DOE-STD-6002-96, Safety of Magnetic Fusion Facilities: Requirements

TS NOT MEASUREMENT SENSITIVE DOE-STD-6002-96 May 1996 DOE STANDARD SAFETY OF MAGNETIC FUSION FACILITIES: REQUIREMENTS U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. Welcome This Portable Document Format (PDF) file contains bookmarks, thumbnails, and hyperlinks to help you navigate through the document. The modules listed in the Overview are linked to the corresponding pages. Text headings in each module are linked to and from the table of contents for that module. Click on the DOE seal below to move to the Overview. This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (423) 576-8401. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 487-4650. Order No. DE96009495 DOE-STD-6002-96 iii TABLE OF CONTENTS Page FOREWORD....................................................................................................................... v DEFINITIONS ..................................................................................................................... vii 1. INTRODUCTION........................................................................................................... 1 2. SAFETY POLICY .......................................................................................................... 1 3. SAFETY REQUIREMENTS .......................................................................................... 1 3.1 Public Safety Function—Confine Radioactive and Hazardous Material ............. 2 3.1.1 Ensure Afterheat Removal .................................................................... 3 3.1.2 Provide Rapid Plasma Shutdown .......................................................... 3 3.1.3 Control of Coolant Internal Energy ........................................................ 4 3.1.4 Control of Chemical Energy Sources .................................................... 4 3.1.5 Control of Magnetic Energy ................................................................... 4 3.1.6 Limit Routine Airborne and Liquid Radiological Releases ..................... 4 3.2 Worker Safety Function—Control of Operating Hazards .................................... 4 3.2.1 Limit Radiation Exposures to the Workers ............................................ 5 3.2.2 Limit Electromagnetic Field Exposures ................................................. 5 3.2.3 Control of Other Industrial Hazards ....................................................... 5 4. SAFETY AND ENVIRONMENTAL PRINCIPLES ......................................................... 5 4.1 Defense-in-Depth................................................................................................ 5 4.2 Identification of Items Required to Implement Safety ......................................... 6 4.3 Design Basis ....................................................................................................... 6 4.4 Design for Reliability ........................................................................................... 7

4.4.1 Redundancy .......................................................................................... 7 4.4.2 Diversity................................................................................................. 7 4.4.3 Independence........................................................................................ 7 4.4.4 Simplicity................................................................................................ 7 4.4.5 Testability/Surveillance Capability ......................................................... 7 4.5 Fail-Safe and Fault-Tolerant Design ................................................................... 8 4.6 Human Factors ................................................................................................... 8 4.7 Remote Maintenance .......................................................................................... 8 4.8 Quality Assurance ............................................................................................... 8 4.9 Codes and Standards ......................................................................................... 8 4.10 Safety Analysis ................................................................................................... 8 4.11 Verification and Validation .................................................................................. 9 4.12 Special Considerations for Experimental Use .................................................... 9 4.13 Waste Recovery and Recycling .......................................................................... 10 4.14 Cleanup and Site Restoration ............................................................................. 10 4.15 Emergency Planning ........................................................................................... 10 DOE-STD-6002-96 iv 4.16 Technical Safety Requirements .......................................................................... 10 4.16.1 Authorization Basis................................................................................ 10 4.16.2 Configuration Management ................................................................... 11 4.16.3 Unreviewed Safety Questions ............................................................... 11 4.16.4 Conduct of Operations........................................................................... 11 4.16.5 Operational Requirements .................................................................... 11 4.16.6 Training and Certification....................................................................... 11 4.16.7 Maintenance Management .................................................................... 12 APPENDIX: BACKGROUND FOR DOE-STD-6002-96, SAFETY OF MAGNETIC FUSION FACILITIES: REQUIREMENTS; AND DOE-STD-6003-96, SAFETY OF MAGNETIC FUSION FACILITIES: GUIDANCE   ................... 13 LIST OF TABLES Table Page 1 Requirements for protection of the public from exposure to radiation.................. 2 DOE-STD-6002-96 v FOREWORD This Standard provides the requirements for developing design and operations envelopes to ensure safety of magnetic fusion facilities. Also, safety principles are established to provide a framework within which the requirements can be implemented to build safety into fusion facility design and operations.

Fusion facilities developers must comply with applicable requirements in public laws and the Code of Federal Regulations. Requirements from these sources, as they pertain to safety of fusion facilities, have been included or referenced here. In some instances, requirements deemed necessary to ensure safety of fusion facilities have not been adequately covered here- tofore, so new requirements in those areas have also been included. These added requirements are only binding to the extent that this Standard is included in performance contracts. They are requirements for conformance to this Standard. Requirements set forth here are intended to apply to facilities constructed after issuance of this document. Requirements identified in this Standard are intended for evaluation of safety in fusion facility design and operations. The safety principles enumerated here constitute direction on practices determined to be essential to safety in fusion facilities. Because of the variation in design specifics of facilities governed by the requirements in this document, flexibility is provided as to how requirements will be met and how principles will be implemented. Included in DOE- STD-6003-96, Safety of Magnetic Fusion Facilities: Guidance, is an identification of potential hazards, energy sources, and potential anticipated operational occurrences and off-normal conditions that should be considered in assessing the safety of a specific fusion facility. The appendix to this Standard provides background information on key considerations in the development of DOE-STD-6002-96 and DOE-STD-6003-96. Beneficial comments (recommendations, additions, deletions) and any pertinent data that may be of use in improving this document should be addressed to: Environment, Safety, and Health Program Manager Office of Fusion Energy Sciences, ER-54 Office of Energy Research U.S. Department of Energy 19901 Germantown Road Germantown, Maryland 20874-1290 by using U.S. Department of Energy Standardization Document Improvement Proposal Form (DOE F 1300.3) appearing at the end of this document or by letter. DOE-STD-6002-96 vi Intentionally Left Blank DOE-STD-6002-96 vii DEFINITIONS Active—An adjective used to describe a feature or function of a component whose operation depends on an external input such as an actuation, mechanical movement, or supply of power. ALARA—As low as is reasonably achievable. Anticipated Operational Occurrences—Operational processes deviating from normal opera- tion that are expected to occur once or more during the operating life of the facility. Common Cause Failure—The failure of multiple devices or components to perform their func- tions as a result of a single specific event or cause. Comparable Industrial Facility—A facility in the industrial sector where workers are exposed to hazards of a similar nature to those encountered in a fusion facility; for example, heavy lifting, vacuum, cryogenics, high electrical potentials and/or currents, and radioactivity. Confinement—A barrier that surrounds radioactive or hazardous materials designed to prevent or mitigate the uncontrolled release of these materials to the environment. Credible Events—Postulated events having estimated probabilities of occurrence >10–6 per facility year. For natural phenomena, separate probability criteria based on site-specific informa- tion and facility characteristics should be used. Design Basis—The set of requirements that bound the design of systems, structures, and com- ponents within the facility.

