DOE-STD-6003-96, Safety of Magnetic Fusion Facilities: Guidance

TS NOT MEASUREMENT SENSITIVE DOE-STD-6003-96 May 1996 DOE STANDARD SAFETY OF MAGNETIC FUSION FACILITIES: GUIDANCE U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. Welcome This Portable Document Format (PDF) file contains bookmarks, thumbnails, and hyperlinks to help you navigate through the document. The modules listed in the Overview are linked to the corresponding pages. Text headings in each module are linked to and from the table of contents for that module. Click on the DOE seal below to move to the Overview. This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (423) 576-8401. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 487-4650. Order No. DE96009494 DOE-STD-6003-96 TABLE OF CONTENTS Page FOREWORD......................................................................................................................... ix DEFINITIONS ....................................................................................................................... xi LIST OF ACRONYMS ......................................................................................................... xix 1. INTRODUCTION ............................................................................................................. 1 1.1 Purpose.................................................................................................................... 1 1.2 Background .............................................................................................................. 1 1.3 Implementation......................................................................................................... 2 1.4 Overview .................................................................................................................. 2 2. RADIATION AND HAZARDOUS MATERIAL .................................................................. 5 2.1 Dose Definitions....................................................................................................... 5 2.2 Public Exposures and Environmental Impacts......................................................... 6 2.2.1 Evaluation Guidelines for Exposures to the Public....................................... 7 2.2.2 Additional Guidance ..................................................................................... 8 2.2.3 Environment ................................................................................................. 8 2.3 Routine Worker Exposure ........................................................................................ 9 2.3.1 Radiation ...................................................................................................... 9 2.3.2 Hazardous Materials .................................................................................... 9 2.3.3 Common Industrial Hazards......................................................................... 10 2.3.4 Magnetic Fields ............................................................................................ 10

2.4 Guidance for Meeting Regulatory Limits.................................................................. 11 2.4.1 Evaluation Guidelines................................................................................... 11 2.4.2 Exposure ...................................................................................................... 12 2.4.3 Meteorological Dispersion............................................................................ 12 2.5 Consequence Thresholds for PAGs and Emergency Response Planning Guidelines ................................................................................................. 12 2.5.1 Radiological (No Ingestion) .......................................................................... 13 2.5.2 Radiological (Ingestion)................................................................................ 13 2.6 Models Used in Relating Exposures to Estimated Consequences .......................... 13 3. ENVIRONMENTAL AND PERMITTING REQUIREMENTS ............................................ 15 3.1 Federal Requirements.............................................................................................. 15 3.1.1 National Environmental Policy Act and Implementing Guidelines, Regulations, and Orders ........................................................... 15 3.1.2 Federal Statutes and DOE Orders Relating to Environmental Quality......... 16 3.2 Federal and State Consultation, Permits, and Approvals......................................... 21 3.2.1 Federal Permits and Approvals.................................................................... 21 3.2.2 State and Local Permits and Approvals ....................................................... 23 3.3 Environmental Compliance Procedures and Scheduling......................................... 24 3.3.1 Environmental Documentation Guidelines ................................................... 24 3.3.2 Environmental Compliance Scheduling........................................................ 26 iii DOE-STD-6003-96 4. PROGRAM MANAGEMENT FOR SAFETY .................................................................... 29 4.1 Design and Construction Management.................................................................... 29 4.2 Operations Management.......................................................................................... 30 4.3 Site Restoration Management ................................................................................. 30 4.4 Tools for Program Management Safety ................................................................... 30 4.4.1 Configuration Management .......................................................................... 30 4.4.2 Quality Assurance ........................................................................................ 32 4.4.3 Verification and Validation............................................................................ 33 4.4.4 Conduct of Operations ................................................................................. 34 4.4.5 Emergency Preparedness............................................................................ 35 4.4.6 Maintenance................................................................................................. 37 4.4.7 Training and Qualifications........................................................................... 39 4.4.8 Tritium Control, Accountability, and Physical Protection.............................. 41

5. SAFETY ANALYSIS ........................................................................................................ 49 5.1 Facility Description................................................................................................... 51 5.1.1 General......................................................................................................... 51 5.1.2 Safety Structures, Systems, and Components ............................................ 52 5.2 Facility Mission/Processes ....................................................................................... 56 5.3 Hazards Analysis ..................................................................................................... 56 5.3.1 Inventory....................................................................................................... 56 5.3.2 Classification ................................................................................................ 57 5.4 Analysis of Off-Normal Conditions ........................................................................... 58 5.4.1 Event Scenario Identification and Classification .......................................... 59 5.4.2 Analysis Approach for the Safety Analysis Report ....................................... 62 5.4.3 Emergency Planning Basis Analysis............................................................ 63 5.5 Safety Analysis Report Process............................................................................... 64 5.5.1 Risk Assessment.......................................................................................... 65 5.5.2 Safety Analysis Report................................................................................. 66 5.6 Safety Envelope Configuration Control.................................................................... 68 5.7 Technical Safety Requirements ............................................................................... 69 5.7.1 Implementation of Technical Safety Requirements...................................... 70 5.7.2 Risk-Based Prioritization in Technical Safety Requirements ....................... 70 5.8 Startup and Restart of Fusion Facilities ................................................................... 71 5.8.1 Implementation of Startup and Restart Reviews.......................................... 71 5.8.2 Risk-Based Prioritization Implications for Startup and Restart Reviews ...... 72 5.9 Authorization Basis .................................................................................................. 72 6. FACILITY DESIGN GUIDANCE ...................................................................................... 73 6.1 Introduction and General Guidance ......................................................................... 73 6.1.1 Design Basis ................................................................................................ 73 6.1.2 Safety Functions and Structures, Systems, and Components ..................... 74 6.1.3 General Design Guidance............................................................................ 76 6.2 Systems Performing Safety Functions..................................................................... 86 6.2.1 Public Safety Function: Confinement Systems ............................................ 86 6.2.2 Worker Safety Function: Systems Controlling Operating Hazards............... 99 iv DOE-STD-6003-96

6.3 Systems Involved with Potential Safety Concerns................................................... 106 6.3.1 Afterheat Removal Systems......................................................................... 107 6.3.2 Rapid Plasma Shutdown System................................................................. 108 6.3.3 Control of Potential Energy Sources ............................................................ 108 6.3.4 Limiting Airborne and Liquid Releases to the Environment ......................... 115 6.4 Systems That Support Safety Functions.................................................................. 116 6.4.1 Instrument and Control Systems.................................................................. 116 6.4.2 Electrical Power Systems............................................................................. 119 6.4.3 Cooling Systems .......................................................................................... 122 6.4.4 Remote-Handling Systems........................................................................... 125 6.5 Impact of Facility Support and Experimental Systems on Safety Functions............ 134 6.5.1 Group 1 Systems.......................................................................................... 135 6.5.2 Group 2 Systems.......................................................................................... 136 7. SITE RESTORATION ...................................................................................................... 139 7.1 General .................................................................................................................... 139 7.2 Decommissioning, Decontamination, and Site Restoration in the Initial Design...... 139 7.3 Site Restoration........................................................................................................ 139 7.4 Waste Sent to Low-Level Waste Repository............................................................ 140 7.4.1 Requirements for Land Disposal of Radioactive Waste............................... 140 7.4.2 Methodology of 10 CFR 61 Extended to Fusion-Specific Isotopes.............. 143 7.4.3 Chemically Hazardous Materials Sent to a Hazardous Waste Site.............. 146 7.4.4 Mixed Waste Requirements ......................................................................... 147 7.5 Requirements on Low-Level Waste Repository ....................................................... 147 APPENDIX A CATEGORY 2 THRESHOLD QUANTITIES OF RADIONUCLIDES .......... 149 APPENDIX B IDENTIFICATION OF POTENTIAL HAZARDS, ENERGY SOURCES, AND GENERIC ACCIDENTS FOR FUSION FACILITIES.......................... 165 B.1 Introduction.......................................................................................... 165 B.2 Hazards ............................................................................................... 165 B.2.1 Radiological Hazards............................................................... 165 B.2.2 Chemical Hazards ................................................................... 166 B.2.3 Industrial Hazards.................................................................... 166 B.3 Energy Sources................................................................................... 167 B.3.1 Plasma Energy ........................................................................ 167 B.3.2 Magnetic Energy...................................................................... 167 B.3.3 Decay Heat.............................................................................. 167 B.3.4 Chemical Energy ..................................................................... 168 B.3.5 Coolant Internal Energy........................................................... 168

B.4 Potential Generic Accident Scenarios ................................................. 168 B.4.1 Loss-of-Coolant Event ............................................................. 169 B.4.2 Loss-of-Flow Event.................................................................. 169 B.4.3 Loss-of-Vacuum Event ............................................................ 170 B.4.4 Plasma Transients................................................................... 170 B.4.5 Magnet Transients................................................................... 170 v DOE-STD-6003-96 B.4.6 Loss of Cryogen....................................................................... 171 B.4.7 Tritium Plant Events................................................................. 171 B.4.8 Auxiliary System Accidents...................................................... 171 APPENDIX C REFERENCES AND SUPPLEMENTAL GUIDANCE ................................. 173 vi DOE-STD-6003-96 LIST OF FIGURES FIGURE Page 3.1 Phased schedule for environmental compliance activities ............................... 27 5.1 Flow logic of the safety analysis process ......................................................... 50 5.2 Event scenario/safety analysis process ........................................................... 60 LIST OF TABLES TABLE Page 2.1 Evaluation guidelines for public protection from radiation ................................ 7 5.1 Safety system functional requirements ............................................................ 55 6.1 Suggested design codes for equipment ............................................................ 80 6.2 Group 1 systems .............................................................................................. 135 6.3 Group 2 systems .............................................................................................. 135 7.1 Surface contamination guidelines ..................................................................... 140 7.2 Classification boundaries as given in 10 CFR 61 ............................................. 142 7.3 Classification based on long-lived radionuclides .............................................. 143 7.4 Specific activity limits for shallow load burial of all radionuclides with Z < 88 and half-lives >5 yr and <1012 yr ................................................... 144 A.1 Thresholds for radionuclides Category 2 .......................................................... 151 vii DOE-STD-6003-96 viii Intentionally Left Blank DOE-STD-6003-96 FOREWORD 1. This DOE Standard is approved for use by all DOE Components and contractors. It was developed by subject matter experts in the Fusion Safety Working Group under the general direction of the Office of Fusion Energy Sciences. It has been reviewed by the Fusion Safety Steering Committee with representation from DOE laboratories, contractors, and universities involved with magnetic fusion research as well as the end user of fusion power, the electric utility industry. 2. This Standard provides guidance to successfully achieve public and worker safety at mag- netic fusion facilities. It is intended for use by managers, designers, operators, and other personnel with safety responsibilities for such facilities. This Standard is concerned mainly with large fusion facilities such as the International Thermonuclear Experimental Reactor. Using a risk-based prioritization, the concepts presented here may also be applied to other magnetic fusion facilities.

