layout, construction materials, controlling dimensions, and dimensions significant to the hazard and accident analysis activity. Supply information to support an overall understanding of the facility structure and the general arrangement of the facility as it pertains to hazard and accident analysis. 2.5 PROCESS DESCRIPTION This section describes the individual processes within the facility. Include details on basic process parameters, including summary of types and quantities of hazardous materials, process equipment, instrumentation and control systems and equipment, basic flow diagrams, and operational considerations associated with individual processes or the entire facility, including major interfaces and relationships between SSCs. The intent is to supply information to provide an understanding of the assessment of normal operations, the safety analysis and its conclusions, and insight into the types of operations for which a safety management program must be devised.

2.6 CONFINEMENT S YSTEMS This section identifies and describes the set of structures, systems, and components that perform confinement functions such as process vessels, glove boxes, ventilation systems, and facility walls. DOE-STD-3009-94 Page 24 2.7 SAFETY S UPPORT S YSTEMS This section identifies and describes the principal systems that perform safety support functions (i.e., safety functions not part of specific processes). State the purpose of each system and provide and overview of each system, including principal components, operations, and control function. Examples of systems under this heading might include fire protection, criticality monitoring, radiological monitoring (e.g., air monitoring, contamination prevention), chemical monitoring (e.g., hydrogen concentration monitoring), effluent monitoring, etc. Note: This section is designed to organize the presentation of information, not to designate any special class of equipment. 2.8 UTILITY DISTRIBUTION S YSTEMS This section provides a schematic outline of the basic utility distribution systems, including a description of the offsite power supplies and onsite components of the system. Details of systems are given, to the level necessary, for understanding the utility distribution philosophy and facility operations. 2.9 AUXILIARY S YSTEMS AND SUPPORT FACILITIES This section provides information on the remaining portions of that facility that have not been covered by the preceding sections and which are necessary to create a conceptual model of the facility as it pertains to the hazard and accident analyses DOE-STD-3009-94 Page 25 Chapter 3 Hazard and Accident Analyses PURPOSE. The purpose of this DSA chapter is to provide information that will satisfy the requirements of 10 CFR 830 to evaluate normal, abnormal, and accident conditions, including consideration of natural and man-made external events, identification of energy sources or process that might contribute to the generation or uncontrolled release of radioactive and other hazardous materials, and consideration of the need for analysis of accidents which may be beyond the design basis of the facility. This chapter describes the process used to systematically identify and assess hazards to evaluate the potential internal, man-made external, and natural events that can cause the identified hazards to develop into accidents. This chapter also presents the results of this hazard identification and assessment process. Hazard analysis considers the complete spectrum of accidents that may occur due to facility operations; analyzes potential accident consequences to the public and workers; estimates likelihood of occurrence; identifies and assesses associated preventive and mitigative features; identifies safety- significant SSCs; and identifies a selected subset of accidents, designated DBAs, to be formally defined in accident analysis. Subsequent accident analysis evaluates these DBAs for comparison with the Evaluation Guideline. This chapter covers the topics of hazard identification, facility hazard categorization, hazard evaluation, and accident analysis. Expected products of this chapter, as applicable based on the graded approach, include: • Description of the methodology for and approach to hazard and accident analyses. • Identification of hazardous materials and energy sources present by type, quantity, form, and location. • Facility hazard categorization, including segmentation in accordance with DOE- STD-1027.

• Identification in the hazard analysis of the spectrum of potential accidents at the facility in terms of largely qualitative consequence and frequency estimates. The summary of this activity will also include: — Identification of planned design and operational safety improvements. — Summary of defense in depth, including identification of safety-significant SSCs, SACs and other items needing TSR coverage in accordance with10 CFR 830. — Summary of the significant worker safety features, including identification of safety-significant SSCs and any relevant programs to be covered under TSR and administrative controls., including those controls designated as SACs. — Summary of design and operational features that reduces the potential for large material releases to the environment. DOE-STD-3009-94 Page 26 — Identification of the limited set of unique and representative accidents (i.e., DBAs) to be assessed further in accident analys is. • Accident analysis of DBAs identified in the hazard analysis. The summary of this activity will include for each accident analyzed, the following: — Estimation of source term and consequence. — Documentation of the rationale for binning frequency of occurrence in a broad range in hazard analysis (detailed probability calculations not required). — Documentation of accident assumptions and identification of safety-class SSCs based on the Evaluation Guideline. Existing supporting documentation is to be referenced. Include brief abstracts of referenced documentation with enough of the salient facts to provide an understanding of the referenced documentation and its relation to this chapter. APPLICATION OF THE GRADED APPROACH. The results of the hazard analysis provide a comprehensive evaluation of the complete DSA accident spectrum. This evaluation will be essentially qualitative in that its aim is to produce a well-reasoned and clear assessment of facility hazards and their associated controls. The focus of hazard analysis is on the completeness of consideration given to the accident spectrum, as opposed to a formalized definition of accident sequences and assumptions. Summary discussion of methodology is appropriate, but detailed bases for judgment and any simple mathematical estimates used in the hazard analysis to guide the judgments of the analysis for specific accident scenarios are not required to be formally documented in the DSA. For a small subset of accidents, the accident analysis documents individual calculations in the DSA, including references to its supporting documents. The accident analysis only needs to provide sufficient calculations to support a comparison to the Evaluation Guideline for the purpose of identifying safety-class SSCs. In general, a graded approach dictates a more thoroughly documented assessment of complex, high hazard facilities than simple, lower hazard facilities since grading is a function of both hazard potential and complexity. The basic elements of hazard identification, categorization, evaluation, and analysis are required for any facility preparing a DSA in accordance with 10 CFR 830. The graded approach for hazard analysis is a function of selecting techniques for hazard evaluation. The techniques used for hazard evaluation can range from simple checklists or What-If analyses to systematic parameter examinations such as Hazard and Operability Analyses (HAZOPs). The technique selected need not be more sophisticated or detailed than is necessary to provide a comprehensive examination of the hazards associated with the facility operations. For example, a simple storage operation may be adequately evaluated by a preliminary hazard analysis or a structured What-IF analysis. There is no obligation for the analysts to perform a complete HAZOP.