Diversity—The existence of multiple components or systems to perform an identified function, where such components or systems incorporate one or more attributes that are different from each other. Effluent—Material that is released into the environment. Evaluation Guidelines—Dose/exposure values for radiation or hazardous materials that a safety analysis evaluates against. Experimental Equipment—Equipment or components installed in or around the facility for the purpose of research and development, not including regular functioning parts of the fusion facil- ity itself (i.e., even when such regular functioning parts may be less than fully developed). Fusion Facility—Any facility that utilizes or supports a magnetically confined plasma in which fusion reactions take place. It includes the associated facility plant and equipment and any experimental apparatus used at the facility. Hazard—A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to personnel or damage to an operation or to the environment DOE-STD-6002-96 viii (without regard for the likelihood or credibility of off-normal conditions or consequence mitigation). Inherent—An adjective to describe a design feature or function that operates without the appli- cation of a separate input such as an activation signal. An example of an inherent design fea- ture is a fail-safe valve that closes automatically on loss of power. ITER—International Thermonuclear Experimental Reactor. Maintenance—The organized activity, both administrative and technical, directed toward keep- ing structures, systems, and components in good operating condition, including both preventive and corrective aspects. May—Permission; neither a requirement nor a recommendation. Monitoring—Continuous or periodic measurement and/or observation of parameters or deter- mination of the status of a system or component. Sampling may be involved as a preliminary step to measurement. Normal Conditions—Conditions associated with the routine operation of the facility. Normal Operations—Activities at a facility performed within specific normal operational limits and conditions, including startup, operation, shutdown, maintenance, and testing. Normal operations do not include anticipated operational occurrences. Off-Normal Conditions—Conditions beyond anticipated operational occurrences that include all credible events. Passive—An adjective that describes a function that requires no operation or movement of component parts. Physical Separation—Isolated by geometry (distance, orientation, etc.), by appropriate barriers, or a combination thereof. Postulated Initiating Events (PIE)—Identified happenings or conditions that lead to anticipated operational occurrences, off-normal conditions, and their consequential failure effects. Potential Safety Concern—A feature and/or process determined to be capable of challenging a public safety function and to which a risk-informed decision-making process is applied during design. Public Safety Function—Essential characteristics or performance needed to ensure the safety and the protection of the public and the environment during operations, anticipated operational occurrences, and off-normal conditions. DOE-STD-6002-96 ix Quality Assurance—Those planned and systematic actions necessary to provide adequate confidence that an item or service will satisfy specified requirements for intended service.

Redundancy—Provision of more than the minimum number of similar elements or systems, so that loss of any one does not result in the loss of the required function. Requirement—That which must be done to be in compliance with this Standard. (Most requirements included here are also mandated by Federal law.) Risk—The quantitative or qualitative expression of possible loss that considers both the proba- bility that an event will occur and the consequence of that event. Shall—Used to denote a firm requirement that must be met to be in compliance with this Standard. Shall Consider—The need for and applicability of stated features or attributes must be evalu- ated and the results of the evaluation documented. Should—A desirable option or recommendation, departure from which is permissible. Technical Safety Requirements—Those requirements that define the bounding conditions for safe operation, the bases thereof, and the management or administrative controls required to ensure the safe operation of a facility. Workers—Persons performing work at the facility or on the site of the facility. Worker Safety Function—Essential characteristics or performance needed to assure the pro- tection of workers during normal operations, anticipated operational occurrences, and off-normal conditions. DOE-STD-6002-96 x Intentionally Left Blank DOE-STD-6002-96 1 1. INTRODUCTION This Standard identifies safety requirements for magnetic fusion facilities. Safety functions are used to define outcomes that must be achieved to ensure that exposures to radiation, haz- ardous materials, or other hazards are maintained within acceptable limits. Requirements appli- cable to magnetic fusion facilities have been derived from Federal law, policy, and other docu- ments. In addition to specific safety requirements, broad direction is given in the form of safety principles that are to be implemented and within which safety can be achieved. 2. SAFETY POLICY Fusion facilities shall be designed, constructed, operated, and removed from service in a way that will ensure the protection of workers, the public, and the environment. Accordingly, the following points of safety policy shall be implemented at fusion facilities: a. The public shall be protected such that no individual bears significant additional risk to health and safety from the operation of those facilities above the risks to which members of the general population are normally exposed. b. Fusion facility workers shall be protected such that the risks to which they are exposed at a fusion facility are no greater than those to which they would be exposed at a comparable industrial facility. c. Risks both to the public and to workers shall be maintained as low as reasonably achievable (ALARA). d. The need for an off-site evacuation plan shall be avoided. e. Wastes, especially high-level radioactive wastes, shall be minimized. 3. SAFETY REQUIREMENTS To achieve safety in fusion facilities, it is important for safety to become an integral part of the design and operation of the facility. From the safety policy, two types of safety functions have been identified: public safety functions and worker safety functions. Fusion facilities shall be designed to ensure that public and worker safety functions are always achieved for condi- tions within the design basis. The public safety function for fusion facilities is the confinement of radioactive (e.g., tritium and activation products) and hazardous (e.g., beryllium or vanadium) materials. The worker safety function is the control of operating hazards including radioactivity and hazardous material.

