DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports

TS NOT MEASUREMENT SENSITIVE DOE-STD-3009-94 July 1994 DOE STANDARD PREPARATION GUIDE FOR U.S. DEPARTMENT OF ENERGY NONREACTOR NUCLEAR FACILITY SAFETY ANALYSIS REPORTS U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. WELCOME This Portable Document Format (PDF) file contains bookmarks, thumbnails, and hyperlinks to help you navigate through the document. All items listed on the contents page are linked to the corresponding sections. In addition, if you click on a section heading while you are reading the text, you will return to the contents page. Click on the DOE seal below to move to the contents page. This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (615) 576-8401. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 487-4650. Order No. DE94016340 DOE-STD-3009-94 Page i Foreword 1. This Department of Energy (DOE) Standard is approved for use by the Department of Energy and its contractors. 2. Beneficial comments (recommendations, additions, deletions) and any pertinent data that may be of use in improving this document should be addressed to: Director, Office of Engineering Operations, Security, and Transition Support (DP-31, GTN), U.S. Department of Energy, Washington, DC, 20585. 3. DOE Order 5480.23, issued in April 1992, imposes requirements for nuclear facility safety analysis reports. The Department of Energy recognizes a benefit from guidance on the interpretation and implementation of this Order to provide safety assurance for all relevant facilities. The Department of Energy safety management approach is built on a hierarchy of documentation. At the top are safety policies. Next come safety requirements (Orders and Rules). Below these are safety guides that clarify the requirements. Technical standards, such as this document, support the guides by providing additional guidance into how the requirements should be met. DOE-STD-3009-94, “Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports,” was prepared to be consistent with the Order requirements and its safety guide (Attachment 1 of the Order). To ensure that safety analysis report developments will be in compliance with DOE 5480.23, it is advised that this Standard be used in conjunction with the Order and its Attachment. Guiding Principles ! This Standard incorporates and integrates many different approaches regarding safety analysis report format and content. To ensure a consistent application of this Standard among users, the following guiding principles are provided. ! The focus of this Standard is primarily on Hazard Category 2 and Hazard Category 3 facilities. ! Hazard analysis and accident analysis are merged into one chapter (Chapter 3) to ensure that the proper emphasis is placed on identification and analysis of hazards. The hazard analysis distinguishes when accident analysis is required as a function of potential offsite consequence. Guidance for hazard and accident analysis is not based on probabilistic risk assessment. ! Defense in depth, worker safety, and environmental issues are identified in the hazard analysis and carried forward to other safety analysis report chapters.

DOE-STD-3009-94 Page ii ! Defense in depth, as discussed in this Standard, consists of two components: — Equipment and administrative features providing preventive or mitigative functions so that multiple features are relied on for accident prevention or mitigation to a degree proportional to the hazard potential. — Integrated safety-management programs that control and discipline operations. ! Guidance is provided for evaluating the safety of a facility for which documentable, deterministic design basis accidents do not exist in order to establish bounding accidents (derivative design basis accidents) that envelope the safety of existing facilities. Guidance is also provided on the treatment of beyond design basis accidents. ! Distinction is made between “safety-class structures, systems , and components,” and “safety-significant structures, systems, and components,” and the balance of facility structures, systems, and components. Safety-class structures, systems, and components are related to public protection and are defined by comparison with numerical Evaluation Guidelines. Safety-significant structures, systems, and components are identified for specific aspects of defense in depth and worker safety as determined by the hazard analysis. Specific definitions are provided for these two terms. ! Consequences from normal operations are addressed in the Radiation Protection, Hazardous Material Protection, and Waste Management chapters. ! Guidance is provided in each chapter on the application of the graded approach. ! A common safety analysis report format (chapter, title, and organization) for all nonreactor nuclear facilities is desirable but not essential. A table is to be provided by the preparer that indicates where the safety analysis report topics required by DOE 5480.23 are addressed. Content needs to be flexible to allow for different facility types, hazard categories, and other grading factors. ! Facility descriptive material is intentionally split to emphasize structures, systems, and components of major significance: — Chapter 2, “Facility Description,” provides a brief, integrated overview of the facility structures, systems, and components. — Chapter 4, “Safety Structures, Systems, and Components,” provides detailed information only for those structures, systems, and components that are safety class and safety significant. This application of the graded approach will provide for a significant reduction of safety analysis report volume, while maintaining a focus on safety. ! The programmatic chapters, including Chapters 6-17, provide a summary description of the key features of the various safety programs as they relate to the facility being analyzed. These chapters are not meant to be used as the vehicle for the determination of adequacy of these programs. DOE-STD-3009-94 Page iii Contents List of Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii List of Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Abbreviations and Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi Introduction to DOE-STD-3009-94 Purpose of DOE-STD-3009-94 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 SAR Preparation Conceptual Basis and Process . . . . . . . . . . . . . . . . . . . . . 2

Worker Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Defense in Depth. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Programmatic Commitments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 TSR and SSC Commitments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Correlation of DOE-STD-3009-94 to DOE 5480.23. . . . . . . . . . . . . . . . . . 11 Hazard Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Accident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Application of Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 SAR Preparation Guidance Executive Summary Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Content Guidance E.1 Facility Background and Mission . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 E.2 Facility Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 E.3 Facility Hazard Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 E.4 Safety Analysis Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 E.5 Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 E.6 Safety Analysis Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 E.7 SAR Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 CHAPTER ONE Site Characteristics Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 DOE-STD-3009-94 Page iv Content Guidance 1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.3 Site Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.3.1 Geography. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.3.2 Demography. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.4 Environmental Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.4.1 Meteorology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.4.2 Hydrology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.4.3 Geology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.5 Natural Phenomena Threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.6 External Man-Made Threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.7 Nearby Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.8 Validity of Existing Environmental Analyses . . . . . . . . . . . . . . . . . . . 26 CHAPTER TWO Facility Description

Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Content Guidance 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.3 Facility Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.4 Facility Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.5 Process Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.6 Confinement Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.7 Safety Support Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.8 Utility Distribution Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.9 Auxiliary Systems and Support Facilities . . . . . . . . . . . . . . . . . . . . . 29 CHAPTER THREE Hazard and Accident Analyses Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Content Guidance 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3.3 Hazard Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3.3.1 Methodology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 3.3.1.1 Hazard Identification. . . . . . . . . . . . . . . . . . . . . . . . . . 37 3.3.1.2 Hazard Evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.3.2 Hazard Analysis Results. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 DOE-STD-3009-94 Page v 3.3.2.1 Hazard Identification. . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.3.2.2 Hazard Classification. . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.3.2.3 Hazard Evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 3.3.2.3.1 Planned Design and Operational Safety Improvements. . . . . . . . . . . . . . . . . . . . . . . . . 42 3.3.2.3.2 Defense in Depth. . . . . . . . . . . . . . . . . . . . . . . 42 3.3.2.3.3 Worker Safety. . . . . . . . . . . . . . . . . . . . . . . . . 46 3.3.2.3.4 Environmental Protection. . . . . . . . . . . . . . . . 47 3.3.2.3.5 Accident Selection. . . . . . . . . . . . . . . . . . . . . . 49 3.4 Accident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.4.1 Methodology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 3.4.2 Design Basis Accidents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.4.2.X [Applicable DBA]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.4.2.X.1 Scenario Development. . . . . . . . . . . . . . . . . . . 56 3.4.2.X.2 Source Term Analysis. . . . . . . . . . . . . . . . . . . 57 3.4.2.X.3 Consequence Analysis. . . . . . . . . . . . . . . . . . . 57 3.4.2.X.4 Comparison to Guidelines. . . . . . . . . . . . . . . . 58 3.4.2.X.5 Summary of Safety-Class SSCs and TSR58

Controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 3.4.3 Beyond Design Basis Accidents. . . . . . . . . . . . . . . . . . . . . . . . . . 58 CHAPTER FOUR Safety Structures, Systems and Components Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Content Guidance 4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 4.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 4.3 Safety-Class Systems, Structures, and Components . . . . . . . . . . . . 63 4.3.X [Applicable Safety-Class System, Structure, or Component]. . . . . 63 4.3.X.1 Safety Function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 4.3.X.2 System Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 4.3.X.3 Functional Requirements. . . . . . . . . . . . . . . . . . . . . . . 64 4.3.X.4 System Evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 4.3.X.5 Controls (TSRs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 4.4 Safety-Significant Structures, Systems, and Components . . . . . . . . 65 4.4.X [Applicable Safety-Significant System, Structure, or Component] . 66 4.4.X.1 Safety Function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 4.4.X.2 System Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 4.4.X.3 Functional Requirements. . . . . . . . . . . . . . . . . . . . . . . 67 4.4.X.4 System Evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 4.4.X.5 Controls (TSRs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 DOE-STD-3009-94 Page vi CHAPTER FIVE Derivation of Technical Safety Requirements Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Content Guidance 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 5.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 5.3 TSR Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 5.4 Derivation of Facility Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 5.5 TSR Derivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 5.5.X [Applicable Hazard/Feature/TSR "X"]. . . . . . . . . . . . . . . . . . . . . . 72 5.5.X.1 Safety Limits, Limiting Control Settings, and Limiting Conditions for Operation. . . . . . . . . . . . . . . . . . . . . . . 72 5.5.X.2 Surveillance Requirements. . . . . . . . . . . . . . . . . . . . . . 72 5.5.X.3 Administrative Controls. . . . . . . . . . . . . . . . . . . . . . . . 72 5.6 Design Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 5.7 Interface with TSRs from Other Facilities . . . . . . . . . . . . . . . . . . . . . 73 CHAPTER SIX Prevention of Inadvertent Criticality Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Content Guidance 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 6.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 6.3 Criticality Concerns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 6.4 Criticality Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 6.4.1 Engineering Controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 6.4.2 Administrative Controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 6.4.3 Application of Double Contingency Principle. . . . . . . . . . . . . . . . 77 6.5 Criticality Protection Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 6.5.1 Criticality Safety Organization. . . . . . . . . . . . . . . . . . . . . . . . . . . 78 6.5.2 Criticality Safety Plans and Procedures. . . . . . . . . . . . . . . . . . . . . 78 6.5.3 Criticality Safety Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 6.5.4 Determination of Operational Nuclear Criticality Limits. . . . . . . . 79 6.5.5 Criticality Safety Inspections/Audits. . . . . . . . . . . . . . . . . . . . . . . 79 6.5.6 Criticality Infraction Reporting and Follow-Up. . . . . . . . . . . . . . . 79 6.6 Criticality Instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 DOE-STD-3009-94 Page vii CHAPTER SEVEN Radiation Protection Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Content Guidance 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 7.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 7.3 Radiation Protection Program and Organization . . . . . . . . . . . . . . . 82 7.4 ALARA Policy and Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 7.5 Radiological Protection Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 7.6 Radiation Exposure Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 7.6.1 Administrative Limits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 7.6.2 Radiological Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 7.6.3 Dosimetry. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 7.6.4 Respiratory Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 7.7 Radiological Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 7.8 Radiological Protection Instrumentation . . . . . . . . . . . . . . . . . . . . . . 84 7.9 Radiological Protection Record Keeping . . . . . . . . . . . . . . . . . . . . . 84 7.10 Occupational Radiation Exposures . . . . . . . . . . . . . . . . . . . . . . . . . 84 CHAPTER EIGHT Hazardous Material Protection Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Content Guidance

8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 8.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 8.3 Hazardous Material Protection Program and Organization . . . . . . . 88 8.4 The ALARA Policy and Program . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 8.5 Hazardous Material Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 8.6 Hazardous Material Exposure Control . . . . . . . . . . . . . . . . . . . . . . . 89 8.6.1 Hazardous Material Identification Program. . . . . . . . . . . . . . . . . . 89 8.6.2 Administrative Limits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 8.6.3 Occupational Medical Programs. . . . . . . . . . . . . . . . . . . . . . . . . . 89 8.6.4 Respiratory Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 8.7 Hazardous Material Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 8.8 Hazardous Material Protection Instrumentation . . . . . . . . . . . . . . . . 90 8.9 Hazardous Material Protection Record Keeping . . . . . . . . . . . . . . . 90 8.10 Hazard Communication Program . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 8.11 Occupational Chemical Exposures . . . . . . . . . . . . . . . . . . . . . . . . . . 91 DOE-STD-3009-94 Page viii CHAPTER NINE Radioactive and Hazardous Waste Management Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Content Guidance 9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 9.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 9.3 Radioactive and Hazardous Waste Management Program and Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 9.4 Radioactive and Hazardous Waste Streams or Sources . . . . . . . . . 94 9.4.1 Waste Management Process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 9.4.2 Waste Sources and Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . 95 9.4.3 Waste Handling or Treatment Systems. . . . . . . . . . . . . . . . . . . . . 95 CHAPTER TEN Initial Testing, In-Service Surveillance, and Maintenance Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Content Guidance 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 10.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 10.3 Initial Testing Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 10.4 In-Service Surveillance Program . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 10.5 Maintenance Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 CHAPTER ELEVEN Operational Safety Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Content Guidance

11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 11.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 11.3 Conduct of Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 11.4 Fire Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 11.4.1 Fire Hazards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 11.4.2 Fire Protection Program and Organization. . . . . . . . . . . . . . . . . . 102 11.4.3 Combustible Loading Control. . . . . . . . . . . . . . . . . . . . . . . . . . . 102 11.4.4 Fire Fighting Capabilities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 11.4.5 Fire Fighting Readiness Assurance. . . . . . . . . . . . . . . . . . . . . . . 103 DOE-STD-3009-94 Page ix CHAPTER TWELVE Procedures and Training Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Content Guidance 12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 12.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 12.3 Procedure Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 12.3.1 Development of Procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 12.3.2 Maintenance of Procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 12.4 Training Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 12.4.1 Development of Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 12.4.2 Maintenance of Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 12.4.3 Modification of Training Materials. . . . . . . . . . . . . . . . . . . . . . . 107 CHAPTER THIRTEEN Human Factors Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Content Guidance 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 13.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 13.3 Human Factors Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 13.4 Identification of Human-Machine Interfaces . . . . . . . . . . . . . . . . . . 111 13.5 Optimization of Human-Machine Interfaces . . . . . . . . . . . . . . . . . . 111 CHAPTER FOURTEEN Quality Assurance Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Content Guidance 14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 14.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 14.3 Quality Assurance Program Organization . . . . . . . . . . . . . . . . . . . 114 14.4 Quality Improvement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 14.5 Documents and Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 14.6 Quality Assurance Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

14.6.1 Work Processes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 14.6.2 Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 14.6.3 Procurement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 DOE-STD-3009-94 Page x 14.6.4 Inspection and Testing for Acceptance. . . . . . . . . . . . . . . . . . . . 115 14.6.5 Independent Assessment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 CHAPTER FIFTEEN Emergency Preparedness Program Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Content Guidance 15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 15.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 15.3 Scope of Emergency Preparedness . . . . . . . . . . . . . . . . . . . . . . . . 118 15.4 Emergency Preparedness Planning . . . . . . . . . . . . . . . . . . . . . . . . 118 15.4.1 Emergency Response Organization. . . . . . . . . . . . . . . . . . . . . . . 118 15.4.2 Assessment Actions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 15.4.3 Notification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 15.4.4 Emergency Facilities and Equipment. . . . . . . . . . . . . . . . . . . . . . 119 15.4.5 Protective Actions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 15.4.6 Training and Exercises. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 15.4.7 Recovery and Reentry. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 CHAPTER SIXTEEN Provisions for Decontamination and Decommissioning Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Content Guidance 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 16.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 16.3 Description of Conceptual Plans . . . . . . . . . . . . . . . . . . . . . . . . . . 122 CHAPTER SEVENTEEN Management, Organization, and Institutional Safety Provisions Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Application of the Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 DOE-STD-3009-94 Page xi Content Guidance 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 17.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 17.3 Organizational Structure, Responsibilities and Interfaces . . . . . . . 124 17.3.1 Organizational Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 17.3.2 Organizational Responsibilities. . . . . . . . . . . . . . . . . . . . . . . . . . 124 17.3.3 Staffing and Qualifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

17.4 Safety Management Policies and Programs . . . . . . . . . . . . . . . . . 125 17.4.1 Safety Review and Performance Assessment. . . . . . . . . . . . . . . . 125 17.4.2 Configuration and Document Control. . . . . . . . . . . . . . . . . . . . . 125 17.4.3 Occurrence Reporting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 17.4.4 Safety Culture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 DOE-STD-3009-94 Page xii DOE-STD-3009-94 Page xiii List of Figures Fig. I-1 SAR scope and integration.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Fig. I-2 SAR preparation process.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Fig. 3-1 Flowchart for performing a hazard analysis.. . . . . . . . . . . . . . 36 Fig. 3-2 Worker safety evaluation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Fig. 3-3 A three-by-three likelihood and consequence ranking matrix for hazard evaluation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Fig. 3-4 Flowchart for performing an accident analysis.. . . . . . . . . . . . 54 List of Tables Table I-1 Correlation of DOE-STD-3009-94 chapters to DOE 5480.23 topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Table 3-1 Example process hazard analysis worksheet.. . . . . . . . . . . . . . 40 Table 3-2 Hazard analysis worksheet based on failure modes and effects analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Table 3-3 Qualitative severity classification table.. . . . . . . . . . . . . . . . . . 51 Table 3-4 Qualitative likelihood classification table.. . . . . . . . . . . . . . . . 51 Table 3-5 Qualitative ranking .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 DOE-STD-3009-94 Page xiv DOE-STD-3009-94 Page xv Definitions Notes: Origins of the definitions are indicated by references shown in “[ ]” (brackets). If no reference is listed, the definition originates in this Preparation Guide and is unique to its application. Accident. An unplanned sequence of events that results in undesirable consequences. Accident analysis. For the purposes of properly implementing the USQ Order, the term accident analysis refers to those bounding analyses selected for inclusion in the SAR. These analyses refer to design basis accidents only. [DOE 5480.21] Accident analysis has historically consisted of the formal development of numerical estimates of the expected consequence and probability of potential accidents associated with a facility. For the purposes of implementing this Standard, accident analysis is a follow-on effort to the hazard analysis, not a fundamentally new examination requiring extensive original work. As such, it requires documentation of the basis for assignment to a given likelihood of occurrence range (e.g., 1/yr to 10 /yr, 10 /yr to 10 /yr, 10 /yr to-2 -2 -4 -4 10 /yr) in hazard analysis and performance of a formally documented consequence-6 analysis. Consequences are compared with offsite Evaluation Guidelines to identify safety-class structures, systems, and components. Administrative controls (ACs). Provisions relating to organization and management, procedures, recordkeeping, assessment, and reporting necessary to ensure the safe operation of a facility. [DOE 5480.23]