3. Beneficial comments (recommendations, additions, deletions) and any pertinent data that may be of use in improving this document should be addressed to: Environment, Safety, and Health Program Manager Office of Fusion Energy Sciences, ER-54 Office of Energy Research U.S. Department of Energy 19901 Germantown Road Germantown, Maryland 20874-1290 by using U.S. Department of Energy Standardization Document Improvement Proposal Form (DOE F 1300.3) appearing at the end of this document or by letter. ix DOE-STD-6003-96 x Intentionally Left Blank DOE-STD-6003-96 DEFINITIONS Active—An adjective used to describe a feature or function of a component whose operation depends on an external input such as an actuation, mechanical movement, or supply of power. Administrative Controls—Provisions relating to organization and management, procedures, recordkeeping, assessment, and reporting necessary to ensure the safe operation of a fusion facility. ALARA—As low as is reasonably achievable. Anticipated Operational Occurrences—Operational processes deviating from normal opera- tion that are expected to occur once or more during the operating life of the fusion facility. Authorization Basis—Those aspects of the facility design basis and operational requirements relied upon by the regulating authority to authorize operation. These aspects are considered to be important to the safety of facility operations. Blanket—The region surrounding the D-T plasma that absorbs the fusion neutrons, transform- ing their energy into heat and breeding tritium to sustain the D-T fuel cycle. Beyond-Design-Basis Event—An event of the same type as a design-basis event (e.g., fire, earthquake, spill, explosion, etc.), but defined by parameters that exceed in severity the param- eters defined for the design basis event. Certification—Process by which management provides written endorsement of the satisfactory achievement of qualification of an individual for a specialized operations position based upon its criticality or safety impact and generally in response to a DOE Order or national consensus code or standard. Common Cause Failure—The failure of multiple devices or components to perform their func- tions as a result of a single specific event or cause. Comparable Industrial Facility—A facility in the industrial sector where workers are exposed to hazards of a similar nature to those encountered in a fusion facility; for example, heavy lifting, vacuum, cryogenics, high electrical potentials and/or currents, and radioactivity. Confinement—A barrier that surrounds radioactive or hazardous materials designed to prevent or mitigate the uncontrolled release of these materials to the environment. Credible Events—Postulated events having estimated probabilities of occurrence >10–6 per facility year. For natural phenomena, separate probability criteria based on site-specific informa- tion and facility characteristics should be used. Cryostat—A chamber, normally metallic, which surrounds the superconducting magnets of a fusion facility to provide vacuum insulation from external heat loads. xi DOE-STD-6003-96 Decommissioning—The process of closing and securing a fusion facility so as to provide adequate protection from radiation exposure and to isolate radioactive contamination from the human environment. Decontamination—The act of removing a chemical, biological, or radiological contaminant from, or neutralizing its potential effect on, a person, object, or environment by washing, chemi- cal action, mechanical cleaning, or other techniques.

Design Basis—The set of requirements that bound the design of systems, structures, and components within the facility. Design Basis Events—Credible events considered in the facility safety analysis and in the design of systems, structures, and components within the facility. Disruption—A rapid loss of the plasma-stored thermal energy to the plasma-facing compo- nents, introducing large thermal loads. Associated with this is a rapid decay of the plasma current that can introduce large mechanical loads to structural components. Disruptions can also generate high energy runaway electrons which impact the first wall. Diversity—The existence of multiple components or systems to perform an identified function, where such components or systems incorporate one or more attributes that are different from each other. Divertor—The component inside the vacuum vessel that diverts the plasma particles in the outer shell of the plasma into a region where they strike a barrier, become neutralized, and are pumped away. Effluent—Material that is released into the environment. Evaluation Guidelines—Dose/exposure values for radiation or hazardous materials that a safety analysis evaluates against. Experimental Equipment—Equipment or components installed in or around the facility for the purpose of research and development, not including regular functioning parts of the fusion facility itself (i.e., even when such regular functioning parts may be less than fully developed). First Wall—Systems and components inside the vacuum vessel directly exposed to the plasma ion and neutron fluxes; the first physical boundary that surrounds a plasma. Fusion Facility—Any facility that utilizes or supports a magnetically confined plasma in which fusion reactions take place. It includes the associated facility plant and equipment and any experimental apparatus used at the facility. Fusion Island—That part of the fusion facility on or inside the cryostat. Typically it includes the cryostat, the magnetic coils, the vacuum vessel and attached pumps, the breeding blanket, heating and fueling systems inside the cryostat, the divertor, and plasma diagnostics. xii DOE-STD-6003-96 Hazard—A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to personnel or damage to an operation or to the environment (without regard for the likelihood or credibility of off-normal conditions or consequence mitigation). Hazard Analysis—The determination of material, system, process, and plant characteristics that can produce undesirable consequences, followed by the assessment of hazardous situa- tions associated with a process or activity. Hazard Classification—Evaluation of the consequences of unmitigated releases to classify facilities or operations into the following hazard categories: – Hazard Category 1: The hazard analysis shows the potential for significant off-site consequences. – Hazard Category 2: The hazard analysis shows the potential for significant on-site consequences. – Hazard Category 3: The hazard analysis shows the potential for only significant localized consequences. Hazardous Material—Any solid, liquid, or gaseous material that is toxic, explosive, flammable, corrosive, or otherwise physically or biologically threatening to health. Inherent—An adjective to describe a design feature or function that operates without the appli- cation of a separate input such as an activation signal. An example of an inherent design feature is a fail-safe valve that closes automatically on loss of power.

ITER—International Thermonuclear Experimental Reactor. Maintenance—The organized activity, both administrative and technical, directed toward keep- ing structures, systems, and components in good operating condition, including both preventive and corrective aspects. Maintenance Personnel—Persons responsible for performing maintenance and repair of mechanical and electrical equipment. Managers—Persons whose assigned responsibilities include ensuring that a fusion facility is safely and reliably operated and that supporting operating and administrative activities are properly controlled. May—Permission; neither a requirement nor a recommendation. Mitigative Feature—Any structure, system, or component that serves to mitigate the conse- quences of a release of hazardous materials in an off-normal event scenario. xiii DOE-STD-6003-96 Monitoring—Continuous or periodic measurement and/or observation of parameters or deter- mination of the status of a system or component. Sampling may be involved as a preliminary step to measurement. Normal Conditions—Conditions associated with the routine operation of the facility. Normal Operations—Activities at a facility performed within specific normal operational limits and conditions, including startup, operation, shutdown, maintenance, and testing. Normal operations do not include anticipated operational occurrences. Off-Normal Conditions—Conditions beyond anticipated operational occurrences that include all credible events. Operations—Activities at a fusion facility performed within specific operational limits and condi- tions, including startup, operation, shutdown, maintenance, and testing. Operations and Facility Support Personnel—Those individuals who perform technical func- tions (such as engineering evaluations, program reviews, technical problem resolution, or data analyses, within their area of expertise) or safety, quality assurance, radiation protection, emer- gency services, and training functions. Operators—Persons responsible for manipulating fusion facility controls, monitoring facility parameters, and operating facility equipment. Certified Operators—Operators who require certification as determined by facility management. Qualified Operators—Operators who require qualification as determined by facility management. Passive—An adjective that describes a function that requires no operation or movement of component parts. Physical Separation—Isolation by geometry (distance, orientation, etc.), by appropriate barriers, or a combination thereof. Plasma—The fourth state of matter; basically an ionized gaseous system composed of an elec- trically equivalent number of electrons and positive ions. Plasma Beta—The ratio of plasma pressure (proportional to the product of density and temperature) to the confining magnetic field pressure (proportional to magnetic field strength squared). As the beta limit is approached, the plasma is more likely to experience a disruption. Potential Safety Concern—A feature and/or process determined to be capable of challenging a public safety function and to which a risk-informed decision-making process is applied during design. xiv DOE-STD-6003-96 Poloidal Field Coils—Coils providing the magnetic field that encircles the plasma axis in toroidal devices. Postulated Initiating Events (PIE)—Identified happenings or conditions that lead to anticipated operational occurrences, off-normal conditions, and their consequential failure effects.

Potential Safety Concern—A feature and/or process determined to be capable of challenging a public safety function and to which a risk-informed decision-making process is applied during design. Preventive Feature—Any structure, system, or component that serves to prevent the release of hazardous material in an off-normal event scenario. Public—All individuals outside the fusion facility site boundary. Public Safety Function—Essential characteristics or performance needed to ensure the safety and the protection of the public and the environment during operations, anticipated operational occurrences, and off-normal conditions. Qualification—Process by which factors, such as education, experience, and any special requirements (e.g., medical examination) are evaluated in addition to training to assure that an individual can competently perform a specialized job function to an anticipated level of proficiency. Qualified—The ability to perform a specific job function based upon completion of a training, qualification, or certification program developed for the job function. Trained personnel are qualified to perform their job function based upon completion of training. Qualified and certified personnel are qualified to perform their job function based upon completion of a specific program. As used in this document, the term “qualified” personnel has two meanings, based upon context: Qualified personnel are those personnel who have successfully completed either training, qualification, or certification requirements appropriate to their job function. Qualified personnel are those personnel who have successfully completed a formal qualifi- cation program appropriate to their job function. Quality Assurance—Those planned and systematic actions necessary to provide adequate confidence that an item or service will satisfy specified requirements for intended service. Redundancy—Provision of more than the minimum number of similar elements or systems, so that loss of any one does not result in the loss of the required function. Risk—The quantitative or qualitative expression of possible loss that considers both the prob- ability that an event will occur and the consequence of that event. xv DOE-STD-6003-96 Risk-Informed Prioritization Approach—A reasoned approach where the degree to which requirements or recommendations are applied and resources expended is commensurate with the risks involved and the facility programmatic importance. Minor hazards require implementa- tion at a lower level than higher risk hazards to workers, the public, and the environment. Runaway Electrons—Those electrons in a plasma that gain energy from an applied electric field faster than they lose energy from collisions; such high-energy electrons can damage plasma-facing components. Safety Analysis—A documented process: (1) to provide systematic identification of hazards within a given facility; (2) to describe and analyze the adequacy of the measures taken to elimi- nate, control, or mitigate identified hazards; and (3) to analyze and evaluate potential off-normal events and their associated risks. Safety Analysis Report (SAR)—A report that documents the adequacy of safety analysis to ensure that a fusion facility can be constructed, operated, maintained, shut down, and decom- missioned safely and in compliance with applicable laws and regulations.