Potential safety concerns that must be considered during the design process to minimize challenges to the public safety function of confinement of radioactive and/or hazardous materi- als include, but should not be limited to the following: DOE-STD-6002-96 2 a. ensuring afterheat removal when required; b. providing rapid controlled reduction in plasma energy when required; c. controlling coolant energy (e.g., pressurized water, cryogens); d. controlling chemical energy sources; e. controlling magnetic energy (e.g., toroidal and poloidal field stored energy); f. limiting airborne and liquid releases to the environment; The specific design of any particular fusion facility must be considered in determining the importance of potential safety concerns in protecting the public and the environment. A risk- based prioritization scheme (graded approach) shall be used to determine the impact of these potential safety concerns for each specific fusion facility. Application of these safety requirements will normally be an iterative process. Require- ments shall be implemented in each phase of the facility life cycle, incorporating feedback from the results of the facility safety analysis and experience/lessons learned during the previous operating phases of the facility. 3.1 Public Safety Function—Confine Radioactive and Hazardous Material Radioactive and hazardous material confinement barriers of sufficient number, strength, leak tightness, and reliability shall be incorporated in the design of fusion facilities to prevent releases of radioactive and/or hazardous materials from exceeding evaluation guidelines during normal operation or during off-normal conditions. As shown in Table 1, two sets of radiological criteria shall be used for evaluating radioac- tive releases: regulatory limits (evaluation guidelines) that shall not be exceeded and fusion requirements. Regulatory limits (evaluation guidelines) are applicable to the maximum exposed individual off-site using conservative assumptions. Best-estimate techniques are used to evalu- ate against fusion requirements. In showing compliance with these guidelines, the ALARA principle shall be applied. Compliance with both sets of criteria shall be demonstrated for all TABLE 1. Requirements for protection of the public from exposure to radiationa Fusion radiological release requirement Regulatory limit (evaluation guideline) Normal and anticipated operational occurrences 0.1 mSv/yr (10 mrem/yr) 1 mSv/yr (100 mrem/yr) Off-normal conditions (per event) 10 mSv (1 rem) (No public evacuation) 250 mSv (25 rem) aBasis for the exposure limits is provided in DOE-STD-6003-96, Chapter 2. DOE-STD-6002-96 3 credible postulated events, noting the difference in analysis methodologies (conservative vs best estimate). Routine releases of nonradiological effluents (including any hazardous materials) shall be controlled in accordance with Federal, State, and local regulations and permit requirements. The design shall also provide adequate means for sampling and monitoring of effluents to the environment. In the design of confinement barriers, the principles of redundancy, diversity, and independence shall be considered. Specifically, in the case of multiple barriers, failure of one barrier shall not result in the failure of another barrier if evaluation guidelines could be exceeded thereby. Redundancy and diversity shall be considered in the total confinement strategy if new or untested components of a barrier are used.

The design basis for confinement barriers shall take into account identified postulated ini- tiating events and extreme loadings and environmental conditions due to anticipated operational occurrences and off-normal conditions as identified in the safety analysis. In addition, considera- tion should be given to the provision of features for the mitigation of consequences of conditions outside of the design basis to meet the fusion requirement of no off-site evacuation for fusion facilities. Consistent with the safety analysis, the design of confinement barriers shall specify an acceptable global leak rate under off-normal conditions, taking into account the vulnerable inventories of radioactive and hazardous materials and the potential energy sources available to liberate such inventories. Any confinement barrier, including equipment, penetrations, seals, etc. relevant to the establishment of an acceptable leak rate, shall be designed and constructed in such a way as to enable initial and periodic leak testing. The following subsections establish the requirements related to the potential safety con- cerns that may affect the public safety function of confinement of radioactive and hazardous material. 3.1.1 Ensure Afterheat Removal The design of fusion facilities shall provide a reliable means to remove any undesirable afterheat generated by activation products produced by neutron absorption in structures such that the public safety function of confinement is assured. The need for and reliability of afterheat removal systems shall be commensurate with the role of afterheat removal in complying with evaluation guidelines. Passive means are preferable to active means. For facilities with levels of afterheat that require active cooling, the concepts of redundancy, diversity, and independence shall be considered in the design of afterheat removal systems. 3.1.2 Provide Rapid Plasma Shutdown A means of rapid plasma shutdown shall be provided for fusion facilities, if required to ensure that evaluation guidelines are met. The level of required reliability, redundancy, and DOE-STD-6002-96 4 diversity of such a system, its effectiveness, and speed of action shall be such that safety func- tions required to meet evaluation guidelines are assured. Consideration shall be given to heat, particle, magnetic, and mechanical loads on confinement barriers resulting from transient over- power events and plasma abnormalities (e.g., vertical displacement events or plasma disrup- tions in tokamaks) in assessing the need for rapid plasma shutdown. 3.1.3 Control of Coolant Internal Energy For fusion facilities that use liquids for active cooling of components (e.g., water and cryogenic liquids), the design shall incorporate means to accommodate the accidental release of the liquid to ensure that confinement barriers are not breached in a manner that could result in exceeding evaluation guidelines. Special consideration shall be given to the effect of large spills of cryogenic liquids on the structural integrity of affected structures, systems, or compo- nents (SSCs) (e.g., embrittlement). 3.1.4 Control of Chemical Energy Sources Fusion facilities shall be designed such that chemical energy sources are controlled dur- ing normal conditions, anticipated operational occurrences, and off-normal conditions so as to minimize energy and pressurization threats to radioactivity and hazardous material confinement barriers. Design measures shall assure that evaluation guidelines are met.

3.1.5 Control of Magnetic Energy Magnet systems in fusion facilities shall be designed so that faults in the magnets and the associated ancillary systems (power supply and electrical systems) shall not threaten public or worker safety functions. 3.1.6 Limit Routine Airborne and Liquid Radiological Releases Adequate systems or design features shall be provided to minimize airborne and liquid radioactive effluents from fusion facilities to meet the limits prescribed in 40 CFR 61, National Emission Standards for Hazardous Air Pollutants. That limit for members of the public is 0.1 mSv/yr (10 mrem/yr). Fusion facilities must provide a level of protection for persons consum- ing water from a public drinking water supply that is equivalent to public community drinking water standards as set forth in 40 CFR 141.16 from National Primary Drinking Water Regula- tions. This requirement translates into an effective dose equivalent of 40 µSv/yr (4 mrem/yr). In addition, exposure from all sources of radiation shall not exceed 1 mSv/yr (100 mrem/yr) per 10 CFR 20.1301 from Standards For Protection Against Radiation. The design shall also provide adequate means for sampling and monitoring of radioactive effluents to the environment. 3.2 Worker Safety Function—Control of Operating Hazards Workers at the facility shall be protected from routine hazards to a level commensurate with that of comparable industrial facilities by a combination of administrative controls and DOE-STD-6002-96 5 design features. The level of protection required depends on the level of risk from the hazard present in the specific facility. 3.2.1 Limit Radiation Exposures to the Workers Fusion facilities shall be designed to limit radiation exposures to the workers during normal operations below the limits prescribed in 10 CFR 20 or 10 CFR 835, Occupational Radiation Protection [50 mSv/yr (5 rem/yr)]. Fusion facilities shall have adequate shielding to limit radiation levels in operating areas. Special consideration shall be included in the design to limit worker doses due to the inhalation and absorption of tritium. The ALARA principle shall be used in developing worker radiological exposure limits for the facility. 3.2.2 Limit Electromagnetic Field Exposures Fusion facilities shall be designed to limit electromagnetic field exposures to workers during routine operations. The limits for occupational exposures to steady-state and low- frequency magnetic fields shall be those established by the American Conference of Governmental Industrial Hygienists (ACGIH).1 3.2.3 Control of Other Industrial Hazards Fusion facilities shall comply with the Occupational Safety and Health Administration (29 CFR 1910, 1926) to control the industrial hazards and hazardous materials present in the facility. 4. SAFETY AND ENVIRONMENTAL PRINCIPLES The safety and environmental principles set forth in this section constitute a framework within which worker and public safety is assured and facility risks are limited. Application of these principles shall be commensurate with the magnitude of the hazards of the facility. 4.1 Defense-in-Depth The design process for fusion facilities shall incorporate the defense-in-depth concept such that multiple levels of protection are provided against the release of radioactive and haz- ardous material. The level of protection needed is a function of the risk to the workers, the public, and the environment. Aspects of the defense-in-depth concept that may be applicable to fusion facilities include the following:

a. the selection of materials and other design processes to reduce radiological and hazardous materials inventories; 1For further information, see “Threshold Limit Values for Chemical Substances and Physical Agents and Biological Exposure Indices,” published by the American Conference of Governmental Industrial Hygienists, 6500 Glenway Ave., Bldg. D-7, Cincinnati, Ohio 45211-4438, latest revision. See also “Documentation of the Threshold Limit Values and Biological Exposure Indices,” published by the ACGIH, latest revision. DOE-STD-6002-96 6 b. the use of conservative design margins; c. the use of a succession of physical barriers (passive preferred) for protection against release of radioactive and hazardous materials; d. the provision of multiple means (inherent, passive, or active) for ensuring the public safety functions for fusion facilities; e. the use of basic design features, equipment, and operating and administrative pro- cedures to minimize anticipated operational occurrences and off-normal conditions and to control and mitigate their consequences should they occur; f. the implementation of a rigorous and formalized quality assurance program, the organization of surveillance activities, and the establishment of a safety culture; g. use of emergency plans as required to mitigate the effects of radiological and haz- ardous releases to workers and the public. h. additional levels of defense may be needed to compensate for technological uncertainties. 4.2 Identification of Items Required to Implement Safety Internal and external postulated initiating events (PIEs) that challenge the public safety functions shall be systematically identified. Event sequences that account for additional potential failures of items (structures, systems, components, and software, etc.) from PIEs shall be developed. Based on these event sequences, items that are required to function to prevent accidental releases of radioactive and/or hazardous materials in excess of evaluation guidelines or to maintain consequences to ALARA goals shall be identified. 4.3 Design Basis The facility design basis shall define the necessary capabilities of the facility to cope with a specified range of operational states, maintenance and other shutdown activities, anticipated operational occurrences, and off-normal conditions to meet the evaluation guidelines presented in Section 3. The facility design shall recognize that both internal and external challenges to each level of defense may occur, and design measures shall be provided to assure that evalua- tion guidelines can be met. The design basis shall include consideration of natural phenomena (e.g., earthquakes, floods, and high winds), environmental effects, and dynamic effects (e.g., pipe ruptures, pipe whip, and missiles) in order to establish a set of external challenges. The importance of these events in the design basis shall be evaluated based on the risk of event sequences developed for the facility. DOE-STD-6002-96 7 Normal operation, anticipated operational occurrences, and off-normal conditions created by PIEs shall be classified for fusion facilities into two categories: (a) normal operation and anticipated operational occurrences; and (b) off-normal conditions that may be expected with lower but still credible probability. A bounding subset of these conditions shall be identified in the safety analysis. 4.4 Design for Reliability

Unavailability limits for items that perform public safety functions shall be specified to ensure the reliability needed to meet evaluation guidelines. Similar limits are recommended but optional for items that perform worker safety functions. The required reliability of items shall be developed in accordance with the importance of their safety function in protecting the workers, the public, and the environment. 4.4.1 Redundancy The principle of redundancy shall be considered as an important design principle for improving the reliability of items and guarding against common-cause failures. Multiple sets of equipment that cannot be operated and tested independently do not meet the redundancy prin- ciple. The degree of redundancy shall reflect the potential for undetected failures that could degrade reliability. 4.4.2 Diversity The principle of diversity s hall be considered as a means to enhance reliability and reduce the potential for common cause failures. 4.4.3 Independence The principle of independence shall be considered to enhance the reliability of systems, in particular with respect to common-cause failures. Independence is accomplished in the design of items by using functional isolation and physical separation (e.g., separation by geometry or barriers). 4.4.4 Simplicity The principle of design simplicity shall be considered to enhance the reliability of items. Less complex items are generally more reliable. 4.4.5 Testability/Surveillance Capability Items performing public and worker safety functions shall be designed and arranged so that they can be adequately inspected, tested, and maintained as appropriate before being placed in service and at suitable and regular intervals thereafter. DOE-STD-6002-96 8 4.5 Fail-Safe and Fault-Tolerant Design The fail-safe principle shall be applied to items performing public and worker safety func- tions; that is, if an item were to fail, it would pass into a safe state without a requirement to initi- ate any actions. The design of systems shall also, to the extent feasible, be tolerant to faults. 4.6 Human Factors Human factors and human-machine interfaces shall be considered in the design of items performing safety functions for fusion facilities. 4.7 Remote Maintenance The design shall make provisions early in the design process, where necessary, for accessibility, adequate shielding, and remote handling of items performing safety functions to facilitate maintenance and repair, taking into account the need to keep worker exposures ALARA. 4.8 Quality Assurance A quality assurance process shall be considered in the design, selection of materials, specifications, fabrication, construction, installation, operating procedures, maintenance, and testing of fusion facilities. The requirements of 10 CFR 830.120, Nuclear Safety Management, shall be used for development of the program. 4.9 Codes and Standards Applicable codes and/or standards shall be identified for use on items performing safety functions when available. Justification for the applicability of the code for use on the compo- nents performing the safety functions shall be provided. For items performing safety functions in fusion facilities for which there are no appropriate established codes or standards, an approach for selecting the requirements that must be met to accomplish those safety functions shall be developed and justified. 4.10 Safety Analysis