Beyond design basis accident. An accident of the same type as a design basis accident (e.g., fire, earthquake, spill, explosion, etc.), but defined by parameters that exceed in severity the parameters defined for the design basis accident. The same correlation applies to beyond derivative design basis accidents with regard to derivative design basis accidents. Decommissioning. The process of closing and securing a nuclear facility or nuclear materials storage facility so as to provide adequate protection from radiation exposure and to isolate radioactive contamination from the human environment. [DOE 5480.30] Decontamination. The act of removing a chemical, biological, or radiological contaminant from, or neutralizing its potential effect on, a person, object or environment by washing, chemical action, mechanical cleaning, or other techniques. [DOE 5480.30] Design basis. The set of requirements that bound the design of systems, structures, and components within the facility. These design requirements include consideration of safety, plant availability, efficiency, reliability, and maintainability. Some aspects of the design basis are important to safety, although others are not. [DOE 5480.23] DOE-STD-3009-94 Page xvi Evaluation guidelines. Hazardous material dose/exposure values that the safety analysis evaluates against. The intention is that theoretical individual doses/exposures exceeding the Evaluation Guideline should not occur at a given point, unlike other values, such as emergency planning thresholds. Offsite Evaluation Guidelines are established for the purpose of identifying and evaluating safety-class structures, systems, and components. Onsite Evaluation Guidelines are not required for adequate documentation of a safety basis utilizing the overall process of this Standard. Facility. Any equipment, structure, system, process, or activity that fulfills a specific purpose. Examples include accelerators, storage areas, fusion research devices, nuclear reactors, production or processing plants, coal conversion plants, magnetohydrodynamics experiments, windmills, radioactive waste disposal systems and burial grounds, environmental restoration activities, testing laboratories, research laboratories, transportation activities and accommodations for analytical examinations of irradiated and nonirradiated components. [DOE 5000.3B] For the purpose of implementing this Standard, the definition most often refers to buildings and other structures, their functional systems and equipment, and other fixed systems and equipment installed therein to delineate a facility. However, specific operations and processes independent of buildings or other structures (e.g., waste retrieval and processing, waste burial, remediation, groundwater or soil decontamination, decommissioning) are also encompassed by this definition. The flexibility in the definition does not extend to subdivision of physically concurrent operations having potential energy sources that can seriously affect one another or which use common systems fundamental to the operation (e.g., a common glovebox ventilation exhaust header). Fissile materials. A nuclide capable of undergoing fission by interaction with slow neutrons provided the effective thermal neutron production cross section exceeds the effective thermal neutron absorption cross section. [DOE 6430.1A]

Hazard. A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to personnel or damage to an operation or to the environment (without regard for the likelihood or credibility of accident scenarios or consequence mitigation). [DOE 5480.23] SARs specifically examine those hazards inherent in processes and related operations that can result in uncontrolled release of hazardous material (i.e., chemical or radiological) or process-unique energy sources (e.g., high pressure autoclave). Standard industrial hazards do not require SAR coverage. Standard industrial hazards such as burns from hot objects, electrocution, falling objects, etc., are of concern only to the degree that they can be a contributor to a significant uncontrolled release of hazardous material (e.g., 115-volt wiring as initiator of a fire) or major energy sources such as explosive energy. Hazard analysis. The determination of material, system, process, and plant characteristics that can produce undesirable consequences, followed by the assessment of hazardous situations associated with a process or activity. Largely qualitative techniques DOE-STD-3009-94 Page xvii are used to pinpoint weaknesses in design or operation of the facility that could lead to accidents. The SAR hazard analysis examines the complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to hazardous materials. Hazard classification. Evaluation of the consequences of unmitigated releases to classify facilities or operations into the following hazard categories: 1. Hazard Category 1: The hazard analysis shows the potential for significant offsite consequences. 2. Hazard Category 2: The hazard analysis shows the potential for significant onsite consequences. 3. Hazard Category 3: The hazard analysis shows the potential for only significant localized consequences. [DOE 5480.23] DOE-STD-1027-92 provides guidance and radiological threshold values for determining the hazard category of a facility. DOE-STD-1027-92 interprets Hazard Category 1 facilities as Category A reactors and other facilities designated as such by the Program Secretarial Officer. Hazardous material. Any solid, liquid, or gaseous material that is toxic, explosive, flammable, corrosive, or otherwise physically or biologically threatening to health. [DOE 5480.23] Candidate hazards include radioactive materials, hazardous chemicals as defined by OSHA in 29 CFR 1910.1200 and 29 CFR 1910.1450; any material assigned a reportable quantity value in 40 CFR 302, Table 302.4; threshold planning quantities in 40 CFR 355 Appendix A; threshold planning quantities in 29 CFR 1910.119; level of concern quantities in EPA’s “Technical Guidance for Hazard Analysis—Emergency Planning for Extremely Hazardous Substances”; or materials rated as 3 or 4 in National Fire Protection Association 704 “Identification of the Fire Hazards of Materials.” Limiting condition for operation (LCO). The lowest functional capability or performance levels of safety-related structures, systems, components, and their support systems required for normal, safe operation of the facility. [DOE 5480.22, section 9.e.(3)(b)] Limiting control setting (LCS). Setting on safety-related structures, systems, components that controls process variables to prevent exceeding safety limits. [DOE 5480.22, section 9.e.(3)(a)]

Mitigative feature. Any structure, system, or component that serves to mitigate the consequences of a release of hazardous materials in an accident scenario. [DOE-STD-1027-92] Nonreactor nuclear facility. Those activities or operations that involve radioactive and/or fissionable materials in such form and quantity that a nuclear hazard potentially exists to the employees or the general public. Included are activities or operations that: DOE-STD-3009-94 Page xviii ! Produce, process, or store radioactive liquid or solid waste, fissionable materials, or tritium; ! Conduct separations operations; ! Conduct irradiated materials inspection, fuel fabrication, decontamination, or recovery operations; ! Conduct fuel enrichment operations; or ! Perform environmental remediation or waste management activities involving radioactive materials. Incidental use and generating of radioactive materials in a facility operation (e.g., check and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and X-ray machines) would not ordinarily require the facility to be included in this definition. Accelerators and reactors and their operations are not included. [DOE 5480.23] Process Safety Management (PSM). A process or activity involving the application of management principles as defined in 29 CFR 1910.119, “Process Safety Management of Highly Hazardous Chemicals.” Programmatic. Reference to facility specific programs or site-wide programs necessary to ensure the safe operation of a facility. Radiation protection, hazardous material protection, quality assurance, training, document control, and emergency preparedness are examples of programs that provide programmatic controls to ensure safe operations. Preventive feature. Any structure, system, or component that serves to prevent the release of hazardous material in an accident scenario. [DOE-STD-1027-92] Public. All individuals outside the DOE site boundary. Risk. The quantitative or qualitative expression of possible loss that considers both the probability that an event will occur and the consequence of that event. [DOE 5480.23] Safety analysis. A documented process: (1) to provide systematic identification of hazards within a given DOE operation; (2) to describe and analyze the adequacy of the measures taken to eliminate, control, or mitigate identified hazards; and (3) to analyze and evaluate potential accidents and their associated risks. [DOE 5480.23] Safety analysis report (SAR). A report that documents the adequacy of safety analysis to ensure that a facility can be constructed, operated, maintained, shut down, and decommissioned safely and in compliance with applicable laws and regulations. [DOE 5480.23] Safety basis. The combination of information relating to the control of hazards at a facility (including design, engineering analyses, and administrative controls) upon which DOE depends for its conclusion that activities at the facility can be conducted safely. [DOE 5480.23]. DOE-STD-3009-94 Page xix Safety-class structures, systems, and components (safety-class SSCs). Systems, structures, or components including primary environmental monitors and portions of process systems, whose failure could adversely affect the environment, or safety and health of the public as identified by safety analyses. [DOE 5480.30]

For the purpose of implementing this Standard, the phrase “adversely affect” means Evaluation Guidelines are exceeded. Safety-class SSCs are systems, structures, or components whose preventive or mitigative function is necessary to keep hazardous material exposure to the public below the offsite Evaluation Guidelines. This definition would typically exclude items such as primary environmental monitors and most process equipment. Safety limits. Limits on process variables associated with those physical barriers, generally passive, that are necessary for the intended facility functions and which are found to be required to guard against the uncontrolled release of radioactivity and other hazardous materials (this includes releases into the complex and/or the community). [DOE 5480.22, section 9.e.(2)] Safety-significant structures, systems, and components (safety-significant SSCs). Structures, systems, and components not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to defense in depth (i.e., prevention of uncontrolled material releases) and/or worker safety as determined from hazard analysis. As a general rule of thumb, safety-significant SSC designations based on worker safety are limited to those systems, structures, or components whose failure is estimated to result in an acute worker fatality or serious injuries to workers. Serious injuries, as used in this definition, refers to medical treatment for immediately life-threatening or permanently disabling injuries (e.g., loss of eye, loss of limb) from other than standard industrial hazards. It specifically excludes potential latent effects (e.g., potential carcinogenic effects of radiological exposure or uptake). The general rule of thumb cited above is not an Evaluation Guideline. It is a lower threshold of concern for which safety-significant SSC designation may be warranted, not a quantitative criteria. Estimates of worker consequences for the purpose of safety-significant SSC designation are not intended to require detailed analytical modeling. Considerations should be based on engineering judgment of possible effects and the potential added value of safety-significant SSC designation. [Note: Safety-significant SSC as used in this Standard distinguishes a specific category of SSCs other than safety-class SSCs. It should not be confused with the generic modifier “safety significant” used in DOE orders (e.g., DOE 5480.23).] Safety structures, systems, and components (safety SSCs). The set of safety-class structures, systems, and components, and safety-significant structures, systems, and components for a given facility. DOE-STD-3009-94 Page xx Site boundary. A well-marked boundary of the property over which the owner and operator can exercise strict control without the aid of outside authorities. [DOE 6430.1A] For the purpose of implementing this Standard, the DOE site boundary is a geographic boundary within which public access is controlled and activities are governed by DOE and its contractors, and not by local authorities. A public road traversing a DOE site is considered to be within the DOE site boundary if, when necessary, DOE or the site contractor has the capability to control the road during accident or emergency conditions. Standard industrial hazards. Hazards that are routinely encountered in general industry and construction, and for which national consensus codes and/or standards (e.g., OSHA, transportation safety) exist to guide safe design and operation without the need for special analysis to define safe design and/or operational parameters.

Technical safety requirements (TSRs). Those requirements that define the conditions, the safe boundaries, and the management or administrative controls necessary to ensure the safe operation of a nuclear facility and to reduce the potential risk to the public and facility workers from uncontrolled releases of radioactive materials or from radiation exposures due to inadvertent criticality. Technical Safety Requirements consist of safety limits, operating limits, surveillance requirements, administrative controls, use and application instructions, and the basis thereof. Technical Safety Requirements were formerly known as Operational Safety Requirements for nonreactor nuclear facilities and Technical Specifications for reactor facilities. [DOE 5480.22] To satisfy the intent of this Standard, the administrative equivalent of TSRs should also be assigned for the conditions, the safe boundaries, and the management or administrative controls necessary to ensure the safe operation of the facility and to reduce the potential risk to the public and facility workers from uncontrolled releases of nonradiological hazardous materials or energy. Such equivalents designated for control of nonradiological hazards are considered as important to safety as radiological TSRs, and are needed to satisfy the overall process outlined in this Standard for controlling the broad spectrum of hazards in accordance with the requirements of DOE 5480.23. Distinguishing between the radiological TSRs and their nonradiological equivalents may be necessary due to the potentially different regulatory enforcement structures associated with each. However, such distinction is beyond the scope of this Standard as the SAR only provides information to derive these controls, not formally define them. Accordingly, for the purposes of this Standard, no distinction is made between radiological TSRs and their nonradiological equivalents, and the term TSRs refers to both. TSRs for radiological hazards are formally defined in the separate TSR document required by DOE 5480.22. DOE-STD-3009-94 Page xxi Abbreviations and Acronyms ALARA As Low As Reasonably Achievable CFR Code of Federal Regulations D&D Decontamination and Decommissioning DBA Design Basis Accidents DOE U.S. Department of Energy DOE-STD DOE Standard DP Office of Defense Programs EH Office of Environment, Safety and Health EM Office of Environmental Restoration and Waste Management EPA Environmental Protection Agency EPP Emergency Preparedness Program ER Office of Energy Research ERPG Emergency Response Planning Guideline HAZOP Hazard and Operability Analysis HEPA High Efficiency Particulate Air LCO Limiting Condition for Operation LCS Limiting Control Setting NRC Nuclear Regulatory Commission OSHA Occupational Safety and Health Administration P&ID Process and Instrument Drawing PHA Preliminary Hazard Analysis PSM Process Safety Management SAR Safety Analysis Report SL Safety Limit SRID Standards and Requirements Identification Documents SSC Structures, Systems, and Components TSR Technical Safety Requirement USQ Unreviewed Safety Question DOE-STD-3009-94 Page xxii DOE-STD-3009-94 Page 1 Introduction This introduction addresses the following major topics related to implementing of DOE 5480.23: ! Purpose of DOE-STD-3009-94—Indicates scope and general applicability of this Standard. ! SAR Preparation Conceptual Basis and Process—Ensures consistent and appropriate treatment of all SAR topics for the variety of DOE nonreactor nuclear facilities.

! Hazard Analysis—Provides final facility hazard classification and considers and incorporates into programmatic requirements measures to protect workers, the public, and the environment from hazardous and accident conditions. Technical Safety Requirements (TSRs) and safety-significant structures, systems, and components that are major contributors to worker safety and defense in depth are identified in the hazard analysis. ! Accident Analysis—Designates safety-class structures, systems, and components and safety controls (i.e., TSRs) as a function of Evaluation Guidelines. ! Application of the Graded Approach—Provides a consistent and measured treatment of this concept, including guidance on the minimum acceptable SAR content. PURPOSE OF DOE-STD-3009-94 This Standard describes a SAR preparation method that is acceptable to the DOE. It was developed to assist Hazard Category 2 and 3 facilities in preparing SARs that will satisfy the requirements of DOE 5480.23, “Nuclear Safety Analysis Reports.” Hazard Category 1 facilities are typically expected to be Category A reactors for which extensive precedents for SARs already exist. Guidance provided by this Standard is generally applicable to any facility required to document its safety basis in accordance with DOE 5480.23. For new facilities in which conceptual design or construction activities are in progress (i.e., PSARs), elements of this guidance may be more appropriately handled as an integral part of the overall design requirement process (e.g., preliminary design to design criteria). The methodology provided by this Standard focuses more on characterizing facility safety (i.e., back-end approach) with or without well-documented design information than on the determination of facility design (i.e., front-end approach). Accordingly, contractors for facilities that are documenting conceptual designs for PSARs should apply the process and format of this Standard to the extent it is judged to be of benefit. DOE-STD-3009-94 Page 2 Beyond conceptual design and construction, the methodology described in this Standard is applicable to the spectrum of missions expected to occur over the lifetime of a facility (e.g., production, shutdown/standby, decontamination and decommissioning). As the phases of facility life change, suitable methodology is provided for use in updating an existing SAR and in developing a new SAR if the new mission is no longer adequately encompassed by the existing SAR (e.g., a change from production operations to decontamination and decommissioning). This integration of the SAR with changes in facility mission and associated updates should be controlled as part of an overall safety management plan. A unique element of SAR documentation is the required provisions for decontamination and decommissioning (D&D) as discussed in Chapter 16 of this Standard. This forward looking aspect of facility operations is independent of facility mission and is intended to be a means of ensuring that current facility operations take into account D&D operations that will occur in the future.

For facilities transitioning into D&D, the safety basis of the D&D operations is documented throughout a SAR. This SAR, of which the principal emphasis is on the D&D operations themselves, provides the necessary analysis and supporting information to describe the facilities as they undergo shutdown, deactivation, decontamination, and decommissioning or dismantlement. The facility consists of the physical building, its constituent components, and the actual processes of D&D being performed. Physical buildings and constituent components targeted for D&D are briefly described in Chapter 2, “Facility Description.” Detailed descriptions are reserved for the actual D&D processes, which are the focus of evaluation in Chapter 3, “Hazard and Accident Analysis,” and Chapter 4, “Safety Structures, Systems, and Components,” for each stage of major configuration change. Also included are the temporary engineering and administrative controls used to maintain the safety basis. This description and evaluation would envelop major configurations during the D&D operations for which the authorization basis is sought. This is consistent with the intent of SARs for operating facilities where all operations conducted are not detailed in the SAR. SARs for D&D describe in Chapter 16, “Provisions for Decontamination and Decommissioning,” assurances that the D&D operations for which approval is being sought are effectively planned and will not result in future, unnecessary D&D activities (e.g., inadequate labeling of characterized hazardous material). SAR PREPARATION CONCEPTUAL BASIS AND PROCESS The programmatic requirements identified in DOE 5480.23, and illustrated in Figure I-1, form the boundaries within which the safety analysis is performed and represent the means of assuring safe operation of the facility. Hazard analysis and accident analysis are performed to identify specific controls and improvements that feed back into overall safety management. Consequence and likelihood estimates obtained from this process also form the bases for grading the level of detail and control needed in specific DOE-STD-3009-94 Page 3 programs. The result is documentation of the safety basis that emphasizes the controls needed to maintain safe operation of a facility. The SAR preparation process is illustrated in Figure I-2. The level of detail provided in the SAR depends on numerous factors. Applying the guidance for the graded approach provided in this Standard will assist the preparer in establishing an acceptable level of detail. The foundation for effectively preparing a SAR is the assembly and integration of an experienced preparation team. The size and makeup of the team depend on the magnitude and type of facility hazards and the complexity of the processes that are required to be addressed in the SAR. In determining the makeup of the preparation team, careful consideration should be given to the key hazard analysis activity. In general, the safety analysis base team should include, as a minimum, individuals experienced in process hazard and accident analyses, facility systems engineers, and process operators. Individuals with experience in specific subject matter such as nuclear criticality, radiological safety, fire safety, chemical safety, or process operations may be needed in the hazard analysis on a regular or as needed basis. Such individuals will typically be necessary in the development of programmatic SAR chapters as well. Consistent, accurate exchange of information among the team members is at least as important as the makeup of the team itself. This can be assured through meaningful integration of the required tasks.