Safety Basis—The combination of information relating to the control of hazards at a fusion facility (including design, engineering analyses, and administrative controls) upon which is based the conclusion that activities at the facility can be conducted safely. Safety-Class Structures, Systems, and Components (safety-class SSCs)—Systems, structures, or components whose failure could adversely affect the environment or safety and health of the public as identified by safety analyses. The phrase “adversely affect” means that Evaluation Guidelines are exceeded. Safety-class SSCs are systems, structures, or components whose preventive or mitigative function is necessary to keep radioactive and hazardous material exposure to the public below the off-site Evaluation Guidelines. Safety Limits—Limits on process variables associated with those physical barriers, generally passive, that are necessary for the intended facility functions and that are found to be required to guard against the uncontrolled release of radioactivity and other hazardous materials. Safety-Significant Structures, Systems, and Components (safety-significant SSCs)— Structures, systems, and components not designated as safety-class SSCs but whose preven- tive or mitigative function is a major contributor to defense-in-depth (i.e., prevention of uncon- trolled releases to the public) and/or worker safety as determined from hazard analysis. Gener- ally, safety-significant SSC designations based on worker safety are limited to those SSCs whose failure could result in an acute worker fatality or serious injury to workers. Safety Structures, Systems, and Components (safety SSCs)—The set of safety-class structures, systems, and components, and safety-significant structures, systems, and compo- nents for a given fusion facility. Shall—A firm requirement that must be met to be in compliance with this Standard. xvi DOE-STD-6003-96 Shall Consider—The need for and applicability of stated features or attributes must be evalu- ated and the results of the evaluation documented. Should—A desirable option or recommendation, departure from which is permissible. Site boundary—A well-marked boundary of the property over which the owner and operator can exercise strict control without the aid of outside authorities. Standard Industrial Hazards—Hazards that are routinely encountered in general industry and construction and for which national consensus codes and/or standards (e.g., OSHA, transporta- tion safety) exist to guide safe design and operation without the need for special analysis to define safe design and/or operational parameters. Supervisors—Persons who are responsible for the quantity and quality of work and who direct the actions of the operators or other personnel. Technicians—Persons responsible for performing specific maintenance or analytical laboratory work. Technical Safety Requirement—Those requirements that define the bounding conditions for safe operation, the bases thereof, and the management or administrative controls required to ensure the safe operation of a facility. Tokamak—The mainline magnetic fusion confinement configuration that employs discrete toroidal coils surrounding a torus-shaped vacuum vessel with poloidal field coils either captured by or external to the toroidal field coils. A large current induced in the plasma provides part of the magnetic field required for plasma confinement.

Toroidal Field Coils—The coils surrounding the vacuum vessel that provide the major confin- ing magnetic field for the plasma. Unreviewed Safety Question—A formalized uncertainty brought about by a proposed change, test, or experiment or the identification of analytic inadequacy when (a) the probability of occur- rence or the consequences of an accident or malfunction of equipment important to safety pre- viously evaluated by safety analyses could be increased; (b) the possibility for an accident or malfunction of a different type than any evaluated previously by safety analyses could be created; or (c) any margin of safety, as defined in the basis for any Technical Safety Require- ment, could be reduced. Vertical Displacement Event—A sudden loss of plasma position control. For highly shaped tokamak plasmas, active vertical position control is required to maintain the vertical position. Loss of the position control is known as a Vertical Displacement Event (VDE). If the main plasma contacts the plasma-facing components, the currents in the plasma can rapidly dis- appear, leading to a disruption. xvii DOE-STD-6003-96 Workers—Persons performing work at the facility or on the site of the facility. Worker Safety Function—Essential characteristics or performance needed to assure the pro- tection of workers during normal operations, anticipated operational occurrences, and off-normal conditions. xviii DOE-STD-6003-96 LIST OF ACRONYMS AC Administrative Control ac alternating current ACGIH American Conference of Governmental Industrial Hygienists AEA Atomic Energy Act AIRFA American Indian Religious Freedom Act ALARA as low as reasonably achievable ANSI American National Standards Institute ASME American Society of Mechanical Engineers BDBA beyond-design-basis accident CAA Clean Air Act CAP-88 Clean Air Act Assessment Package-1988 CCTV closed-circuit television CED committed effective dose CEQ Council on Environmental Quality CERCLA Comprehensive Environmental Response, Compensation, and Liability Act D-D deuterium-deuterium D-T deuterium-tritium DBA design-basis accident dc direct current DOE Department of Energy DOT Department of Transportation EA Environmental Assessment EAL Emergency Action Level ED effective dose EG Evaluation Guideline EIS Environmental Impact Statement EIS/ROD environmental impact statement/record of decision EMM electromechanical manipulator EMS Emergency Management System EOC Emergency Operations Center EPA Environmental Protection Agency FAA Federal Aviation Administration FWS Fish and Wildlife Service HEPA high-efficiency particulate air HVAC heating, ventilating, and air conditioning I&C instrumentation and control ICRP International Commission on Radiological Protection IEEE Institute of Electrical and Electronic Engineers IPCEA Insulated Power Cable Engineers Association ITER International Thermonuclear Experimental Reactor JET Joint European Torus LCE loss-of-coolant event LCOs Limiting Conditions for Operations LCS Limiting Control Setting xix DOE-STD-6003-96

LFE loss-of-flow event LLW low-level waste LVE loss-of-vacuum event MACCS MELCOR Accident Consequence Code System MAP Mitigation Action Plan MC&A Materials Control and Accountability MEI most exposed individual MG motor generator MSM master slave manipulator NAAQS National Ambient Air Quality Standards NCRP National Council on Radiation Protection and Measurements NDE nondestructive examination NEPA National Environmental Policy Act NESHAPS National Emission Standards for Hazardous Air Pollutants NFPA National Fire Protection Association NIOSH National Institute of Occupational Safety and Health NPDES National Pollutant Discharge Elimination System NRC Nuclear Regulatory Commission NSPS New Source Performance Standards OSHA Occupational Safety and Health Act PAG Protective Action Guideline PF poloidal field PFC plasma-facing component PIE postulated initiating event PRA probabilistic risk assessment PSD Prevention of Significant Deterioration PTC permit to construct PVTC pressure/volume/temperature/composition QA quality assurance QAP Quality Assurance Plan QC quality control RCRA Resource Conservation and Recovery Act RF radio frequency SA specific activity SAR safety analysis report SARA Superfund Amendments and Reauthorization Act SHIPO State Historic Preservation Office SIP State Implementation Plan SL safety limit SR Surveillance Requirement SSCs structures, systems, and components TF toroidal field TFTR Tokamak Fusion Test Reactor TSCA Toxic Substances Control Act TSD treatment, storage, and disposal TSR Technical Safety Requirement xx DOE-STD-6003-96 UHMWPE Ultra-high molecular weight polyethylene UPS uninterruptable power supply USQ Unreviewed Safety Question V&V verified and validated VDE vertical displacement event xxi DOE-STD-6003-96 xxii Intentionally Left Blank DOE-STD-6003-96 1. INTRODUCTION 1.1 Purpose This document provides guidance for the implementation of the requirements identified in DOE-STD-6002-96, Safety of Magnetic Fusion Facilities: Requirements. This guidance is intended for the managers, designers, operators, and other personnel with safety responsibili- ties for facilities designated as magnetic fusion facilities. While the requirements in DOE-STD- 6002-96 are generally applicable to a wide range of fusion facilities, this Standard, DOE-STD- 6003-96, is concerned mainly with the implementation of those requirements in large facilities such as the International Thermonuclear Experimental Reactor (ITER). Using a risk-based prioritization, the concepts presented here may also be applied to other magnetic fusion facilities. This Standard is oriented toward regulation in the Department of Energy (DOE) environment as opposed to regulation by other regulatory agencies. As the need for guidance involving other types of fusion facilities or other regulatory environments emerges, additional guidance volumes should be prepared. The concepts, processes, and recommendations set forth here are for guidance only. They will contribute to safety at magnetic fusion facilities. 1.2 Background When the development of fusion facilities began changing from comparatively small-scale experiments in physics to large facilities with megawatt-power levels and significant activation concerns, a need to develop safety requirements and associated guidance for fusion became apparent. Fusion systems are sufficiently different from other nuclear facilities that the require- ments and regulations governing existing nuclear facilities are not fully appropriate for the regu- lation of magnetic fusion facilities.

Efforts were begun to develop a group of documents that would be appropriate for safety regulation in magnetic fusion facilities. The documents that resulted from that process consist of a requirements document, DOE-STD-6002-96, Safety of Magnetic Fusion Facilities: Require- ments, which attempts to assemble in one place those requirements needed for safety, and this guidance document, which sets forth information that will assist fusion developers in meeting those requirements. The intent in this guidance document is to provide a fairly complete, though not exhaus- tive, set of instructions that if followed will contribute to the achievement of safety. There has been a conscious effort to include either directly or by reference those items that are germane to safety so that the manager, designer, or operator will be able to clearly identify actions that should be taken to meet the requirements using risk-based prioritization. The guidance provided here represents the collective wisdom of a broad and diverse group with experience in nuclear facility safety as well as with fusion. The concepts presented are included not only because they have been applied successfully to other kinds of facilities, but because they were deemed to make sense for fusion. 1 DOE-STD-6003-96 A conscious attempt has been made to exclude from this document concepts and advice not directly related to safety. In this sense, this document is not intended to be exhaustive. Of the many sound design or management practices that make good sense for a project, the ones included here are those that are directly safety-related. The intent here has been to identify concerns, practices, or procedures that will contribute to safety. Often, these are only summarized, not detailed here. Where appropriate guidance is available from other sources such as DOE Orders or other Standards, those sources are refer- enced here. This Standard was written in the reference frame of the Orders, Standards, and other documents that were in force at the time of writing. It was recognized that the DOE directives system was under major revision and that some of the references included here may be out of date at the time this Standard is implemented. Therefore, the user is encouraged to use the most current version of documents referred to here or their replacements. 1.3 Implementation The requirements in DOE-STD-6002-96 and the guidance in this Standard should be implemented using a risk-based prioritization approach. The degree to which they are applied should be commensurate with the risk involved. Fusion facilities that involve only minor hazards will require implementation at a lower level than will facilities such as ITER where activation and tritium inventories will be concerns. 1.4 Overview The responsibility for safety at fusion facilities, as all other facilities, lies with those having charge of the program or project. Safety is a requirement during all phases of the facility life cycle. It must be incorporated into the design, implemented during operations, and integrated into facility removal and site restoration. Success in the latter two phases often hinges on the success with which safety foresight and planning have been included in the design. To assist managers, designers, operators, and removal staffs in achieving safety, there are a number of tools (i.e., considerations, practices, processes, or other vehicles) that if implemented will con- tribute substantially to the overall safety of the facility. Those deemed most appropriate for fusion facilities are described in subsequent sections of this Standard.