To achieve the objectives of analysis of accidents, the graded approach ranges from a hazard analysis to a detailed quantitative analysis where formally quantified event trees DOE-STD-3009-94 Page 27 and/or fault trees form the bases for physical phenomena modeling and engineering analysis. The level of analytical effort employed is primarily a function of magnitude of hazard, but also takes into account system complexity, and the degree to which detailed modeling can be meaningfully supported by system definition. For nonreactor nuclear facilities, these considerations do not support a need for probabilistic/qualitative risk assessment of overall facility operations. This Standard does not present an expectation of or a requirement for probabilistic/qua litative risk assessment. Additionally, in accordance with DOE-STD-1027, the hazard analysis as described in Section 3.3, “Hazard Analysis,” of this Standard is sufficient to meet the 10 CFR 830 requirements of accident analysis for Hazard Category 3 facilities. The hazard analysis should be adequate to provide a simple estimate of bounding consequences for Hazard Category 3 facilities. It must be kept in mind that Hazard Category 3 facilities may also have chemical hazards. The hazard classification mechanism used in DOE-STD-1027 does not consider the potential hazardous chemical releases. The results of the hazard analysis will indicate whether a facility contains significant chemical hazard(s) that may necessitate accident analysis. Accident analysis is also inherently graded in terms of the degree of physical modeling and engineering analysis needed to quantify accident consequences and likelihood. The use of bounding assumptions and less detailed physical modeling in accident analysis is appropriate. For example, where a given release has low consequences even if a filtered ventilation system is bypassed, detailed modeling of filtered release parameters such as filter differential pressure, plenum temperature, etc, is not needed for the given accident. Formal, quantitative analysis of potential accident sequences as described in Section 3.4, “Accident Analysis,” is not required to assess worker safety issues in addition to the hazard analysis. The largely qualitative hazard evaluation described in Section 3.3, which is a thorough analysis of potential accidents, is a more relevant vehicle for worker safety assurance. Additional guidance on hazard and accident may be gained from the following references: • Guidelines for Hazard Evaluation Procedures, American Institute of Chemical Engineers, 1992. • “Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports” DOE-STD-1027. • “Recommended Values and Technical Bases for Airborne Release Fractions (ARFs), Airborne Release Rates (ARRs), and Respirable Fractions (RFs) at DOE Non-Reactor Nuclear Facilities” DOE Handbook (HDBK)-3010. • Nuclear Fuel Cycle Facility Accident Analysts Handbook, Nuclear Regulatory Commission NUREG-1320. • “A Strategy for Occupational Exposure Assessment,” American Industrial Hygienists Association, 1991. • “Application of Hazard Evaluation Techniques to the Degree of Potentially Hazardous Industrial Chemical Processes,” National Institute of Occupational DOE-STD-3009-94 Page 28 Safety and Health No. 88-79897, March 1992. • 29 CFR 1910.119, “Process Safety Management of High Hazardous Chemicals.” CONTENT GUIDANCE FOR SECTIONS OF CHAPTER 3

3.1 INTRODUCTION This section provides an introduction to the contents of this chapter based on the graded approach and includes objectives and scope specific to the chapter as developed. 3.2 REQUIREMENTS This section lists the design codes, standards, regulations, and DOE Orders that are required for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. SRIDS may be referenced as appropriate. 3.3 HAZARD ANALYSIS This section describes the hazard identification and evaluation performed for the facility. The purpose of this information is to present a comprehensive evaluation of potential process related, natural events, and man-made external hazards that can affect the public, workers, and the environment due to single or multiple failures. Consideration will be given to all modes of operation, including startup, shutdown, and abnormal testing or maintenance configurations. As is standard industrial practice, examination of all modes of operation considers the potential for both equipment failure and human error. Hazard identification and evaluation provide a thorough, predominantly qualitative evaluation of the spectrum of risks to the public, workers, and the environment due to accidents involving any of the hazards identified. The evaluation identifies preventive and mitigative features, including identification of expected operator response to incidents (e.g., accident mitigation actions or evacuation) and provisions for operator protection in the accident environment (see Table 3-1, Action item/Comment column). A basic flowchart for hazard/accident analysis is provided in Figure 3-1. The major features of hazard analysis and the graded approach are captured in this figure. Hazard identification provides the basis for the final hazard categorization of the facility. That categorization is input for the graded approach for hazard evaluation. Hazard Category 3 facilities are not required to perform formal, quantitative accident analysis. DOE-STD-3009-94 Page 29 Figure 3-1 identifies the specific point where the analyst must move beyond the general outline of this Standard and use the graded approach to specifically determine appropriate hazard analysis methodology. Application of a graded approach is based on the judgment and experience of the analysts and results in the selection of a hazard evaluation technique such as Preliminary Hazard Analysis (PHA), HAZOP, etc. As previously noted, more elaborate techniques will generally be associated with more complex processes. Experience and capabilities of analysts are also a major consideration in efficient performance of a comprehensive hazard evaluation. Systematic application of the chosen techniques to the operations in a facility generates a number of basic accidents based on types of events and system performance in response to the events. These accidents can be binned in accordance with predefined consequence and frequency ranking thresholds. Products of the hazard evaluation include: • Identification of planned design and operational safety improvements. • Summary of defense in depth including identification of safety-significant SSCs and other items needing TSR coverage, including relevant programs covered under TSR administrative controls.

• Summary of significant worker protection features including identification of safety-significant SSCs and relevant programs covered under TSR administrative controls. • Summary of design and operational features that reduces the potential for large material releases to the environment. • Selection of a limited set of bounding accidents (i.e., DBAs) to be further developed in Section 3.4, “Accident Analysis.” DOE-STD-3009-94 Page 30 Figure 3-1. Flowchart for performing a hazard analysis. Yes DOE-STD-3009-94 Page 31 3.3.1 Methodology This section presents the methodology used to identify and characterize hazards and to perform a systematic evaluation of basic accidents. 3.3.1.1 Hazard Identification This subsection identifies the method used by analysts to identify and inventory hazardous materials and energy sources (in terms of quantity, form, and location) associated with the facility processes or associated operations (e.g., waste handling). This methodology first identifies sources of referenced information that are not an integral part of the DSA hazard identification. Possible sources of such information include fire hazard analyses, health and safety plans, job safety analyses, occurrence reporting histories, etc. The DSA covers worker safety issues related to hazards in processes and associated activities. It is not the intention of the DSA to cover safety as it relates to the common industrial hazards that make up a large portion of basic OSHA regulatory compliance. It is important not to expend DSA resources on those hazards for which national consensus codes and/or standards (e.g., OSHA regulations) already define and regulate appropriate practices without the need for special analysis. As noted in this Standard’s definition of “hazard,” standard industrial hazards are identified only to the degree they are initiators and contributors to accidents in main processes and activities. For example, worker electrocution from electrical wiring faults is not a DSA issue. However, the existence of 440 volt AC cabling in a glovebox would be identified as a potential accident initiator for a scenario (i.e., fire) involving hazardous materials. The distinction cited in the previous examples makes careful identification of hazards covered in the DSA essential so that potential worker hazards are not overlooked. As part of the identification process, the basis that was used in the hazard screening to remove standard industrial hazards or insignificant hazards from further consideration needs to be presented as well. For these cases, the DSA hazard analysis process interfaces with other programs such as specific topics of OSHA compliance or general industrial safety. These interfaces must be identified. Some of these compliance issues, while not presented in the DSA as such, may be a portion of a safety management program committed to by the facility. An example of this is the Health and Safety Plans required by OSHA in accordance with the Hazard Waste Operations and Emergency Response program. This could be one element of the “plans, procedures, and training for governing operations involving radioactive and hazardous waste” specified in Section 9.3, “Radioactive and Hazardous Waste Management Organization.” This subsection also indicates the sources from which information was obtained, such as flowsheet inventories, maximum historical inventories, vessel sizes, contamination analyses, etc. The interpretation of the data used to