Once team makeup is determined, base information needed to support SAR development is gathered. Maximum advantage should be taken of pertinent existing safety analyses and design information (i.e., requirements and their bases) that are immediately available, or can be retrieved through reasonable efforts. Other information arises from existing sources such as process hazards analyses, fire hazards analyses, explosive safety analyses, health and safety plans, environmental impact statements, etc. The need for additional or specific information becomes apparent throughout the hazard analysis process. The remaining key steps for efficient completion of the safety analysis and the SAR development process are: ! Identify the SAR project functions using project information and ensure the team matches the functions that are required. ! Perform hazard analysis to provide facility hazard classification, evaluate worker safety and defense in depth, and identify unique and representative accidents to be carried forward to accident analysis. Safety-significant SSCs and TSRs are designated in hazard analysis as well. ! Perform an accident analysis and assess the results to identify any safety-class SSCs and accident specific TSRs based on comparison of accident consequences to Evaluation Guidelines. ! Develop the chapters for the SAR by providing information necessary to support the results of the safety analysis. These chapters detail the results of DOE-STD-3009-94 Page 4 Figure I-1. SAR scope and integration. DOE-STD-3009-94 Page 5 Figure I-2. SAR preparation process. DOE-STD-3009-94 Page 6 the analysis, describe the facility and the safety SSCs, and the safety management programs that relate to the facility safety basis. ! Prepare the Executive Summary. The process of developing a SAR is a process that may require numerous iterations depending on the complexity of the facility and the level of detail required. The hazard and accident analyses (hazard analysis is adequate for Category 3 facilities) are the central elements of this process. The results of the hazard analysis form the basis for grading the level of detail necessary to ensure an acceptable SAR. The hazard analysis specifically identifies safety-significant SSCs for defense in depth and worker safety, and TSR controls. The results of the accident analysis form the basis for determining additional safety controls imposed on the facility (e.g., safety-class SSCs and TSRs) as a function of Evaluation Guidelines. These specific controls are then factored into overall safety management programs that ensure the operational discipline required by the hazards identified is maintained. Several specific topics are directly relevant to understanding the conceptual basis of this Standard. These topics are worker safety, defense in depth, programmatic commitments, SSC and TSR commitments, and correlation of this Standard to DOE 5480.23. The remainder of this section discusses each of these topics in discrete subsections. Worker Safety Workers, typically those in close proximity to operations, are the population principally at risk from potential consequences associated with Hazard Category 2 and 3 facilities. The DOE recognizes, via DOE 5480.23, the importance of including worker safety in safety analyses by specifically noting the worker as a population of concern. This represents a new emphasis for SARs, which have traditionally focused on potential consequences to the public. Accordingly, developing a conceptual basis for the methodology used in this Standard requires answering the fundamental question of how worker safety is most appropriately addressed in the SAR.

The Occupational Health and Safety Administration (OSHA) has recently published 10 CFR 1910.119, “Process Safety Management of Highly Hazardous Chemicals.” The purpose of this regulation is defined by OSHA in summary fashion as, “Employees have been and continue to be exposed to the hazards of toxicity, fires, and explosions from catastrophic releases of highly hazardous chemicals in their workplaces. The requirements in this standard are intended to eliminate or mitigate the consequences of such releases.” Many of the topics requiring coverage in this federal regulation, such as design codes and standards, process hazard analysis, human factors, training, etc., are directly parallel to the topics addressed by DOE 5480.23. The regulation also provides overall integration of these topics. The OSHA standard addresses the issue of worker safety from process accidents by requiring the performance of hazards analyses for processes (exclusive of standard industrial hazards) in conjunction with implementation of basic safety programs that DOE-STD-3009-94 Page 7 discipline operations and ensure judgments made in hazard analyses are supported by actual operating conditions. These requirements effectively integrate programs and analyses into an overall safety management structure without requiring quantitative risk assessment. This integration and the basic concepts of Process Safety Management (PSM) described above are philosophically accepted as appropriate for SARs. This Standard effectively merges PSM principles with traditional nuclear SAR precepts. Defense in Depth Defense in depth as an approach to facility safety has extensive precedent in nuclear safety philosophy. It builds in layers of defense against release of hazardous materials so that no one layer by itself, no matter how good, is completely relied upon. To compensate for potential human and mechanical failures, defense in depth is based on several layers of protection with successive barriers to prevent the release of hazardous material to the environment. This approach includes protection of the barriers to avert damage to the plant and to the barriers themselves. It includes further measures to protect the public, workers, and the environment from harm in case these barriers are not fully effective. The defense-in-depth philosophy is a fundamental approach to hazard control for nonreactor nuclear facilities even though they do not possess the catastrophic accident potential associated with nuclear power plants. In keeping with the graded-approach concept, no requirement to demonstrate a generic, minimum number of layers of defense in depth is imposed. However, defining defense in depth as it exists at a given facility is crucial for determining a safety basis. Operators of DOE facilities need to use the rigorous application of defense-in-depth thinking in their designs and operations. Such an approach is representative of industrial operations with an effective commitment to public and worker safety and the minimization of environmental releases. For high hazard operations, there are typically multiple layers of defense in depth. The inner layer of defense in depth relies upon a high level of design quality so that important systems, structures, and components will perform their required functions with high reliability and high tolerance against degradation. The inner layer also relies on competent operating personnel who are well trained in operations and maintenance procedures. Competent personnel translates into fewer malfunctions, failures, or errors and, thus, minimizes challenges to the next layer of defense.

In the event that the inner layer of defense in depth is compromised from either equipment malfunction (from whatever cause) or operator error and there is a progression from the normal to an abnormal range of operation, the next layer of defense in depth is relied upon. It can consist of: (1) automatic systems; or (2) means to alert the operator to take action or manually activate systems that correct the abnormal situation and halt the progression of events toward a serious accident. Mitigation of the consequences of accidents is provided in the outer layer of defense in depth. Passive, automatically or manually activated features (e.g., containment or DOE-STD-3009-94 Page 8 confinement system, deluge systems, filtered exhaust), and/or safety management programs (i.e., emergency response) minimize consequences in the event that all other layers have been breached. The contribution of emergency response actions to minimizing consequences of a given accident cannot be neglected as they represent a truly final measure of protection for releases that cannot be prevented. Structures, systems, or components that are major contributors to defense in depth are designated as safety-significant SSCs. Additionally, this Standard provides guidance on grading the safety management programs (e.g., radiation protection, hazardous material protection, maintenance, procedures, training) that a facility must commit to in order to establish an adequate safety basis. The discipline imposed by safety management programs goes beyond merely supporting the assumptions identified in the hazard analysis and is an integral part of defense in depth. In accordance with nuclear safety precepts, a special level of control is provided through use of TSRs. DOE 5480.22 provides screening criteria for converting existing Operational Safety Requirements into TSRs. For the purposes of this Standard, the screening criteria are considered a generally reasonable set of criteria to designate TSRs for defense in depth. The safety items identified in the hazard analysis are examined against those criteria to identify a subset of the most significant controls that prevent uncontrolled release of hazardous materials and nuclear criticality. These TSR controls may be captured in operational limits or in administrative controls, including those on safety management programs. This collection of TSRs formally acknowledges features that are of major significance to defense in depth. Programmatic Commitments This Standard recognizes that the discipline imposed by programmatic commitments is at least as important to safety as the safety analysis itself. Programmatic commitments (e.g., radiation protection, maintenance, quality assurance) encompass a large number of details that are more appropriately covered in specific program documents (e.g., plans and procedures) external to the SAR. The cumulative effect of these details, however, are recognized as being important to facility safety, which is the rationale for a top level programmatic commitment becoming part of the safety basis. The importance of the programmatic commitments, which can be incorporated in TSRs as administrative controls, cannot be overestimated. The SAR safety basis, however, includes only the top level summary of program elements, not the details of the program or its governing documents. Inspection discrepancies in a program would not constitute violation of the SAR safety basis unless the discrepancies were so gross as to render premises of the summary invalid.

By virtue of application of the graded approach, the majority of the engineered features in a facility will not be identified in the categories of safety-class or safety-significant SSCs even though they may perform some safety functions. However, such controls noted as a barrier or preventive or mitigative feature in the hazard and accident analyses must not DOE-STD-3009-94 Page 9 be ignored in managing operations. Such a gross discrepancy would violate the safety basis documented in the SAR even if the controls are not designated safety-class or safety-significant, because programmatic commitments extend to these SSCs as well. For example, the commitment to a maintenance program means that the preventive and mitigative equipment noted as such in the SAR hazard analysis are included in the facility maintenance program. As a minimum, all aspects of defense in depth identified must be covered within the relevant safety management programs (e.g., maintenance, quality assurance) committed to in the SAR. The details of that coverage, however, are developed in the maintenance program as opposed to in the SAR. Facility operators are expected to have noted the relative significance of these engineered features and have provided for them in programs, in keeping with standard industrial practice, based on the importance of the equipment. It is the fact of coverage that is relevant to the facility safety basis. The details of this programmatic coverage (i.e., exact type of maintenance items and associated periodicities) are not developed in or part of the SAR. One overall commitment made in a SAR is that the contractor will not change the facility configuration underlying the documented safety basis without implementing and completing the unreviewed safety question (USQ) process. However, situations do occur where a USQ process is not necessary. For example, a stipulation to have a radiation protection program in the administrative control section of the TSR is a commitment; however, changes to specific program provisions do not require going through the USQ process. Further clarification of such interpretations can be found in DOE 5480.21, “Unreviewed Safety Questions.” DOE facilities that use and rely on site-wide, safety support services, organizations, and procedures, may summarize the applicable site-wide documentation provided its interface with the facility is made clear. The SAR then notes whether the reference applies to a specific commitment in a portion of the referenced documentation or is a global commitment to maintaining a program for which a number of details may vary without affecting the global commitment. Any documents referenced in the SAR are to be made available upon request. TSR and SSC Commitments In accordance with traditional nuclear safety practices, specific safety controls are committed to in the SAR. In keeping with the graded-approach principle, distinctions are made to avoid wasting effort by providing detailed descriptions of all facility SSCs. While a basic descriptive model of the facility and its equipment must be provided in Chapter 2, “Facility Description,” highly detailed descriptions are reserved for two categories of SSCs comprising the most crucial aspects of facility safety. These two categories are safety-class SSCs and safety-significant SSCs. Detailed descriptions are provided for these SSCs in Chapter 4 of the SAR because of the importance of their safety functions. Descriptions result in the definition of functional requirements and associated performance criteria used to derive TSRs. TSRs are safety

DOE-STD-3009-94 Page 10 controls developed in accordance with the precepts of DOE 5480.22. TSR and SSC commitments encompass the following: !! Technical safety requirements. TSRs comprise: (1) safety limits (SLs); (2) operational limits consisting of limiting control settings (LCSs) and limiting conditions for operation (LCOs) and associated surveillance requirements; and (3) administrative controls. Based on the results of hazard and accident analysis TSRs are designated for: (1) defense in depth in accordance with the screening criteria of DOE 5480.22, “Technical Safety Requirements;” (2) safety management programs for defense in depth or worker safety; (3) safety-class SSCs and controls needed to meet Evaluation Guidelines; and (4) safety-significant SSCs. It is important to develop TSRs judiciously. TSRs should not be used as a vehicle to cover the many procedural and programmatic controls inherent in any operation. Excessive use of TSR limits to manage operations will result in distortion of the regulatory structure DOE is attempting to develop and will dilute the emphasis intended for the most critical controls. Sls should be limited in number and designated with caution. In accordance with DOE 5480.22, SLs are generally reserved for limits on stresses that threaten passive barriers, with associated operating limits applying to active SSCs that prevent exceeding SLs. The only candidates for SLs should be safety-class SSCs and any non-SSC controls needed to meet Evaluation Guidelines. Nuclear industry precedent is that only a limited subset of safety-class SSCs, if any, require definition of associated SLs, which are intended to prevent significant accidents as opposed to mitigating their effects. TSRs assigned for defense in depth or safety-significant SSCs (i.e., not related to meeting Evaluation Guidelines) do not have SLs and are not required to use operational limits (i.e., LCSs, LCOs). They should, however, receive coverage in the administrative control section of TSRs as a minimum. Judgment should be used to determine what controls warrant use of operational limits. When TSR administrative controls are used for purposes other than generic coverage of safety management programs, descriptions should be sufficiently detailed that a basic understanding is provided of what is controlled and why. Beyond safety-significant SSCs designated for worker safety and their associated TSR coverage, additional worker safety issues should be covered in TSRs only by administrative controls on overall safety management programs. !! Safety-class structures, systems, and components. The safety-class designation has been traditionally reserved for SSCs needed for public protection. Accordingly, safety-class SSCs are those SSCs that accident analysis indicates are needed to prevent accident consequences from exceeding Evaluation Guidelines. This designation carries with it the most DOE-STD-3009-94 Page 11 stringent requirements (e.g., enhanced inspection, testing and maintenance, and special instrumentation and control systems). Safety-class SSCs normally will not be associated with Hazard Category 2 and 3 facilities due to their limited potential for offsite impact. !! Safety-significant structures, systems, and components. This category of SSCs is provided to ensure that important SSCs will be given adequate attention in the SAR and facility operations programs. Safety-significant SSCs are those of particular importance to defense in depth or worker safety as determined in hazard analysis. Control of such SSCs does not require meeting the level of stringency associated with safety-class SSCs.

Evaluation Guidelines are not used for designating safety-significant SSCs. Safety-class SSCs are designated to address public risk, which makes a dose/exposure guideline at the site boundary a useful tool. Safety-significant SSCs address risk for all individuals within the site boundary, making a dose/exposure guideline at any one point an artificial distinction distorting the process of systematically evaluating SSCs. TSRs covering SSCs insuring defense in depth should generally correlate with safety-significant SSC designation for defense in depth, but exact one-to-one correlation is not required. Correlation of DOE-STD-3009-94 to DOE 5480.23 The chapters in the Standard address SAR documentation requirements contained in DOE 5480.23. The correlation between the Standard’s chapters and the subject matter (Topics) of the Order is given in Table I-1. While the table indicates some variation between the Standard and the Order, a close correlation is also apparent. The principal variations between the Standard and the Order are as follows: ! Requirements from Topics 8.b.(3)(b), (f), and (u) of the Order (Applicable Statutes, Rules, and Departmental Orders, Safety Criteria, and Design Criteria) have been distributed to each chapter in the Standard to provide explicit correlation to topics. ! Requirements from Topic 8.b.(3)(d) for safety equipment designation have been emphasized in a new chapter, Chapter 4, “Safety Structures, Systems, and Components.” ! Topics 8.b.(3)(e) and (k) of the Order (Hazard Analysis and Classification of the Facility and Accident Analysis) have been combined in a single chapter, Chapter 3, “Hazard and Accident Analyses,” because of their close interrelationship. DOE-STD-3009-94 Page 12 Table I-1. Correlation of DOE-STD-3009-94 chapters to DOE 5480.23 topics. Topic DOE-STD-3009-94 DOE 5480.23 Chapter Topic 8.b.(3) Executive Summary unnumbered (a) Site Characteristics 1 (c) Facility Description 2 (d) Hazard and Accident Analysis 3 (e), (k) Safety Structures, Systems, and Components 4 (d) Derivation of Technical Safety Requirements 5 (p) Prevention of Inadvertent Criticality 6 (h) Radiation Protection 7 (i), (k) Hazardous Material Protection 8 (j), (k) Radioactive and Hazardous Waste 9 (g), (k) Initial Testing, In-Service Surveillance, and Maintenance 10 (o) Operational Safety 11 (q) Procedures and Training 12 (m) Human Factors 13 (n) Quality Assurance 14 (r) Emergency Preparedness Program 15 (s) Provisions for Decontamination and Decommissioning 16 (t) Management, Organization, and Institutional Safety Provisions 17 (l) NOTE: Topics (b), (f), and (u) are incorporated into all applicable chapters. Preparers of SARs yet to be written need to use the topic arrangements presented in this Standard. However, if a SAR using a different format is already in an advanced state of preparation, a table similar to Table I-1, indicating the specific chapter where each DOE 5480.23 topic is addressed, needs to be provided in the SAR. DOE-STD-3009-94 Page 13 ! The subtopics of normal operations in Topic 8.b.(3)(k) are interpreted to represent commitments to maintain occupational exposures and hazardous effluents within known and established limits. This requirement has been incorporated into specific subsections of Chapter 7, “Radiation Protection,” and Chapter 8, “Hazardous Material Protection.” Design and operational facility aspects relevant to general worker safety are also discussed in Chapter 3, “Hazard and Accident Analyses,” and Chapter 11, “Operational Safety.”