Chapter 2 of this volume provides guidance on radiation and hazardous materials management to ensure that safety objectives are met. A primary consideration in any nuclear facility, including fusion facilities, is the management of radioactivity and hazardous materials. Protection from radiation and hazardous materials at all times is a primary concern for worker safety. The design and operating protocols of the facility should incorporate features that will limit exposures to radioactivity or hazardous materials in off-normal events as well as under normal operating conditions. Guidance on how to provide that protection is presented in Chapter 2. 2 DOE-STD-6003-96 Environmental considerations are summarized in Chapter 3. References to requirements in the environmental area are listed here with annotations because such a listing is not readily available from other sources. Program management considerations to achieve safety are addressed in Chapter 4. As indicated previously, the ultimate responsibility for safety lies with management. Integration of safety in the design, operation, and site restoration all involve the implementation of safety- related processes and a safety culture. In Chapter 4 the most significant of the tools available for achievement of safety are discussed: configuration management, quality assurance, conduct of operations, emergency planning, and tritium accountability. A major area of involvement for safety professionals with management is in the prepara- tion of safety analysis to evaluate the extent to which a given facility or design meets safety goals. Chapter 5 of this Standard includes guidance on how to establish the facility hazard classification; identify safety-related structures, systems, and components; develop technical safety requirements; and deal with unresolved safety questions. A key concept in safety analy- sis is the design basis and the associated requirements for approving facility operation. The analysis process described in Chapter 5 makes use of that concept and indicates how various off-normal event scenarios should be dealt with in the analysis. Chapter 6 is the most comprehensive of the chapters. It addresses design requirements and considerations for safety in design of fusion facilities. It begins with general design guidance that applies to all systems; then systems performing safety functions are described with design considerations to achieve those functions. Guidance is also provided for systems with potential safety concerns. These systems are not required to operate to achieve safety, but their failure may influence the levels of defense-in-depth available to the facility. Safety design guidance for supporting systems (those systems that support those systems providing safety functions) is also presented. The chapter concludes with guidance on safety in experimental systems and facility support. The final chapter in this Standard, Chapter 7, is concerned with facility removal and site restoration. It provides guidance for returning the site of the fusion facility to its original condition at the end of its useful life. Safety in this phase of the life cycle will be strongly influenced by planning and design features that have been incorporated from the outset of the project.

Appendices in this Standard provide additional supporting information. Appendix A is a list of isotopes for radiological considerations specific to fusion facilities. Appendix B is an overview of hazards typically associated with magnetic fusion facilities. Appendix C supplements this vol- ume with a listing of available orders, standards, and other documents appropriate to manage- ment of projects within DOE and lists specific references cited in the text. 3 DOE-STD-6003-96 Intentionally Left Blank 4 DOE-STD-6003-96 2. RADIATION AND HAZARDOUS MATERIAL The neutron flux in a fusion facility will result in activation of the first wall and structure, resulting in the production of radioactive materials. The level of activation is a function of power level, fuel cycle [deuterium-deuterium (D-D) vs deuterium-tritium (D-T)], and materials choice. Fusion experiments and power plants presently envisioned will also use strong magnetic fields, radio-frequency heating, and some potentially hazardous materials such as beryllium and vanadium. This section summarizes general guidance regarding radiological, magnetic field, and hazardous material concerns expected to be present at fusion facilities. Chemically hazardous materials are sometimes specified in the design of a fusion power core because of their mechanical or nuclear properties. The most prominent of these materials are beryllium, used as a first wall coating and as a neutron multiplier, and vanadium, used as a first wall and blanket structure material. 2.1 Dose Definitions The effective dose E has associated with it the same probability of the occurrence of cancer and genetic effects whether received by the whole body via uniform irradiation or by partial or individual organ irradiation. Although an assumption of uniformity may be a sufficient approximation in many external irradiation cases, in others more precise evaluation of individual tissue doses will be necessary. With external irradiation, differences may arise with depth in the body and with orientation of the body in the generally nonuniform radiation field. When irradia- tion is from radionuclides deposited in various tissues and organs, nonuniform or partial body exposures usually occur. Tissues also vary in their sensitivity to radiation. The effective dose E is a concept similar to the effective dose equivalent HE used by ICRP Publication 26 (ICRP 1977) and NCRP Report No. 91 (NCRP 1987). However, they are conceptually different. The effective dose E is intended to provide a means for handling nonuniform irradiation situations, as did the earlier dose equivalent. The effective dose E is the sum of the weighted equivalent doses for all irradiated tissues or organs. The tissue weighting factor wT takes into account the relative detriment to each organ and tissue including the different mortality and morbidity risks from cancer, the risk of severe hereditary effects for all generations, and the length of life lost due to these effects. The risks for all stochastic effects will be the same whether the whole body is irradiated uniformly or nonuniformly if E = wTHT T ∑ , (1) where wT is the tissue weighting factor representing the proportionate detriment (stochastic) tissue T when the whole body is irradiated uniformly, and HT is the equivalent dose received by tissue T. For further explanation see NCRP Report No. 116 (NCRP 1993). Doses mean the 50-yr committed effective dose (CED) unless otherwise stated. The exposure times and exposure pathways to be included in the calculation of CED should be

5 DOE-STD-6003-96 appropriate for the fusion isotopes involved, the accident scenario, and the public mitigative actions (if any) being considered. Acute dose is defined for specific organs depending on what short-term exposure is the best predictor of acute health effects. For example, the acute lung dose is typically the 1-yr CED, and the bone marrow acute dose is typically considered as the 7-day CED or 100% of the 7-day CED plus 50% of the 8–30th day CED. Thus, for the same exposure time periods, the acute dose is always less than (or equal to for very short half-lives) the 50-yr CED. Early dose is the 50-yr CED from the first 7 days of exposure following the onset of an accident, specifically the inhalation and cloudshine doses during plume passage, inhalation from resuspended/re-emitted isotopes during the first 7 days, and the groundshine dose from the first 7 days. This dose measure is appropriate when contemplating the need for short-term public mitigative actions. The early dose is generally calculated for the most exposed individual (MEI) of the public, assumed to reside at the site boundary or (for release elevated above ground level) where the plume reaches the ground. Two-hour (prompt) dose is the 50-yr CED resulting from the first 2 hours of exposure fol- lowing the onset of an accident, as in DOE 6430.1A. This dose measure implicitly assumes evacuation within 2 hours. Chronic dose is the 50-yr CED from 50-yr exposure after an event, specifically from inhalation of resuspended or re-emitted isotopes, groundshine, and ingestion of radionuclides. This dose measure is appropriate when contemplating whether long-term public mitigative actions are needed and, if so, when and for how long. When calculated for an individual, the chronic dose should include reasonable assumptions about the fraction of time an individual resides at the site boundary and the fraction of food produced at that location. Because of the long time scales, the chronic dose is more appropriately calculated for the “average” resident of the surrounding area. The factor χ is the instantaneous concentration of a radioactive or hazardous material (in becquerels per cubic meter or grams per cubic meter) at a given location distant from the point where the material is released into the environment. The factor Q is the amount of material released, expressed in grams or becquerels; ′ Q is the rate of material release emission from a continuous point source. The ratios χ/Q and χ ′ Q are determined by the atmospheric condi- tions, the distance between the source and distant location atmospheric transport, and the time since release. For further explanation, see Slade (AEC 1968). 2.2 Public Exposures and Environmental Impacts A significant part of 10 CFR 20 is directed toward protecting the public, the environment, and workers from the risks of exposure to radiation. Part of 40 CFR 61 is also concerned with protecting the public from chronic exposure to radiation. In addition, exposures to workers, the public, and the environment must be kept “as low as reasonably achievable” (ALARA). “Reasonably achievable” levels are typically a fraction of those allowed by 10 CFR 20 and 40 CFR 61. 6 DOE-STD-6003-96

