DOE-STD-3011-2016, Preparation of Documented Safety Analysis for Interim Operations at DOE Nuclear Facilities

NOT MEASUREMENT SENSITIVE DOE-STD-3011-2016 January 2016 DOE STANDARD PREPARATION OF DOCUMENTED SAFETY ANALYSIS FOR INTERIM OPERATIONS AT DOE NUCLEAR FACILITIES U.S. Department of Energy AREA SAFT Washington, DC 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. DOE-STD-3011-2016 ii FOREWORD 1. This Department of Energy (DOE) Standard (STD) has been approved to be used by DOE, including the National Nuclear Security Administration, and their contractors. 2. Beneficial comments (recommendations, additions, and deletions), as well as any pertinent data that may be of use in improving this document, should be addressed to: Office of Nuclear Safety (AU-30) Office of Environment, Health, Safety and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 Phone: (301) 903-2996 Facsimile: (301) 903-6172 3. Title 10 of the Code of Federal Regulations (C.F.R.) Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements, establishes requirements for the documented safety analyses (DSA) for nuclear facilities. This Standard provides an acceptable methodology for meeting the 10 C.F.R. Part 830 requirements for the preparation of DSAs for limited operational life, deactivation, and transition surveillance and maintenance of nonreactor nuclear facilities. 4. This Standard is a revision of DOE-STD-3011-2002, Guidance for Preparation of Basis for Interim Operation (BIO) Documents, and a successor document to DOE-STD-3011-94, Guidance for Preparation of DOE 5480.22 (TSR) and DOE 5480.23 (SAR) Implementation Plans. The principal purpose of the revision is to clearly identify actions necessary for satisfying this methodology for DSA preparation. The revision also updates this DSA methodology to reflect experience, lessons learned, and the changes in DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis. 5. Throughout this Standard, the word “shall” denotes actions that are required to satisfy this Standard. The word “should” is used to indicate recommended practices. The use of “may” with reference to application of a procedure or method indicates that the use of the procedure or method is optional. To use this Standard as an acceptable methodology for meeting 10 C.F.R. Part 830 requirements for preparing DSAs, all applicable “shall” statements need to be met. 6. Documented safety analyses developed using previous revisions to this standard were characterized as BIOs, consistent with the previous title of the standard. This revised Standard does not use this terminology in an effort to promote consistency and to make it clear that use of this Standard results in a DSA that meets 10 C.F.R. Part 830 requirements. 7. DOE-STD-3011-2002 will be cancelled with the issuance of this revision. DOE-STD-3011-2016 iii CONTENTS FOREWORD .................................................................................................................................. ii  DEFINITIONS ............................................................................................................................... iv  1.0  INTRODUCTION ............................................................................................................... 1

1.1  Purpose ............................................................................................................................. 1  1.2  Applicability ..................................................................................................................... 1  1.3  Background ...................................................................................................................... 2  1.4  Overview of the Changes in this Revision ....................................................................... 3  1.5  Overview of the Standard ................................................................................................. 3  2.0  GENERAL APPROACH FOR DSA METHODOLOGY ................................................... 3  2.1  Use of DOE-STD-3011 vs. DOE-STD-3009 ................................................................... 3  2.2  Existing Facilities with Approved DOE-STD-3011-2002 DSAs .................................... 4  2.3  Development of a New DSA ............................................................................................ 4  2.4  Application of the Graded Approach Principles .............................................................. 5  3.0  DSA DEVELOPMENT REQUIREMENTS ....................................................................... 6  3.1  Hazard Identification and Evaluation ............................................................................... 6  3.2  Accident Analysis ............................................................................................................ 9  3.3  Hazard Controls Selection .............................................................................................. 11  3.4  DSA Format and Content ............................................................................................... 13  3.5  Disposition Plans ............................................................................................................ 14  4.0  REFERENCES .................................................................................................................. 15  Appendix A: TYPES OF NUCLEAR FACILITIES ................................................................. A-1  A.1  DSA for a Nuclear Facility with a Limited Operational Life ...................................... A-1  A.2  DSA for Deactivation of a Nuclear Facility ................................................................. A-1  A.3  DSA for Transition Surveillance and Maintenance at a Nuclear Facility .................... A-2  DOE-STD-3011-2016 iv DEFINITIONS The definitions presented below are provided for understanding and consistency among the various safe harbor methodologies. The origins of the definitions are indicated by references shown in square brackets [ ]. If no reference is listed, the definition originates in this Standard. Accident analysis. The process of deriving a set of formalized design/evaluation basis accidents from the hazard evaluation and determining their consequences. Accident analysis results are used to identify the need to designate safety class and safety significant controls. [DOE-STD-3009-2014] Beyond Design/Evaluation Basis Accident (BDBA/BEBA). An accident that exceeds the severity of the design/evaluation basis accident. [DOE-STD-3009-2014] Deactivation. The process of placing a facility in a stable and known condition, including the removal of hazardous and radioactive materials. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3]

Decommissioning. Those actions taking place after deactivation of a nuclear facility to retire it from service, and includes surveillance and maintenance, decontamination, and/or dismantlement. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Decontamination. The removal or reduction of residual radioactive and hazardous materials by mechanical, chemical, or other techniques to a stated objective or end condition. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Design Basis. The set of requirements that bound the design of structures, systems, and components within the facility. Some, but not necessarily all, aspects of the design basis are important to safety. [DOE-STD-3009-2014] Design Basis Accidents (DBAs). Accidents explicitly considered as part of the facility design for a new facility (or major modifications) for the purpose of establishing functional and performance requirements for safety class and/or safety significant controls. [DOE-STD-3009- 2014] Disposition. Those activities that follow completion of program missions, including, but not limited to, preparation for reuse, surveillance, maintenance, deactivation, decommissioning, and long-term stewardship. [DOE O 430.1B, Attachment 3] Documented Safety Analysis (DSA). A documented analysis of the extent to which a nuclear facility can be operated safely with respect to workers, the public, and the environment, DOE-STD-3011-2016 v including a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety. [10 C.F.R. § 830.3] Evaluation basis accidents (EBAs). When an adequate set of design basis accidents does not exist, the representative and unique accidents evaluated in the accident analysis for the purposes of determining the need for safety class and safety significant controls in an existing facility where design basis accidents were not used for this purpose. [DOE-STD-3009-2014] Graded Approach. The process of ensuring that the level of analysis, documentation, and actions used to comply with a requirement in this Standard is commensurate with:  The relative importance to safety, safeguards, and security;  The magnitude of any hazards involved;  The life cycle stage of a facility;  The programmatic mission of a facility;  The particular characteristics of a facility;  The relative importance of radiological and non-radiological hazards; and  Any other relevant factor. [10 C.F.R. § 830.3] Hazard. A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to a person or damage to a facility or to the environment (without regard to the likelihood or credibility of accident scenarios or consequence mitigation). [10 C.F.R. § 830.3] Hazard Analysis. The identification of materials, systems, processes, and plant characteristics that can produce undesirable consequences (hazard identification), followed by the assessment of hazardous situations associated with a process or activity (hazard evaluation). Qualitative techniques are usually employed to pinpoint weaknesses in design or operation of the facility that could lead to accidents. The hazard evaluation includes an examination of the complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to radioactive and other hazardous materials. [DOE-STD-3009- 2014]