DOE-STD-3009-94 Page 32 derive conservative inventory values needs to be provided. 3.3.1.2 Hazard Evaluation This subsection presents, in summary fashion, the basic approach and guidance used for generating the largely qualitative consequence and likelihood estimates in hazard evaluation. Reference detailed guidance as necessary. Additionally, present any screening logic used for binning accidents. The appropriateness of the overall methods used to evaluate hazards is presented and justified. This justification focuses on the selection of a technique for given processes, not justification from first principles of standard analysis methods, such as HAZOP. 3.3.2 Hazard Analysis Results 3.3.2.1 Hazard Identification This subsection presents the results of the hazard identification activity, either by direct inclusion of or by reference to the hazard identification data sheets. As a minimum, provide a summary table identifying hazards by form, type, location, and total quantity. The attributes of hazards identified in this section are the basis for subsequent hazard evaluation and accident analysis. Include in the basic set of hazards identified radionuclides, hazardous chemicals, flammable and explosive materials used or potentially generated in facility processes, and any mechanical, chemical, or electrical source of energy that may influence accident progression involving such materials. To provide a perspective on facility hazards, summarize in this subsection the major accidents or hazardous situations (e.g., fires, explosions, loss of confinement) that have occurred in the facility’s operating history. Specific details on each occurrence are not required. A general summary by type with emphasis on the major occurrences will suffice. 3.3.2.2 Hazard Categorization This subsection presents the results of the final hazard categorization activity specified in DOE-STD-1027. Include the facility hazard categorization and, where segmentation has been employed, the segment boundaries and individual segment classifications. Justify any segmentation in terms of independence. Where facility segmentation is used, provide the hazard breakdown by segment in the summary table required in Section 3.3.2.1. DOE-STD-3009-94 Page 33 3.3.2.3 Hazard Evaluation Hazard evaluation characterizes the identified hazards in the context of the actual facility and process. For example, simple hazard identification would be that 2000 grams of plutonium oxide are in a steel container under a hood waiting for entry into a glove box. One accident, which places this hazard in the actual context of facility parameters, involves spilling the container on the room floor. The hazard evaluation would qualitatively consider the action of moving the container into the glove box to evaluate the likelihood of spilling the contents. It would also consider mitigative features that would affect potential consequences. References such as Guidelines for Hazard Evaluation Procedures (1992) provide acceptable guidelines for selecting hazard evaluation techniques and generic lists of initiators that need to be incorporated in systematic evaluation with a given technique. Public and worker safety issues are the traditional focus of hazard evaluations. The DSA hazard evaluation also examines the potential for large-scale environmental contamination. The information on environmental contamination may be used in a separate cost-benefit analysis, not related to the DSA effort, to determine if additional preventive or mitigative features are needed in the facility.

Tables 3-1 and 3-2 provide two examples of hazard analysis output. Table 3-1 is an example of a portion of the evaluation of a hydrogen fluoride unloading operation. It identifies accident initiators, associated preventive and mitigative functions, and operational safety enhancements determined to be necessary. The parenthetical numbers in the table under the headings of “Cause,” “Consequence,” and “Frequency” distinguish a numbering system that serves to identify specific accident scenarios (i.e., cause #1 is an event that has been judged to have consequence #1 and frequency #1, resulting in the overall ranking aligned with frequency #1). The ranking (i.e., low, medium, and high) of estimated consequences and frequencies are based on judgment of analysts, and the overall binning rank is in accordance with the numbers assigned to the example in Figure 3-2. Table 3-1 demonstrates how a number of basic accidents can be identified and evaluated in a concise manner. The last column of Table 3-1 presents safety enhancements in the form of two procedural verifications and two action items for procedural alteration that were identified in the course of the evaluation. Table 3-1 also provides an example of how worker safety issues are integrated into this presentation. However, significant worker safety evaluations unrelated to the hazard scope defined for a DSA (i.e., standard industrial hazards) will be occurring outside the DSA. This reinforces the importance of the emphasis in Section 3.3.1.1, “Hazard Identification,” of identifying the dividing line between process/activity hazards covered in the DSA and those covered by direct OSHA regulatory compliance. Specifying the location of this dividing line is essential to developing an integrated safety posture where the functions of DSA hazard analysis vis-à-vis health and safety plans, job task DOE-STD-3009-94 Page 34 analyses, etc., is understood. Table 3-2, although not filled out, provides an example of another type of evaluation table. Whereas Table 3-1 is based more on a What- if or PHA-type approach, Table 3-2 is based on a failure modes and effects analysis (FMEA) approach. The basic outputs, however, remain unchanged. The second example is provided to indicate there is no one correct approach or presentation. The only constant is that effort needs to be expended only to the level necessary to basically characterize the accident spectrum. Hazard evaluation presents potential accidents in terms of hazards, energy sources, causes, preventive and mitigative features, consequence estimates, and frequency estimates. Where a large number of scenarios are involved, present simple summaries in the text of this chapter with detailed tables generated in the performance of the hazard evaluation included as an appendix to the DSA. Beyond the basic results, the individual subheadings (Sections 3.3.2.3.1 through 3.3.2.3.5) of Section 3.3.2.3, “Hazard Evaluation,” present organized summaries of specific topics of concern. DOE-STD-3009-94 Page 35 Table 3-1. Example process hazard analysis worksheet Facility: Example Refinery Date: 04/07/90 Page 3 of 30 Area: HF Alkylation Unit: Unloading HF from Supply Tanker Hazard Cause Protection and mitigative systems Consequence Frequency Ranking Action item/ Comment (1) Anhy- drous HF, 5,000 gallons. (2) <100 psi potential energy from nitrogen blanket. (1) Leak at connec- tion point. (2) HF hose ruptures.