For comparison with the evaluation guidelines, only plume passage dose is evaluated. Plume passage dose includes the following pathways: (1) direct cloudshine and (2) 50-yr CED from inhalation for the duration of plume passage. These pathways are considered an immedi- ate threat. Other slow-developing pathways are not included because they are a measure of the effectiveness of public health measures (e.g., interdiction) rather than the severity of the acci- dent itself. If dose is evaluated on public access roads that are not controllable by the licensee, the time of exposure to the plume should be based on realistic vehicle passage time estimates. 2.2.1 Evaluation Guidelines for Exposures to the Public The following goals and requirements have been established in DOE-STD-6002-96 for exposures to the general public during normal and anticipated operational occurrences and for off-normal conditions and accidents. The origin of each of the limits follows Table 2.1. Evaluation guidelines for public exposures to nonradiological materials should be in accordance with federal, state, and local regulatory and permit requirements. TABLE 2.1. Evaluation guidelines for public protection from radiation Fusion radiological release requirement Regulatory limit (evaluation guidelines) Normal and anticipated operational occurrences 100 µSv/yr [10 mrem/yr]a 1 mSv/yr [100 mrem/yr]b Off-normal conditions (per event) 10 mSv [1 rem]c (no public evacuation) 250 mSv [25 rem]d aThis value, which is a limit for the MEI, is consistent with the limit on the emissions of radionuclides to the ambient air for DOE facilities as stated in 40 CFR 61.92. In meeting this limit, a facility would be well below the exposure limit mandated by the Nuclear Regulatory Commission (NRC) safety goals for nuclear facilities (51 FR 30028) and the DOE safety goals. Both of these goals, which consider the average exposure to the population within 10 miles of a facility, state that the risk to the population resulting from nuclear operations should not exceed 0.1% of the sum of all cancer fatality risks resulting from all other causes. The radiological cancer risk coefficient is about 0.4%/0.1 Sv for long-term exposures (BEIR-V, p. 6), and the annual cancer fatality risk due to all causes is about 200/100,000 people. If we conservatively assume that the site-boundary to average exposure ratio is 2, then the routine exposure limit should be (0.1%) (200 per year/100,000 people) (0.1 Sv/0.4%) (2) = 0.1 mSv/yr = 10 mrem/yr. bThis value is based on the 10 CFR 20.1301 dose limits on individual members of the public. cThis requirement is based on the limit in the Protective Action Guideline (PAG) (EPA 1991) at which public sheltering and evacuation should be undertaken. dThis is the required limit for exposure due to an accident. This value is based on the design basis acceptance criteria for nuclear reactor siting in 10 CFR 100. 7 DOE-STD-6003-96 2.2.2 Additional Guidance 10 CFR 100 defines requirements for siting of nuclear reactor facilities. These guide- lines have also been applied to nonreactor nuclear facilities (DOE 6430.1A). According to 10 CFR 100.11, the maximum calculated dose to an off-site individual from exposure that results from internal and external sources of radiation must not exceed 250-mSv (25-rem), 50-yr CED to the whole body. If multiple organs receive doses during the same exposure, the ED shall not exceed 250 mSv (25 rem). The exposure duration should be consistent with the requirement for no public evacuation. DOE 6430.1A recommends using meteorological condi- tions that result in unfavorable dispersion (e.g., the higher of the 0.5% χ/Q for each sector of the site and the 5% direction independent χ/Q for the site). In the absence of site-specific meteor- ology, conservative assumptions (Class F, 1.0-m/s wind speed) should be used for design assessments. Further guidance is contained in Sections 2.4.3 and 5.4.3.

DOE Order 6430.1A notes that these values are guidelines and do not constitute accept- able limits on the doses to the public in the event of an accident. These guidelines are used by DOE to evaluate the facility design in combination with the site characterization with respect to the risk to the public from low-probability accidents. Accidents to be evaluated for comparison to these dose guidelines include events with a probability of occurrence >10–6/yr. When the doses are calculated, the degraded performance of engineered safety features and administrative controls should be assumed unless they can be shown to be capable of performing their safety function. The radionuclides of concern in a fusion facility cover a wide range of characteristics. Tritium is generally the most mobile. Tritium is hazardous if it is taken into the body via inges- tion, inhalation, or absorption through the skin. Because of the relatively low energy of the beta particle, 18-keV maximum energy, it does not present a significant hazard outside the body. Other radionuclides are the products of neutron activation. These radionuclides, usually imbed- ded in a metal, have much higher energies and undergo γ-decay. Typical radionuclides are Fe-55, Co-58, Co-60, Mn-54, Mn-56, Ni-59, and Ni-63. Alloying elements and impurities further increase the range of activation products. 2.2.3 Environment Radiation protection standards have been developed expressly for the protection of humans. It has been generally accepted that by protecting humans we are protecting the environment. Recently, the ICRP stated (ICRP 1991): The Commission believes that the standard of environmental control needed to protect man to the degree currently thought desirable will ensure that other species are not put at risk. Occasionally, individual members of non-human species might be harmed, but not to the extent of endangering whole species or creating imbalance between species. Additional guidance on other areas of environmental protection is provided in Chapter 3. 8 DOE-STD-6003-96 The Environmental Protection Agency (EPA) has set limits on the emissions of beryllium into the environment from industries that process beryllium ores, metal, oxide, alloys, or waste. 40 CFR 61 limits the amount of beryllium emitted to 10 g in a 24-h period or to an amount that would result in atmospheric levels of 0.01-µg beryllium/m3 of air, averaged over a 30-day period. EPA’s Office of Water Regulations and Standards limits the concentration of beryllium in water to between 0.68 and 68 ng beryllium/L for protection of human health. 2.3 Routine Worker Exposure 2.3.1 Radiation In a fusion facility, occupational exposure to radiation can result from gamma radiation, neutron fluxes, tritium ingestion or inhalation, and the mobilization of activation products. The exposures from all these sources are combined into an effective dose (ED) that accounts for the energy, half-life, and biological mobility of each of the radionuclides. Under 10 CFR 20 and 10 CFR 835, the radiological workers at commercial and DOE facilities are limited to an annual ED (internal and external) exposure of 50 mSv (5 rem). Expo- sures to organs, tissues, or extremities are limited to 500 mSv (50 rem). Lower limits apply to declared pregnant women, minors (less than 18 years old) and students, visitors, and the public. Under DOE requirements, permission of the Cognizant Secretarial Officer is required for all occupational doses in excess of 2 rem. Higher exposures are tolerated for emergency situations, such as saving a human life, recovering a deceased victim, and protecting health and property.

The goal for doses due to normal and anticipated operational occurrences is 10 mSv/yr (1 rem/yr). In all cases the dose to workers must be as low as reasonably achievable. This value is based on ICRP 26 and NCRP 116 recommendations. Doses should be kept “as low as reasonably achievable” (ALARA). In the design of facili- ties the design objective for controlling personnel exposure from external sources of radiation in areas of continuous occupational occupancy (2000 hours per year) shall be to maintain expo- sure level below an average of 0.5 mrem (5 microsieverts) per hour and as far below this aver- age as is reasonably achievable. The design objectives for exposure rates for potential expo- sure to a radiological worker where occupancy differs from the above shall be ALARA and shall not exceed 20 percent of the applicable standards of 10 CFR 835.202 (10 CFR 835). 2.3.2 Hazardous Materials There may be a number of hazardous materials in a fusion facility such as metallic dust, diborane, inert gases, and organic compounds. Other regulations are concerned with exposures to these hazardous materials and other industrial hazards. In this guidance emphasis is given to beryllium and vanadium because these materials are more relevant to fusion facilities. Exposure limits should be taken from National Institute of Occupational Safety and Health (NIOSH) recom- mendations (NIOSH 1994), Occupational Safety and Health Act (OSHA) regulations (29 CFR 1910), and industrial standards. 9 DOE-STD-6003-96 2.3.2.1 Beryllium Beryllium and beryllium compounds can pose potential health risks to humans. They may be used as plasma-facing components in ITER. This section summarizes the current U.S. regu- lations about allowable emission to the environment and permissible occupational exposure to workers. OSHA regulations limit permissible exposures to a time-weighted average of 0.002 mg/m3 for the beryllium concentration in workroom air. For short-term exposure (i.e., 30 min), the exposure limit is 0.025 mg/m3. The NIOSH recommends an exposure guideline of 0.0005 mg/m3 in workroom air during an 8-h shift. There are also limits on acceptable beryllium ambient air concentrations and drinking water quality standards for a number of states in the United States (DHHS 1993). This Standard recommends the adoption of the NIOSH exposure guidelines for beryllium in a fusion facility. 2.3.2.2 Vanadium Oxides Since absorption of vanadium is chiefly by the respiratory tract, mechanical enclosure of many vanadium-using operations is required. If this is impractical, the worker must be provided with an air-fed unit to ensure complete respiratory protection from vanadium pentoxide (Finkel 1983). NIOSH 15-min time-weighted average exposure limits for vanadium compounds in air are 0.05 mg vanadium/m3. For metallic vanadium, ferrovanadium dust, and vanadium carbide, the NIOSH exposure limits are 1.0 mg V/m3 (3 mg V/m3 for short-term exposures) (NIOSH 1994). OSHA exposure limits are 0.5 mg V2O5 /m3 for vanadium dust, 0.1 mg V2O5 /m3 for vanadium fume, and 1 mg/m3 for ferrovanadium dust (29 CFR 1910). This Standard recom- mends the adoption of the NIOSH exposure guidelines for vanadium in a fusion facility. 2.3.3 Common Industrial Hazards As with any large industrial facility, a fusion power plant facility will contain other hazards, such as flammable materials, rotating machinery, and nonbreathable gases. These hazards are not unique to fusion power and will therefore be regulated according to existing OSHA criteria (29 CFR 1910, 1926) or commonly accepted industrial safety practices.

2.3.4 Magnetic Fields The magnetic confinement fusion facilities addressed in this Standard may have magnetic fields of considerable strength extending throughout areas of the facilities and possibly beyond interior rooms. These fields may be steady state, or they may vary in time and/or space. In general, the magnetic field at the site boundary will be very low, usually less than the earth’s magnetic field (~50 µT). The recommended limits for occupational exposures to steady-state and low-frequency magnetic fields are those established by the American Conference of Governmental Industrial Hygienists (ACGIH). At present, the ACGIH states: 10 DOE-STD-6003-96 Routine occupational exposure should not exceed BTLV = C f , (2) where BTLV = the threshold limit value for the magnetic field in millitesla (mT) C = a constant equal to 60 mT-Hz f = the field frequency in Hertz (Hz). At frequencies below 1 Hz, the threshold limit value is 60 mT. The magnetic field strengths in these limits are root-mean-square (rms) values. For workers wearing cardiac pacemakers, the threshold limit value may not protect against electromagnetic interference with pacemaker function. The threshold limit for pace- maker wearers should be reduced by a safety factor of 10. In the future, this Standard will adopt modifications of the ACGIH threshold limit value for magnetic fields. 2.4 Guidance for Meeting Regulatory Limits This section provides guidance for calculational procedures to meet the regulatory limits given in DOE-STD-6002-96. Guidance on the types of off-normal analyses required to meet these regulatory limits is provided in Section 5.4 of this Standard. 2.4.1 Evaluation Guidelines Evaluation Guidelines (EGs) are accident impact criteria established for the purpose of evaluating the acceptability of facility safety design. For radionuclide releases, criteria are given for ED and are termed “dose values.” It is important to note that these criteria do not necessarily constitute acceptable limits for human health impacts in the event of an accident. Rather, they are used to evaluate the level of safety associated with the design of the facility with respect to the risk from low-probability accidents. EGs are typically established using a risk-based frame- work. Higher dose values are associated with lower frequency to provide balance in the design with appropriate focus at both the high- and low-probability ends of the accident frequency scale. Dose values are given for normal operation and anticipated operational occurrences. A second set of dose values is given for off-normal conditions. Events with an estimated fre- quency of <10–6/yr are considered hypothetical, and comparison to an EG is not required. The method is comparable to that established in DOE Standard 3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports. EGs are provided for off-site (public) locations. 11 DOE-STD-6003-96 2.4.2 Exposure Off-site doses are evaluated for the most exposed individual (MEI). This is a hypothetical individual located at the closest point on the site boundary (or at off-site distance of maximum air concentration for elevated releases). 2.4.3 Meteorological Dispersion