Hazard Categorization. Evaluation of the consequences of unmitigated radiological releases to categorize facilities in accordance with the requirements of 10 C.F.R. Part 830. Note: 10 C.F.R. Part 830 requires categorization consistent with DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports. [DOE-STD-3009-2014] DOE-STD-3011-2016 vi Hazard Controls. Measures to eliminate, limit, or mitigate hazards to workers, the public, or environment, including: (1) physical design, structural, and engineering features; (2) safety structures, systems, and components; (3) safety management programs; (4) technical safety requirements; and (5) other controls necessary to provide adequate protection from hazards. [10 C.F.R. § 830.3] Note: “hazard controls” include “specific administrative controls.” Interim Operations. Activities conducted during a nuclear facility’s life cycle phase that involves: (1) limited operational life; (2) deactivation; or (3) transition surveillance and maintenance. Life Cycle. The life of an asset from planning through acquisition, maintenance, operation, remediation, disposition, long-term stewardship, and disposal. [DOE O 430.1B, Attachment 3] Nuclear Facility. A reactor or a nonreactor nuclear facility where an activity is conducted for or on behalf of DOE and includes any related area, structure, facility, or activity to the extent necessary to ensure proper implementation of the requirements established by 10 C.F.R. Part 830. [10 C.F.R. § 830.3] Nuclear Facility with a Limited Operational Life. A nuclear facility for which there is a short remaining operational period before ending the facility’s mission and initiating deactivation and decommissioning and for which there are no intended additional missions other than cleanup. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Safety Basis. The documented safety analysis and hazard controls that provide reasonable assurance that a DOE nuclear facility can be operated safely in a manner that adequately protects workers, the public, and the environment. [10 C.F.R. § 830.3] Safety Class Structures, Systems, and Components (SC SSCs). Structures, systems, or components, including portions of process systems, whose preventive or mitigative function is necessary to limit radioactive hazardous material exposure to the public, as determined from safety analyses. [10 C.F.R. § 830.3] Safety Significant Structures, Systems, and Components (SS SSCs). Structures, systems, and components which are not designated as safety class SSCs but whose preventive or mitigative function is a major contributor to defense-in-depth and/or worker safety as determined from safety analyses. [10 C.F.R. § 830.3] Safety Structures, Systems, and Components (safety SSCs). Both safety class structures, systems, and components, and safety significant structures, systems, and components. [10 C.F.R. § 830.3] DOE-STD-3011-2016 vii Specific Administrative Control. An administrative control that is: 1) identified in a DSA as a control needed to prevent or mitigate an accident scenario, and 2) has a safety function that would be safety significant or safety class if the function were provided by a structure, system, or component. [DOE-STD-1186-2004]

Technical Safety Requirements (TSRs). The limits, controls, and related actions that establish the specific parameters and requisite actions for the safe operation of a nuclear facility and include, as appropriate for the work and the hazards identified in the DSA for the facility: safety limits, operating limits, surveillance requirements, administrative and management controls, use and application provisions, and design features, as well as a bases appendix. [10 C.F.R. § 830.3] Transfer of Facilities. Transferring programmatic and financial responsibility of land and/or facilities from one program office to another. [DOE O 430.1B, Attachment 3] Transition Surveillance and Maintenance Activities. Activities conducted when a facility is not operating or during deactivation, decontamination, and decommissioning operations when surveillance and maintenance are the predominant activities being conducted at the facility. These activities are necessary for satisfactory containment of hazardous materials and protection of workers, the public, and the environment. These activities include providing periodic inspections, maintenance of structures, systems, and components, and actions to prevent the alteration of hazardous materials to an unsafe state. [10 C.F.R. Part 830, Subpart B, Appendix A, Table 3] Note: Transition surveillance and maintenance phases may occur at any of the following transitions between life cycle phases: (1) transition from operations to deactivation or decommissioning; (2) transition from deactivation to decommissioning; and (3) transition from decommissioning to environmental restoration. DOE-STD-3011-2016 1 1.0 INTRODUCTION 1.1 Purpose This Department of Energy (DOE) Standard (STD), DOE-STD-3011-2016, describes a method for preparing a Documented Safety Analysis (DSA) for interim operations1 that is acceptable to DOE for hazard category (HC) 1, 2, or 3 nuclear facilities as set forth in Table 2 of Appendix A to Title 10 of the Code of Federal Regulations (C.F.R.) Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements. 1.2 Applicability Title 10 C.F.R. Part 830, Subpart B, Section 830.204(a) requires that “The contractor responsible for a hazard category 1, 2, or 3 DOE nuclear facility must obtain approval from DOE for the methodology used to prepare the documented safety analysis for the facility unless the contractor uses a methodology set forth in Table 2 of Appendix A to this Part.” This Standard provides an acceptable methodology for the following types of DOE nuclear facilities and activities: a. A nuclear facility with a limited operational life; b. The deactivation of a nuclear facility; and c. The transition surveillance and maintenance of a nuclear facility. Application of this Standard is not appropriate, and should not be used, when any one of the following conditions exist:  The nuclear material has been reduced to below HC-3 quantities or DOE approves a final hazard categorization per DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, as a below HC-3 nuclear (radiological) facility;  The mission of the facility changes and the facility returns to operational status;  The life cycle phase has changed to decommissioning or environmental restoration activities, and DOE-STD-1120, Preparation of Documented Safety Analysis for Decommissioning and Environmental Restoration Activities, becomes an acceptable DSA safe harbor methodology; or