(3) HF hose ruptures, flow not immedi- ately shut off. (4) Truck relief valve fails open. (5) Truck relief valve opens; over- pressure conditions. (6) Tanker failure from over- pressure. (7) N2 hose ruptures. (8) N2 hose ruptures, check valve fails. (9) HF line not swept after unloading. (A) Operators in chemical suits with respirators for emergency use. (B) Specific procedures, trained operators. (C) HF detectors. (D) HF line remote shutoff valve on truck. (E) Emergency relief valve capping kit available. (F) Two N2 pressure regulators. (G) Check valve on N2 gas line. Maximum N2 pressure less than tanker design pressure. (H) Emergency water deluge system. (1) Minor operator exposure – LOW. (2) Minor operator exposure off site <ERPG-2 – LOW. (3) Operator exposure, possibly ERPG-2 off site – MEDIUM. (4) Typically (a) LOW if capped. Possibly (b) MEDIUM if not capped and no deluge. (5) Typically (a) LOW if short duration. Possibly (b) MEDIUM if longer and no change. (6) Possible operator fatalities and ERPG-3 off site – HIGH. (7) N2 leak – LOW. (8) See item #5 above. (9) Minor operator exposure – LOW. (1) HIGH (2) MEDIUM (3) LOW (4) (a) MEDIUM (4) (b) LOW (5) (a) LOW (5) (b) LOW (6) LOW (7) MEDIUM (8) See #5 frequency (9) HIGH 4 2 3 2 3 1 3 6 2 See item #5 4 (1) Verify that procedures provide consistent leak- check on fitting. (2) Verify that procedures provide appropriately defined interaction between plant personnel and truck operators. (3) Area should be roped off and access controlled during unloading. (4) Specific evacuation routes for operators should be defined in procedures. DOE-STD-3009-94 Page 36 DOE-STD-3009-94 Page 37 Figure 3-2. Worker safety evaluation. Hazard Identification Hazard Analysis • Defense in depth • Environmental protection • Worker safety Worker safety controls • Administrative • SSCs Is control administrative or a SSC? Is it a safety significant SSC? Describe safety significant SSC (Chapter 4) Describe SAC (Chapter 4) Commitment to overall safety management programs Information sources external to DSA • Existing Process Hazards Analysis • Emergency Preparedness Plan (EPP) • Fire Hazards Analysis • Health and Safety Plan • Job Task Analysis • Occurrence reports/ lessons learned • Other Is it a SAC? SSC Administrative No No Yes Yes • TSR administrative controls as appropriate (Chapter 5) • Safety management (Chapters 7 – 17) TSR LCO format SAC or Directive Action Format SAC (see DOE-STD-1186) TSR operational limit DOE-STD-3009-94 Page 38 3.3.2.3.1 Planned Design and Operational Safety Improvements If the DSA preparer wants to make commitments to planned improvements not yet implemented (as a result of the hazard evaluation), this section will identify those major design and operational improvements. Summarize the basis for committing to the improvement and, if needed, any interim controls proposed until the improvement is implemented. Provide a general outline of the improvement intended to the degree it has been conceptually finalized. Due to capital costs, need for further study (e.g., technical issues, cost benefit), procurement lead times, or other complications, it may not be feasible to implement such design or operational improvements prior to DSA submittal. DOE does not desire to unduly delay DSA completion for such items, and numerous safety precedents acknowledge accepting work in progress. Accordingly, the facility operator may choose to commit to implementation of an improvement that is not reflected in current design or facility operations.

3.3.2.3.2 Defense in Depth This section summarizes significant aspects of defense in depth, and identifies associated safety-significant SSCs, SACs and other items needing TSR coverage. Include both the facility design and administrative features of defense in depth. Facility design germane to defense in depth typically includes SSCs that function as: • Barriers to contain uncontrolled hazardous material or energy release (e.g., metal dissolver vessel). • Preventive systems to protect those barriers (e.g., hydrogen detection, air purge, and shutdown systems for metal dissolver). • Systems to mitigate uncontrolled hazardous material or energy release upon barrier failure (e.g., ventilation zone confinement). Administrative features are typically linked to the overall safety management programs that directly control operations. Administrative features include the following aspects of operator interfaces: • Procedural restrictions or limits imposed. • Manual monitoring of critical parameters. • Equipment support functions. • Responses or actions counted on to limit abnormal conditions, accident progression, or potential personnel exposure. DOE-STD-3009-94 Page 39 The individual features that comprise defense in depth are identified in “Hazard Evaluation,” Section 3.3.2.3. Table 3-1 provides an example of how existing and proposed features (barriers to uncontrolled hazardous material or energy release) for specific operations are identified. The raw information in the hazard evaluation tables will be examined and distilled into an organized discussion of the elements of defense in depth. Relevant accidents may be used to frame and focus the discussion, but the hazard evaluation already provided in or appended to the DSA in tabular form should not be duplicated. Organize the presentation in a systematic manner (i.e., inner to outer) to clearly identify the layers of defense. Note that there is no requirement to demonstrate any generic, minimum number of layers of defense. The intent is to support the conclusion that defense in depth for a given hazard is commensurate with industrial practices for the relevant type of activity. Identify the broad purpose and importance of defense-in-depth features, not the details of their design or implementation. For example, a glovebox represents an aspect of defense in depth. Only its major features and interactions with other elements of defense in depth, such as ventilation zone confinement, need to be summarized. It is not necessary to discuss the individual penetration fittings, welded piping junctions, gloveport designs, etc., which allow the glovebox to function as designed. Likewise, if there is a procedural requirement for the operator to perform an action if a parameter is exceeded, it is not necessary to identify the exact procedure, the exact phrasing of the requirement, the specific details of how the operator accomplishes that action, etc. Stating the action, providing a brief summary of its rationale, and noting that both procedures and training needed to cover that action are sufficient. Safety-Significant SSCs Distinguish safety-significant SSCs from among those structures, systems, and components contributing to defense in depth. To effectively use the graded- approach concept, focus on the most important items of defense in depth whose failure could result in the most adverse uncontrolled releases of hazardous material. This Standard maintains that all SSCs with a safety function do not require classification as equipment requiring detailed description in the DSA (i.e., safety-class SSCs and safety-significant SSCs). As noted in the Introduction, this is one of the principle reasons for the emphasis on programmatic commitments.

The major features of defense in depth typically comprise the outer or predominant means of mitigating uncontrolled release of hazardous materials [e.g., ventilation system directing airflow to High Efficiency Particulate Air (HEPA) filters, overall building structure], any preventive features that are designed to preclude highly energetic events that potentially threaten multiple layers of defense in depth or essentially defeat any one layer (e.g., a hydrogen detector and purge flow interlock on a vessel that prevents a large hydrogen explosion, a sprinkler system that prevents a large fire that is physically possible for a type of operation), or any SSCs needed to insure the availability DOE-STD-3009-94 Page 40 of such preventive or mitigative functions (e.g., electrical power sources for ventilation). The total layers of defense in depth available are also key considerations in designating safety-significant SSCs. If many effective barriers are available, the significance of any one barrier is limited. If only one or two barriers can be realistically counted on, their individual significance increases. Likewise, if total hazardous material inventory is distributed over a hundred containers (e.g., waste drum storage pad, plutonium storage vault), the failure of any one container does not necessarily constitute a major uncontrolled hazardous material release, depending on the nature of the material and the design adequacy of the container. If all material is held in one container (e.g., 3000 gallon hydrogen fluoride storage tank), the failure of that container is of major concern in controlling the release of hazardous material. In the case where quantities of hazardous materials are being stored so that breached nuclear material storage packages might result from facility accident conditions, the containers themselves may need to be upgraded or another facility level method (secondary containment or confinement) considered for defense- in- depth. A principle reason for designating such major features as safety-significant SSCs is that they typically represent facility specific systems as opposed to more generic systems. While all glovebox line facilities use zone systems of ventilation for confinement, there is an enormous variation in the DOE complex with regard to specific design parameters such as number and types of exhaust systems, means of flow control, etc. Accordingly, more detailed descriptions of such equipment in a DSA is considered both appropriate and necessary for Hazard Category 2 facilities. Such description would not provide the same utility for relatively generic confinement items such as 55- gallon waste drums. The need for designation as a safety-significant SSC would also be superseded if that SSC was designated as a safety-class SSC in accident analysis. TSRs Summarize those safety-significant SSCs, SACs and other aspects of defense in depth that require TSR coverage. The scope of the TSR coverage is determined by the degree to which barriers or the facility-safety basis are seriously challenged. Vital, passive components such as piping, vessels, supports, structures, and containers would typically be considered design features. These components are discussed in the Design Features Section of the TSR document. For example, a glovebox is an obvious barrier to uncontrolled material release. The windows, gloves, and cable/piping connectors are all necessary to maintain the barrier, but do not specifically require operational limits or administrative controls as contributors to defense in depth.