Site-specific 5% weather conditions (i.e., stability class and wind speed more unfavorable than 95% of the expected weather) without regard to wind direction, defined by at least 1 yr of weather data, should be used for diffusive transport to downwind receptors. Alternatively, site- specific climatological studies using actual measurements of diffusion/dilution characteristics under representative meteorological conditions can be used as a basis for determining site- specific dilution factors (χ/Qs) (see NOAA 1989 for example). These weather conditions should be determined using the anticipated release height of the accident cloud (e.g., ground level or elevated). For evaporating chemicals, a range of stability class/wind speed combinations should be examined due to the chemical-specific effects of these parameters on source emission rates and downwind dispersion. A dense gas model may need to be used for evaluation of impacts at near-field receptor distances if the chemical/air mixture density at the source exceeds the ambi- ent air density by 50%. Dense gas effects are usually insignificant at far-field receptor distances. 2.5 Consequence Thresholds for PAGs and Emergency Response Planning Guidelines As stated in DOE-STD-6002-96, the Fusion Radiological Release Requirement for off- normal events at fusion facilities is that no events result in a public exposure greater than 10 mSv (1 rem). If the projected early dose to the surrounding population can be shown to be less than 10 mSv, then no public protective action planning would be necessary. In determining whether a given event at a fusion facility will require protective action, best estimate meteorology and system operation are assumed. All estimates of the site-specific transport coefficients (χ/Q) are based on at least 1 yr of meteorological data. Best-estimate meteorology can be used to determine public exposures in three ways: a. Use the annual average windspeed and the highest-frequency stability conditions in determining the χ/Q at the site boundary. b. Calculate the hourly χ/Q for meteorological conditions throughout the year. Select the 50 percentile χ/Q to determine off-site transport. c. Using meteorological data for at least 1 yr, use a Monte Carlo technique to select random starting times for the off-normal event. Average the public exposure due to each of the transients to obtain the best-estimate off-site doses. Because of differences among the mean, median, and mode of the χ/Q distributions through the year, the preferred method is “c” above. Further guidance in the application of best estimate off-site dose calculation can be found in NUREG-0654/FEMA-REP-1. 12 DOE-STD-6003-96 2.5.1 Radiological (No Ingestion) Guidance for sheltering, evacuation, and food interdiction is given in the EPA “Manual of Protective Action Guides and Protective Actions for Nuclear Incidents” (EPA 1991). A nuclear incident is divided into three phases: early, intermediate, and late. During the early phases shel- tering or evacuation is the appropriate measure to consider. The PAGs are criteria based upon the potentially avoided dose, which determine whether action must be taken. a. Evacuation (or, for some situations, sheltering) should normally be initiated to avoid a 10-mSv (1-rem) dose to a standard man for ”early” pathways inhalation (CED) and external gamma ED (cloudshine/immersion and ground surface).

b. For radionuclides with long effective half-times in the body, use 50-mSv (5-rem) CED + ED as the action criterion. For committed effective dose equivalent to the skin, use 500 mSv (50 rem) for the action criterion. 2.5.2 Radiological (Ingestion) During the intermediate and late phases of the incident, controls on the ingestion of con- taminated food and water are appropriate (FDA 1982). The avoided doses at which such inter- diction is appropriate are shown below: a. “Preventative PAG”—5 mSv (0.5 rem) to “whole body, bone marrow, or any other organ.” This is the level at which protective actions having minimal impact should be taken. b. “Emergency PAG”—50 mSv (5 rem) to “whole body, bone marrow, or any other organ.” This is the level at which food should be isolated for condemnation or other disposition. 2.6 Models Used in Relating Exposures to Estimated Consequences The following code systems are examples of tools that have been accepted for use in a regulatory context for relating releases, exposures, and estimated consequences. This list is not all inclusive, and other codes of greater capability might be developed in the future. GENII (Napier 1988) is a coupled system of computer codes used to estimate potential radiation doses to individuals or populations from both routine and accidental releases of radionuclides to air or water and residual contamination from spills or decontamination operations. The MACCS (MELCOR Accident Consequence Code System) (Chanin 1990) code sys- tem calculates impacts of severe accidents at nuclear reactors on the surrounding environment. Principle phenomena considered include atmospheric transport dose mitigation actions, dose accumulation, and health effects. The MACCS code has been expanded to include isotopes of interest in fusion facilities. 13 DOE-STD-6003-96 The RSAC (Wenzel 1993) code calculates the consequences of the release of radio- nuclides to the atmosphere. A user can generate a radioactive inventory, decay and ingrow the inventory during transport through process facilities and the environment, model the downwind dispersion of the activity, and calculate doses to downwind individuals. Doses are calculated through the inhalation, immersion, ground surface, and ingestion pathways. The CAP-88 (Clean Air Act Assessment Package-1988) (Parks 1992) computer model is a set of computer programs, data bases, and associated utility programs for estimation of dose and risk from routine radionuclide emissions to air. CAP-88 must be used to show compliance with 40 CFR 61.93(a) unless the EPA approves an alternate. The CAP-88-PC software package allows users to perform full-featured dose and risk assessments in a personal computer environment for the purpose of demonstrating compliance with 40 CFR 61.93(a) for routine radionuclide releases to the air. CAP-88-PC provides the CAP-88 methodology for assessments of both collective populations and MEIs. The complete set of dose and risk factors used in CAP-88 is provided. CAP-88-PC used a modified Gaussian plume equation to estimate the average dispersion of radionuclides released from up to six sources. The sources may be either elevated stacks, such as a smokestack, or uniform area sources, such as a pile of uranium mill tailings. Plume rise can be calculated assuming either a momentum or buoyancy-driven plume. Assessments are done for a circular grid of distances and directions for a radius of 80 km (50 miles) around the facility. 14

DOE-STD-6003-96 3. ENVIRONMENTAL AND PERMITTING REQUIREMENTS This chapter is a compilation of environmental and permitting requirements potentially applicable to magnetic fusion facilities. It is not intended nor should it be interpreted to be the definitive listing of all environmental laws and regulations to which a new fusion facility would be subject. The information is provided to facilitate planning for preparing the environmental and permitting documentation that may be required. Ongoing rulemaking may influence the applica- bility and completeness of the environmental and permitting requirements that must be satisfied for specific fusion facilities. In addition, state and local regulations may impose additional requirements and more stringent standards on those facilities. Requirements in this chapter are only repeated here from original sources for user convenience and do not constitute new requirements. 3.1 Federal Requirements 3.1.1 National Environmental Policy Act and Implementing Guidelines, Regulations, and Orders National Environmental Policy Act (NEPA) of 1969 (42 USC 4321 et seq.; 40 CFR 1500– 1508) establishes national policies and goals for the protection of the environment. Section 102 requires Federal agencies to incorporate environmental considerations into their planning and decision-making processes using a systematic interdisciplinary approach. The Council on Environmental Quality (CEQ) regulations implementing NEPA (40 CFR 1500–1508) contain action-forcing provisions to ensure that Federal agencies consider environmental information before making decisions on proposed actions. The NEPA process includes decision points at which the significance of environmental effects is considered, project alternatives are identified, and any appropriate mitigation measures are identified and adapted. Title 10 CFR 1021 estab- lishes DOE’s policy of complying fully with NEPA, and DOE Order 451.1 describes the roles of the various DOE offices in implementing the Act. The NEPA review process consists of evaluating the potential environmental effects of a Federal undertaking, establishing possible alternatives to the proposed action, and determining the level of NEPA documentation required to proceed with the action. Three levels of NEPA documentation include determination of categorical exclusion, preparation of an environmental assessment/finding of no significant impact (EA/FONSI), and preparation of an environmental impact statement/record of decision (EIS/ROD). For major Federal actions with the potential for significant environmental impacts, an EIS is typically required. The National Environmental Policy Act Compliance Program (10 CFR 1021, DOE Order 451.1) establishes procedures to implement NEPA, including the level of review necessary under NEPA. This Order promotes smooth generation, review, and release of documents pur- suant to NEPA and provides for the cooperation between various elements of DOE. Further guidance on preparing EAs and EISs is provided in DOE’s NEPA “Greenbook” (DOE, 1993b). Executive Order 12114, “Environmental Effects Abroad of Major Federal Actions” (44 FR 1957), establishes procedural and other actions to be taken by Federal agencies to 15 DOE-STD-6003-96

further the purposes of NEPA with respect to the environment outside the United States, its territories, and possessions. Final DOE guidelines for implementing the Order were published in the Federal Register in 1981 (46 FR 1009). Therein, the categories of actions and the manda- tory environmental review requirements are identified. Major Federal actions that could poten- tially affect the global environment or resources require some level of environmental review and documentation, depending on the nature of the action and the environments potentially impacted. 3.1.2 Federal Statutes and DOE Orders Relating to Environmental Quality 3.1.2.1 Federal Statutes The Atomic Energy Act (AEA) of 1954, as amended [42 USC 2011, et seq.; 10 CFR 20, 39, 60, 61, 71, 100, 762, 835, 960, 962 and 40 CFR 190–192], authorizes the conduct of atomic energy activities and governs the design, location, and operation of facilities (including Federal facilities) involved with nuclear materials. DOE facilities are not required by the AEA to be permitted or licensed but are required to comply with the act and its amendments. The Pollution Prevention Act of 1990 declares a national policy to prevent pollution at the source and to recycle pollution in an environmentally safe manner. The Act provides that the fol- lowing hierarchical sequence of steps be taken in dealing with pollution: (1) pollution should be prevented or reduced at the source whenever possible; (2) polluting materials should be recy- cled in an environmentally safe manner whenever feasible; (3) polluting materials should be treated in an environmentally safe manner; (4) disposal or other release to the environment is to be employed only as a last resort and conducted in an environmentally safe manner. The Clean Air Act, as amended [42 USC 7401 et seq. (40 CFR 50–80)], provides require- ments to protect and enhance the quality of the nation’s air resources and to promote public health and welfare. The act establishes National Ambient Air Quality Standards (NAAQS), Pre- vention of Significant Deterioration (PSD) regulations, National Emission Standards for Haz- ardous Air Pollutants (NESHAPS), and New Source Performance Standards (NSPS). The EPA can delegate permitting and regulatory authority to a state. Delegation under the Clean Air Act can take forms other than a State Implementation Plan (SIP). The Water Pollution Control Act, amended by the Clean Water Act of 1977 (33 USC 1251 et seq.; 40 CFR 110, 116, 117, 121, 122, 124, 129, 230, 401, 403; 33 CFR 289, 320, 323, 327, and 330), pertains to restoration and maintenance of the chemical, physical, and biological integrity of the nation’s waters. Using minimum technology-based guidelines set by the Envi- ronmental Protection Agency (EPA), states will issue National Pollutant Discharge Elimination System (NPDES) permits to discharge wastes into U.S. waters; a NPDES permit is required for discharges to waters of the United States. Fusion facilities must comply with applicable U.S. Army Corps of Engineers dredge and fill regulations. Impacts to wetlands greater than 10 acres require a permit from the U.S. Army Corps of Engineers. In addition, some states have more stringent requirements pertaining to wetlands. It is recommended that an expert on water quality be consulted for establishing the water quality requirements for the site in question. 16 DOE-STD-6003-96