The safety of fusion facilities shall be analyzed to demonstrate that the facility meets the evaluation guidelines presented in Section 3. The development of the safety analysis and the design of the facility are complementary processes that should be carried out interactively. The evaluation of the safety of the facility shall include a hazard analysis and an analysis of the response of the facility to a range of PIEs under each mode of facility operation, including maintenance and shutdown. These PIEs shall include equipment failures and malfunctions, operator errors, and external events that could lead to either anticipated operational occur- rences or off-normal conditions. These analyses shall be used as the basis for the selection of operational limits and conditions for the facility. DOE-STD-6002-96 9 The safety analysis shall show that the set of PIEs bounds credible anticipated opera- tional occurrences and off-normal conditions that influence the safety of the facility. The PIEs and their consequences shall be analyzed and categorized so that a subset of bounding or limit- ing events from each category (i.e., anticipated operational occurrences and off-normal condi- tions) can be selected for detailed quantitative analysis as part of the design basis. Off-normal conditions beyond the design basis should be analyzed for the purpose of emergency planning and to ensure that there are no events with probabilities near the limit of credibility with conse- quences that are much larger than those for the worst credible events. A combination of probabilistic and deterministic approaches may be used in the safety analysis. Probabilistic approaches may be used to gain insight and to help establish events within the design basis as discussed in Section 4.3. When probabilistic approaches are used and data are scarce, conservative estimates shall be used and the rationale for their use shall be documented. These estimates may be based on inference from similar equipment, expert opinion, detailed analyses (such as probabilistic fracture mechanics), existing fusion experience, or other means. Deterministic analyses shall specify the assumptions used in the assessments (i.e., input parameters, initial conditions, boundary conditions, assumptions, models, and codes used) and the level of conservatism (i.e., safety margin) in the assessment. Results of these complementary approaches provide input into the design process of the facility. 4.11 Verification and Validation The applicability of the design and safety analysis methods shall be verified and the methods validated. Furthermore, an equipment qualification procedure shall be established for items performing public safety functions to confirm that the equipment is capable of meeting the safety functions for the facility while subject to the environmental conditions (e.g., vibration, temperature, pressure, jet impingement, radiation, humidity, chemical attack, and magnetic fields) existing at the time of need. Experimental data used in the design process or in the safety analysis shall undergo formal validation. 4.12 Special Considerations for Experimental Use Fusion facilities, especially those considered test facilities, may by their nature include experimental component modules or equipment. As a general rule, experimental systems should not be expected to perform safety functions. However, if such components are required to perform a safety function, the safety analysis must show that potential faults in experimental equipment shall not cause evaluation guidelines to be exceeded. The flexible nature and changing states of the system also require special precautions to be taken in the design and operation to minimize the effects of human error.

Experimental equipment shall be designed so that in each operational state it cannot cause unacceptable consequences to the facility, other experiments, workers, or the public. Specific considerations include but are not limited to the following: a. factors in experiments that could cause a breach of any confinement barrier; b. factors in experiments that could adversely affect items performing safety functions; DOE-STD-6002-96 10 c. factors in experiments that could create additional radiological, hazardous, chemical, or other risks; d. factors relating to interactions with other experiments or operational activities. 4.13 Waste Recovery and Recycling Waste recovery and recycling shall be addressed in the design of the facility. The fusion waste shall be minimized. The goal for fusion facilities is that wastes be recoverable or disposable as low-level waste meeting the requirements of 10 CFR 61, Licensing Requirements for Land Disposal of Radioactive Waste. 4.14 Cleanup and Site Restoration The design of fusion facilities shall consider aspects to facilitate cleanup and removal of the facility. Reduction of the amount of radioactive waste generated shall be considered in the design, selection of materials, and conduct of operations of a fusion facility. Adequate systems shall be provided, as necessary, for handling, collecting, processing, and storing on site any radioactive, hazardous, or mixed wastes generated in a fusion facility. Exposure to workers, the public, and the environment during cleanup and removal shall comply with 10 CFR 20 for the public and the environment and 10 CFR 835 for the workers and shall be maintained ALARA. 4.15 Emergency Planning Emergency plans (on-site and off-site) for fusion facilities shall be developed in accor- dance with applicable requirements (e.g., the Environmental Protection Agency's 1-rem protec- tive action guideline). Facilities meeting the fusion radiological release requirement of less than 1-rem off-site exposure do not require off-site evacuation plans for radiological emergencies. 4.16 Technical Safety Requirements Requisite systems must be operational to stay within the limits identified in the safety analysis. The following paragraphs apply to a fusion facility during the operating period. 4.16.1 Authorization Basis Each fusion facility shall have an authorization basis that is documented and approved by the regulatory authority. It shall specify the factual information that was used to determine that risks to persons and the environment from the operation of the facility were acceptable, and it shall specify an operating envelope within which the facility can be safely operated. The operat- ing envelope shall include operational limits that protect and preserve the assumptions and safety margins specified in the safety analysis. DOE-STD-6002-96 11 4.16.2 Configuration Management Each fusion facility shall have a configuration management system. The configuration management program shall assure that the actual as-built configuration of the facility is known, that the configuration reflects and is accurate with respect to the design requirements, that the documentation is maintained as it relates to items performing safety functions, and that changes to this configuration are controlled. 4.16.3 Unreviewed Safety Questions

Each fusion facility shall have a system for performing evaluations of proposed actions against the facility's authorization basis. Evaluations shall be performed for changes to the facil- ity described in the existing safety analysis, changes to procedures that affect items performing safety functions, and tests or experiments that are not bounded in the existing safety analysis. If a condition is discovered in the facility that is not covered by the existing authorization basis, then operations not enveloped by the existing authorization basis shall cease until an appropri- ate analysis has been completed and the facility’s authorization basis has been changed to reflect the actual plant conditions. 4.16.4 Conduct of Operations Each fusion facility shall have a conduct-of-operations program. The program shall address the operating organization and administration, shift routines and operating practices, control area activities, communications, control of on-shift training, investigation of abnormal events, notifications, control of equipment and system status, lockout and tagout, independent verification, log keeping, operations turnover, required reading, operator orders, operations pro- cedures, operator aids, and equipment labeling. The extent of the conduct-of-operations pro- gram will be based upon a graded approach commensurate with the risks of the facility. 4.16.5 Operational Requirements Each fusion facility shall prepare and maintain an operational requirements document . This document shall be based upon safety analysis and shall define the lowest functional oper- ability or performance level of systems, components, and functions required for normal safe operation of the facility. 4.16.6 Training and Certification Each fusion facility shall develop and implement a training, qualification, and certification program using a graded approach based upon the risk of the facility. The training program shall identify the required training, qualification, and certification program for each required operator position. The program shall include the theory and principles of operations, facility operating characteristics, facility instrumentation, items performing safety functions, normal and emer- gency procedures, radiation control and safety, authorization basis, and written evaluations and examinations. The training program shall also include operator proficiency requirements and DOE-STD-6002-96 12 medical examination requirements as applicable. Additional training programs shall include safety considerations for maintenance and support activities. 4.16.7 Maintenance Management Each fusion facility shall develop and implement a maintenance program that addresses items performing safety functions . The program shall include as a minimum: planning, schedul- ing, and coordinating activities; maintenance history and trending; types of maintenance; listing of items performing safety functions; and indicators to measure the effectiveness of the mainte- nance program. A reliability-centered maintenance approach shall be considered. DOE-STD-6002-96 13 APPENDIX BACKGROUND FOR DOE-STD-6002-96, SAFETY OF MAGNETIC FUSION FACILITIES: REQUIREMENTS; AND DOE-STD-6003-96, SAFETY OF MAGNETIC FUSION FACILITIES: GUIDANCE