HAZARD ANALYSIS The initial analytical effort for all facilities is a hazard analysis that systematically identifies facility hazards and accident potentials through hazard identification and hazard evaluation. The focus of the hazard analysis is on thoroughness and requires evaluation of the complete spectrum of hazards and accidents. This largely qualitative effort forms the basis for the entire safety analysis effort, including specifically addressing defense in depth and protection of workers and the environment. Basic industrial methods for hazard analysis, its interface with more structured quantitative evaluations, and the basis for both have been described in references such as the American Institute of Chemical Engineers Guidelines for Hazard Evaluation Procedures (1992). These guidelines have been accepted by OSHA as the standard for analytical adequacy in characterizing commercial chemical processes that perform the same type of unit operations conducted at DOE nonreactor nuclear facilities. Appropriately applied, they help fulfill the requirements of SARs for Hazard Category 2 and 3 facilities as specified in DOE 5480.23. The largely qualitative techniques described in the above reference on hazard analysis provide methodologies for comprehensive definition of the accident spectrum for workers and the public. The basic identification of hazards inherent in the process provides a broad, initial basis for identification of safety programs needed (e.g., radiation protection, hazardous chemical protection). The hazard analysis then moves beyond basic hazard identification to evaluation of the expected consequences and estimation of likelihood of accidents, an activity that in no way connotes the level of effort of a probabilistic or quantitative risk assessment. Throughout the evaluation process, preventive and mitigative SSCs and pertinent elements of programmatic controls are identified. This identification also establishes functional requirements for SSCs, which will subsequently delineate the technical information (i.e., response parameters) needed to establish performance criteria. The SAR summarizes these requirements and criteria for safety-class and safety-significant SSCs only. Refinement of the information obtained in hazard evaluation leads to overall definition of defense in depth, worker safety, and environmental protection. The most significant aspects of defense in depth and worker safety are subject to definition as safety-significant SSCs and coverage by TSRs. Other items noted are encompassed by the details of safety management programs (e.g., procedures, training, DOE-STD-3009-94 Page 14 maintenance, quality assurance), which can be captured in top-level fashion in TSR administrative controls. The hazard evaluation conducted to assess the accident spectrum associated with hazards germane to the SAR indicates the adequacy of programmatic efforts and provides input to programmatic activities whose discipline provides a significant margin of safety.

The process outlined above is self grading for analytical effort. Analytical effort can be limited to a simple, resource efficient hazard analysis geared to facility needs, unless events are noted that are of sufficient complexity to require more detailed, quantitative evaluations to understand the basis for safety assurance. Implicit in this methodology is the statement of DOE-STD-1027-92 that the largely qualitative level of effort in hazard analysis is appropriate and sufficient for accident analysis of Hazard Category 3 facilities. It is again noted that the hazard analysis effort is not a quantitative risk assessment. Preparers (and subsequent reviewers) cannot expect the level of detail associated with a quantitative risk assessment in a hazard analysis, as the hazard analysis is focused on systematically assessing what can go wrong in a facility as opposed to deriving mathematical expressions of risk. The final purpose of hazard analysis is to identify a limited subset of accidents to be carried forward to accident analysis. DOE 5480.23 requires identification of design basis accidents (DBAs) in safety analysis and use of DBAs, as appropriate, in defining a facility safety basis. The attachment to the Order states that DBAs should be identified and notes that they are “accidents that are utilized to provide the design parameters for release barriers and mitigating systems” (see discussion under “Analysis of Normal, Abnormal, and Accident Conditions, Including Design Basis Accidents”). So defined, DBAs are a “front-end” device for designing individual equipment or systems to meet functional requirements, as evidenced by use of the phrase “utilized to provide the design parameters.” An accident can be defined as a DBA if relevant SSCs were specifically designed to function during that accident and appropriate documentation of this fact exists. The Attachment to the Order also states that “the range of accident scenarios analyzed in a SAR should be such that a complete set of bounding conditions to define the envelope of accident conditions to which the operation could be subjected are evaluated and documented.” This requirement necessitates the consideration of accidents other than DBAs for two cardinal reasons. First, even if DBAs exist, they may not adequately cover “the range of accident scenarios” needed to establish the facility safety basis. Secondly, DBAs may not cover a “complete set of bounding conditions.” Either of these conditions may arise for a number of reasons, such as the original design not being related to bounding conditions, the criteria for determining facility safety basis having significantly changed, operations or types of hazards having changed, or magnitude of hazards having increased. Any one of these reasons may make the DBA inadequate for determining a facility safety basis. DOE-STD-3009-94 Page 15 The most obvious and extreme reason for examining accidents other than DBAs for existing facilities is a lack of design documentation. If appropriate design documentation is not available, postulated accidents are not DBAs. The front-end purpose of a DBA (i.e., “to provide the design parameters”) cannot be meaningfully addressed even if existing design parameters are estimated and used to develop an accident scenario. The reconstructed accident would not determine design parameters. It would be determined by them. The requirements for analyzing a range of scenarios that bound conditions would not clearly be met by such an exercise. This potential lack of relevance is one of the reasons that the SAR is not the proper vehicle for formally filling gaps in existing design documentation.

Where DBAs do not exist, or do not adequately cover the range of scenarios or bounding conditions, surrogate evaluation bases are needed. These derivative DBAs are used to estimate the response of SSCs to “the range of accident scenarios” and stresses that bound “the envelope of accident conditions to which the facility could be subjected” in order to evaluate accident consequences. The derivative DBAs should take maximum advantage of the pertinent existing design information (i.e., requirements and bases) that is immediately available or can be retrieved through reasonable efforts. To the extent necessary, this information can be supplemented by testing, extrapolation, and engineering judgments. Existing facilities, like all industrial facilities, were generally built with standard process and utility SSCs with a high consideration for basic safety. For the majority of these facilities, adequate facility design and process information exist that, while not of the quality and detail expected for current conceptual design, is typical of many commercial processing operations, which comprise the majority of industrial practices. This information can be used in estimating SSC response to derivative DBAs whose evaluation will satisfy the requirements of safety analysis. For operational accidents, a derivative DBA is defined based on the physical possibility of phenomena as defined in the hazards analysis. Use of a lower binning threshold such as 10 /yr is generally appropriate, but should not be used as an absolute cutoff for-6 dismissing physically credible low probability operational accidents (e.g., red oil explosions) without any evaluation of preventive and mitigative features in hazard analysis. This distinction is made to prevent “pencil sharpening” at the expense of objective evaluation of hazards. Examples of a candidate derivative DBA would be an ion exchange column or a red oil explosion at a facility where the phenomena is physically possible and documentation is not available substantiating ventilation and building confinement systems were specifically designed for such an occurrence. For natural phenomena accidents, derivative DBAs are defined by a frequency of initiator based on DOE 5480.28, “Natural Phenomena Hazards Mitigation,” and its associated implementation standards. For external man-made accidents, derivative DBAs are assumed if the event can occur with a frequency >10 /yr as conservatively estimated, or-6 >10 /yr as realistically estimated. Use of a frequency cutoff for external events-7 DOE-STD-3009-94 Page 16 represents a unique case for external events only, based on established NRC precedents. For simplicity, use of the term DBA throughout this Standard is inclusive of both DBAs and derivative DBAs. ACCIDENT ANALYSIS The complete spectrum of accidents are examined in hazard analysis where safety- significant SSCs are designated. A limited subset of accidents, (i.e., DBAs and derivative DBAs) that bound "the envelope of accident conditions to which the operation could be subjected" are carried forward to accident analysis where safety-class SSCs are designated by comparison of accident consequences to Evaluation Guidelines. These scenarios are the accidents requiring formal definition. Information obtained from specific accidents or representative accidents enveloping many small accidents are used to specify functional requirements for safety-class SSCs in Chapter 4.

An accident analysis is performed for the bounding accidents. Accident analysis in this Standard refers to the formal quantification (i.e., all assumptions identified and justified and individual computations presented or summarized) of accident consequences. The general binning estimates used in hazard analysis are adequate and representative of the level of effort desired for frequency determination. Accordingly, accident analysis need only document the basis used in hazard analysis for assigning accident likelihood to two-orders-of-magnitude bins. The quantified consequences are compared to numerical Evaluation Guidelines for the purpose of identifying safety-class SSCs and any accident specific assumptions requiring coverage by TSRs. APPLICATION OF THE GRADED APPROACH DOE 5480.23 prescribes the use of a graded approach for the effort expended in safety analysis and the level of detail presented in associated documentation. The graded approach applied to SAR preparations and updates is intended to produce cost efficient safety analysis and SAR content that provide adequate assurance to the DOE that a facility has acceptable safety provisions without providing unnecessary information. As described in DOE 5480.23, the graded approach adjusts the magnitude of the preparation effort to the characteristics of the subject facility based on three attributes: ! Facility hazard magnitude or severity. ! Facility complexity. ! Facility life cycle stage. The Order provides for developing the SAR based on judgment of the facility in relation to these three factors. For example, simple Hazard Category 3 facilities or facilities that have a short operational life may only require a limited but adequate analysis documented to a level less than that required for a Hazard Category 2 facility. In addition, facilities with short operational lives (or other compelling circumstances) should consider the DOE-STD-3009-94 Page 17 appropriateness of requesting exemptions from the requirements of DOE 5480.23. The exemption process is a useful tool that should be considered when applying the graded approach. On the opposite end of the spectrum, a complex Hazard Category 1 facility that is just going into operation requires extensive analysis and highly detailed documentation. This Standard describes both an acceptable methodology and the SAR documentation requirements for each of the Topics covered in DOE 5480.23. The 17 chapters (21 SAR topics) discussed in this Standard present guidance for the preparation of comprehensive SARs for complex, Hazard Category 2, nonreactor nuclear facilities with long operational lives. However, the application of the graded approach will allow for much simpler analysis and documentation for these facilities. As DOE 5480.23 states in paragraph 4.f.(1)(c) of Attachment 1: For facilities of little hazard, or hazards in Category 3 level, for which only a modest reduction of risk is required, the SAR may be simple and short. In such cases all of the topics for the SAR listed in paragraph 8b(3) of this Order will not be necessary and with proper technical bases some topics may be omitted or reduced in the detail that would otherwise be required of Hazard Category 1 or 2 facilities. Thus, with application of the graded approach, SARs for Hazard Category 3 facilities or facilities with short operational lives will normally require more simplified SAR analysis and documentation. Specific minimum levels of detail for these facilities are given in the graded approach section of each chapter in this Standard. As a minimum, a SAR would be found acceptable for a simple Hazard Category 3 facility if it contained the following level of detail:

! Statement of the facility mission, life cycle, hazards, and summary of the safety analysis results. (Encompasses Executive Summary) ! Brief description of the standards and requirements that govern the operation. (Encompasses generic requirements from all chapters.) ! Brief description of facility siting to identify location, and boundaries. (Encompasses Chapter 1) ! Sufficient facility description to provide an understanding of facility processes, structures, systems, and components. (Encompasses Chapters 2 and 4) ! Basic hazard analysis (traditional accident analysis is not normally performed) sufficient to understand hazards posed to workers and the environment. (Encompasses Chapter 3) ! Derivation of TSRs to limit inventories of hazardous materials and to protect workers from unique hazards. (Encompasses Chapter 5) DOE-STD-3009-94 Page 18 ! Programmatic safety descriptions to address site specific, safety management programs in relation to hazards identified. (Encompasses Chapters 7–17; Chapter 6 not needed due to lack of critical mass of material). DOE-STD-3009-94 Page 19 Executive Summary PURPOSE. The purpose of this summary is to provide information that will satisfy the requirements of DOE 5480.23, paragraph(s) 8.b.(3)(a), as amplified in Attachment 1, paragraph(s) 4.f.(3)(d)1, of the Order (Topic 1). This summary provides an overview of the facility safety basis and presents information sufficient to establish a top-level understanding of the facility, its operations, and the results of the safety analysis. It summarizes the facility safety basis as documented in detail in the remainder of the SAR. Expected products of this summary, as applicable based on the graded approach, include: ! Summary of the facility background and mission. ! Overview of the facility including location and boundaries. ! Description of the facility hazard category. ! Summary of the results of the facility safety analysis including operational hazards analyzed, DBAs, and significant preventive and mitigative features. ! Summary of the facility organizations involved in safety functions. ! Summary of the acceptability of the facility safety basis. ! Guide to the structure and content of the SAR (i.e., “road map”). APPLICATION OF THE GRADED APPROACH. This summary is intended as an overview of the facility safety basis and presents information sufficient to provide a basic understanding of the facility, operations, and results of the safety analysis. It is prepared upon completion of all the other SAR chapters since it predominately draws upon the information in those chapters (see the Introduction and Figure I-2). Information provided should be top-level in nature and avoid reproducing the details of material documented in subsequent chapters. CONTENT GUIDANCE FOR SECTIONS OF THE EXECUTIVE SUMMARY E.1 FACILITY BACKGROUND AND MISSION This section identifies the facility for which the SAR has been prepared and presents general information on the background of the facility as it relates to the stage of facility life cycle. Clearly present the current mission statement for DOE-STD-3009-94 Page 20 which the SAR documents the safety basis (i.e., the purpose for which authorization is being sought). Present any relevant information (e.g., short facility life cycle, anticipated future change in facility mission, approved DOE exemptions) impacting the extent of safety analysis documented in the SAR and briefly explain its impact in terms of application of the graded approach.

E.2 FACILITY OVERVIEW This section provides an overview of the facility, including the facility location, physical and institutional boundaries, relationship and interfaces with nearby facilities, facility layout, and significant external interfaces (e.g. utilities, fire support, and medical support). E.3 FACILITY HAZARD CLASSIFICATION This section provides a statement of the facility hazard category as determined in accordance with DOE-STD-1027-92. If determination of the hazard category relied upon segmentation of facility hazards, then provide a brief explanation of the technical basis for such segmentation. E.4 SAFETY ANALYSIS OVERVIEW This section provides an overview of the facility operations and the results of the facility safety analysis to include: ! Description of the facility operations analyzed in the SAR. ! Summary of the significant hazards associated with the facility processes including DBAs. ! Summary of the main preventive and mitigative features relied upon in the facility safety basis. E.5 ORGANIZATIONS This section identifies the prime contractors responsible for facility design and construction (e.g., architect-engineer), facility maintenance and operation, and any consultants, oversight groups, and outside service organizations with significant safety functions. This section should also identify participants, including consultants, participating in the SAR development process. DOE-STD-3009-94 Page 21 E.6 SAFETY ANALYSIS CONCLUSIONS This section should provide a brief assessment of the appropriateness of the facility safety basis. As part of this summary, this section would identify any issues significant to the facility safety basis recognized by the facility operators to require further resolution, but for which delay in documenting the facility safety basis is not warranted or potential budgetary considerations require DOE involvement in a decision process requiring extensive study (e.g., backfit analysis). E.7 SAR ORGANIZATION This section provides a guide to the structure and content of the SAR, its chapters, and appendixes. If the main body of the SAR parallels the format delineated in this Standard, a simple statement to that effect will suffice. DOE-STD-3009-94 Page 22 DOE-STD-3009-94 Page 23 Chapter 1 Site Characteristics PURPOSE. The purpose of this chapter is to provide information that will satisfy the requirements of DOE 5480.23, paragraph(s) 8.b.(3)(c), as amplified in Attachment 1, paragraph(s) 4.f.(3)(d)3, of the Order (Topic 3). This chapter also includes information, if applicable, that will partially satisfy the requirements of DOE 5480.23 paragraph(s) 8.b.(3)(b),(f), and (u) as discussed in the Introduction of this Standard. This chapter provides a description of site characteristics necessary for understanding the facility environs important to the safety basis. Information is provided to support and clarify assumptions used in the hazard and accident analyses to identify and analyze potential external and natural phenomena accident initiators and accident consequences external to the facility. Expected products of this chapter, as applicable based on the graded approach, include: ! Description of the location of the site, location of the facility within the site, its proximity to the public and to other facilities, and identification of the point where Evaluation Guidelines are applied.

! Specification of population sheltering, population location and density, and other aspects of the surrounding area to the site that relate to assessment of the protection of the health and safety of the public. ! Determination of the historical basis for site characteristics in meteorology, hydrology, geology, seismology, volcanology, and other natural phenomena to the extent needed for hazard and accident analyses. ! Identification of design basis natural phenomena. ! Identification of sources of external accidents, such as nearby airports, railroads, or utilities such as natural gas lines. ! Identification of nearby facilities impacting, or impacted by, the facility under evaluation. ! Validation of site characteristic assumptions common to safety analysis that were used in prior environmental analyses and impact statements, or of the need to revise and update such assumptions used in facility environmental impact statements. Existing supporting documentation is to be referenced. Include brief abstracts of referenced documentation with enough of the salient facts to provide an understanding of the referenced documentation and its relation to this chapter. DOE-STD-3009-94 Page 24 APPLICATION OF THE GRADED APPROACH. Hazard Category 3 facilities do not have the potential for resulting in significant radiological consequences beyond the immediate facility. Therefore, the description of site characteristics, as a minimum, locates the facility on the overall site, shows the facility boundaries, and identifies any other facilities that can significantly impact the facility being examined. For Hazard Category 3 facilities, onsite meteorological conditions, hydrology, population information, and offsite accident pathways are not typically required, since consequences are limited to the facility itself. Note, however, that if significant chemical hazards are present in a Hazard Category 3 facility (i.e., approaching Evaluation Guidelines), more information is necessary. For Hazard Category 2 facilities with the potential for an accident which results in consequences below Evaluation Guidelines at the site boundary, the emphasis of site characteristics description is focused within site boundaries. For Hazard Category 2 facilities with the potential for an accident resulting in consequences above Evaluation Guidelines at the site boundary, site characteristics information is extended beyond the site boundary sufficient to support assessment of population dose, land contamination, and emergency planning external to the site. CONTENT GUIDANCE FOR SECTIONS OF CHAPTER 1 1.1 INTRODUCTION This section provides an introduction to the contents of this chapter based on the graded approach and includes objectives and scope specific to the chapter as developed. 1.2 REQUIREMENTS This section lists the design codes, standards, regulations, and DOE Orders which are required for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. Standards and Requirements Identification Documents (SRIDs) may be referenced as appropriate. 1.3 SITE DESCRIPTION This section describes the site boundary and facility area boundary. DOE-STD-3009-94 Page 25 1.3.1 Geography This section provides basic geographic information, such as: ! State and county in which the site is located.