The Safe Drinking Water Act, as amended [42 USC 300(f–j) et seq.; 40 CFR 140–149], establishes uniform Federal standards for drinking water quality. The EPA has the authority to delegate enforcement of these standards to the states. This act sets two types of standards for drinking water, primary and secondary. Primary standards are mandatory and apply to sub- stances that may have adverse affects on health. Secondary standards are advisory and affect color, smell, taste, or other physical characteristics of drinking water. This act also pertains to groundwater aquifers, banning underground injection of certain materials in or near groundwater recharge areas. The Solid Waste Disposal Act, as amended by the Resource Conservation and Recovery Act (RCRA) (42 USC 6901 et seq., 40 CFR 240–282 and 124), established a comprehensive program for regulating and managing solid waste (Subtitle D), hazardous waste, including radioactive mixed waste (Subtitle C), and underground storage tanks (Subtitle I), and for pro- moting the use of recycled and recovered materials (Subtitle F). The Toxic Substances Control Act (TSCA) (15 USC 2601 et seq.; 40 CFR 700–799) pro- vides the regulatory vehicle for controlling exposure and use of raw industrial chemicals that fall outside the jurisdiction of other environmental laws. TSCA assures that chemicals are evaluated before use to ensure they pose no unnecessary risk to health or the environment. Fusion facility personnel shall review proposed chemical use to assure that appropriate alternatives have been evaluated. The management of PCBs is also regulated under TSCA. There are specific require- ments for facilities that maintain transformers and other equipment containing PCB dielectric fluid. The Federal Facility Compliance Act waives sovereign immunity for fines and penalties for RCRA violations at Federal facilities. However, the effective date of the waiver has been delayed for mixed waste storage prohibition violations, as long as the Federal facility is in com- pliance with all other applicable requirements of RCRA. During this period, DOE is required to prepare plans for developing the required treatment capacity for mixed wastes stored or gener- ated at each facility. Each plan must be approved by the host state or the EPA after consultation with other affected states, and a consent order must be issued by the regulator requiring com- pliance with the plan. The Federal Facility Compliance Act further provides that the DOE will not be subject to fines and penalties for land disposal restriction storage prohibition violations for mixed waste as long as it is in compliance with such an approved plan and consent order and meets all other applicable regulations. The Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA), as amended (42 USC §9601 ET SEQ.), provides a statutory framework for the cleanup of waste sites containing hazardous substances and—as amended by the Superfund Amendments and Reauthorization Act—provides an emergency response program in the event of a release (or threat of a release) of a hazardous substance to the environment. Using the Hazard Ranking System, Federal and private sites are ranked and may be included on the National Priorities List. The Comprehensive Environmental Response, Compensation, and Lia- bility Act, as amended, requires such Federal facilities having such sites to undertake investiga- tions and remediation as necessary. The Act also includes requirements for reporting releases of certain hazardous substances in excess of specified amounts to State and Federal agencies.

17 DOE-STD-6003-96 The Emergency Planning and Community Right-To-Know Act of 1986 (42 USC 10227; 40 CFR 350–372) was enacted as Title III of the Superfund Amendments and Reauthorization Act (SARA). This act establishes requirements for emergency planning, spill reporting, haz- ardous chemical inventory reporting, and toxic chemical release reporting. The act also provides for the establishment of state and local emergency planning committees to prepare plans to respond to potential chemical emergencies. A facility emergency coordinator must be desig- nated, and a list or copies of Material Safety Data Sheets for hazardous substances at the site must be submitted to the Local Emergency Planning Committee, the State Emergency Response Commission, and the local fire department. Reporting Requirements. An annual hazardous chemical inventory report shall be submitted to the Local Emergency Planning Committee, the State Emer- gency Response Commission, and local fire department. A Toxic Chemical Release Form for specified toxic chemicals shall also be submitted annually. In the event of a hazardous substance release, appropriate notifications of Federal, state, and local authorities shall be made. The Hazardous Materials Transportation Act (49 USC 180 et seq.; 49 CFR 171–178) establishes requirements for the transportation of hazardous materials by road, air, and rail. Packaging, labeling, marking, and shipping requirements are specified for quantities and forms of substances that are designated as hazardous. Hazardous materials, including radioactive materials and wastes, must be shipped from the fusion facility site in accordance with the appli- cable U.S. Department of Transportation packaging, labeling, marking, and placarding requirements. Floodplain/Wetlands Executive Orders (EO 11988 & EO 11990; 10 CFR 1022) protect wetlands and minimize adverse effects of development in floodplains. The proposed site for the fusion facility must be evaluated to determine if it contains wetlands or floodplains. If floodplains/ wetlands do occur at the proposed site, a notice must be published in the Federal Register and Federal, state, and local agencies notified of a proposed floodplain/wetlands assessment. This assessment shall identify alternate measures to minimize harmful impacts to floodplains or wet- lands due to activities. A statement of finding must be published for public record. The Farmland Protection Policy Act (7 USC 4201 et seq.; 7 CFR 658) seeks to minimize the extent to which Federal programs contribute to the unnecessary and irreversible conversion of farmland to nonagricultural uses and assure that Federal programs are administered in a manner that will be compatible with state and local government and private programs and policies to protect farmland. The Soil Conservation Service must be requested to determine whether the site or any part of the site is farmland by using site assessment criteria and the rela- tive value of the site. If the evaluation results in a high score for the site, alternatives shall be considered that could lessen adverse effects on the site as farmland. The Archaeological Resources Protection Act of 1979 (16 USC 47000 et seq.; 43 CFR 7; 36 CFR 296) requires that a determination be made of the measures that shall be taken if archaeological resources present on Federal land may be damaged during project-related activi- 18 DOE-STD-6003-96

ties. Archaeological resources are defined as any material remains of past human life or activi- ties of archaeological interest. The National Historic Preservation Act of 1966, as amended (16 USC 470 et seq.; 36 CFR 60 and 800; Historic Sites, Buildings and Antiquities Act; 16 USC 461 et seq.), endeav- ors to preserve, maintain, and enrich irreplaceable cultural, educational, inspirational, and eco- nomic history. A determination must be made if the project area contains any site, structure, or object identified in, or eligible to be included, in the National Register of Historic Places and determine if the proposed project will affect the site, structure, or object adversely. If the effect would be adverse, the Advisory Council on Historic Preservation must be consulted to deter- mine what actions should be taken. The American Antiquities Act (16 USC 432 et seq.; 25 CFR 261; 36 CFR 296; and 43 CFR 3-7) protects historic and prehistoric ruins, monuments, and objects of antiquity on lands owned and/or controlled by the Federal government. Additionally, the act stipulates that the Federal government is to provide leadership in the preservation, restoration, and mainte- nance of the historical cultural environment of the nation. The American Indian Religious Freedom Act (AIRFA) (42 USC 1996; 36 CFR 296 and 43 CFR 7) protects and preserves for Native Americans their inherent right of freedom to believe, express, and exercise their traditional religious rights guaranteed by the First Amend- ment of the U.S. Constitution. This includes access to sites; use and possession of sacred objects; and freedom to worship through ceremonial and traditional rites. A determination must be made whether the project site is in an area related to Native American religious rites or is a sacred site. The Migratory Bird Treaty Act (16 USC 703 et seq.; 50 CFR 10) prohibits the killing, cap- turing, transporting, etc., of migratory birds, their nests, and eggs, and any part of such bird, nest, and egg. The Fish and Wildlife Coordination Act (16 USC 661 et seq.) mandates that wildlife con- servation receive equal consideration and coordination with other features of water resource programs through planning, development, maintenance, and coordination of wildlife conserva- tion and rehabilitation. The Bald and Golden Eagles Protection Act (16 USC 668–668d; 50 CFR Parts 13 and 22) prohibits the killing, capturing, and transporting of any bald and golden eagles, living or dead, their nests, and eggs, and any part of such a bird, nest, and egg. The National Wildlife Refuge Systems Administration Act of 1966 (16 USC 668OD– 668EE; 50 CFR 25, 27, 28 and 29) establishes the National Wildlife Refuge System by consoli- dating fish and wildlife conservation under the Fish and Wildlife Service (FWS). This will include fish and wildlife in danger of extinction; wildlife ranges, game ranges, wildlife management areas; or waterfowl production areas. 19 DOE-STD-6003-96 The Endangered Species Act of 1973 (16 USC 1531 et seq.; 50 CFR 17, 222, 226, 227, 402, 424, 450, 451, 452, and 453) prohibits Federal agencies from taking any action that would jeopardize the continued existence of any threatened or endangered species or result in the destruction or adverse modification of critical habitat unless an exemption has been obtained.