DOE G 423.1-1 provides basic screening criteria to identify defense-in-depth DOE-STD-3009-94 Page 41 features/items that may require specific TSR coverage. Such features include instrumentation designed to detect significant barrier degradation; equipment that actuates or controls so as to reduce the likelihood of significant barrier challenges; process variables controlled for that purpose; and active controls that prevent criticality. Every control or indicator does not require specific TSR coverage. Likewise, every design feature malfunction or abnormal condition does not constitute a major barrier or facility safety basis degradation/challenge. Significant challenges to the facility safety basis are typically those events which have a genuine potential to seriously damage safety SSCs, require actuation of safety SSCs not on line as part of normal operations, or approach conditions TSR controls are designed to prevent. Significant barrier degradation is generally considered to mean substantial loss of barrier function resulting in significant hazardous material release to areas of personnel occupancy, or the occurrence of highly energetic events with the potential to damage multiple barriers. To further explore barrier degradation, consider a glovebox containing a dissolver vessel. A leak from the dissolver would not be a major degradation of overall confinement because: • It is a slow, low energy phenomenon where the primary vessel itself remains intact. • The release is into another layer of confinement not occup ied by personnel. Process upsets resulting in an eructation from the vessel would not be major degradation either. Even small, vapor space deflagrations that rupture vessel blowout ports would not be a major degradation if the glovebox itself would not sustain significant damage. In contrast, consider a large hydrogen deflagration or detonation that ruptures the vessel and piping, drives debris through the glovebox structural elements, and momentarily pressurizes the glovebox. This is a highly energetic event and multiple barriers have been damaged allowing a potentially significant release of hazardous material directly to occupied areas. Possible TSR coverage could include the maximum hydrogen concentration limits or requiring an air purge system to be functioning when the dissolver is operating. TSRs may also be provided for safety management programs in the form of TSR administrative controls to support adequate defense in depth. Such all- encompassing TSRs should be used in lieu of individual TSRs for numerous specific aspects of programs unless the control is significant to specific accident risk reduction. These administrative controls, designated as SACs, are addressed in the TSRs as limiting conditions for operation with surveillance requirements, or as specific directive action AC in the Administrative Controls section of the TSR. DOE Standard 1186 provides additional guidance for implementing SACs in TSRs. DOE-STD-3009-94 Page 42 3.3.2.3.3 Worker Safety This section summarizes the major features protecting workers from the hazards of facility operation, exclusive of standard industrial hazards. Summary products germane to worker safety typically include: • General overview of worker safety in terms of SSCs and administrative features. • Identification of any safety-significant SSCs and SACs. • Identification of any safety management programs that will be assigned TSR coverage in the form of administrative controls for adequate worker safety.

General prioritization of the features needs to be included and expressed in terms of the magnitude of process hazard, number of potentially affected employees, pertinent aspects of operation history, and projected lifetime of the process. Only a summary level discussion is required, not a detailed discussion or defense of the prioritiza tion logic. The safety features to be addressed in this section fall into one of three categories: • Structures, systems, and components. • Specific administrative controls. • Administrative features.. This subsection is derived from examining the raw information in the hazard evaluation tables (see Table 3-1 for example) and distilling it into a clear overview of worker safety features at the facility. This presentation may use relevant accidents to frame and focus the discussion, but need not duplicate the hazard evaluation already provided in or appended to the DSA in tabular form. If the basic function of a worker safety feature has already been discussed in Section 3.3.2.3.2, “Defense in Depth,” that feature may simply be identified by name and referenced. Identify structures, systems, and components as safety-significant SSCs where appropriate. As a general rule of thumb, safety-significant SSC designations based on worker safety are limited to those systems, structures, or components whose failure is estimated to result in a prompt worker fatality or serious injuries to workers or significant radiological or chemical exposures to workers (see definition of safety-significant SSCs for further clarification). Inadvertent worker exposure to materials from breached nuclear storage packages during inspections or handling may fit this description. Identify specific administrative controls important to safety that are needed to prevent or mitigate an accident scenario as appropriate. In general, SAC designations based on worker safety are limited to those administrative controls that would have been safety-significant had that safety function been provided by a safety-significant SSC. The established hierarchy of hazard controls requires that engineering controls with an emphasis on safety-related DOE-STD-3009-94 Page 43 SSCs be preferable to ACs or SACs due to the inherent uncertainty of human performance. Categorize administrative features in terms of the programmatic elements covered in later chapters of the DSA. With the exception of safety-significant SSCs, TSR designation is made in the form of administrative controls for overall programs only for worker safety. Typical safety-management programs include criticality protection, radiation protection, hazardous material protection, institutional safety provisions, procedures and training, operational safety, and emergency preparedness. Specifically note programs that will be provided TSR coverage as administrative controls in Chapter 5, “Derivation of Technical Safety Requirements.” Figure 3-3 shows how worker safety is addressed in the hazard analysis process. This subsection provides documented evidence that worker safety features are an integral part of facility design and operation, that basic facility operations for worker safety are adequate, and that workers are protected by a number of means including programs described elsewhere in the DSA (e.g., Chapters 7 and 8). It is emphasized again that this subsection is written at a summary level. Identify the broad purpose of features, but not the details of their design.

3.3.2.3.4 Environmental Protection This subsection summarizes the design and operational features that reduce the potential for large material releases to the environment. Document pathways for uncontrolled release of large amounts of hazardous materials to the environment identified in the hazard evaluation. Estimate potential consequences and preventive and mitigative features associated with specific pathways. If specific pathways have previously been addressed (e.g., Section 3.3.2.3.2, “Defense in Depth”), a reference is sufficient. DOE-STD-3009-94 Page 44 Low Medium High 4 2 1 3 5 Lo w M ed iu m H ig h Combination of conclusions from risk analysis that identify situations of major concern Combinations that identify situations of concern (Taken from EPA Technical Guidance for Hazards Analysis) Severity of consequences 6 8 9 7 lik el ih oo d of re le as e Figure 3-3. A three-by-three likelihood and consequence ranking matrix for hazard evaluation. DOE-STD-3009-94 Page 45 This subsection should conclude that no large release with the potential to cause significant environmental insult exists that an obvious and easily implemented design or operational change could minimize. For example, consider widespread river or groundwater contamination due to spills from the contents of a tank. It would not be an appropriate conclusion to accept such a risk if a simple dike around the tank would alleviate the problem and yet had not been installed. Conversely, consider the handling of plutonium in a facility with gloveboxes, ventilation zones of confinement, and HEPA filters. These measures would be adequate for closure of environmental contamination concerns for process accidents. In the majority of instances, process related TSRs and safety SSCs assigned for defense in depth might be sufficient to address environmental concerns. This subsection is not intended to present detailed, cost-benefit conclusions about the adequacy of design related to potential environmental contamination. It may serve as input to separate cost-benefit analysis to determine if additional preventive or mitigative features are to be added to the facility. However, such analyses are not related to the DSA effort. The numerical Evaluation Guideline and legal limits on normal operations [i.e., Environmental Protection Agency (EPA) regulations] inherently place an upper bound on potential environmental releases. Further, issues of environmental contamination are not direct safety issues. Safety SSC designations are not required for issues solely related to environmental protection. In accordance with 10 CFR 830, TSR designations are not required for such issues either. TSR designation associated with prevention of uncontrolled release of hazardous materials would typically be assigned for defense- in-depth considerations. 3.3.2.3.5 Accident Selection Accident analysis entails the formal quantification of a limited subset of accidents (i.e., DBAs). These accidents represent a complete set of bounding conditions. The identification of DBAs results from the hazard evaluation ranking of the complete spectrum of facility accidents. Figure 3-2 and Tables 3-3 through 3-5 provide examples of hazard evaluation ranking mechanisms. Two examples are provided to indicate there is more than one correct approach. The approach used at any specific facility is based on the detail needed for a given facility and the experience of the analysts. Figure 3-2 is a graphical example of a common three-by-three frequency and consequence ranking matrix. This particular example was used for evaluating airborne hazardous