! Location of the site relative to prominent natural and man-made features, such as rivers, lakes, mountain ranges, dams, airports, population centers. ! General location map to define the boundary of the site and show the correct distance of significant facility features from the site boundary. ! Public exclusion areas and access control areas. ! Identification of the point where Evaluation Guidelines are applied. ! Additional detail maps, as needed, to present near plant detail, such as orientation of buildings, traffic routes, transmission lines, and neighboring structures. 1.3.2 Demography Population information based on recent census data is included to show the population distribution as a function of distance and direction from the facility. Demographic information emphasizes worker populations and nearby residences, major population centers, and major institutions such as schools, hospitals, etc., to the degree warranted by potential offsite consequences. The minimum area addressed is defined by the area significantly affected by the accidents analyzed in Chapter 3, “Hazard and Accident Analyses.” 1.4 ENVIRONMENTAL DESCRIPTION This section describes the site’s meteorology, hydrology, and geology. 1.4.1 Meteorology This section provides the meteorological information necessary to understand the regional weather phenomena of concern for facility operation and to understand the dispersion analyses performed. 1.4.2 Hydrology This section provides the hydrological information necessary to understand any regional hydrological phenomena of concern for facility operation and to understand any dispersion analyses performed. Include information on groundwater aquifers, drainage plots, soil porosity, and other aspects of the hydrological character of the site. Discuss or reference, to the degree necessary, the average and extreme conditions as determined by historical data to meet the intent of this section. DOE-STD-3009-94 Page 26 1.4.3 Geology This section provides the geological information necessary to understand any regional geological phenomena of concern for facility operation. Describe the nature of investigations performed and provide the results of the investigations. Include geologic history, soil structures, and other aspects of the geologic character of the site. 1.5 NATURAL PHENOMENA THREATS This section provides identification of specific natural phenomena events, such as design basis earthquakes considered to be potential accident initiators. Summarize assumptions supporting the analysis in Chapter 3, “Hazard and Accident Analyses.” 1.6 EXTERNAL MAN-MADE THREATS This section provides identification of specific external man-made phenomena associated with the site—events such as explosions from natural gas lines or accidents from nearby transportation activities—considered to be potential accident initiators, exclusive of sabotage and terrorism. Summarize assumptions supporting the analysis in Chapter 3, “Hazard and Accident Analyses.” 1.7 NEARBY FACILITIES This section identifies any nearby facilities that could be affected by accidents within the facility being evaluated. Conversely, this section also identifies any hazardous operations or facilities onsite or offsite that could adversely impact the facility under evaluation. Summarize assumptions supporting the analysis in Chapter 3, “Hazard and Accident Analyses.” 1.8 VALIDITY OF EXISTING ENVIRONMENTAL ANALYSES

This section assesses the validity of site characteristic assumptions for existing environmental analyses and impact statements based on the more recent SAR effort. Simply state that no significant discrepancies exist or indicate the need to revise and update assumptions used in facility environmental statements through brief discussions summarizing major discrepancies. DOE-STD-3009-94 Page 27 Chapter 2 Facility Description PURPOSE. The purpose of this chapter is to provide information that will satisfy the requirements of DOE 5480.23, paragraph(s) 8.b.(3)(d), as amplified in Attachment 1, paragraph(s) 4.f.(3)(d)4a, of the Order (Topic 4). Topic 4 parts b and c of the Attachment to the Order are covered in Chapter 4. This chapter also includes information, if applicable, that will partially satisfy the requirements of DOE 5480.23 paragraph(s) 8.b.(3)(b),(f), and (u) as discussed in detail in the Introduction of this Standard. This chapter provides descriptions of the facility and processes to support assumptions used in the hazard and accident analyses. These descriptions focus on all major facility features necessary to understand the hazard analysis and accident analysis, not just safety SSCs. Expected products of this chapter, as applicable based on the graded approach, include: ! Overview of the facility, its inputs and its outputs, including mission and history. ! Description of the facility structure and design basis. ! Description of the facility process systems and constituent components, instrumentation, controls, operating parameters, and relationships of SSCs. ! Description of confinement systems. ! Description of the facility safety support systems. ! Description of the facility utilities. ! Description of facility auxiliary systems and support facilities. Existing supporting documentation is to be referenced. Include brief abstracts of referenced documentation with enough of the salient facts to provide an understanding of the referenced documentation and its relation to this chapter. APPLICATION OF THE GRADED APPROACH. The development of this chapter for Hazard Category 2 and 3 facilities is an iterative process dependent on the development of the hazard and accident analyses. The facility description should provide a model of the facility that would allow an independent reader to develop an understanding of facility operations and an appreciation of facility structure and operations without extensive consultation of controlled references. The level of detail required in the facility description is based on the significance of preventive and mitigative features identified and the degree of facility context necessary to understand the analyses. For a Hazard DOE-STD-3009-94 Page 28 Category 3 facility, provide a brief description of the facility, processes, and major SSCs. Grading will be based predominantly on complexity. This chapter does not include information at the level of functional requirements and performance criteria. That information is provided for safety SSCs only in Chapter 4. In the basic description of safety SSCs, their categorization as safety-class SSC or safety significant SSC should simply be noted. CONTENT GUIDANCE FOR SECTIONS OF CHAPTER 2 2.1 INTRODUCTION This section provides an introduction to the contents of this chapter based on the graded approach and includes objectives and scope specific to the chapter as developed. 2.2 REQUIREMENTS

This section lists the design codes, standards, regulations, and DOE Orders which are required for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. SRIDs may be referenced as appropriate. 2.3 FACILITY OVERVIEW This section includes a brief overview of the current and historical use of the facility, projected future uses, facility configuration, and the basic processes performed therein. 2.4 FACILITY STRUCTURE This section provides an overview of the basic facility buildings and structures, including construction details such as basic floor plans, equipment layout, construction materials, controlling dimensions, and dimensions significant to the hazard and accident analysis activity. Supply information to support an overall understanding of the facility structure and the general arrangement of the facility as it pertains to hazard and accident analyses. DOE-STD-3009-94 Page 29 2.5 PROCESS DESCRIPTION This section describes the individual processes within the facility. Include details on basic process parameters, including summary of types and quantities of hazardous materials, process equipment, instrumentation and control systems and equipment, basic flow diagrams, and operational considerations associated with individual processes or the entire facility, including major interfaces and relationships between SSCs. The intent is to supply information to provide an understanding of the assessment of normal operations, the safety analysis and its conclusions, and insight into the types of operations for which a safety management program must be devised. 2.6 CONFINEMENT SYSTEMS This section identifies and describes the set of structures, systems, and components that perform confinement functions such as process vessels, glove boxes, ventilation systems, and facility walls. 2.7 SAFETY SUPPORT SYSTEMS This section identifies and describes the principal systems that perform safety support functions (i.e., safety functions not part of specific processes). State the purpose of each system and provide an overview of each system, including principal components, operations, and control function. Examples of systems under this heading might include fire protection, criticality monitoring, radiological monitoring (e.g., air monitoring, contamination prevention), chemical monitoring (e.g., hydrogen concentration monitoring), effluent monitoring, etc. NOTE: This section is designed to organize the presentation of information, not to designate any special class of equipment. 2.8 UTILITY DISTRIBUTION SYSTEMS This section provides a schematic outline of the basic utility distribution systems, including a description of the offsite power supplies and onsite components of the system. Details of systems are given, to the level necessary, for understanding the utility distribution philosophy and facility operation. 2.9 AUXILIARY SYSTEMS AND SUPPORT FACILITIES This section provides information on the remaining portions of the facility that have not been covered by the preceding sections and which are necessary to create a conceptual model of the facility as it pertains to the hazard and accident analyses. DOE-STD-3009-94 Page 30 DOE-STD-3009-94 Page 31 Chapter 3 Hazard and Accident Analyses

PURPOSE. The purpose of this chapter is to provide information that will satisfy the requirements of DOE 5480.23, paragraph(s) 8.b.(3)(e) and 8.b.(3)(k), as amplified in Attachment 1, paragraph(s) 4.f.(3)(d)5 and 4.f.(3)(d)11, of the Order (Topics 5 and 11). Topic 11, part k of the Attachment to the Order is covered in Chapter 12, and Topic 11, part n of the Attachment to the Order is covered in Chapter 4. This chapter also includes information, if applicable, that will partially satisfy the requirements of DOE 5480.23 paragraph(s) 8.b.(3)(b),(f), and (u) as discussed in detail in the Introduction of this Standard. This chapter describes the process used to systematically identify and assess hazards to evaluate the potential internal, external, and natural phenomena events that can cause the identified hazards to develop into accidents. This chapter also presents the results of this hazard identification and assessment process. Hazard analysis considers the complete spectrum of accidents that may occur due to facility operations; analyzes potential accident consequences to the public and workers; estimates likelihood of occurrence; identifies and assesses associated preventive and mitigative features; identifies safety-significant SSCs; and identifies a selected subset of accidents, designated DBAs, to be formally defined in accident analysis. Subsequent accident analysis evaluates these DBAs for comparison with Evaluation Guidelines to identify and assess the adequacy of safety-class SSCs. This chapter covers the topics of hazard identification, facility hazard classification, hazard evaluation, and accident analysis. Expected products of this chapter, as applicable based on the graded approach, include: ! Description of the methodology for and approach to hazard and accident analyses. ! Identification of hazardous materials and energy sources present by type, quantity, form, and location. ! Facility hazard classification, including segmentation in accordance with DOE-STD-1027-92. ! Identification in the hazard analysis of the spectrum of potential accidents at the facility in terms of largely qualitative consequence and frequency estimates. The summary of this activity will also include: — Identification of planned design and operational safety improvements. — Summary of defense in depth, including identification of safety- DOE-STD-3009-94 Page 32 significant SSCs and other items needing TSR coverage in accordance with DOE Order 5480.22. — Summary of the significant worker safety features, including identification of safety-significant SSCs and any relevant programs to be covered under TSR administrative controls. — Summary of design and operational features that reduce the potential for large material releases to the environment. — Identification of the limited set of unique and representative accidents (i.e., DBAs) to be assessed further in accident analysis. ! Accident analysis of DBAs identified in the hazard analysis. The summary of this activity will include, for each accident analyzed, the following: — Estimation of source term and consequence. — Documentation of the rationale for binning frequency of occurrence in a broad range in hazard analysis (detailed probability calculations not required). — Documentation of accident assumptions and identification of safety-class SSCs based on Evaluation Guidelines.

Existing supporting documentation is to be referenced. Include brief abstracts of referenced documentation with enough of the salient facts to provide an understanding of the referenced documentation and its relation to this chapter. APPLICATION OF THE GRADED APPROACH. The results of the hazard analysis provide a comprehensive evaluation of the complete SAR accident spectrum. This evaluation will be essentially qualitative in that its aim is to produce a well reasoned and clear assessment of facility hazards and their associated controls. The focus of hazard analysis is on the completeness of consideration given to the accident spectrum, as opposed to a formalized definition of accident sequences and assumptions. Summary discussion of methodology is appropriate, but detailed bases for judgment and any simple mathematical estimates used in the hazard analysis to guide the judgments of the analysts for specific accident scenarios are not required to be formally documented in the SAR. For a small subset of accidents, the accident analysis documents individual calculations in the SAR, including references to its supporting documents. The accident analysis only needs to provide sufficient calculations to demonstrate that the Evaluation Guidelines are not exceeded. Once this is shown, additional quantitative analysis is not required. In general, a graded approach dictates a more thoroughly documented assessment of complex, higher hazard facilities than simple, lower hazard facilities since grading is a function of both hazard potential and complexity. The basic elements of hazard identification, categorization, evaluation, and analysis are required for any facility preparing a SAR in accordance with DOE 5480.23. The graded approach for hazard DOE-STD-3009-94 Page 33 analysis is a function of selecting techniques for hazard evaluation. The techniques used for hazard evaluation can range from simple checklists or What-If analyses to systematic parameter examinations such as Hazard and Operability Analyses (HAZOPs). The technique selected need not be more sophisticated or detailed than is necessary to provide a comprehensive examination of the hazards associated with the facility operations. For example, a simple storage operation may be adequately evaluated by a preliminary hazard analysis or a structured What-If analysis. There is no obligation for the analyst to perform a complete HAZOP. To achieve the objectives of analysis of accidents, the graded approach ranges from a hazard analysis to a detailed quantitative analysis where formally quantified event trees and/or fault trees form the bases for physical phenomena modeling and engineering analysis. The level of analytical effort employed is primarily a function of magnitude of hazard, but also takes into account system complexity, and the degree to which detailed modeling can be meaningfully supported by system definition. For nonreactor nuclear facilities, these considerations do not support a need for probabilistic/quantitative risk assessment of overall facility operations. This Standard does not present an expectation of or requirement for probabilistic/quantitative risk assessment. Additionally, in accordance with DOE-STD-1027-92, the hazard analysis as described in Section 3.3, “Hazard Analysis,” of this Standard is sufficient to meet the Order requirements of accident analysis for Hazard Category 3 facilities. The hazard analysis should be adequate to provide a simple estimate of bounding consequences for Hazard Category 3 facilities.

It must be kept in mind that Hazard Category 3 facilities may also have chemical hazards. The hazard classification mechanism used in DOE-STD-1027-92 does not consider potential hazardous chemical releases. The results of the hazard analysis will indicate whether a facility contains significant chemical hazard(s) that may exceed Evaluation Guidelines thereby necessitating accident analysis. Accident analysis is also inherently graded in terms of the degree of physical modeling and engineering analysis needed to quantify accident consequences and likelihoods. The use of bounding assumptions and less detailed physical modeling in accident analysis is appropriate. For example, where a given release has low consequences even if a filtered ventilation system is bypassed, detailed modeling of filtered release parameters such as filter differential pressure, plenum temperature, etc., is not needed for the given accident. Formal, quantitative analysis of potential accident sequences as described in Section 3.4, “Accident Analysis,” is not required to assess worker safety issues in addition to the hazard analysis. The largely qualitative hazard evaluation described in Section 3.3, which is a thorough analysis of potential accidents, is a more relevant vehicle for worker safety assurance. Additional guidance on hazard and accident analyses may be gained from the following references: DOE-STD-3009-94 Page 34 ! Guidelines for Hazard Evaluation Procedures, American Institute of Chemical Engineers, 1992. ! “Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports” DOE-STD-1027-92. ! “Recommended Values and Technical Bases for Airborne Release Fractions (ARFs), Airborne Release Rates (ARRs), and Respirable Fractions (RFs) at DOE Non-Reactor Nuclear Facilities” DOE-HDBK-3010-94. ! Nuclear Fuel Cycle Facility Accident Analysis Handbook, Nuclear Regulatory Commission NUREG-1320. ! “A Strategy for Occupational Exposure Assessment,” American Industrial Hygienists Association, 1991. ! “Application of Hazard Evaluation Techniques to the Design of Potentially Hazardous Industrial Chemical Processes,” National Institute of Occupational Safety and Health No. 88-79897, March 1992. ! 29 CFR 1910.119, “Process Safety Management of Highly Hazardous Chemicals.” CONTENT GUIDANCE FOR SECTIONS OF CHAPTER 3 3.1 INTRODUCTION This section provides an introduction to the contents of this chapter based on the graded approach and includes objectives and scope specific to the chapter as developed. 3.2 REQUIREMENTS This section lists the design codes, standards, regulations, and DOE Orders which are required for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. SRIDs may be referenced as appropriate. 3.3 HAZARD ANALYSIS This section describes the hazard identification and evaluation performed for the facility. The purpose of this information is to present a comprehensive evaluation of DOE-STD-3009-94 Page 35 potential process related, natural phenomena, and external hazards that can affect the public, workers, and the environment due to single or multiple failures. Consideration will be given to all modes of operation, including startup, shutdown, and abnormal testing or maintenance configurations. As is standard industrial practice, examination of all modes of operation considers the potential for both equipment failure and human error.

Hazard identification and evaluation provide a thorough, predominantly qualitative evaluation of the spectrum of risks to the public, workers, and the environment due to accidents involving any of the hazards identified. The evaluation identifies preventive and mitigative features , including identification of expected operator response to incidents (e.g., accident mitigation actions or evacuation) and provisions for operator protection in the accident environment (see Table 3-1, Action item/Comment column). A basic flowchart for hazard/accident analysis is provided in Figure 3-1. The major features of hazard analysis and the graded approach are captured in this figure. Hazard identification provides the basis for the final hazard categorization of the facility. That categorization is input for the graded approach for hazard evaluation. Hazard Category 3 facilities are not required to perform formal, quantitative accident analysis. Figure 3-1 identifies the specific point where the analyst must move beyond the general outline of this Standard and use the graded approach to specifically determine appropriate hazard analysis methodology. Application of a graded approach is based on the judgment and experience of the analysts and results in the selection of a hazard evaluation technique such as Preliminary Hazard Analysis (PHA), HAZOP, etc. As previously noted, more elaborate techniques will generally be associated with more complex processes. Experience and capabilities of analysts are also a major consideration in efficient performance of a comprehensive hazard evaluation. Systematic application of the chosen techniques to the operations in a facility generates a number of basic accidents based on types of events and system performance in response to the events. These accidents can be binned in accordance with predefined consequence and frequency ranking thresholds. Products of the hazard evaluation include: ! Identification of planned design and operational safety improvements. ! Summary of defense in depth including identification of safety-significant SSCs and other items needing TSR coverage, including relevant programs covered under TSR administrative controls. ! Summary of significant worker protection features including identification of safety-significant SSCs and relevant programs covered under TSR administrative controls. DOE-STD-3009-94 Page 36 Figure 3-1. Flowchart for performing a hazard analysis. DOE-STD-3009-94 Page 37 ! Summary of design and operational features that reduce the potential for large material releases to the environment. ! Selection of a limited set of bounding accidents (i.e., DBAs) to be further developed in Section 3.4, “Accident Analysis.” 3.3.1 Methodology This section presents the methodology used to identify and characterize hazards and to perform a systematic evaluation of basic accidents. 3.3.1.1 Hazard Identification This subsection identifies the method used by analysts to identify and inventory hazardous materials and energy sources (in terms of quantity, form, and location) associated with the facility processes or associated operations (e.g., waste handling). This methodology first identifies sources of referenced information that are not an integral part of the SAR hazard identification. Possible sources of such information include fire hazard analyses, health and safety plans, job safety analyses, occurrence reporting histories, etc.