 The estimated mitigated offsite dose to the public exceeds 25 rem. 1 Interim operations are activities conducted during a nuclear facility’s life cycle phase that involves: (1) limited operational life; (2) deactivation; or (3) transition surveillance and maintenance. DOE-STD-3011-2016 2 1.3 Background The term BIO (Basis for Interim Operation) was introduced in DOE-STD-3011-94, Guidance for Preparation of DOE 5480.22 (TSR) and DOE 5480.23 (SAR) Implementation Plans. BIO was then defined as the documented establishment of a safety basis for existing DOE nuclear facilities until more detailed documentation, fully compliant with the requirements of DOE 5480.22, Technical Safety Requirements, and DOE 5480.23, Nuclear Safety Analysis Report, was developed and approved by DOE. An approved BIO served as the interim (e.g., for a six month period) DOE safety basis until compliant safety documentation was developed and approved. The scope and level of effort for these BIOs depended upon the need for safety basis upgrade (i.e., the gaps between current safety basis and safety basis expectations of 5480.22 and 5480.23). The original BIOs were intended to be in effect for a limited duration, until the safety basis was developed and approved in accordance with 5480.22 and 5480.23. The DOE-STD-3011-94 BIOs were expected to provide (1) a summary description of facility activities, (2) identification of hazards associated with the facility, (3) characterization of potential impacts of potential deviations from normal operating parameters and conditions, (4) the results of at least a qualitative (or semi-quantitative) safety analysis, (5) identification of controls to ensure that operations are conducted safely, and (6) identification of safety management programs. The original BIOs were required to adhere to the safety basis principles prescribed by DOE 5480.23, although, consistent with their practical application, the BIOs were required to satisfy these same principles at a significantly reduced level of detail of new analysis and presentation of information. Title 10 C.F.R. Part 830, Subpart B, was approved in 2001 and replaced 5480.22 and 5480.23 with a very similar set of requirements for DSAs and Technical Safety Requirements (TSRs). DOE-STD-3011-94 “or successor document” was identified in Appendix A to 10 C.F.R. Part 830 as an acceptable safe harbor standard for meeting the new Subpart B requirements for three specific situations: (1) a limited operational life prior to deactivation, (2) deactivation, or (3) transition surveillance and maintenance before or after deactivation. DOE-STD-3011-94 was subsequently revised and updated to reflect these interim applications. Again, these applications were expected to last for interim, limited durations, although experience has shown that sometimes transition surveillance and maintenance periods can extend over many years due to funding levels and competing priorities. The revised standard was issued as DOE-STD-3011- 2002. BIOs approved prior to the 10 C.F.R. Part 830 rule were required to be reviewed and brought into compliance with the regulation's safety basis requirements (Sections 830.202 and 830.204). DOE-STD-3011-2002, Guidance for Preparation of Basis for Interim Operation (BIO) Documents, identifies the primary rationale for using the DOE-STD-3011-2002 DSA method, vice the DOE-STD-3009-94 DSA method, as the short time period of use (typically less than 5 DOE-STD-3011-2016 3

years) does not justify the time and cost required for the full DOE-STD-3009-94 method. DOE- STD-3011-2002 recommends maximum use of existing, readily-available safety analysis and design information, with pragmatic supplementation using qualitative but thorough analyses, and conservative compensatory approaches where necessary. This standard recommended organization of existing and supplemental safety basis information into a format consistent with DOE-STD-3009-94, chapters 2 through 6, though not to the same level of detail. 1.4 Overview of the Changes in this Revision This revision incorporates experience and lessons learned in implementing DOE-STD-3011- 2002 to provide clearer criteria and guidance for DSAs supporting interim operations. This revision also reflects pertinent changes to other key DOE documents, such as DOE Order (O) 420.lC, Facility Safety, and DOE-STD-3009-2014 which have been revised since this Standard was last issued. DOE contractors may choose to use this revision to update a facility’s DSA. If a DOE contractor chooses to use this revision of DOE-STD-3011 to update an existing DSA, then the applicable sections of this Standard are required to be implemented completely. This revision clearly identifies which of its provisions are mandatory, unless DOE approval for use of an alternate methodology is obtained [See 10 C.F.R. § 830.204(a)]. This Standard is an acceptable safe harbor methodology for DSA development pursuant to 10 C.F.R. § 830.204. 1.5 Overview of the Standard Section 2 provides the general approach for preparing a DSA using this method. Section 3 provides specific requirements for implementing this method. Section 4 provides references. Appendix A provides additional guidance for the facility types. 2.0 GENERAL APPROACH FOR DSA METHODOLOGY 2.1 Use of DOE-STD-3011 vs. DOE-STD-3009 Table 2 in Appendix A of 10 C.F.R Part 830 Subpart B allows use of either DOE-STD-3011 or DOE-STD-3009 as the safe harbor method for interim operations DSAs. In most cases, where an existing DOE nuclear facility with an approved DOE-STD-3009 DSA is moving to interim operations, DOE-STD-3009 is the preferred safe harbor for interim operations. In these cases, interim operations typically may be conducted under the existing approved safety basis, which would envelope most hazards. The DSA would only need to be revised to reflect the new activities along with any step-out criteria for hazard controls (i.e., criteria for determining when it is appropriate to retire controls from the safety basis). Revision and use of the existing DOE- STD-3009 DSA is generally the most simple, straightforward, and cost-effective approach. DOE-STD-3011-2016 4 Use of DOE-STD-3011 for interim operations may be more appropriate than the use of DOE- STD-3009 in the following cases: (1) the nature and scope of interim operations (including associated hazards) are significantly different from the existing operational activities; or (2) the facility does not have an existing DOE-STD-3009 DSA. Regardless of which methodology is used, DOE-STD-3009-2014 provides the most complete, up-to-date description of the DOE’s general safety analysis approach. DOE-STD-3009-2014 should be used as a reference, as needed, for effective and acceptable methods for hazards and accident analysis. 2.2 Existing Facilities with Approved DOE-STD-3011-2002 DSAs