This appendix sets forth considerations of key issues given by the Fusion Safety Steering Committee and Working Group in the preparation of DOE-STD-6002-96, Safety of Magnetic Fusion Facilities: Requirements, and DOE-STD-6003-96, Safety of Magnetic Fusion Facilities: Guidance. The intent is to assist readers in understanding the reasoning and logic behind these documents and thereby to alleviate misunderstandings and resolve concerns regarding their content. The requirements and guidance incorporated in these two Standards beyond those found in Federal regulations are only binding to the extent that these Standards are included in a performance contract, except as otherwise mandated by Federal statute or regulation. They are not expected to be applicable automatically to previously existing facilities. 1. Purpose. DOE-STD-6002-96 and its companion, DOE-STD-6003-96, address safety in magnetic fusion facilities. DOE-STD-6002-96 was prepared to provide users with a succinct and comprehensible assembly of safety-based design and operational requirements specific to fusion facilities. This Standard is written for developmental facilities constructed after the issuance of this Standard and future commercial facili- ties. Requirements have been written generically so that this Standard may serve as a prototype document for any agency that may regulate fusion. These Standards are intended to provide assurance that magnetic fusion facilities are designed, con- structed, operated, modified, maintained, and removed from service in a manner that assures protection of the worker, the public, and the environment. DOE-STD-6003- 96 was prepared as guidance in meeting the requirements identified in DOE-STD- 6002-96 for a near-term facility such as the International Thermonuclear Experimen- tal Reactor (ITER) in the Department of Energy (DOE) environment. Requirements found in the Code of Federal Regulations (CFRs) and in directives derived from them are based primarily on experience with activities related to the fission fuel cycle, because there had been little experience with fusion at the time of their development. There are major differences between fusion facilities and other facilities. These differences should be reflected in the requirements and implementa- tion of features and processes to achieve safety of fusion facilities. By their nature, the hazards in fusion are unique in many ways. In fission, the energy source and inventory are intimately coupled (e.g. in the core), the time scales for accidents are fairly short, and accident protection and mitigation are more viable than accident prevention. In fusion, the energy sources and the radioactive inventories are more distributed, there is a strong ability for accident prevention by careful materials selection, and the inherent time scales to provide protection or mitigation are gener- ally longer. Because of the distributed nature of the energy sources and inventories DOE-STD-6002-96 14 in fusion, careful attention to design can prevent accidents or can minimize the threats posed by the energy source to liberate the inventories. These differences indicate that a unique approach is needed in the development of fusion safety requirements. One detailed example of the difference in hazards is that fusion facilities are expected to contain no fissile or fertile materials or fission products.1 Nuclear critical- ity with its associated energy release cannot occur in fusion facilities. For the fusion reaction to take place, controlled and difficult-to-achieve conditions must be main- tained. Any event that disturbs these conditions results in a quenching of the plasma and the cessation of fusion reactions.

A second example is the difference in the hazard associated with the radionuclide inventories. Fission, by its nature, results in long-lived, highly radioactive fission products. In fusion facilities, however, radionuclide inventories will be dominated by tritium fuel that collects on internal structures and activation products in the struc- tures, depending on the fuel cycle, the stage of operation, and the specific mission and operating profile of the machine. Tritium is also a highly mobile gas, relatively difficult to contain. Fusion activation products will be principally solids, not easily mobilized except in an extreme accident scenario. Furthermore these inventories may be reduced by proper selection of materials. Differences in the vulnerabilities of the inventories of radioactive material will exist in fusion machines as compared with those in other nuclear facilities. For example, early fusion machines will probably operate in a pulsed mode where operation is only for relatively short periods. The hazards tend to be more distributed spatially than in fission systems. Further, there is no possibility for criticality related accidents in a fusion machine. There are also differences in the relative biological risks of the radioisotopes because actinides, radioactive noble gases, radioiodine, radiocesium, radiostrontium, or plutonium, which are inherently associated with the fission-connected process, are not present in fusion. These are more biologically hazardous than tritium (which is the most significant releasable radionuclide in fusion). A third difference is that while fission-related facilities usually can be operated only as nuclear facilities (e.g., with fission reactions taking place in reactors), a fusion facility may be operated using only protium and/or deuterium for comparatively extensive periods during which the radionuclide production is below thresholds requiring special handling as a nuclear facility.2 Hence, for that period, fusion 1Some designs have been proposed for hybrid fusion reactors that would contain fissile fuel, but there are no specific plans to build machines of this type. 2The Tokamak Fusion Test Reactor and the DIII-D facility have operated with deuterium for years as non- nuclear facilities. DOE-STD-6002-96 15 facilities need not necessarily be managed as nuclear facilities3 but could be operated as non-nuclear facilities. Finally, fusion facilities will have several hazards not normally associated with fission reactor systems. Some of these include cryogenic systems, very high electric cur- rents and voltages, and strong magnetic fields. These differences between fusion facilities and other nuclear facilities must be reflected in DOE's safety requirements for fusion facilities. They must reflect the unique design aspects of fusion facilities so that requirements not directly applicable, which would not enhance safety, are not imposed. Fusion-specific requirements that are different from those derived from fission experience may also be needed and incorporated in safety documentation. Until now, the best sources of general safety program requirements for facilities were DOE Order 5481.1B, Environment, Safety, And Health Program For Department Of Energy Operations, which is risk-management driven, and DOE Order 5480.23, Nuclear Safety Analysis Reports, which is fission-technology driven. However, prob- lems are experienced when attempting to apply the fission-technology-based DOE Orders to fusion facilities. Among these problem areas are:

a. how to apply a graded approach for fusion structures, systems, and compo- nents required for safety, which tend to have distributed energy sources; b. whether and to what degree fission codes and standards are applicable to engineered systems in fusion facilities, especially structures, systems, and components required for safety; c. whether the hazards categorization process for nuclear facilities is sufficient for fusion facilities given the different radionuclides generated by activation of structural metal (e.g., stainless steel) vs fission of uranium; d. whether there are unique security/accountability requirements concerning facility safety and the use of tritium as a fuel; and e. how other aspects such as magnetic field exposure, disposal of activated materials, and other unique characteristics of fusion facilities should be treated in the context of DOE Safety Orders. In all these areas, supplemental guidance is needed that takes into consideration the unique aspects of fusion facilities, for all life cycle phases including cleanup and site 3The definition of a nuclear facility for DOE safety purposes is in DOE Order 5480.23. Nuclear facilities are fission reactors and nonreactor nuclear facilities. Nonreactor nuclear facility means those activities or operations that involve radioactive and/or fissionable materials in such form and quantity that a nuclear hazard potentially exists to the employees or the general public. DOE-STD-6002-96 16 restoration. Relevant experience should be drawn from all applicable areas within the DOE community in developing the needed guidance. Accordingly, the basic intent of this set of Standards is to more clearly identify design and operational safety requirements for fusion facilities and to provide guidance in meeting those requirements. These Standards reflect recognition of the differences between fusion facilities and other facilities. 2. Relationship Between the Two Standards. Two Standards have been produced. The first, DOE-STD-6002-96, Safety of Magnetic Fusion Facilities: Requirements, is a summary of requirements relative to safety of magnetic fusion facilities. With two exceptions, requirements presented there come from CFRs, national consensus standards, or best available information from recognized authoritative institutions implemented within a fusion context. The exceptions, addressed in following para- graphs, come from community consensus and the best judgment of the Fusion Safety Steering Committee, charged with the responsibility of preparing these documents. The requirements, in DOE-STD-6002-96, convey a set of rules for use by owners, managers, designers, and operators of a fusion facility to establish its design and operating envelope to ensure that workers, the public, and the environment are pro- tected from the facility's hazards. Capital investment protection was not a specific goal of the requirements document. Because of the range of fusion facilities that may come under the purview of this Standard and their differing hazards, the Standard was not written to be prescriptive. It states what must be done, but not how. This approach gives designers flexibility, but it also puts the burden on them to determine how to implement the requirements for the specific facility. Furthermore, the use of risk-informed prioritization or graded approach is recommended in meeting the requirements.

DOE-STD-6003-96, Safety of Magnetic Fusion Facilities: Guidance is, as the name indicates, guidance on how to achieve or implement the requirements set forth in the Requirements Standard, DOE-STD-6002-96, assuming DOE regulation for an engineering scale facility like ITER. Nothing in the guidance volume is intended to add to the requirements, only to indicate methods and processes that may be used to meet existing requirements. In that sense, it is subordinate to DOE-STD-6002-96. The guidance provides an acceptable but not necessarily unique way to implement the requirements for an experimental fusion facility such as ITER or DEMO. This guidance would presumably be updated for eventual fusion power reactors, where results from preceding experimental devices would resolve outstanding material, plasma physics, and fusion technology issues that the present guidance document has to accommodate. 3. Source of Requirements. The requirements in this Standard are based on require- ments found in Federal regulations implemented within a fusion context and on input DOE-STD-6002-96 17 from representatives of a large and diverse cross section of U.S. industry (potential future operators of fusion facilities). An attempt has been made to assemble and synthesize these sometimes contradictory inputs into a consistent set of safety requirements and safety principles for fusion. Safety philosophies, approaches, and requirements from radiation protection, nuclear power, risk and reliability, space, and chemical technologies were examined. Those requirements that were appropriate for fusion were accepted. Others were modified as needed, and those that were not appropriate for fusion were omitted. Because of uncertainty regarding the future role of DOE in self-regulation, this approach was taken to capture the intent of those requirements that are imple- mented by regulatory agencies [e.g., Nuclear Regulatory Commission (NRC), DOE, Environmental Protection Agency (EPA)] and at the same time not reflect any specific agency's approach, which would then have to be changed once a final decision about such matters is made. Thus, the requirements in this Standard are stated generically so that they can be adopted by any agency that might regulate future fusion machines. A key factor in making those decisions was the understanding of the hazards involved in fusion facilities. Applicable requirements from U.S. Federal law (e.g., radiation, hazardous release limits) were integrated into the overall set of require- ments. This approach resulted in a set of functional safety requirements that make sense for fusion and that can be used for the range of facilities expected. The majority of the safety policy was adopted from and is consistent with SEN-35-91, “Nuclear Safety Policy,” DOE Order 5480.30, “Nuclear Reactor Safety Design Criteria,” and NRC safety goals. Fusion facilities will comply with this policy if they meet the requirements presented in this Standard. Two areas are neither specifically DOE nor Federal requirements but are specified as part of the Safety Policy of the Requirements Standard: • no public evacuation for magnetic fusion facilities, and • minimization of the amount of fusion facility waste, especially high-level radioac- tive waste. These additional points, which are related to global facility safety and environmental issues, are considered sufficiently important to the acceptance of magnetic fusion power by the utility industry and the public that they are included as an integral part of the safety policy.

4. Fusion Requirement of No Public Evacuation. The most sweeping departure from existing requirements for safety of nuclear facilities is the requirement that fusion facilities be designed and operated in such a way that no public evacuation will be necessary, even in the event of a severe off-normal event. DOE-STD-6002-96 18 Under off-normal conditions, the regulatory requirement (evaluation guideline) of 250 mSv (25 rem) is based on siting criteria in DOE Order 6430.1A, General Design Criteria, and the design basis acceptance criteria for nuclear reactor siting in 10 CFR 100, Reactor Site Criteria. The 25-rem value is used as an evaluation guideline to determine if a system is important to safety. Systems required to function during off- normal conditions to prevent an exposure of the maximally exposed individual in excess of 25 rem would be classified as an item needed to implement safety (see Section 4.2 of DOE-STD-6002-96). In the calculation of the exposure, conservative assumptions are used (e.g., conservative meteorology for dispersion, conservative response of system) based on the precedence set with nuclear facilities. The fusion requirement of 10 mSv (1 rem) under off-normal conditions is based on the desire to have no off-site evacuation. The 1-rem value is the lowest EPA protec- tive action guideline for evacuation of the general population (from PB92-164763, Manual of Protective Action Guides and Protective Action for Nuclear Incidents, Environmental Protection Agency, October 1991). Exposures to compare with the 1-rem value are also assessed to the maximally exposed individual. However, a best estimate approach that considers the most realistic response of the entire facility over a range of off-normal conditions (including a limited set of events outside of the design basis) is used for emergency planning purposes. It is not clear whether this fusion “no public evacuation” requirement will be more or less restrictive than the regulatory limit because of the differences in the methods used in estimating doses to the maximally exposed individual. The “no public evacuation” requirement was strongly endorsed by the U.S. Fusion Utility Advisory Group (see unnumbered UCLA report, “A Synopsis of Major Issues Discussed at the Third Meeting of the Utility Advisory Committee, Fusion Power Plant Studies Program, UCLA, February 10, 1994” and unnumbered UCSD report, “Report of the Sixth Joint Meeting of the Fusion Power Plant Studies Utility Advisory Committee and EPRI Fusion Working Group, UC San Diego, February 16–17, 1995” for discussions of this topic4). Members of this group come from the utilities industry and various groups of fusion developers. It is also endorsed by the U.S. ITER Steering Committee. It represents a positive step in making fusion facilities more acceptable to the public. 5. Radioactive Waste Requirements. A long-term fusion goal that will help show the safety and environmental potential of fusion is the control of waste production in such a manner that fusion facility radioactive waste can be recycled or disposed of as low level waste. This area is one with strong interest from the public and from potential developers. It is a long-term goal because its achievement will depend on expected developments in materials and design techniques. Further, this is an area in which quantitative requirements are difficult to specify in view of the general developmental