The SAR covers worker safety issues related to hazards in processes and associated activities. It is not the intention of the SAR to cover safety as it relates to the common industrial hazards that make up a large portion of basic OSHA regulatory compliance. It is important not to expend SAR resources on those hazards for which national consensus codes and/or standards (e.g., OSHA regulations) already define and regulate appropriate practices without the need for special analysis. As noted in this Standard’s definition of “hazard,” standard industrial hazards are identified only to the degree they are initiators and contributors to accidents in main processes and activities. For example, worker electrocution from electrical wiring faults is not a SAR issue. However, the existence of 440 volt AC cabling in a glovebox would be identified as a potential accident initiator for a scenario (i.e., fire) involving hazardous materials. The distinction cited in the previous examples makes careful identification of hazards covered in the SAR essential so that potential worker hazards are not overlooked. As part of the identification process, the basis that was used in the hazard screening to remove standard industrial hazards or insignificant hazards from further consideration needs to be presented as well. For these cases, the SAR hazard analysis process interfaces with other programs such as specific topics of OSHA compliance or general industrial safety. These interfaces must be identified. Some of these compliance issues, while not presented in the SAR as such, may be a portion of a safety management program committed to by the facility. An example of this is the Health and Safety Plans required by OSHA in accordance with the Hazard Waste Operations and Emergency Response program. This could be one element of the “plans, procedures, and training for DOE-STD-3009-94 Page 38 governing operations involving radioactive and hazardous waste” specified in Section 9.3, “Radioactive and Hazardous Waste Management Organization.” This subsection also indicates the sources from which information was obtained, such as flowsheet inventories, maximum historical inventories, vessel sizes, contamination analyses, etc. The interpretation of the data used to derive conservative inventory values needs to be provided. 3.3.1.2 Hazard Evaluation This subsection presents, in summary fashion, the basic approach and guidance used for generating the largely qualitative consequence and likelihood estimates in hazard evaluation. Reference detailed guidance as necessary. Additionally, present any screening logic used for binning accidents. The appropriateness of the overall methods used to evaluate hazards is presented and justified. This justification focuses on the selection of a technique for given processes, not justification from first principles of standard analysis methods, such as HAZOP. 3.3.2 Hazard Analysis Results 3.3.2.1 Hazard Identification This subsection presents the results of the hazard identification activity, either by direct inclusion of or by reference to the hazard identification data sheets. As a minimum, provide a summary table identifying hazards by form, type, location, and total quantity. The attributes of hazards identified in this section are the basis for subsequent hazard evaluation and accident analysis. Include in the basic set of hazards identified radionuclides, hazardous chemicals, flammable and explosive materials used or potentially generated in facility processes, and any mechanical, chemical, or electrical source of energy that may influence accident progression involving such materials.

To provide a perspective on facility hazards, summarize in this subsection the major accidents or hazardous situations (e.g., fires, explosions, loss of confinement) that have occurred in the facility’s operating history. Specific details on each occurrence are not required. A general summary by type with emphasis on the major occurrences will suffice. 3.3.2.2 Hazard Classification This subsection presents the results of the final hazard classification activity specified in DOE-STD-1027-92. Include the facility hazard classification and, where segmentation has been employed, the segment boundaries and individual segment classifications. Justify any segmentation in terms of independence. DOE-STD-3009-94 Page 39 Where facility segmentation is used, provide the hazard breakdown by segment in the summary table required in Section 3.3.2.1. 3.3.2.3 Hazard Evaluation Hazard evaluation characterizes the identified hazards in the context of the actual facility and process. For example, a simple hazard identification would be that 2000 grams of plutonium oxide are in a steel container under a hood waiting for entry into a glove box. One accident, which places this hazard in the actual context of facility parameters, involves spilling the container on the room floor. The hazard evaluation would qualitatively consider the action of moving the container into the glove box to evaluate the likelihood of spilling the contents. It would also consider mitigative features that would affect potential consequences. References such as Guidelines for Hazard Evaluation Procedures (1992) provide acceptable guidelines for selecting hazard evaluation techniques and generic lists of initiators that need to be incorporated in systematic evaluation with a given technique. Public and worker safety issues are the traditional focus of hazard evaluations. The SAR hazard evaluation also examines the potential for large scale environmental contamination. The information on environmental contamination may be used in a separate cost-benefit analysis, not related to the SAR effort, to determine if additional preventive or mitigative features are needed in the facility. Tables 3-1 and 3-2 provide two examples of hazard analysis output. Table 3-1 is an example of a portion of the evaluation of a hydrogen fluoride unloading operation. It identifies accident initiators, associated preventive and mitigative functions, and operational safety enhancements determined to be necessary. The parenthetical numbers in the table under the headings of “Cause,” “Consequence,” and “Frequency” distinguish a numbering system that serves to identify specific accident scenarios (i.e., cause #1 is an event that has been judged to have consequence #1 and frequency #1, resulting in the overall ranking aligned with frequency #1). The ranking (i.e., low, medium, and high) of estimated consequences and frequencies are based on judgment of analysts, and the overall binning rank is in accordance with the numbers assigned to the example in Figure 3-3. Table 3-1 demonstrates how a number of basic accidents can be identified and evaluated in a concise manner. The last column of Table 3-1 presents safety enhancements in the form of two procedural verifications and two action items for procedural alteration that were identified in the course of the evaluation.

Table 3-1 also provides an example of how worker safety issues are integrated into this presentation. However, significant worker safety evaluations unrelated to the hazards scope defined for a SAR (i.e., standard industrial hazards) will be occurring outside the SAR. This reinforces the importance of the emphasis in Section 3.3.1.1, “Hazard Identification,” of identifying the dividing line between DOE-STD-3009-94 Page 40 Table 3-1. Example process hazard analysis worksheet. Facility: Example Refinery Date: 04/07/90 Page 3 of 30 Area: HF Alkylation Unit: Unloading HF from Supply Tanker Hazard Cause mitigative Consequence Frequency Ranking Comment Protection and Action item/ systems (1) Anhy- (1) Leak (A) Operators in (1)Minor operator(1) HIGH. 4 (1) Verify that drousHF, at connec- chemical suits with exposure—LOW. procedures 5,000 tion point. respirators for provide consistent gallons. emergency use. leak-check on (2) <100 psi (2) Verify potential procedures provide energy appropriately from defined interaction nitrogen between plant blanket. personnel and truck (2) HF hose rup- (B) Specific tures. procedures, trained (3) HF hose (C) HF detectors. ruptures, flow not (D) HF line remote immedi- shutoff valve on ately shut truck. off. (4) Truck valve capping kit relief valve available. fails open. (5) Truck regulators. relief valve opens; Maximum N pressure less than pressure tanker design conditions. pressure. (6) Tanker (G) Check valve on failure N gas line. from over- pressure. (H) Emergency water (7) N hose2 ruptures. (8) N hose 2 ruptures, check valve fails. (9) HF line not swept after unloading. operators. (E) Emergency relief (F) Two N pressure2 2 over- 2 deluge system. (2) Minor operator exposure, offsite <ERPG-2—LOW. (3)Operator exposure, possibly ERPG-2 offsite— MEDIUM. (4) Typically (a) LOW if capped. Possibly (b) MEDIUM if not capped and no deluge. (5) Typically (a) LOW if short duration. Possibly(b) MEDIUM if longer and no deluge. (6) Possible operator fatalities and ERPG- 3 offsite—HIGH. (7) N leak—LOW.2 (8) See #5 above. (9) Minor operator exposure—LOW. (2) MEDIUM. (3) LOW. (4) (a) MEDIUM . (4) (b)LOW . (5) (a) LOW. (5) (b)LOW. (6) LOW. (7) MEDIUM. (8) See #5 frequency. (9) HIGH. 2 3 2 3 1 3 6 2 See item #5 4 fitting. operators. (3) Area should be roped off and access controlled during unloading. (4) Specific evacuation routes for operators should be defined in procedures. DOE-STD-3009-94 Page 41 Table 3-2. Hazard analysis worksheet based on failure modes and effects analysis. Location _________________________________ Sheet _____of _____________________________ Project ___________________________________ Date _____________________________________ Ref. Drawing ______________________________ Process ___________________________________ Plant Section ______________________________ Effects on Item error mode / people System detected corrected class class required Line or equipment designation Failure or Components How How Frequency Consequence Action process/activity hazards covered in the SAR and those covered by direct OSHA regulatory compliance. Specifying the location of this dividing line is essential todeveloping an integrated safety posture where the functions of SAR hazard analysis vis-a-vis health and safety plans, job task analyses, etc., is understood.

Table 3-2, although not filled out, provides an example of another type of evaluation table. Whereas Table 3-1 is based more on a What-if or PHA-type approach, Table 3-2 is based on a failure modes and effects analysis approach. The basic outputs, however, remain unchanged. The second example is provided to indicate there is no one correct approach or presentation. The only constant is that effort needs to be expended only to the level necessary to basically characterize the accident spectrum. Hazard evaluation presents potential accidents in terms of hazards, energy sources, causes, preventive and mitigative features, consequence estimates, and DOE-STD-3009-94 Page 42 frequency estimates. Where a large number of scenarios are involved, present simple summaries in the text of this chapter with detailed tables generated in the performance of the hazard evaluation included as an appendix to the SAR. Beyond the basic results provided, the individual subheadings (Sections 3.3.2.3.1 through 3.3.2.3.5) of Section 3.3.2.3, “Hazard Evaluation,” present organized summaries of specific topics of concern. 3.3.2.3.1 Planned Design and Operational Safety Improvements If the SAR preparer wants to make commitments to planned improvements not yet implemented (as a result of the hazard evaluation), this section will identify those major design and operational improvements. Summarize the basis for committing to the improvement and, if needed, any interim controls proposed until the improvement is implemented. Provide a general outline of the improvement intended to the degree it has been conceptually finalized. Due to capital costs, need for further study (e.g., technical issues, cost benefit), procurement lead times, or other complications, it may not be feasible to implement such design or operational improvements prior to SAR submittal. DOE does not desire to unduly delay SAR completion for such items, and numerous safety precedents acknowledge accepting work in progress. Accordingly, the facility operator may choose to commit to implementation of an improvement that is not reflected in current design or facility operations. 3.3.2.3.2 Defense in Depth This section summarizes significant aspects of defense in depth, and identifies associated safety-significant SSCs and other items needing TSR coverage. Include both the facility design and administrative features of defense in depth. Facility design germane to defense in depth typically includes SSCs that function as: ! Barriers to contain uncontrolled hazardous material or energy release (e.g., metal dissolver vessel). ! Preventive systems to protect those barriers (e.g., hydrogen detection, air purge, and shutdown systems for metal dissolver). ! Systems to mitigate uncontrolled hazardous material or energy release upon barrier failure (e.g., ventilation zone confinement). Administrative features are typically linked to the overall safety management programs that directly control operations. Administrative features include the following aspects of operator interfaces: ! Procedural restrictions or limits imposed. ! Manual monitoring of critical parameters. ! Equipment support functions. DOE-STD-3009-94 Page 43 ! Responses or actions counted on to limit abnormal conditions, accident progression, or potential personnel exposure.

The individual features that comprise defense in depth are identified in “Hazard Evaluation,” Section 3.3.2.3. Table 3-1 provides an example of how existing and proposed features (barriers to uncontrolled hazardous material or energy release) for specific operations are identified. The raw information in the hazard evaluation tables will be examined and distilled into an organized discussion of the elements of defense in depth. Relevant accidents may be used to frame and focus the discussion, but the hazard evaluation already provided in or appended to the SAR in tabular form should not be duplicated. Organize the presentation in a systematic manner (i.e., inner to outer) to clearly identify the layers of defense. Note that there is no requirement to demonstrate any generic, minimum number of layers of defense. The intent is to support the conclusion that defense in depth for a given hazard is commensurate with industrial practices for the relevant type of activity. Identify the broad purpose and importance of defense-in-depth features, not the details of their design or implementation. For example, a glovebox represents an aspect of defense in depth. Only its major features and interactions with other elements of defense in depth, such as ventilation zone confinement, need to be summarized. It is not necessary to discuss the individual penetration fittings, welded piping junctions, gloveport designs, etc., that allow the glovebox to function as designed. Likewise, if there is a procedural requirement for the operator to perform an action if a parameter is exceeded, it is not necessary to identify the exact procedure, the exact phrasing of the requirement, the specific details of how the operator accomplishes that action, etc. Stating the action, providing a brief summary of its rationale, and noting that both procedures and training needed to cover that action are sufficient. Safety-Significant SSCs Distinguish safety-significant SSCs from among those structures, systems, and components contributing to defense in depth. To effectively use the graded- approach concept, focus on the most important items of defense in depth whose failure could result in the most adverse uncontrolled releases of hazardous material. This Standard maintains that all SSCs with a safety function do not require categorization as equipment requiring detailed description in the SAR (i.e., safety-class SSCs and safety-significant SSCs). As noted in the Introduction, this is one of the principle reasons for the emphasis on programmatic commitments. The major features of defense in depth typically comprise the outer or predominant means of mitigating uncontrolled release of hazardous materials (e.g., ventilation system directing airflow to HEPA filters, overall building structure), any preventive features that are designed to preclude highly energetic DOE-STD-3009-94 Page 44 events that potentially threaten multiple layers of defense in depth or essentially defeat any one layer (e.g., a hydrogen detector and purge flow interlock on a vessel that prevents a large hydrogen explosion, a sprinkler system that prevents a large fire that is physically possible for a type of operation), or any SSCs needed to insure the availability of such preventive or mitigative functions (e.g., electrical power sources for ventilation).

The total layers of defense in depth available are also key considerations in designating safety-significant SSCs. If many effective barriers are available, the significance of any one barrier is limited. If only one or two barriers can be realistically counted on, their individual significance increases. Likewise, if total hazardous material inventory is distributed over a hundred containers (e.g., waste drum storage pad, plutonium storage vault), the failure of any one container does not constitute a major uncontrolled hazardous material release. If all material is held in one container (e.g., 3000 gallon hydrogen fluoride storage tank), the failure of that container is of major concern in controlling the release of hazardous material. A principle reason for designating such major features as safety-significant SSCs is that they typically represent facility specific systems as opposed to more generic systems. While all glovebox line facilities use zone systems of ventilation for confinement, there is an enormous variation in the DOE complex with regard to specific design parameters such as number and types of exhaust systems, means of flow control, etc. Accordingly, more detailed descriptions of such equipment in a SAR is considered both appropriate and necessary for Hazard Category 2 facilities. Such description would not provide the same utility for relatively generic confinement items such as 55-gallon waste drums. The need for designation as a safety-significant SSC would also be superseded if that SSC was designated as a safety-class SSC in accident analysis. TSRs Summarize those safety-significant SSCs and other aspects of defense in depth that require TSR coverage in accordance with the screening criteria of DOE 5480.22, “Technical Safety Requirements.” The scope of the TSR coverage is determined by the degree to which barriers or the facility-safety basis are seriously challenged. Vital, passive components such as piping, vessels, supports, structures, and containers would typically be considered design features. These components are discussed in the Design Features Appendix of the TSR document to the degree they are not covered in the SAR. For example, a glovebox is an obvious barrier to uncontrolled material release. The windows, gloves, and cable/piping connectors are all necessary to maintain the barrier, but do not specifically require TSR coverage (i.e., operational limits or administrative controls) as contributors to defense in depth. DOE-STD-3009-94 Page 45 DOE 5480.22 provides basic screening criteria to identify defense-in-depth features that may require actual TSR coverage. Such features include instrumentation designed to detect significant barrier degradation; equipment that actuates or controls so as to reduce the likelihood of significant barrier challenges; process variables controlled for that purpose; and active controls that prevent criticality. Every control or indicator does not require specific TSR coverage. Likewise, every design feature malfunction or abnormal condition does not constitute a major barrier or facility safety basis degradation/challenge. Significant challenges to the facility safety basis are typically those events which have a genuine potential to seriously damage safety SSCs, require actuation of safety SSCs not on line as part of normal operations, or approach conditions TSR controls are designed to prevent. Significant barrier degradation is generally considered to mean substantial loss of barrier function resulting in significant hazardous material release to areas of personnel occupancy, or the occurrence of highly energetic events with the potential to damage multiple barriers.