DOE-STD-3009-94 Page 46 Table 3-3. Qualitative severity classification table. Descriptive Word Description No Negligible on-site and off-site impact on people or the environs. Low Minor on-site and negligible off-site impact on people or the environs. Moderate Considerable on-site impact on people or the environs; only minor off-site impact. High Considerable on-site and off- site impacts on people or the environs. Table 3-4. Qualitative likelihood classification table. Estimated annual Descriptive likelihood of word occurrence Description Anticipated 10-1>p>10-2 Incidents that may occur several times during the lifetime of the facility. (Incidents that commonly occur) Unlikely 10-2>p>10-4 Accidents that are not anticipated to occur during the lifetime of the facility. Natural phenomena of this probability class include: Uniform Building Code-level earthquake, 100-year flood, maximum wind gust, etc. Extremely 10-4>p>10-6 Accidents that will probably not Unlikely occur during the life cycle of the facility. This class includes the design basis accidents. Beyond Extremely 10-6>p All other accidents. Unlikely DOE-STD-3009-94 Page 47 Table 3-5. Qualitative ranking. Description Risk evaluation No impact or beyond extremely unlikely. Low severity and extremely unlikely. Moderate severity and extremely unlikely or low severity and unlikely. Acceptable High severity and extremely unlikely or low severity and anticipated. Moderate severity and Unlikely. Marginal Moderate severity and anticipated or high severity and unlikely.

High severity and anticipated. Unacceptable material releases. The logic behind Figure 3-2 is elaborated on in Tables 3-3 through 3-5, which provide a description of a four-by-four frequency and consequence-ranking matrix. Although differing in presentation and structural details, the philosophical basis and objectives for both examples are identical. The ranking schemes are designed to separate the lower risk accidents that are adequately assessed by hazard evaluation from higher risk accidents that may warrant additional quantitative analysis if the phenomena involved are not simplistic. A limited number of moderate risk accidents between the two extremes may also be identified for assessment. Tables 3-3 through 3-5 provide typical descriptions of consequence and likelihood thresholds for binning. Ranking should use broad bins. For example, frequency bins should typically cover two orders of magnitude. Although the exercise of binning is essentially qualitative, analysts often use a simple numerical basis for judgments to provide consistency. For example, a simple methodology for frequency binning would be to assign a probability of 1 to nonindependent events, 0.1 to human errors, and 0.01 to genuinely independent failures. Another methodology would be to use a summary of historical data. Likewise, before beginning the evaluation, a conservative Gaussian plume estimation of the amount of material needed outside the building to cause a certain dose might be performed to aid in defining thresholds of significance. Briefly discuss or reference any such guidelines in Section 3.3.1.2, “Hazard Evaluation.” Note, however, that the ranking of DOE-STD-3009-94 Page 48 frequency and consequence into such broad categories is more of a qualitative than a quantitative exercise. This effort does not constitute the need for, or expectation of, a probabilistic / quantitative risk assessment. An important factor in estimating binning thresholds for public consequences is to tie the thresholds to the Evaluation Guideline so that accidents that could challenge the guideline are correctly identified for formal accident analysis. The binning requirement of this subsection does not preclude the use of other sorting mechanisms in addition to risk sorting if an analyst finds such mechanisms useful. This accident selection activity identifies the process and criteria used to select the unique and representative potential accidents (i.e., DBAs) to be included in accident analysis. Unique accidents are those with sufficiently high-risk estimates that individual examination is needed (e.g., a single fire whose specific parameters result in approaching the Evaluation Guideline, situations of major concern from Figure 3-2). Representative accidents bound a number of similar accidents of lesser risk (e.g., the worst fire for a number of similar fires, situations of concern in Figure 3-2). Representative accidents are examined to the extent they are not bounded by unique accidents. In any case, at least one bounding accident from each of the major types determined from the hazard analysis (e.g., fire, explosion, spill, etc.) should be selected unless the bounding consequences are “Low” (See Figure 3-2). Accidents are identified and listed by accident category (i.e., internally and externally initiated) and type (e.g., fire, explosion, spill, etc.).

Since the hazard analysis activity is considered sufficient for Hazard Category 3 facilities, DSAs for these facilities need simply summarize the maximum consequences expected from facility operation and state that detailed accident quantification is not necessary because potential consequences are well below the Evaluation Guideline. A possible exception to this case, as previously noted, is a facility with Hazard Category 3 quantities of radionuclides but possessing large amounts of toxic chemicals. Such facilities need to summarize the maximum radiological consequences expected and identify the chemical accidents selected for accident analysis. 3.4 ACCIDENT ANALYSIS This section presents the formal development of the potential accidents identified in Section 3.3.2.3.5, “Accident Selection,” beginning with a formal sequence of developing connecting initiating events to preventive feature and mitigative feature responses. A basic flowsheet for accident analysis is presented in Figure 3-4. The principal purpose of the accident analysis is to identify any safety-class SSCs, SACs and TSRs needed for protection of the public. Each accident sequence needs to be analyzed through the use of a documented, deterministic, DBA. Whenever possible, DBAs are analyzed using the simplest applicable deterministic, phenomenological calculations (e.g. pressure estimates from a simple ideal gas law calculation, hand calculated Gaussian plume DOE-STD-3009-94 Page 49 dispersions). The nondeterministic aspects of DBA analysis are simplified by estimating overall sequence frequencies in broad frequency ranges in hazard analysis. This process is considered sufficient for DSA purposes and accident analysis need only document the basis for the binning performed in hazard analysis. Detailed probabilistic calculations are neither expected nor required. Natural events and man-made external events are special cases. Natural event DBAs are those events with a phenomenon initiating frequency as specified in DOE 420.1 and its applicable standards. External events are not typically design bases for facilities. However, they will be referred to as DBAs and analyzed as such if frequency of occurrence is estimated to exceed 10-6/yr conservatively calculated, or 10-7/yr realistically calculated. Accident analysis typically starts with formal descriptions of accident scenarios. Basic event trees may support such descriptions. All major assumptions in scenarios must be identified. The next step is determination of accident source terms. Source terms for accidents are obtained through phenomenological and system response calculations. Once a source term has been determined, consequences due to atmospheric dispersion or other relevant pathways of concern are determined. As with every phase of the analysis, the effort expended is a function of the estimated consequence. If the source term is small, a simple, dispersion hand calculation for consequences would be sufficient. If source terms are large, computer modeling to determine consequences may be required. The consequences finally determined are compared to the Evaluation Guideline (see Appendix A). From this activity, it is determined if safety-class SSC designation is needed. The need for accident specific TSRs to meet the Evaluation Guideline will also be determined. Detailed description of safety- class SSCs, SACs and TSRs are presented in Chapter 4, “Safety Structures, Systems, and Components,” and Chapter 5, “Derivation of Technical Safety Requirements.” The nature of the accidents to be analyzed will vary depending upon the facility and processes considered. However, it is anticipated that for most facilities or processes, the number of accidents requiring formal analysis will not be large. The categories of DBAs examined are:

• Operational accidents (caused by initiators internal to the facility). • Natural events (e.g., earthquakes, tornadoes). • Man-made external events (caused by man-made initiators external to the facility). All assumptions made in the accident analysis (i.e., defining points in scenario progression) are to be validated as part of the accident analysis activity. DOE-STD-3009-94 Page 50 Figure 3-4. Flowchart for performing and accident analysis. For example, if an operator is supposed to push Button Z to stop an accident progression, the accident analysis needs to make it clear that the operator can actually do so. Making it clear may simply involve noting there is no physical phenomena associated with the accident that would preclude him from doing so. Likewise, basic assurance must be provided that equipment relied upon in unusual or severe environments will function. This assurance does not constitute the need for or expectation of full, formal environmental qualification. The above guidance is not meant to imply that the DSA must contain detailed validations for all assumptions. The DSA needs to present information at a level that is considered sufficient for review and approval of the DSA. Referencing an auditable trail of information as part of the controlled supporting documentation is acceptable. DOE-STD-3009-94 Page 51 3.4.1 Methodology This section summarizes the methods used to quantify the consequences of operational accidents, natural external events, and man-made external events selected in Section 3.3.2.3.5, “Accident Selection.” Identify and describe any computer programs used to implement methods discussed below. Include in the description the origin of the code, its precedent for use, input data, the range of variables investigated, the basic analytical models, their interrelationships, and the progression of the analysis. Briefly summarize and reference detailed information on algorithms, computational and analytical bases, and software quality assurance measures. Documentation of methodology should include the following: • Methods used to estimate radiological or other hazardous material source terms for DBAs including: (1) basic approach for estimating physical facility damage from DBAs; (2) general basis for assigning material-atrisk quantities not directly derived from hazard identification, if differing values are used; and (3) basis for material release and respirable fractions or release rates used. • Methods used to estimate dose and exposure profiles including assumptions on variables such as meteorological conditions, time dependent characteristics, activity, and release rates or duration for radioactive or other hazardous materials that could be released to the environment. 3.4.2 Design Basis Accidents This section analyzes DBAs for each of the major categories to quantify consequences and compare them to the Evaluation Guideline. The major categories are: internally initiated operational accidents (e.g., fires, explosions, spills, criticality); natural events for the site (e.g., earthquakes, tornadoes) that could affect the facility; and man-made externally initiated events such as airplane crashes, transportation accidents, adjacent facility events, etc., that can either cause releases at the facility under examination or have a major impact on facility operations. Beyond DBAs are discussed in Section 3.4.3, “Beyond Design Basis Accidents.”

Quantification methods are typically limited to calculating the dose profile of a release. The process is iterative, starting by taking no credit for mitigative features and comparing results to the Evaluation Guideline. Continue taking credit for additional mitigative features incrementally and comparing the results to the Evaluation Guideline until below the guideline. This iterative process, however, does not require denying the physical design of facility structures, systems, and components. For example, if liquid hazardous material is brought into a facility in steel piping and stored in steel tanks, it is not meaningful to disregard the existence of these physical features in analysis. Simply admitting they exist does not require safety-class SSC designation either. Stated another DOE-STD-3009-94 Page 52 way, facilities should be analyzed as they exist when quantifying meaningful release mechanisms. Note: The following format is repeated sequentially for each (“X”) DBA. 3.4.2.X [Applicable DBA] Identify the DBA by individual title, category (i.e., operational, natural, man- made external) and general type (e.g., fire, explosion, spill, earthquake, tornado). 3.4.2.X.1 Scenario Development This subsection describes accident progression linking initiating events with preventive and mitigative events and other contributing phenomena to formally define the accidents identified in Section 3.3.2.3.5, “Accident Selection.” Note each response, action, or indication required to initiate action that is relevant to the scenario progression. Document the rationale used in hazard analysis for binning the DBA in a broad frequency range. When summarizing the initiating event for a given natural event DBA, use DOE 420.1 and its applicable standards (i.e., DOE-STD-1020 through -1024) to determine the natural event DBAs for the facility. Design basis guidelines include, among others, load factors, return periods, amplification factors for the facility, etc. Summarize facility and equipment response (emphasizing preventive or mitigative equipment) to the loads postulated to be present at the time the given natural event occurs. Reference the facility documentation of this evaluation and summarize relevant assumptions. Discuss the degree of conservatism of the evaluation. Evaluate secondary events directly caused by natural events, such as earthquake induced fires, based on their physical possibility for facility conditions (i.e., the induced accident must already potentially exist in the absence of the seismic event). For example, seismic induced fires should be considered DBAs where significant accumulations of flammable material are exposed to fire initiators by seismic damage to the facility. If minimal combustible material is present in a given location, a large seismic induced fire in that location would not be a DBA as the potential is not physically possible. Although external events are not typically design bases, this Standard considers them as DBAs if the frequency of occurrence is estimated to exceed 10-6/yr conservatively calculated, or 10-7/yr realistically calculated. The specific use of this NRC frequency precedent is limited to external events only due to their unique nature. External events are presented because frequency criteria for inclusion are met. Accordingly, the analysis that substantiates frequency need only be referenced. DOE-STD-3009-94 Page 53 3.4.2.X.2 Source Term Analysis