Contractors with facilities having existing DOE-approved DSAs using the methodology of DOE- STD-3011-94, or successor document, may continue operations under those DSAs, provided approved DSAs reflect the current facility status and operations. In reaching a conclusion that the DSA reflects current facility status and operations, contractors should consider the following:  Facility mission changes (e.g., the facility was originally planned for deactivation but will now be in long term surveillance and maintenance),  Schedule changes (e.g., the facility was originally planned to be de-inventoried to the below HC-3 threshold by the end of 2015, but will be extended to 2020), and  Hazard and accident analysis assumptions (i.e., the assumptions and scenarios of the facility’s analysis in the DSA may not reflect recent information such as meteorological data, air dispersion modelling, or natural phenomena hazards). DSAs that do not reflect the current facility status or operations are required to be updated to current conditions to remain valid with the existing safety harbor methodology. DSAs developed using DOE-STD-3011-2002 were not and are not intended for long-term use. If a DSA is more than 10 years old and significant changes to the DSA or existing controls are warranted, the DSA should be reviewed and converted to the new DOE-STD-3011-2016, or to the DOE-STD-3009- 2014 method. Major modifications2 to facilities with existing DSAs, completed and approved in accordance with DOE-STD-3011-2002, should trigger the DSA to be updated to meet this revision, DOE-STD-3011-2016, or to DOE-STD-3009-2014. DSAs developed using the methodology of DOE-STD-3011-2002 in which mitigated off-site dose estimates exceed the Evaluation Guideline (EG) of 25 rem should use DOE-STD-3009-2014. 2.3 Development of a New DSA DSAs prepared for interim operations of DOE nuclear facilities after the revision of this Standard 2 Major modification is defined in 10 C.F.R. § 830.3 and further described in DOE-STD-1189. DOE-STD-3011-2016 5 should use this Standard, not previous versions. The goal of this revised Standard is to provide clearer criteria and guidance to support effective and consistent DSAs based upon lessons learned from implementation. DOE contractors may choose to use this revision to update a facility DSA, if desired. If a DOE contractor chooses to use this DOE-STD-3011 revision for updating an existing DSA, then the applicable sections of this Standard are required to be implemented completely, unless DOE approves use of an alternate methodology due to the deviations from this Standard. Where DSA updates require changes to the identified hazard controls, such changes should be carefully considered to ensure a conservative approach is preserved. Upon completion of its operating mission, a nuclear facility may continue to operate without a DSA as a below HC-3 nuclear (radiological) facility, or a non-nuclear facility, or be deactivated or decommissioned. The approach taken to supplement existing information should be pragmatic. For HC-1, 2, or 3 facilities, the DSA should explicitly define the mission, provide an expected lifetime of that mission, and be consistent with the lifetime expectancy of the facility. Analyses should generally be qualitative, but thorough. When adequate information is not available to fully support the DSA, conservative compensatory approaches to assuring adequate safety should be considered and, if adopted, the rationale for concluding that there is safety adequacy should be presented in the DSA.

2.4 Application of the Graded Approach Principles Section 830.7 of 10 C.F.R. Part 830 prescribes the use of a graded approach, where appropriate, for the effort expended in safety analysis and the level of detail presented in the associated documentation. The graded approach, applied to initial DSA preparation and subsequent updates, is intended to produce an effective and efficient safety analysis and a DSA that is sufficient to assure DOE that a facility has acceptable safety provisions, without providing unnecessary information. As described in 10 C.F.R. § 830.3, the graded approach adjusts the magnitude of the preparation effort to the characteristics of the subject facility based on:  The relative importance to safety, safeguards, and security;  The magnitude of any hazard involved;  The life cycle stage of a facility;  The programmatic mission of a facility;  The particular characteristics of a facility;  The relative importance of radiological and non-radiological hazards; and  Any other relevant factor (e.g., short operational life). The application of the graded approach may allow for much simpler analysis and documentation DOE-STD-3011-2016 6 for some facilities. However, the DSA is still required to provide a systematic evaluation of hazards and an appropriate set of controls commensurate with the results of the hazard evaluation. 3.0 DSA DEVELOPMENT REQUIREMENTS This Standard provides a safe harbor methodology to develop DSAs in compliance with 10 C.F.R. Part 830, Subpart B, for interim operations. Many (but not all) of the requirements for compliance with the Standard are drawn from DOE-STD-3009-2014, which also provides detailed guidance on interpreting these requirements. Rather than extend the length of this Standard by reprinting that guidance, the user of this Standard should refer to DOE-STD-3009-2014, as necessary, for effective and acceptable methods for hazards and accident analysis (e.g., standard industrial hazard screening, unmitigated analysis, dispersion and consequence analysis). Hazard analysis and accident analysis are performed to identify specific controls and improvements that feed back into overall safety management. Consequence and likelihood estimates obtained from this process also form the bases for selecting the level of detail and control needed in key elements of specific safety management programs, using a graded approach. The result is documentation of the safety basis that emphasizes the hazard controls needed to maintain safe operation of a facility. The level of detail provided in the DSA depends on numerous factors. Applying the guidance for the graded approach in Section 2.4 of this Standard will help the preparer to select an acceptable level of detail. Although all elements of the DSA preparation are important, three elements—hazard analysis, accident analysis, and hazard control selection—are fundamental, because they determine the hazard controls needed to provide protection for workers, the public, and the environment. This section provides detailed criteria and guidance for performing these three elements. 3.1 Hazard Identification and Evaluation