To further explore barrier degradation, consider a glovebox containing a dissolver vessel. A leak from the dissolver would not be a major degradation of overall confinement because: ! It is a slow, low energy phenomenon where the primary vessel itself remains intact. ! The release is into another layer of confinement not occupied by personnel. Process upsets resulting in an eructation from the vessel would not be major degradation either. Even small, vapor space deflagrations that rupture vessel blowout ports would not be a major degradation if the glovebox itself would not sustain significant damage. In contrast, consider a large hydrogen deflagration or detonation that ruptures the vessel and piping, drives debris through the glovebox structural elements, and momentarily pressurizes the glovebox. This is a highly energetic event and multiple barriers have been damaged allowing a potentially significant release of hazardous material directly to occupied areas. Possible TSR coverage could include the maximum hydrogen concentration limits or requiring an air purge system to be functioning when the dissolver is operating. TSRs may also be provided for safety management programs in the form of TSR administrative controls to support adequate defense in depth. Such all encompassing TSRs should be used in lieu of individual TSRs for numerous specific aspects of programs. DOE-STD-3009-94 Page 46 3.3.2.3.3 Worker Safety This section summarizes the major features protecting workers from the hazards of facility operation, exclusive of standard industrial hazards. Summary products germane to worker safety typically include: ! General overview of worker safety in terms of SSCs and administrative features. ! Identification of any safety-significant SSCs. ! Identification of any safety management programs that will be assigned TSR coverage in the form of administrative controls for adequate worker safety. General prioritization of the features needs to be included and expressed in terms of the magnitude of process hazard, number of potentially affected employees, pertinent aspects of operation history, and projected lifetime of the process. Only a summary level discussion is required, not a detailed discussion or defense of the prioritization logic. The safety features to be addressed in this section fall into one of two categories: ! Structures, systems, and components. ! Administrative features. This subsection is derived from examining the raw information in the hazard evaluation tables (see Table 3-1 for example) and distilling it into a clear overview of worker safety features at the facility. This presentation may use relevant accidents to frame and focus the discussion, but need not duplicate the hazard evaluation already provided in or appended to the SAR in tabular form. If the basic function of a worker safety feature has already been discussed in Section 3.3.2.3.2, “Defense in Depth,” that feature may simply be identified by name and referenced. Identify structures, systems, and components as safety-significant SSCs where appropriate. As a general rule of thumb, safety-significant SSC designations based on worker safety are limited to those systems, structures, or components whose failure is estimated to result in an acute worker fatality or serious injuries to workers (see definition of safety-significant SSCs for further clarification).

Categorize administrative features in terms of the programmatic elements covered in later chapters of the SAR. With the exception of safety-significant SSCs, TSR designation is made in the form of administrative controls for overall programs only for worker safety. Typical safety-management programs include criticality protection, radiation protection, hazardous material protection, institutional safety provisions, procedures and training, operational safety, and emergency preparedness. Specifically note programs that will be provided TSR coverage as administrative controls in Chapter 5, “Derivation of Technical Safety Requirements.” DOE-STD-3009-94 Page 47 Figure 3-2 shows how worker safety is addressed in the hazard analysis process. This subsection provides documented evidence that worker safety features are an integral part of facility design and operation, that basic facility operations for worker safety are adequate, and that workers are protected by a number of means including programs described elsewhere in the SAR (e.g., Chapters 7 and 8). It is emphasized again that this subsection is written at a summary level. Identify the broad purpose of features, but not the details of their design. 3.3.2.3.4 Environmental Protection This subsection summarizes the design and operational features that reduce the potential for large material releases to the environment. Document pathways for uncontrolled release of large amounts of hazardous materials to the environment identified in the hazard evaluation. Estimate potential consequences and preventive and mitigative features associated with specific pathways. If specific pathways have previously been addressed (e.g., Section 3.3.2.3.2, “Defense in Depth”), a reference is sufficient. This subsection should conclude that no large release with the potential to cause significant environmental insult exists that an obvious and easily implemented design or operational change could minimize. For example, consider widespread river or groundwater contamination due to spills from the contents of a tank. It would not be an appropriate conclusion to accept such a risk if a simple dike around the tank would alleviate the problem and yet had not been installed. Conversely, consider the handling of plutonium in a facility with gloveboxes, ventilation zones of confinement, and HEPA filters. These measures would be adequate for closure of environmental contamination concerns for process accidents. In the majority of instances, process related TSRs and safety SSCs assigned for defense in depth will be sufficient to address environmental concerns. This subsection is not intended to present detailed, cost-benefit conclusions about the adequacy of design related to potential environmental contamination. It may serve as input to separate cost-benefit analysis to determine if additional preventive or mitigative features are to be added to the facility. However, such analyses are not related to the SAR effort. The numerical Evaluation Guidelines and legal limits on normal operations (i.e., EPA regulations) inherently place an upper bound on potential environmental releases. Further, issues of environmental contamination are not direct safety issues. Safety SSC designations are not required for issues solely related to environmental protection. In accordance with DOE 5480.22, TSR designations are not required for such issues either. TSR designation associated with prevention of uncontrolled release of hazardous materials would typically be assigned for defense-in-depth considerations.

D O E -S T D -3009-94 P age 48 F igure 3-2. W orker safety evaluation. DOE-STD-3009-94 Page 49 3.3.2.3.5 Accident Selection Accident analysis entails the formal quantification of a limited subset of accidents (i.e., DBAs). These accidents represent, as noted in DOE 5480.23, “a complete set of bounding conditions.” The identification of DBAs results from the hazard evaluation ranking of the complete spectrum of facility accidents. Figure 3-3 and Tables 3-3 through 3-5 provide examples of hazard evaluation ranking mechanisms. Two examples are provided to indicate there is more than one correct approach. The approach used at any specific facility is based on the detail needed for a given facility and the experience of the analysts. Figure 3-3 is a graphical example of a common three-by-three frequency and consequence ranking matrix. This particular example was used for evaluating airborne hazardous material releases. The logic behind Figure 3-3 is elaborated on in Tables 3-3 through 3-5 which provide a description of a four-by-four frequency and consequence ranking matrix. Although differing in presentation and structural details, the philosophical basis and objectives for both examples are identical. The ranking schemes are designed to separate the lower risk accidents that are adequately assessed by hazard evaluation from higher risk accidents that may warrant additional quantitative analysis if the phenomena involved are not simplistic. A limited number of moderate risk accidents between the two extremes may also be identified for assessment. Tables 3-3 through 3-5 provide typical descriptions of consequence and likelihood thresholds for binning. Ranking should use broad bins. For example, frequency bins should typically cover two orders of magnitude. Although the exercise of binning is essentially qualitative, analysts often use a simple numerical basis for judgments to provide consistency. For example, a simple methodology for frequency binning would be to assign a probability of 1 to nonindependent events, 0.1 to human errors, and 0.01 to genuinely independent failures. Another methodology would be to use a summary of historical data. Likewise, before beginning the evaluation, a conservative Gaussian plume estimation of the amount of material needed outside the building to cause a certain dose might be performed to aid in defining thresholds of significance. Briefly discuss or reference any such guidelines in Section 3.3.1.2, “Hazard Evaluation.” Note, however, that the ranking of frequency and consequence into such broad categories is more of a qualitative than a quantitative exercise. This effort does not constitute the need for, or expectation of, a probabilistic/quantitative risk assessment. An important factor in estimating binning thresholds for public consequences is to tie the thresholds to Evaluation Guidelines so that accidents that could challenge guidelines are correctly identified for formal accident analysis. The binning requirement of this subsection does not preclude the use of other sorting mechanisms in addition to risk sorting if an analyst finds such mechanisms useful. DOE-STD-3009-94 Page 50 Figure 3-3. A three-by-three likelihood and consequence ranking matrix for hazard evaluation. DOE-STD-3009-94 Page 51 Table 3-3. Qualitative severity classification table. Descriptive word Description No Negligible onsite and offsite impact on people or the environs.

Low Minor onsite and negligible offsite impact on people or the environs. Moderate Considerable onsite impact on people or the environs; only minor offsite impact. High Considerable onsite and offsite impacts on people or the environs. Table 3-4. Qualitative likelihood classification table. Descriptive likelihood of Estimated annual word occurrence Description Anticipated 10$p>10 Incidents that may occur several-1 -2 times during the lifetime of the facility. (Incidents that commonly occur) Unlikely 10 $p>10 Accidents that are not anticipated-2 -4 to occur during the lifetime of the facility. Natural phenomena of this probability class include: Uniform Building Code-level earthquake, 100-year flood, maximum wind gust, etc. Extremely 10$p>10 Accidents that will probably not Unlikely occur during the life cycle of the -4 -6 facility. This class includes the design basis accidents. Beyond Extremely 10$p All other accidents. Unlikely -6 DOE-STD-3009-94 Page 52 Table 3-5. Qualitative ranking. Risk Description evaluation No impact or beyond extremely unlikely. Low severity and extremely unlikely. Acceptable Moderate severity and extremely unlikely or low severity and unlikely. High severity and extremely unlikely or low severity and anticipated. Marginal Moderate severity and unlikely. Moderate severity and anticipated or high severity and unlikely. Unacceptable High severity and anticipated. This accident selection activity identifies the process and criteria used to select the unique and representative potential accidents (i.e., DBAs) to be included in accident analysis. Unique accidents are those with sufficiently high-risk estimates that individual examination is needed (e.g., a single fire whose specific parameters result in approaching Evaluation Guidelines, situations of major concern from Figure 3-3). Representative accidents bound a number of similar accidents of lesser risk (e.g., the worst fire for a number of similar fires, situations of concern in Figure 3-3). Representative accidents are examined to the extent they are not bounded by unique accidents. In any case, at least one bounding accident from each of the major types determined from the hazard analysis (e.g., fire, explosion, spill, etc.) should be selected unless the bounding consequences are “Low” (See Figure 3-3). Accidents are identified and listed by accident category (i.e., internally and externally initiated) and type (e.g., fire, explosion, spill, etc.). Since the hazard analysis activity is considered sufficient for Hazard Category 3 facilities, SARs for these facilities need simply summarize the maximum DOE-STD-3009-94 Page 53 consequences expected from facility operation and state that detailed accident quantification is not necessary because potential consequences are well below Evaluation Guidelines. The one possible exception to this case, as previously noted, is a facility with Hazard Category 3 quantities of radionuclides but possessing large amounts of toxic chemicals that could result in accident scenarios challenging Evaluation Guidelines. Such facilities need to summarize the maximum radiological consequences expected and identify the chemical accidents selected for accident analysis. 3.4 ACCIDENT ANALYSIS

This section presents the formal development of the potential accidents identified in Section 3.3.2.3.5, “Accident Selection,” beginning with a formal sequence of developing connecting initiating events to preventive feature and mitigative feature responses. A basic flowsheet for accident analysis is presented in Figure 3-4. The principal purpose of the accident analysis is to identify any safety-class SSCs and TSRs needed for protection of the public. Each accident sequence needs to be analyzed through the use of a documented, deterministic, DBA. Whenever possible, DBAs are analyzed using the simplest applicable deterministic, phenomenological calculations (e.g. pressure estimates from a simple ideal gas law calculation, hand calculated Gaussian plume dispersions). The nondeterministic aspects of DBA analysis are simplified by estimating overall sequence frequencies in broad frequency ranges in hazard analysis. This process is considered sufficient for SAR purposes and accident analysis need only document the basis for the binning performed in hazard analysis. Detailed probabilistic calculations are neither expected nor required. Natural phenomena and external events are special cases. Natural phenomenon DBAs are those events with a phenomenon initiating frequency as specified in DOE 5480.28 and its applicable standards. External events are not typically design bases for facilities. However, they will be referred to as DBAs and analyzed as such if frequency of occurrence is estimated to exceed 10 /yr-6 conservatively calculated, or 10 /yr realistically calculated. -7 Accident analysis typically starts with formal descriptions of accident scenarios. Such descriptions may be supported by basic event trees. All major assumptions in scenarios must be identified. The next step is determination of accident source terms. Source terms for accidents are obtained through phenomenological and system response calculations. Once a source term has been determined, consequences due to atmospheric dispersion or other relevant pathways of concern are determined. As with every phase of the analysis, the effort expended is a function of the estimated consequence. If the source term is small, a simple, dispersion hand calculation for DOE-STD-3009-94 Page 54 Figure 3-4. Flowchart for performing an accident analysis. consequences would be sufficient. If source terms are large, computer modeling to determine consequences may be required. The consequences finally determined are compared to Evaluation Guidelines. From this activity, it is determined if safety-class SSC designation is needed. The need for accident specific TSRs to meet Evaluation Guidelines will also be determined. Detailed description of safety-class SSCs and TSRs are presented in Chapter 4, “Safety Structures, Systems, and Components,” and Chapter 5, “Derivation of Technical Safety Requirements.” The nature of the accidents to be analyzed will vary depending upon the facility and processes considered. However, it is anticipated that for most facilities or processes, the number of accidents requiring formal analysis will not be large. The categories of DBAs examined are: DOE-STD-3009-94 Page 55 ! Operational accidents (caused by initiators internal to the facility). ! Natural phenomena events (e.g., earthquakes, tornadoes). ! External events (caused by man-made initiators external to the facility).

All assumptions made in the accident analysis (i.e., defining points in scenario progression) are to be validated as part of the accident analysis activity. For example, if an operator is supposed to push Button Z to stop an accident progression, the accident analysis needs to make it clear that the operator can actually do so. Making it clear may simply involve noting there is no physical phenomena associated with the accident that would preclude him from doing so. Likewise, basic assurance must be provided that equipment relied upon in unusual or severe environments will function. This assurance does not constitute the need for or expectation of full, formal environmental qualification. The above guidance is not meant to imply that the SAR must contain detailed validations for all assumptions. The SAR needs to present information at a level that is considered sufficient for review and approval of the SAR. Referencing an auditable trail of information as part of the controlled supporting documentation is acceptable. 3.4.1 Methodology This section summarizes the methods used to quantify the consequences of operational accidents, natural phenomena events, and external events selected in Section 3.3.2.3.5, “Accident Selection.” Identify and describe any computer programs used to implement methods discussed below. Include in the description the origin of the code, its precedent for use, input data, the range of variables investigated, the basic analytical models, their interrelationships, and the progression of the analysis. Briefly summarize and reference detailed information on algorithms, computational and analytical bases, and software quality assurance measures. Documentation of methodology should include the following: ! Methods used to estimate radiological or other hazardous material source terms for DBAs including: (1) basic approach for estimating physical facility damage from DBAs; (2) general basis for assigning material-at-risk quantities not directly derived from hazard identification, if differing values are used; and (3) basis for material release and respirable fractions or release rates used. ! Methods used to estimate dose and exposure profiles including assumptions on variables such as meteorological conditions, time dependent characteristics, activity, and release rates or duration for radioactive or other hazardous materials that could be released to the environment. DOE-STD-3009-94 Page 56 3.4.2 Design Basis Accidents This section analyzes DBAs for each of the major categories to quantify consequences and compare them to Evaluation Guidelines. The major categories are: internally initiated operational accidents (e.g., fires, explosions, spills, criticality); natural phenomena events for the site (e.g., earthquakes, tornadoes) that could affect the facility; and externally initiated, man-made events such as airplane crashes, transportation accidents, adjacent facility events, etc., that can either cause releases at the facility under examination or have a major impact on facility operations. Beyond DBAs are discussed in Section 3.4.3, “Beyond Design Basis Accidents.”

Quantification methods are typically limited to calculating the dose/exposure profile of a release. The process is iterative, starting by taking no credit for mitigative features and comparing results to Evaluation Guidelines. Continue taking credit for additional mitigative features incrementally and comparing results to Evaluation Guidelines until below the guidelines. This iterative process, however, does not require denying the physical design of facility structures, systems, and components. For example, if liquid hazardous material is brought into a facility in steel piping and stored in steel tanks, it is not meaningful to disregard the existence of these physical features in analysis. Simply admitting they exist does not require safety-class SSC designation either. Stated another way, facilities should be analyzed as they exist when quantifying meaningful release mechanisms. NOTE: The following format is repeated sequentially for each (“X”) DBA. 3.4.2.X [Applicable DBA] Identify the DBA by individual title, category (i.e., operational, natural phenomena, external) and general type (e.g., fire, explosion, spill, earthquake, tornado). 3.4.2.X.1 Scenario Development This subsection describes accident progression linking initiating events with preventive and mitigative events and other contributing phenomena to formally define the accidents identified in Section 3.3.2.3.5, “Accident Selection.” Note each response, action, or indication required to initiate action that is relevant to the scenario progression. Document the rationale used in hazard analysis for binning the DBA in a broad frequency range. When summarizing the initiating event for a given natural phenomena DBA, use DOE 5480.28 and its applicable standards (i.e., DOE-STD-1020 through -1024) to determine the natural phenomena DBAs for the facility. Design basis guidelines include, among others, load factors, return periods, amplification DOE-STD-3009-94 Page 57 factors for the facility, etc. Summarize facility and equipment response (emphasizing preventive or mitigative equipment) to the loads postulated to be present at the time the given natural phenomena event occurs. Reference the facility documentation of this evaluation and summarize relevant assumptions. Discuss the degree of conservatism of the evaluation. Evaluate secondary events directly caused by natural phenomena, such as earthquake induced fires, based on their physical possibility for facility conditions (i.e., the induced accident must already potentially exist in the absence of the seismic event). For example, seismic induced fires should be considered DBAs where significant accumulations of flammable material are exposed to fire initiators by seismic damage to the facility. If minimal combustible material is present in a given location, a large seismic induced fire in that location would not be a DBA as the potential is not physically possible. Although external events are not typically design bases, this Standard considers them as DBAs if the frequency of occurrence is estimated to exceed 10 /yr-6 conservatively calculated, or 10 /yr realistically calculated. The specific use of-7 this NRC frequency precedent is limited to external events only due to their unique nature. External events are presented because frequency criteria for inclusion are met. Accordingly, the analysis that substantiates frequency need only be referenced. 3.4.2.X.2 Source Term Analysis

This subsection determines the accidental material or energy released through the pathways of concern. Define all parameters and phenomenological models used to derive the source term. As a minimum, this definition includes the material at risk (as derived from the hazard identification), the release fraction or rate that determines the initial source term, and the overall facility leakpath factors that determine the final source term released external to the facility. The degree of conservatism believed to be present in the calculation needs to be consistent with Evaluation Guideline definitions. Detailed quantification of uncertainty is not required. 3.4.2.X.3 Consequence Analysis This subsection determines the receptor doses/exposures associated with the relevant pathways. Derive the exposures and doses in accordance with the definition of Evaluation Guidelines. The information derived from the hazard and accident analyses related to protection of the public and potential insights gained for environmental contamination issues needs to be compared to the facility National Environmental Policy Act documentation to ensure that no significant discrepancies exist between the SAR and that documentation. DOE-STD-3009-94 Page 58 3.4.2.X.4 Comparison to Guidelines This subsection compares the receptor dose/exposure for the accident sequence to the Evaluation Guidelines. If Evaluation Guidelines cannot be met, provide a summary assessment of the significance of the failure to meet Evaluation Guidelines and administrative and/or engineered controls whose implementation would allow guidelines to be met. Detailed cost-benefit analyses to evaluate potential changes are beyond the scope of the SAR. 3.4.2.X.5 Summary of Safety-Class SSCs and TSR Controls This subsection identifies the safety-class SSCs and assumptions judged to require TSR coverage to meet Evaluation Guidelines. Any TSR assumption not directly related to exceeding of Evaluation Guidelines should be defined in section 3.3.2.3.2, “Defense in Depth.” For details, refer to Chapter 4, “Safety Structures, Systems, and Components,” and Chapter 5, “Derivation of Technical Safety Requirements.” 3.4.3 Beyond Design Basis Accidents DOE 5480.23 requires the evaluation of accidents beyond the design basis to provide a perspective of the residual risk associated with the operation of the facility (see Attachment 1, paragraph 4.f.(3)(d)11c, of the Order). Such beyond DBAs are not required to provide assurance of public health and safety. Accordingly, they serve as bases for cost-benefit considerations if consequences exceeding Evaluation Guidelines are identified in the beyond DBA range. However, such cost-benefit analysis would be performed outside the SAR with the concurrence of DOE. It is expected that beyond DBAs will not be analyzed to the same level of detail as DBAs. The requirement is that an evaluation be performed that simply provides insight into the magnitude of consequences of beyond DBAs (i.e., provide perspective on potential facility vulnerabilities). This insight from beyond DBA analysis has the potential for identifying additional facility features that could prevent or reduce severe beyond DBA consequences. For nonreactor nuclear facilities, however, the sharp increase in consequences from DBA to beyond DBA is not anticipated to approach that found in commercial reactors where the beyond DBA precedent was generated. No lower limit of frequency for examination is provided for beyond DBAs whose definition is frequency dependent. It is understood that as frequencies become very low, little or no meaningful insight is attained.