4Contact Prof. Farrokh Najmabadi, University of California, San Diego, for these documents or for further information on these meetings. DOE-STD-6002-96 19 nature of fusion and the variety of facilities anticipated. Thus, reduction of the amount and activity of radioactive waste generated is to be considered and documented in the design, selection of materials, and conduct of operations of a fusion facility. 6. Public and Worker Safety Functions. Because the safety policy in Chapter 2 of DOE- STD-6002-96 deals with protection of the public and protection of the workers, two broad categories of safety functions have been identified: public safety functions and worker safety functions. Public safety functions are the essential characteristics needed to ensure safety and protection of the public and the environment in opera- tional states and during and following anticipated operational occurrences and off- normal conditions (i.e., functions needed to ensure that evaluation guidelines are not exceeded). Worker safety functions are the essential characteristics needed to ensure the safety and protection of the workers. Potential hazards at fusion facilities were identified, and corresponding functions required to control these hazards were developed. (See Appendix B of DOE-STD-6003-96 for detailed discussion of hazards.) The resultant functions were evaluated to determine if they were more likely to be involved with public safety or worker safety. Because of the large impact facility design has on these hazards and the develop- mental nature of fusion, only two of the these functions could be identified at this time as applying to each fusion facility: Confine Radioactive and Hazardous Material, a public safety function, and Control of Operating Hazards, a worker safety function. The remaining functions have been identified as “potential safety concerns” if their failure could threaten the public safety function. The potential safety concerns related to the public safety function of confining radioactive and hazardous materials follow: • ensure afterheat removal when required; • provide rapid controlled plasma shutdown when required; • control coolant internal energy (e.g., pressurized water, cryogens); • control chemical energy sources (e.g., chemical reactions between plasma facing components and air or water, chemical reactions between liquid metals and air or water); • control magnetic energy (e.g., toroidal and poloidal field stored energy); and • limit airborne and liquid discharges from the facility. Those functions that are involved with worker safety issues were recognized as being an elaboration of the general worker safety function, “Control Operating Hazards.” They include these three concerns: DOE-STD-6002-96 20 • limit routine exposure to radiation and hazardous materials, • limit exposure to electromagnetic fields, and • control other industrial hazards. These potential safety concerns are derived from fusion facility hazards (e.g., inven- tories and energy sources); however, their impact on the public and worker safety functions is extremely design specific. Careful attention to design can ameliorate the potential safety concern without the need for add-on safety systems. Thus, the requirements document provides safety design principles for these potential safety concerns to assure that the public and worker safety function are met, thereby inte- grating safety into the design process.

7. Safety Policy. The Safety Policy statement included in the Requirements Standard, while generally extracted from similar statements elsewhere, contains some specific language that is intended to convey specific meanings. The Safety Policy statement specifically includes making public as well as worker risk subject to the ALARA prin- ciple. The Safety Policy statement refers to workers “at” a facility and states that the risk to workers at fusion facilities shall be no greater than those to which they would be exposed at other industrial facilities where similar hazards are encountered. The word “at” is intended to refer not only to normal operations but to off-normal condi- tions as well. Thus, while recognizing that the workers' risk under off-normal condi- tions at fusion facilities would be greater than for members of the public, the infer- ence is clear that accepted norms for risk from an accident should be maintained. 8. Use of Codes and Standards. Codes and standards applicable to magnetic fusion facilities may come from a variety of technologies, not just from the nuclear power industry. Some of these may include conventional power systems, vacuum and cryogenic technologies, magnetic systems, and the chemical industry. Furthermore, not all codes and standards in use in the fission industry are applicable or appropri- ate for fusion facilities. The intent of this Standard is that such codes and standards are tools to be used to achieve the required ends of safety in magnetic fusion facili- ties. For that reason, references to such codes and standards in DOE-STD-6002-96 are deliberately vague. That will allow the designers and operators of fusion facilities great flexibility in determining which ones will be most appropriate and in negotiating their use with regulators. Further, designers will have the responsibility of ensuring that codes and standards used in the design are appropriate for that design. 9. Use of Fission Reactor Terminology and Concepts. The Requirements Standard (DOE-STD-6002-96) has not employed some of the conventional fission terminology, lexicon and concepts (e.g., loss-of-coolant accident). Two specific concepts deserve mention here: (1) safety-class and safety-significant structures, systems, and com- ponents (SSCs) and (2) the single failure criterion. The Requirements Standard does not invoke the use of the concept of safety-class and safety-significant in classifying SSCs. Instead, it requires that items important to safety be identified, leaving the DOE-STD-6002-96 21 designer the flexibility to develop a safety classification scheme using a graded approach that best fits the fusion facility and avoids the pitfalls and burdens associ- ated with this fission concept. The Requirements Standard does not invoke the single failure criterion as a requirement. Instead, broader requirements in terms of redundancy, diversity, and independence are employed to give the designer flexibility in achieving overall reliability/unavailability goals for items that implement safety. However, in the Guidance Standard (DOE-STD-6003-96), both concepts are used because of their prevalence in the existing DOE Order structure and because the goal of the document is to indicate a recommended way to implement the require- ments set forth in the Requirements Standard for a fusion facility within the DOE regulatory system. Thus, these concepts can be used to achieve safety but are not specified as requirements in DOE-STD-6002-96. DOE-STD-6002-96 CONCLUDING MATERIAL Review Activity: Preparing Activity: DOE Field Offices DOE-ER-54 DP AL EH CH Project Number: EM ID SAFT-0028 ER NV FM OR LM RFO NE RL NS SR SR SF SA Fernald National Laboratories ANL BNL INEL LANL LLNL PNL Sandia Area Offices Amarillo Argonne Brookhaven Dayton Golden Kirtland Los Alamos Rocky Flats Pinellas Princeton ** Including all DOE Technical Standards Managers TABLE OF CONTENTS