The initial analytical effort for all facilities is a hazard analysis that systematically identifies and evaluates facility hazards, potential accidents, and controls. The hazard evaluation focuses on evaluating the complete spectrum of hazards and accidents. This largely qualitative effort forms the basis for the entire safety analysis, including the identification of worker safety controls and the subset of accidents to be analyzed. Note: DOE’s 10 C.F.R. Part 835, Occupational Radiation Protection, and 10 C.F.R. Part 851, Worker Safety and Health Program, also require DOE contractors to conduct hazard identification and evaluation which may aid analysts in DSA development. DOE-STD-3011-2016 7 3.1.1 The methodology used for hazard identification shall ensure comprehensive identification of the hazards associated with the full scope of facility processes, associated operations, such as handling of fissionable materials and hazardous waste, and work activities covered by the DSA. The methodology shall include characterization of hazardous materials (radiological and non- radiological) and energy sources, in terms of quantity, form, and location. Commercial industry practices for hazard identification, such as those described in the Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures (Third Edition, Wiley/American Institute of Chemical Engineers, 2008), may be used. 3.1.2 Bounding inventory values of radiological or hazardous materials shall be used, consistent with the maximum quantities of material that are stored and used in facility processes. Inventory data may be obtained from flowsheets, vessel sizes, contamination analyses, maximum historical inventories, and similar sources. Other possible sources of information supporting hazard identification include fire hazard analyses, health and safety plans, job safety analyses, and occurrence reporting histories. 3.1.3 The hazard evaluation shall provide (a) an assessment of the facility hazards associated with the full scope of planned operations covered by the DSA and (b) the identification of controls that can prevent or mitigate these hazards or hazardous conditions. The hazard evaluation shall analyze normal operations (e.g., startup, facility activities, shutdown, and testing and maintenance configurations) as well as abnormal and accident conditions. In addition to the process-related hazards identified during the hazard identification process, the hazard evaluation shall also address natural phenomena and man-made external events that can affect the facility. 3.1.4 As part of the hazard evaluation, an unmitigated hazard scenario shall be evaluated for each initiating event by assuming the absence of preventive and mitigative controls. Initial conditions may be necessary to define the unmitigated evaluation; further guidance is provided in Section A.3 of Appendix A of DOE-STD-3009-2014. The consequences and the likelihood of the unmitigated hazard scenario shall be estimated (using qualitative and/or semi-quantitative techniques) to address potential effects on facility workers3, co-located workers, and the public (maximally-exposed offsite individuals [MOIs]), consistent with the likelihoods and consequence levels described in Tables 1 and 2 of DOE-STD-3009-2014.

3.1.5 Consequence determinations used for co-located workers in the hazard evaluation shall be supported by an adequate technical basis such as scoping calculations. Alternately, the quantitative evaluation of co-located worker consequences used to compare to DOE-STD-3009- 2014 Table 1 thresholds may be performed in the accident analysis and reported in the DSA. 3 See DOE-STD-3009-2014, Section 3.1.3.1, for information regarding qualitative evaluation of facility worker consequences. DOE-STD-3011-2016 8 3.1.6 Risk ranking/binning may be used to support the selection of Design Basis Accidents (DBAs)/ Evaluation Basis Accidents (EBAs) and hazard controls4. If risk ranking/binning is used, the consequence and likelihood thresholds in DOE-STD-3009-2014 Tables 1 and 2 shall be used. 3.1.7 For each of the unmitigated hazard scenarios, the controls (structures, systems, and components [SSCs], administrative and/or programmatic) that can prevent or mitigate the hazard scenario shall be identified. A mitigated hazard evaluation shall be performed to determine the effectiveness of safety significant (SS)5 controls (following the preferred hierarchy as described in Section 3.3 of this Standard) by estimating hazard scenario likelihood with preventive controls and consequences with mitigative controls. 3.1.8 The analysis should include SS controls for hazard scenarios having high estimated chemical consequences to the public, or high radiological or chemical consequences to workers (i.e., as defined by Table 1 of DOE-STD-3009-2014). This information, along with safety functions for these controls, shall be included in the hazard evaluation, unless determined as part of the accident analysis (see Section 3.2). 3.1.9 An inadvertent criticality accident represents a special case for hazard evaluation. The criticality safety program requirements6 are derived from the hazard analysis process established in the American National Standards Institute/American Nuclear Society (ANSI/ANS)-8 series of national standards, which require a documented criticality safety evaluation demonstrating that operations with fissionable material remain subcritical under both normal and credible abnormal conditions (see Appendix A, Section A.5 of DOE-STD-3009-2014 for details). In addition, the DSA hazard evaluation shall include:  Events where consequences (from the criticality itself or subsequent impact to hazardous material) exceed the high radiological consequence thresholds for either the co-located workers or the MOI in Table 1 unless it has been determined that an unmitigated criticality accident is not credible; and,  Situations where an active engineered control(s) is required by the Nuclear Criticality Safety (NCS) analysis to ensure subcriticality. 4 See DOE-STD-3009-2014 Appendix A, Section A.4 for information on risk ranking/binning. 5 Since unmitigated high or moderate radiological consequences to the public could challenge the Evaluation Guideline and are required by Section 3.2 to be evaluated as Design Basis Accidents, or as representative or unique Evaluation Basis Accidents, a mitigated analysis for the public is optional for the DSA hazard evaluation. 6 Criticality safety program requirements are established in DOE O 420.1C. This Order states that DOE-STD- 3007-2007, Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Non-Reactor Nuclear Facilities, is the required method for performing criticality safety evaluations, unless DOE approves an alternate method.