Operational beyond DBAs are simply those operational accidents with more severe conditions or equipment failures than are estimated for the corresponding DBA. For example, if a deterministic DBA assumed releases were filtered because accident phenomenology did not damage filters, the same accident with DOE-STD-3009-94 Page 59 loss of filtration is a beyond DBA. The same concept holds true for natural phenomena events, but beyond DBAs are defined by the initiating frequency of the natural phenomena event itself (i.e., frequency of occurrence less than DBA frequency of occurrence). Beyond DBAs are not evaluated for external events. DOE-STD-3009-94 Page 60 DOE-STD-3009-94 Page 61 Chapter 4 Safety Structures, Systems, and Components PURPOSE. The purpose of this chapter is to provide information that will satisfy the requirements of DOE 5480.23, paragraph(s) 8.b.(3)(d), as amplified in Attachment 1, paragraph(s) 4.f.(3)(d)4b and 4.f.(3)(d)4c, of the Order (Topic 4), and paragraph(s) 8.b.(3)(k), as amplified in Attachment 1, paragraph(s) 4.f.(3)(d) 11n, of the Order (Topic 11). This chapter also includes information, if applicable, that will partially satisfy the requirements of DOE 5480.23 paragraph(s) 8.b.(3)(b),(f), and (u) as discussed in detail in the Introduction of this Standard. This chapter provides details on those facility structures, systems, and components that are necessary for the facility to satisfy Evaluation Guidelines, provide defense in depth, or contribute to worker safety. Descriptions are provided of the attributes (i.e., functional requirements and performance criteria) required to support the safety functions identified in the hazard and accident analyses and to support subsequent derivation of TSRs. Expected products of this chapter, as applicable based on the graded approach, include: ! Descriptions of safety SSCs, including safety functions. ! Identification of support systems safety SSCs depend upon to carry out safety functions. ! Identification of the functional requirements necessary for the safety SSCs to perform their safety functions, and the general conditions caused by postulated accidents under which the safety SSCs must operate. ! Identification of the performance criteria necessary to provide reasonable assurance that the functional requirements will be met. ! Identification of assumptions needing TSR coverage. Existing supporting documentation is to be referenced. Maximum advantage should be taken of pertinent existing safety analyses and design information (i.e., requirements and their bases) that are immediately available or can be retrieved through reasonable efforts. Include a brief summary for each such reference that explains its relevance to this chapter and provides an introductory understanding of the reference. APPLICATION OF THE GRADED APPROACH. Hazard Category 3 facilities will not have safety-class SSCs and the number of safety-significant SSCs, if any, will be less than that of a Hazard Category 2 facility due to the reduced magnitude of hazards. As noted in Chapter 3, “Hazard and Accident Analyses,” a possible exception to this general guidance DOE-STD-3009-94 Page 62 pertains to chemical hazards. The hazard classification mechanism used in DOE-STD- 1027-92 does not consider potential hazardous chemical releases. It is possible that a Hazard Category 3 facility could need safety-class items for large chemical hazards, although it is not typically expected. Hazard Category 2 facilities have the potential for an accident resulting in significant onsite consequences and may have consequences offsite. These facilities characteristically have safety-significant SSCs. They may need safety-class SSCs as well, although this is not typically expected.

Hazard Category 2 and 3 facilities do not have the consequence potential associated with high hazard facilities, such as Class A reactors. Consequently, in keeping with the use of a graded approach, the means of safety assurance expected of Class A reactors, such as formal design reconstitution and full, formal environmental qualification, are generally unsuitable for Hazard Category 2 and 3 facilities. SAR preparers (and subsequent reviewers) should not expect this level of information to be attained, especially for SSCs for which the original design is not documented. Precedent for dealing with facilities where the original technical information is undocumented and must be estimated has been provided by OSHA in the PSM rulemaking where it was stated “OSHA believed that a properly conducted process hazard analysis should systematically identify technical information regarding the process and allow adequate estimation of safe parameters for the process.” The actual requirement imposed by OSHA was “where the original technical information no longer exists, such information may be developed in conjunction with the process hazard analysis in sufficient detail to support the analysis.” The SAR specifically requires determination of safety functions and functional requirements for safety SSCs and designation of performance criteria. However, a SAR prepared in accordance with this Standard is focused on identifying functional requirements that, in general, are neither absolute nor subject to fine safety margin resolution. Further, associated performance criteria are only defined for critical operational aspects of SSCs, not general design. As noted in the preceding paragraph, if the design information no longer exists, new information may be developed as part of the process hazard analysis. However, pertinent existing safety analyses and design information (requirements and their bases) that are immediately available or can be retrieved through reasonable efforts should be used. For additional technical information that is critical to the SAR development and is not retrievable through such efforts, new information may be developed as part of the hazard analyses and accident analyses. Documented engineering judgments (including their bases) and testing can be used to extrapolate the available existing information and hence establish the performance capabilities of the existing SSCs. In general, safety-class SSCs require more formality in establishing functional requirements and performance criteria than safety-significant SSCs due to their public protection function. DOE-STD-3009-94 Page 63 CONTENT GUIDANCE FOR SECTIONS OF CHAPTER 4 4.1 INTRODUCTION This section provides an introduction to the contents of this chapter based on the graded approach and includes objectives and scope specific to the chapter as developed. 4.2 REQUIREMENTS This section lists the design codes, standards, regulations, and DOE Orders which are required for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. SRIDs may be referenced as appropriate. 4.3 SAFETY-CLASS SYSTEMS, STRUCTURES, AND COMPONENTS

Relevant information is provided, in the following SSC specific subsections, for safety-class SSCs with descriptions sufficiently detailed to provide an understanding of the safety function of safety-class SSCs. Descriptions for each safety-class SSC must be complete enough to indicate suitability of safety analysis inputs and assumptions. Provide a summary list of safety-class SSCs. This summary list should identify, in tabular form, safety-class SSCs, the accidents from Chapter 3 for which safety-class designation was made, safety functions, functional requirements, and performance criteria judged to require TSR coverage. The remaining subsections provide details that correlate to the summary list. NOTE: The following format is repeated sequentially for each (“X”) safety-class SSC. The examples provided are for illustration purposes only, and should not be construed as a requirement to designate such systems safety-class or safety-significant. 4.3.X [Applicable Safety-class System, Structure, or Component] Identify the safety-class SSC. DOE-STD-3009-94 Page 64 4.3.X.1 Safety Function This subsection states the reason for designating the SSC as a safety-class SSC, followed by specific identification of its preventive or mitigative safety function(s) as determined in the hazard and accident analysis. Do not discuss nonsafety functions. Safety functions are top level statements that express the objective of the SSC in a given accident scenario. For example, the safety function of a hydrogen detector in a dissolver vessel offgas line could be stated as: “To monitor hydrogen concentration in the dissolver offgas and provide a signal to shutdown the dissolving operation before explosive concentrations of hydrogen are reached.” The specific accidents associated with the safety function should be identified. 4.3.X.2 System Description This subsection provides a description of the safety-class SSC and the basic principles by which it performs its safety function (e.g., sensor and interlock for hydrogen detector discussed in section 4.3.X.1). Describe its boundaries and interface points with other SSCs relevant to the safety function. Identify SSCs whose failure would result in a safety-class SSC losing the ability to perform its required safety function. These SSCs would also be considered safety-class SSCs for the specific accident conditions for which the safety-class designation was made originally. When describing the SSC, provide a basic summation of the physical information known about the SSC, including Process and Instrumentation Drawings (P&IDs), or a simplified system drawing with reference to P&IDs. If known, abstract and reference pertinent aspects of manufacturer’s specifications. Pertinent aspects are considered to be those that directly relate to the safety function (e.g., diesel generator load capacity, time to load if critical) as opposed to general industrial equipment specifications that fall out from these capabilities (e.g., starting torque, motor insulation, number and type of windings). Such lower tier details should be implicitly included only by reference to the overall specifications. 4.3.X.3 Functional Requirements This subsection identifies requirements that are specifically needed to fulfill safety functions. Such functional requirements are specified for both the safety-class SSC and any needed support safety-class SSCs.

Limit functional requirement designation to those requirements necessary for the safety function. Functional requirements are provided for safety-class SSCs for the specific accident(s) where the safety-class SSC must function to meet the Evaluation Guidelines (e.g., if that accident is not initiated by an earthquake, the functional requirement does not involve seismic parameters). DOE-STD-3009-94 Page 65 Functional requirements specifically address the pertinent response parameters or nonambient environmental stresses related to an accident for which the safety function is being relied upon. In the hydrogen detector example, one obvious parameter would be maintaining hydrogen concentration below the explosive limit. If the offgas temperature was significantly above ambient temperatures, operation at that temperature would be a functional requirement as well. 4.3.X.4 System Evaluation This subsection provides performance criteria imposed on the safety-class SSC so it can meet functional requirement(s) and thereby satisfy its safety function. Performance criteria characterize the specific operational responses and capabilities necessary to meet functional requirements. Engineering judgment should be used to develop performance criteria for existing safety SSCs (i.e., already designed) where documentation of design and operational responses may not exist. In determining performance criteria for safety-class SSCs, existing criteria traditionally associated with safety-class designation, such as single failure criteria, should be considered in the judgment process. However, for existing SSCs, formal design comparison and compliance with traditional safety-class performance criteria is not required. Evaluate the capabilities of the SSC to meet performance criteria. The evaluation should be as simple as possible, and rely on engineering judgment, calculations, or performance tests as opposed to formal design reconstitution. For example, the hydrogen detector could be fed a test gas composition that would exceed its interlock trip point. Such a pass-fail test would typically bound the needed equipment performance as response time is not a highly sensitive parameter. 4.3.X.5 Controls (TSRs) This subsection identifies those assumptions requiring TSRs to ensure performance of the safety function. 4.4 SAFETY-SIGNIFICANT STRUCTURES, SYSTEMS, AND COMPONENTS Relevant information is provided, in the following SSC specific subsections, with descriptions sufficiently detailed to provide an understanding of the safety function of safety-significant SSCs. Descriptions for each safety-significant SSC must be complete enough to allow for verification of the accuracy of the safety analysis inputs and assumptions. DOE-STD-3009-94 Page 66 Provide a summary list of safety-significant SSCs. This summary list should identify, in tabular form, safety-significant SSCs, the rationale from Chapter 3 for which safety-significant designation was made, safety functions, functional requirements, and performance criteria judged to require TSR coverage. The remaining subsections provide details that correlate to the summary list. NOTE: The following format is repeated sequentially for each (“X”) safety-significant SSC. The examples provided are for illustration purposes only, and should not be construed as a requirement to designate such systems safety-class or safety-significant. 4.4.X [Applicable Safety-significant System, Structure, or Component]

Identify the safety-significant SSC. 4.4.X.1 Safety Function This subsection states the reason for designating the SSC as a safety-significant SSC, followed by specific identification of its preventive or mitigative safety function(s) as determined in the hazard and accident analysis. Do not discuss nonsafety functions. Safety functions are top-level statements that express the objective of the SSC in a given accident scenario. For example, the safety function of a hydrogen detector in a dissolver vessel offgas line could be stated as: “To monitor hydrogen concentration in the dissolver offgas and provide a signal to shutdown the dissolving operation before explosive concentrations of hydrogen are reached.” The specific accident(s) or general rationale associated with the safety function should be identified. Safety-significant SSCs are designated for overall purposes such as defense-in-depth, for which even normal operation considerations are involved. There may, or may not be, a single accident that, by itself, completely defines the safety function. 4.4.X.2 System Description This subsection provides a description of the safety-significant SSC and the basic principles by which it performs its safety function (e.g., sensor and interlock for hydrogen detector discussed in section 4.3.X.1). Describe its boundaries and interface points with other SSCs relevant to the safety function. Identify SSCs whose failure would result in a safety-significant SSC losing the ability to perform its required safety function. These SSCs would also be considered safety-significant SSCs for the specific accident conditions or general rationale for which the safety-significant designation was made originally. DOE-STD-3009-94 Page 67 When describing the SSC, provide a basic summation of the physical information known about the SSC, including simplified system drawings. If known, summarize pertinent aspects of manufacturer’s specifications. Pertinent aspects are considered to be those that directly relate to the safety function (e.g., diesel generator load capacity, time to load if critical) as opposed to general industrial equipment specifications that fall out from these capabilities (e.g., starting torque, motor insulation, number and type of windings). Such lower tier details should be implicitly included only by reference to the overall specifications. 4.4.X.3 Functional Requirements This subsection identifies requirements that are specifically needed to fulfill safety functions. Such functional requirements are specified for both the safety-significant SSC and any needed support safety-significant SSCs. Limit functional requirement designation to those requirements necessary for the safety function. Functional requirements are provided for safety-significant SSCs for the specific accident(s) or general rationales for which the SSC is needed (e.g., if that accident is not initiated by an earthquake, the functional requirement does not involve seismic parameters). Functional requirements specifically address the pertinent response parameters or nonambient environmental stresses related to an accident for which the safety function is being relied upon. In the hydrogen detector example, one obvious parameter would be maintaining hydrogen concentration below the explosive limit. If the offgas temperature was significantly above ambient temperatures, operation at that temperature would be a functional requirement as well.

4.4.X.4 System Evaluation This subsection provides performance criteria imposed on the safety-significant SSC so it can meet functional requirement(s) and thereby satisfy its safety function. Performance criteria characterize the specific operational responses and capabilities necessary to meet functional requirements. Safety-significant SSCs, are not required to consider performance criteria traditionally associated with safety-class SSCs or traditional nuclear standards in general. Performance criteria for a safety-significant SSC should be representative of the general rigor associated with non-nuclear power reactor industrial and OSHA practices. Performance criteria for safety-significant SSCs are developed by SAR preparers using engineering judgment based on the expected functions for which it was designated a safety-significant SSC and its overall importance to safety. Evaluate the capabilities of the SSC to meet performance criteria. The evaluation should be as simple as possible, and rely on engineering judgment, calculations, or performance tests as opposed to formal design reconstitution. DOE-STD-3009-94 Page 68 For example, the hydrogen detector could be fed a test gas composition that would exceed its interlock trip point. Such a test would typically bound the needed equipment performance as response time is not a highly sensitive parameter. 4.4.X.5 Controls (TSRs) This subsection identifies those assumptions requiring TSRs to ensure performance of the safety function. DOE-STD-3009-94 Page 69 Chapter 5 Derivation of Technical Safety Requirements PURPOSE. The purpose of this chapter is to provide information that will satisfy the requirements of DOE 5480.23, paragraph(s) 8.b.(3)(p), as amplified in Attachment 1, paragraph(s) 4.f.(3)(d)16, of the Order (Topic 16). This chapter also includes information, if applicable, that will partially satisfy the requirements of DOE 5480.23 paragraph(s) 8.b.(3)(b),(f), and (u) as discussed in detail in the Introduction of this Standard. This chapter builds upon the control functions determined to be essential in Chapter 3, “Hazard and Accident Analyses,” and Chapter 4, “Safety Structures, Systems, and Components,” to derive TSRs. This chapter is meant to support and provide the information necessary for the separate TSR document required by DOE Order 5480.22. Derivation of TSRs consists of summaries and references to pertinent sections of the SAR in which design (i.e., SSCs) and administrative features (i.e., non-SSCs) are needed to prevent or mitigate the consequences of accidents. Design and administrative features addressed include ones which: (1) provide significant defense in depth in accordance with the screening criteria of DOE 5480.22; (2) provide for significant worker safety; or (3) maintain consequences of facility operations below Evaluation Guidelines. Expected products of this chapter, as applicable based on the graded approach, include: ! Information with sufficient basis from