This subsection determines the accidental material or energy released through the pathways of concern. Define all parameters and phenomenological models used to derive the source term. As a minimum, this definition includes the material at risk (as derived from the hazard identification), the release fraction or rate that determines the initial source term, and the overall facility leakpath factors that determine the final source term released external to the facility. The degree of conservatism believed to be present in the calculation needs to be consistent with the Evaluation Guideline definition. Detailed quantification of uncertainty is not required. 3.4.2.X.3 Consequence Analysis This subsection determines the receptor doses associated with the relevant pathways. Derive the doses in accordance with the definition of the Evaluation Guideline. The information derived from the hazard and accident analyses related to protection of the public and potential insights gained for environmental contamination issues needs to be compared to the facility National Environmental Policy Act (NEPA) documentation to ensure that no significant discrepancies exist between the DSA and that documentation. 3.4.2.X.4 Comparison to the Evaluation Guideline This subsection compares the unmitigated receptor dose for the accident sequence to the Evaluation Guideline. If the Evaluation Guideline is exceeded, provide a summary assessment of the significance of the exceedance and administrative and/or engineered controls whose implementation would prevent or mitigate the accident sequence. Detailed cost-benefit analyses to evaluate potential changes are beyond the scope of the DSA. 3.4.2.X.5 Summary of Safety-Class SSCs, SACs and TSR Controls This subsection identifies the safety-class SSCs (or equivalent SAC) and assumptions judged to require TSR coverage. Any TSR assumption not directly related to exceeding of the Evaluation Guideline should be defined in section 3.3.2.3.2, “Defense in Depth.” For details, refer to Chapter 4, “Safety Structures, Systems, and Components,” and Chapter 5, “Derivation of Technical Safety Requirements.” DOE-STD-3009-94 Page 54 3.4.3 Beyond Design Basis Accidents The Rule requires consideration of the need for analysis of accidents which may be beyond the design basis of the facility to provide a perspective of the residual risk associated with the operation of the facility The beyond DBAs serve as bases for cost-benefit considerations if consequences exceeding the Evaluation Guideline are identified in the beyond DBA range. However, such cost-benefit analysis would be performed outside the DSA with the concurrence of DOE. It is expected that beyond DBAs will not be analyzed to the same level of detail as DBAs. The requirement is that an evaluation be performed that simply provides insight into the magnitude of consequences of beyond DBAs (i.e., provide perspective on potential facility vulnerabilities). This insight from beyond DBA analysis has the potential for identifying additional facility features that could prevent or reduce severe beyond DBA consequences. For nonreactor nuclear facilities, however, the sharp increase in consequences from DBA to beyond DBA is not anticipated to approach that found in commercial reactors where the beyond DBA precedent was generated. No lower limit of frequency for examination is provided for beyond DBAs whose definition is frequency dependent. It is understood that as frequencies become very low, little or no meaningful insight is attained.

Operational beyond DBAs are simply those operational accidents with more severe conditions or equipment failures than are estimated for the corresponding DBA. For example, if a deterministic DBA assumed releases were filtered because accident phenomenology did not damage filters, the same accident with loss of filtration is a beyond DBA. The same concept holds true for natural events, but beyond DBAs are defined by the initiating frequency of the natural event itself (i.e., frequency of occurrence less than DBA frequency of occurrence). Beyond DBAs are not evaluated for man-made external events. DOE-STD-3009-94 Page 55 Chapter 4 Safety Structures, Systems, and Components PURPOSE. The purpose of this DSA chapter is to provide information necessary to support the safety basis requirements of 10 CFR 830 for derivation of hazard controls. This chapter provides details on those facility structures, systems, and components that are necessary for the facility to protect the public, provide defense in depth, or contribute to worker safety. Similarly, this chapter provides details on specific administrative controls that are significant to specific accident risk reduction. Descriptions are provided of the attributes (i.e., functional requirements and performance criteria) required to support the safety functions identified in the hazard and accident analyses and to support subsequent derivation of TSRs. Expected products of this chapter, as applicable based on the graded approach, include: • Descriptions of safety SSCs and SACs including safety functions. • Identification of support systems safety SSCs depend upon to carry out safety functions. • Identification of the functional requirements necessary for the safety SSCs and SACs to perform their safety functions, and the general conditions caused by postulated accidents under which the safety SSCs or SACs must operate. • Identification of the performance criteria necessary to provide reasonable assurance that the functional requirements will be met. • Identification of assumptions needing TSR coverage. Existing supporting documentation is to be referenced. Maximum advantage should be taken of pertinent existing safety analyses and design information (i.e., requirements and their bases) that are immediately available or can be retrieved through reasonable efforts. Include a brief summary for each such reference that explains its relevance to this chapter and provides an introductory understanding of the reference. APPLICATION OF THE GRADED APPROACH. Hazard Category 3 facilities will not have safety-class SSCs and the number of safety-significant SSCs and SACs if any, will be less than that of a Hazard Category 2 facility due to the reduced magnitude of hazards. As noted in Chapter 3, “Hazard and Accident Analyses,” a possible exception to this general guidance pertains to chemical hazards. The hazard classification mechanism used in DOE-STD-1027-92 does not consider potential hazardous chemical releases. It is possible that a Hazard Category 3 facility could need safety-class items for large chemical hazards, although it is not typically expected. Hazard Category 2 facilities have the potential for an accident resulting in significant onsite consequences and may have offsite consequences. These facilities DOE-STD-3009-94 Page 56 characteristically have safety-significant SSCs. They may need safety-class SSCs as well, although this is not typically expected.

Hazard Category 2 and 3 facilities do not have the consequence potential associated with Hazard Category 1 facilities, such as Class A reactors. Consequently, in keeping with the use of a graded approach, the means of safety assurance expected of Class A reactors, such as formal design reconstitution and full, formal environmental qualification, are generally unsuitable for Hazard Category 2 and 3 facilities. DSA preparers (and subsequent reviewers) should not expect this level of information to be attained, especially for SSCs for which the original design is not documented. Precedent for dealing with facilities where the original technical information is undocumented and must be estimated has been provided by OSHA in the PSM rulemaking where it was stated “OSHA believed that a properly conducted process hazard analysis should systematically identify technical information regarding the process and allow adequate estimation of safe parameters for the process.” The actual requirement imposed by OSHA was “where the original technical information no longer exists, such information may be developed in conjunction with the process hazard analysis in sufficient detail to support the analysis.” The DSA specifically requires determination of safety functions and functional requirements for safety SSCs and designation of performance criteria. However, a DSA prepared in accordance with this Standard is focused on identifying functional requirements that, in general, are neither absolute nor subject to fine safety margin resolution. Further, associated performance criteria are only defined for critical operational aspects of SSCs, not general design. As noted in the preceding paragraph, if the design information no longer exists, new information may be developed as part of the process hazard analysis. However, pertinent existing safety analyses and design information (requirements and their bases) that is immediately available or can be retrieved through reasonable efforts should be used. For additional technical information that is critical to the DSA development and is not retrievable through such efforts, new information may be developed as part of the hazard analyses and accident analyses. Documented engineering judgments (including their bases) and testing can be used to extrapolate the available existing information and hence establish the performance capabilities of the existing SSCs. In general, safety-class SSCs require more formality in establishing functional requirements and performance criteria than safety-significant SSCs due to their public protection function. DOE-STD-3009-94 Page 57 CONTENT GUIDANCE FOR SECTIONS OF CHAPTER 4 4.1 INTRODUCTION This section provides an introduction to the contents of this chapter based on the graded approach and includes objectives and scope specific to the chapter as developed. 4.2 REQUIREMENTS This section lists the design codes, standards, regulations, and DOE Orders that are required for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. SRIDs may be referenced as appropriate. 4.3 SAFETY-CLASS SYSTEMS, STRUCTURES, AND COMPONENTS Relevant information is provided, in the following SSC specific subsections, for safety-class SSCs with descriptions sufficiently detailed to provide an understanding of the safety function of safety-class SSCs. Descriptions for each safety-class SSC must be complete enough to indicate suitability of safety analysis inputs and assumptions. Provide a summary list of safety-class SSCs. This summary list should identify, in tabular form, safety-class SSCs, the accidents from Chapter 3 for which safety-class designation was made, safety functions, functional requirements, and performance criteria judged to require TSR coverage. The remaining subsection