DOE-STD-3011-2016 9 3.1.10 If the NCS program requires a criticality accident alarm system, then the criticality accident alarm system shall be discussed in the hazard evaluation and carried forward to evaluation in accordance with Section 3.3 of this Standard. 3.2 Accident Analysis Accident analysis entails the formal characterization of a limited subset of accidents, referred to as DBAs/ EBAs7 and the determination of consequences and hazard controls associated with these events. Accident analyses are not necessary for facilities with unmitigated offsite consequences that do not have the potential to challenge the EG. Scoping calculations performed during hazard evaluation may be used to show that accident analysis is not needed. For the purpose of identifying safety class (SC) SSCs, estimated consequences to the MOI are compared to the EG. For identification of SS SSCs, an evaluation of co-located worker consequences and offsite chemical consequences is performed as part of either: (1) the hazard evaluation as described in Sections 3.1 of this Standard or (2) the accident analysis addressed in this section and compared to the applicable quantitative and qualitative criteria in Section 3.3 for the various categories of affected persons. The need for SS controls to protect the facility worker is determined by the qualitative hazard evaluation discussed in Section 3.1.3.1 of DOE-STD- 3009-2014. 3.2.1 EBAs are derived from the spectrum of hazard scenarios developed in the hazard evaluation. Two types of EBAs shall be defined for further analysis: representative and unique. Representative EBAs bound a number of accidents with a similar control set (e.g., the worst fire, for a number of similar fires). At least one bounding accident from each of the major types determined from the hazard evaluation that have the potential to challenge the EG (fire, explosion, spill, etc.) shall be selected. Unique EBAs are those events that may be bounded by other events but have their own unique control set or other hazard/accident characteristics. 3.2.2 Representative EBAs shall be defined such that:  The control(s) applicable to the EBA are similar and will perform the same function as the controls of the represented hazard scenarios; and  The accident environment associated with the EBA envelopes the environment expected from the represented hazard scenarios. 3.2.3 Both the hazard evaluation and the accident analysis require an unmitigated analysis of the consequences and likelihood of accidents (note: the term “accident” as used in this subsection also includes “hazard scenarios”). An unmitigated consequence analysis shall be performed for 7 DOE-STD-3009-2014 Appendix A, Section A.6 discusses the concept of EBAs. DOE-STD-3011-2016 10 plausible operational accident scenarios8, natural phenomena hazards events, and external events. 3.2.4 The unmitigated source term should characterize both the release fractions and the energies driving the release in accordance with the physical realities of the accident phenomena at a given facility, activity, or operation. As a result, some additional assumptions may be necessary in order to define a meaningful accident scenario9, and such assumptions may also affect the magnitude of the resultant consequences. An assumption that an SSC exists does not automatically require SC or SS designation. However, assumptions shall be protected at a level commensurate with their importance.

3.2.5 A mitigated analysis shall be performed to determine the effectiveness of SS and SC controls to protect co-located workers and the public. This analysis should be the same as the unmitigated analysis except that accident likelihood is estimated with preventive controls available, and consequences are estimated with mitigative controls available. 3.2.6 Where preventive controls are credited as SS or SC, the DSA shall evaluate the effectiveness of the controls to either eliminate the hazard or terminate the accident and prevent a release of radioactive or other hazardous materials. If hazard elimination or accident termination cannot be accomplished, the effectiveness of the credited controls is evaluated in terms of the overall reduction in the likelihood of the accident. 3.2.7 A mitigated consequence analysis is required if the credited preventive controls do not eliminate the hazard or terminate the accident. This analysis shall demonstrate how SC mitigative SSC(s) and/or specific administrative controls (SACs) reduce consequences below the EG and how SC (if identified) and SS mitigative SSCs and/or SACs reduce co-located worker consequences below 100 rem Total Effective Dose (TED) (i.e., as representative of the co- located worker). 3.2.8 Calculations shall be made based on technically-justified input parameters and underlying assumptions10 such that the overall consequence calculation is conservative. Conservatism is assured by the selection of bounding accident scenarios, the use of a conservative analysis methodology, and the selection of source term and input parameters that are consistent with that methodology. 3.2.9 A χ/Q value of 3.5 x 10-3 sec/m3 shall be used for ground-level radiological or chemical release evaluation at the 100 meter receptor location, unless an alternate onsite χ/Q value is 8 See DOE-STD-3009-2014, Section 3.2.1 for further discussion of plausible accidents. 9 Section 3.2.2 of DOE-STD-3009-2014 provides additional guidance for unmitigated analysis assumptions of plausible accident scenarios. 10 Section 3.2.4 of DOE-STD-3009-2014 provides detailed discussion on the derivation and selection of accident analysis source term and input parameters. DOE-STD-3011-2016 11 justified. This value may not be appropriate for certain unique situations, such as operations not conducted within a physical structure11. When an alternate value is used, the DSA shall provide a technical basis supporting the need for the alternate value and the value selected. 3.3 Hazard Controls Selection If a SC or SS control is found necessary, all preventive and mitigative controls associated with the sequence of failures that result in a given release scenario are candidates for consideration. Preventive or mitigative controls are selected using a judgment-based process considering a hierarchy of controls that gives preference to passive engineered safety features over active ones; engineered safety features over administrative controls or SACs; and preventive over mitigative controls. 3.3.1 When the hierarchy of controls is not used for situations requiring SC/SS controls (e.g., a SAC is selected over an available SSC), the DSA shall provide a technical basis that supports the controls selected. Following efforts to minimize hazardous materials, this control selection strategy translates into the following hierarchy of controls12, listed from most preferred to least preferred:

(1) SSCs that are preventive and passive; (2) SSCs that are preventive and active; (3) SSCs that are mitigative and passive; (4) SSCs that are mitigative and active; (5) Administrative controls that are preventive; and (6) Administrative controls that are mitigative. 3.3.2 In some cases, safety-SSCs rely upon supporting SSCs to perform their intended safety function. For existing facilities, support SSCs shall be designated at the same classification (SC or SS) as the safety controls they support, or else compensatory measures shall be established to assure that the supported safety-SSC can perform its safety function when called upon. SSCs whose failure would result in losing the ability to complete an action required by a SAC are similarly identified and designated as SC or SS based on the SAC safety function, or justification provided if not so designated. 11 Operating Experience Level 3, Atmospheric Dispersion Parameter (χ/Q) for Calculation of Collocated Worker Dose, dated April 2015, and associated technical report, NSRD-2015-TD01, Technical Report for Calculations of Atmospheric Dispersion at Onsite Locations for Department of Energy Nuclear Facilities, conclude that the default χ/Q value may not be appropriate for releases from small facilities (i.e., those with dimensions less than 10 m tall by 36 m wide). 12 An exception to this hierarchy is for confinement of radioactive materials. See Section A.8 in DOE-STD-3009- 2014. DOE-STD-3011-2016 12 3.3.3 If the unmitigated release consequence for a DBA/EBA exceeds the EG, SC controls shall be applied to prevent the accident or mitigate the consequences to below the EG. If unmitigated off-site doses between 5 rem and 25 rem are calculated (i.e., challenging the EG), SC controls should be considered, and the rationale should be described for decisions on whether or not to classify controls as SC. 3.3.4 SS control designation shall be made on the basis of: (1) major contribution to defense- in-depth; (2) protection of the public from release of hazardous chemicals; (3) protection of co- located workers from hazardous chemicals and radioactive materials; and, (4) protection of facility workers from fatality, serious injury, or significant radiological or chemical exposure. 3.3.5 SS designation of controls for protection of the public from chemical releases shall be based on a peak 15 minute time-weighted average air concentration, measured at the receptor location, that exceeds Protective Action Criteria (PAC) level 2. 3.3.6 For radiation hazards, a conservatively calculated unmitigated dose of 100 rem TED to a receptor located at 100 meters from the point of release shall be used as the threshold for designation of SS controls. The methodology used to determine consequences shall be consistent with that described in Section 3.2. SS designation for protection of co-located workers from chemical releases shall be based on a peak 15 minute time-weighted average air concentration at the receptor location that exceeds PAC-3. 3.3.7 Safety management programs provide an important part of the overall strategy for protecting facility workers. However, SS controls (SSCs or SACs) shall be selected for cases where a fatality, serious injury, or significant radiological or chemical exposure to a facility worker may occur. The term “serious injury” refers to an injury requiring medical treatment for immediately life-threatening or permanently disabling injury such as the loss of an eye or limb. SS controls are not designated solely to address standard industrial hazards (see Section 3.1.3.1 and Appendix A.1 of DOE-STD-3009-2014). Examples of conditions that warrant consideration of SS designation include:

 High concentrations of radioactive or chemically toxic materials in areas where a facility worker could be present;  Explosions or over-pressurizations within process equipment or confinement/containment structures or vessels, where serious injury or death to a facility worker may result from the fragmentation of structures or vessels; and  Unique hazards that could result in asphyxiation or significant chemical/thermal burns. 3.3.8 The Criticality Safety Program ensures that operations remain subcritical under normal DOE-STD-3011-2016 13 and credible abnormal conditions. NCS controls derived in accordance with the DOE-approved NCS Program are required to be implemented in accordance with 10 C.F.R. Part 830, Subpart A, Quality Assurance Requirements, commensurate with the importance of the safety functions performed. Explicit criticality controls required as a result of hazard evaluation criteria established in Section 3.1 shall be documented in the DSA and classified in accordance with requirements of this Section. 3.3.9 If hazard controls are anticipated to be removed or downgraded during the interim operations, step-out criteria shall be documented in the DSA. For points in time in which anticipated step-out criteria will apply; unmitigated source terms and consequences should be considered and supported by the hazard analysis and accident analysis, if necessary. The following criteria should be used when determining if it is appropriate to retire a control from the safety basis:  Hazardous condition being controlled is no longer present.  Hazardous substance’s physical form has changed to a less dispersible form.  Hazardous substance quantities are no longer present or have been reduced to the point where the consequences of releases are no longer a concern. 3.4 DSA Format and Content Criteria and guidance for the format and content of each of the chapters in the DSA are provided in this section. The DSA format and content shall address the DSA sections and subsections described below. The DSA may include addenda for short-term evolutions (e.g., activities that may be conducted only once) provided the addenda meet the requirements of this Standard.  DSA [Executive Summary]  DSA [Chapter 1: Introduction] o Rationale for DSA Methodology o Site Description o Facility End Point  DSA [Chapter 2: Facility Description] o Site Location o Facility Mission and Operating History o Facility and Work Description  DSA [Chapter 3: Hazard and Accident Analysis and Control Selection] o Hazard Evaluation and Safety Significant Control Selection o Hazard Categorization o Accident Analysis and Safety Class Control Selection o Beyond Design/Evaluation Basis Accident Consideration DOE-STD-3011-2016 14  DSA [Chapter 4: Safety Structures, Systems and Components] o Safety Class Systems, Structures, and Components  Safety Function, Functional Requirements, System Evaluation, and TSR Requirements o Safety Significant Systems, Structures, and Components  Safety Function, Functional Requirements, System Evaluation, and TSR Requirements o Specific Administrative Controls  Safety Function, Functional Requirements, SAC Evaluation, and TSR Requirements  DSA [Chapter 5: Derivation of Technical Safety Requirements] o TSR Coverage o Derivation of Facility Modes o TSR Derivation o Design Features  DSA [Chapter 6: Prevention of Inadvertent Criticality] o Criticality Safety Program

 DSA [Chapter 7: Safety Management Programs] o Radiation Protection o Fire Protection o Maintenance o Procedures o Training o Conduct of Operations o Quality Assurance o Emergency Preparedness o Waste Management 3.5 Disposition Plans The guidance provided in this Standard addresses only the preparation of a DSA for limited operational life facilities, deactivation, or transition surveillance and maintenance. In development of a DSA for interim operations, it is helpful to understand the process for developing a disposition plan that the DSA will support. DOE O 430.1B, Real Property Asset Management (which superseded DOE O 430.1A, Life-Cycle Asset Management) requires the development of a disposition plan along with specifics of what the disposition plan needs to cover. The use of the terms “disposition” and “disposition plan”, refers to activities that follow completion of the facility’s mission including, but not limited to, surveillance and maintenance, the deactivation and decommissioning phases, and long-term stewardship. Guidance is provided for each of the disposition life cycle phases in the following Guides: DOE-STD-3011-2016 15  DOE G 430.1-2, Implementation Guide for Surveillance and Maintenance during Facility Transition and Disposition, dated 9-29-99;  DOE G 430.1-3, Deactivation Implementation Guide, dated 9-29-99;  DOE G 430.1-4, Decommissioning Implementation Guide, dated 9-2-99; and  DOE G 430.1-5, Transition Implementation Guide, dated 4-24-01. 4.0 REFERENCES [1] 10 C.F.R. Part 830, Nuclear Safety Management [2] DOE O 420.1C, Facility Safety, December 2012 [3] DOE O 430.1B, Real Property Asset Management [4] DOE G 430.1-2, Implementation Guide for Surveillance and Maintenance during Facility Transition and Disposition, dated 9-29-99 [5] DOE G 430.1-3, Deactivation Implementation Guide, dated 9-29-99 [6] DOE G 430.1-4, Decommissioning Implementation Guide, dated 9-2-99 [7] DOE G 430.1-5, Transition Implementation Guide, dated 4-24-01 [8] DOE-STD-1020-2012, Natural Phenomena Hazards Analysis and Design Criteria for DOE Facilities, December 2012 [9] DOE-STD-1027-92, Change Notice NO. 1, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, September 1997 [10] DOE-STD-3007-2007, Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Nonreactor Nuclear Facilities, February 2007 [11] DOE-STD-3009-94, Change Notice NO. 3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, March 2006 [12] DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, November 2014 [13] DOE-STD-3011-94, Guidance for Preparation of DOE 5480.22 (TSR) and DOE 5480.23 (SAR) Implementation Plans, November 1994 [14] DOE-STD-3011-2002, Guidance for Preparation of Basis for Interim Operation (BIO) Documents, December 2002 [15] Guidelines for Hazard Evaluation Procedures, Center for Chemical Process Safety, Third Edition, Wiley/American Institute of Chemical Engineers, 2008 [16] Operating Experience Level 3, Atmospheric Dispersion Parameter (χ/Q) for Calculation DOE-STD-3011-2016 16 of Collocated Worker Dose, April 2015 DOE-STD-3011-2016 A-1 APPENDIX A: TYPES OF NUCLEAR FACILITIES A.1 DSA for a Nuclear Facility with a Limited Operational Life

By definition, a nuclear facility with a limited operational life is a nuclear facility for which there is a short remaining operational period before ending the facility's mission as a nuclear facility. A DSA for a limited operational life nuclear facility is applicable in cases where a facility or activity may need to continue to be active as a nuclear operation for a short period (i.e., five years or less) to complete a defined mission before deactivation, decommissioning, or transition surveillance and maintenance activities. However, as discussed in Section 2.1, it is preferable for the nuclear facility to conduct interim operations using the existing DSA with the appropriate revisions to include any activities or hazards not already enveloped. Another case where a DSA for a limited operational life nuclear facility is applicable is when a nuclear facility is transferred to DOE where there is no approved DSA and there is a remaining operational period. This Standard is not applicable for nuclear mission activities that are new and will only be conducted for short duration (e.g., experiments). An appropriate safe harbor for such activities is DOE-STD-3009-2014. A.2 DSA for Deactivation of a Nuclear Facility A nuclear facility that no longer has a mission that requires the existence of its nuclear hazards, or where nuclear material greater than HC-3 quantities is discovered, should be deactivated. Deactivation is the process of placing a facility in a stable and known condition, including the removal of hazardous and radioactive material. These deactivation activities may be conducted on the order of a few months to multiple years, depending on funding and the complexity of the hazards. As discussed in Section 2.1, it is preferable for the nuclear facility to conduct deactivation activities using the existing DSA with the appropriate revisions to include any activities or hazards not already enveloped. A goal of deactivation is to reduce the facility’s hazard categorization to below HC-3. The last deactivation activity under 10 C.F.R. Part 830, Subpart B, should be to verify the facility’s radioactive material inventory is below the thresholds in DOE-STD-1027, or other inventory basis for a below HC-3 final hazard categorization determination. Depending on the extent of material removal during the process of deactivation, the facility may fall below the HC-3 nuclear facility threshold during deactivation. That point should be identified and provisions made for verification, because Subpart B requirements of the Rule would no longer apply; the appropriate contractual provisions for a radiological facility would need to be implemented. Usually facility safety SSCs and SACs will all be appropriate controls at the beginning of the deactivation process. However, as hazardous materials are removed, the accident scenarios for which they were originally designed for prevention or mitigation may no longer be possible, and DOE-STD-3011-2016 A-2 the controls may be removed. Stepping out of a control does not necessarily mean that the control may be de-energized, as it still may be needed to satisfy life safety or emergency response requirements. It simply means that a control may be retired from the safety basis without formally revising the DSA and TSR and re-submitting for DOE approval.

Once step-out criteria are satisfied, contractor verification of the condition and DOE notification is necessary to allow the contractor to retire the control. When using this approach, the TSR should (1) use explicit TSR definitions that define terms and conditions used in retiring controls; (2) incorporate step-out criteria into Limiting Conditions of Operation or SAC applicability statements; (3) provide administrative controls that formalize the process for stepping out of a control, as well as further safety measures necessary once a control is retired; and (4) provide TSR bases that support the established points for stepping out of controls. There may be unanticipated situations in which a retired facility safety control is needed to perform its past safety function. In these cases, the operability, maintainability, reliability, and availability of the reactivated control should be verified prior to placing the control back into service. It may add clarity if, beyond facility description in a DSA chapter 2, the DSA refers to a major step or activity in the disposition plan. That is, for each major activity, the hazards that apply are identified and analyzed, and hazard controls, including safety management programs are described. Association with a timeline or schedule may also be useful. A.3 DSA for Transition Surveillance and Maintenance at a Nuclear Facility Ideally, deactivation would precede transition surveillance and maintenance, but often it does not. Mission related operations may have been terminated and the facility placed into a surveillance and maintenance mode, possibly with the expectation of resuming operations at a later date, without removal of hazardous materials. During this phase, surveillance and maintenance are the primary activities being conducted at the facility. These activities are necessary for satisfactory containment of hazardous materials and protection of workers, the public, and the environment. As discussed in Section 2.1, it is preferable for the nuclear facility to conduct transition surveillance and maintenance activities using the existing DSA with the appropriate revisions to include any activities or hazards not already enveloped or to remove any unnecessary detail due to the simplistic surveillance and maintenance activities. Surveillance and maintenance activities include providing periodic inspections and maintenance of structures, systems, and components necessary to ensure the performance criteria will be preserved through a potentially prolonged period of time. The identified controls need to be maintained to support their mitigative and/or preventive features as derived in the DSA for protection of workers, the public, and the environment. Surveillance and maintenance of the DOE-STD-3011-2016 A-3 facility should address the stability and known conditions of the hazards present that includes actions to prevent the alteration in chemical makeup (e.g., chemical changes in material in storage tanks leading to the creation of explosive mixtures), physical state, and/or configuration of a hazardous substance or radioactive material. The DSA should also include actions taken with regard to physical SSCs (e.g., roofs, ventilation and fire suppression systems). The DSA written for normal operations may have not addressed safety concerns for transition activities. The DSA for transition surveillance and maintenance of a nuclear facility should address the following hazards:  Radioactive and toxic materials;  Qualitative risk to workers and public conducting surveillance and maintenance;  Degradation of the facility’s physical state; and  Natural phenomena such as earthquakes and floods. The extent to which each of the hazards needs to be address is related to the length of time planned before deactivation or decommissioning is resumed or initiated.