Objects Affecting Navigable Airspace (49 USC 1501; 14 CFR 77) requires that all persons give adequate public notice of the construction or alteration, or the proposed construction or alteration, of any structure that would be a hazard to air navigation, and regulates structures that could obstruct air navigation. The Federal Aviation Administration (FAA) has the following pro- cedures that must be followed: Notice of Proposed Construction, Construction Permit, and a Notice of Progress of Construction or Alteration. The Rivers and Harbors Appropriations Act of 1899 (33 USC 401–413, 06; 33 USC 33 CFR 209, 320, 325, 326, 329, and 330), the Bridge Act of 1949, and Construction and Operation of Bridges Act of 1946 (33 USC 525; 33 CFR 114–115) prevent alteration or modifi- cation of the course, location, current condition, or capacity of any navigable water in the United States without a permit. “U.S. navigable waters” have been defined in a loose manner by regula- tors. Dry lake beds, arroyos, and ditches have all been considered navigable waters. Bridge construction is also regulated under this act. The U.S. Army Corps of Engineers has established an integrated permitting process that allows a single permit application to be used for compli- ance with regulated activities. A permit must be obtained from the U.S. Army Corps of Engineers for any activity regulated under this act. The Noise Control Act of 1972, as amended [42 USC 4901–4918 (EO 12088)] directs all Federal agencies to carry out programs within their jurisdictions in a manner that furthers a national policy of promoting an environment free from noise that jeopardizes health and welfare. If the noise levels and/or emissions from a fusion facility would jeopardize the health or welfare of the public in the area surrounding the site, a plan to minimize noise emissions must be pre- pared. The plan may require a change in design parameters. 3.1.2.2 DOE Orders and Guidance DOE Orders are internal department documents that set policy and specify procedures for implementing that policy. They may apply to specific sites and facilities or to all areas of DOE operations. In some cases, DOE Orders may mandate compliance with existing Federal, state, and local regulations. Because specific DOE Orders may change or new Orders are issued, a review of the latest DOE Orders should be conducted. The General Environmental Protection Program (DOE Order 5400.1) establishes environ- mental protection requirements, authorities, and responsibilities for DOE operations for ensuring compliance with applicable federal, state, and local environmental protection laws and regula- tions, executive orders, and internal DOE policies. This Order implements DOE policy, which mandates that all operations be conducted in an environmentally safe and sound manner, including protection of the public and the environment. DOE Order 5400.1 requires that DOE operations be conducted in compliance with the letter and spirit of applicable environmental statutes, regulations, and standards. This includes sound environmental management of current 20 DOE-STD-6003-96 activities, the correction of existing problems, the minimization of risks to the environment or public health, and anticipating and addressing potential environmental problems before they threaten the quality of the environment or public welfare. DOE Order 5400.1 describes the envi- ronmental monitoring required to demonstrate compliance with environmental laws and regulations.

The Waste Minimization Crosscut Plan (SEN-37-92, March 13, 1992) was implemented by the DOE Secretary of Energy in accordance with the Pollution Prevention Act of 1990. This plan identifies key objectives and strategies for the Department’s achievement of excellence in waste minimization. The Environmental, Safety, and Health Appraisal Program (DOE Order 5482.1B) estab- lishes the program to evaluate the protection of the environment and the health, and safety of the public. This Order also establishes criteria for a safe and healthful work place for employees of the DOE and the DOE contractors. The Environmental Protection, Safety, and Health Protection Information Reporting Requirements (DOE Order 5484.1) establish the requirements and procedures for the reporting of information having environmental protection, safety, or health protection significance for DOE Operations. The Order identifies accidents and incidents and provides instruction in the areas of format and content of accident/incident investigation reports. 3.2 Federal and State Consultation, Permits, and Approvals 3.2.1 Federal Permits and Approvals National Emission Standards for Hazardous Air Pollutants (NESHAPS) (40 CFR Part 61) regulate substances that potentially will be emitted by fusion facilities, such as beryllium and radionuclides. If the fusion facility will result in a predicted effective dose (ED) to a maximally exposed member of the public equal to or greater than 1% of the standard for radionuclides [i.e., 0.001 mSv/yr (0.1 mrem/yr)], a NESHAPS permit to construct (PTC) application must be submitted prior to the initiation of construction to obtain the approval of the Regional Administrator of the EPA. The EPA will provide notification of approval or intention to deny approval of construction within 60 days after receipt of a complete application. After construction of the fusion facility, the EPA must be notified of the anticipated date of initial start-up of the source at least 30 days prior to that date and the actual date of initial start-up of the source within 15 days after that date. A Prevention of Significant Deterioration (PSD) of Air Quality review is required if the emission rate of any criteria air pollutant (carbon monoxide, hydrocarbons, nitrogen oxides, total suspended particulates, photochemical oxidants, sulfur oxides, and lead) from routine opera- tions of a stationary source is greater than 250 tons/yr. If necessary, a new PSD permit applica- tion or a modification to an existing permit must be submitted to the appropriate state agency before construction of a fusion facility. 21 DOE-STD-6003-96 According to the National Pollutant Discharge Elimination System (NPDES), states will issue NPDES permits to discharge wastes into waters of the United States using minimum technology-based guidelines set by the EPA. An NPDES permit for all discharges to waters of the United States must be obtained. Fusion facilities shall comply with applicable U.S. Army Corps of Engineers dredge and fill regulations. Impacts to wetlands greater than 10 acres will require an additional permit from the U.S. Army Corps of Engineers. Safe Drinking Water Act. If future fusion facilities affect existing or require new drinking water systems, a permit to conduct monitoring must be obtained as required. The Resource Conservation and Recovery Act (RCRA) was established to regulate solid and hazardous wastes.

a. Solid Waste. Subtitle D requires each state to prepare a solid waste management plan to prohibit new open dumps and require upgrading or closing of all existing dumps. Federal guidelines for solid waste collection, transport, separation, recovery, and disposal practices have been promulgated. b. Hazardous Waste. Under the land disposal restrictions (40 CFR 268) the generator of hazardous waste must assure a system of manifesting, reporting, standards, and permits to achieve control of hazardous waste from generation to final disposition. These requirements apply to generators and transporters of hazardous waste and owners and operators of hazardous waste treatment, storage, and disposal (TSD) facilities. Reuse, reclamation, and recycling of hazardous waste is also subject to the regulatory program. Under the land disposal restrictions (40 CFR 268) waste generators must assure that the waste is treated prior to ultimate disposal to the land. Specific requirements have been estab- lished by the EPA, usually requiring treatment to a particular contaminant concentration, but occasionally requiring a specific treatment method. There are also extensive regulations for the various processes or techniques by which hazardous wastes may be managed. These detailed standards include requirements for the proper management of containers, tank systems, surface impoundments, waste piles, land treatment, landfills, incinerators, and miscellaneous units (those not covered by the specifically identified techniques). State regulations may be more extensive than the Federal system and must be reviewed for applicability. The operation of the fusion facilities may require preparation of a new RCRA Part A or Part B permit application, a change in existing interim status, or a modification to an existing permit, depending on site location. 1. Underground storage tanks. All new underground storage tanks must be permitted prior to installation. Any person proposing to install a tank must file a notification prior to installation and prior to operation. The underground tank rules in RCRA Subtitle I 22 DOE-STD-6003-96 cover any substance defined as hazardous under CERCLA (Superfund) and includes underground tanks containing petroleum products. 2. Federal procurement guidelines. The EPA has established and published Federal guidelines for several materials: building installation products containing recovered materials; cement and concrete containing fly ash; paper and paper products contain- ing recovered material; lubricating oils containing re-refined oil; and retreaded tires. Particular attention should be paid to the cement and concrete guideline as it may apply to the construction phase of the program. Major procurement actions for ser- vices and materials for the fusion facilities should include specifications for the use of recycled and recovered materials. The Fish and Wildlife Coordination Act and National Wildlife Refuge Systems Administra- tion Act Permit Requirements include consultation with the FWS concerning project activities that (1) may conflict with the protection and conservation purposes set by the National Wildlife Refuge System (a permit may also be required); (2) may impact birds, especially migratory birds on the site; and (3) may modify, control, or impound, due to construction activities, a body of water greater than or equal to 10 acres. The State Administrator of wildlife resources must also be consulted for (2) and (3).

In the Bald and Golden Eagles Protection Act, a Federal Fish and Wildlife License Permit is required if upon investigation of the proposed site, a golden eagle’s nest is found and must be disturbed. A Federal Fish and Wildlife License Permit Application shall be submitted to the Assistant Regional Director for Law Enforcement of the district in which the site is located. If a permit is granted, the Director of Law Enforcement of the district in which the site is located shall be notified in writing at least 10 days, but no more than 30 days, before any golden eagle nest is taken. Any mitigation measures determined by the Director shall be complied with and a report of activities conducted under the permit shall be submitted to the Director within 10 days follow- ing the permit’s expiration. The Archaeological Resources Protection and National Historic Preservation Acts require consultation with the Advisory Council on Historic Preservation if a proposed project will impact a site with historic/prehistoric ruins, monument, or object of antiquity, or a site on the National Register of Historic Places. The AIRFA provides the following guidance. If a project site falls into the category of a Native American religious or sacred site, consultation is required with Native American leaders to determine if the proposed action would infringe on constitutional rights or impact Native American traditional religions. 3.2.2 State and Local Permits and Approvals Specific state and local permitting and approval requirements may vary by location; how- ever, general guidance is provided in the following sections. 23 DOE-STD-6003-96 3.2.2.1 Air Most states have been granted the authority by EPA to implement some, if not all, of the requirements of the Clean Air Act. a. Permit to Construct (PTC). Applications for a PTC and an Operating Permit for the proposed facility should be submitted to the state 15 to 18 months prior to commence- ment of construction. Generally (although this may vary from state to state), the state will notify the applicant within 30 days whether the application for PTC or operating permit is complete and within 60 days will issue a proposed approval, proposed con- ditional approval, or proposed denial, with an opportunity for public comments to follow. b. NESHAP Analysis. A NESHAP analysis is generally submitted to the state along with the PTC application. State review of the PTC application does not occur until the EPA approves the NESHAP document. Data collection (ambient air and engineering data) for the analysis typically takes 1 yr, and preparation of the analysis about 6 months. 3.2.2.2 Archaeological Finds If archaeological resources are determined to be endangered by a project-related activity, application for a permit from the jurisdictional land manager to remove or excavate an archaeo- logical site must be submitted. Activities are coordinated with the State Historic Preservation Office (SHIPO). The DOE must be qualified to do the permitted removal or excavation. Archaeo- logical resources excavated or removed remain the property of the United States. The remains and the copies of records and data must be archived by a suitable institution. 3.2.2.3 Other State Requirements Other state requirements will likely include water quality standards and wastewater treat- ment requirements, solid and hazardous waste requirements, and special provisions for wildlife. These vary by state and will have to be developed when specific fusion facility sites are selected.

3.3 Environmental Compliance Procedures and Scheduling 3.3.1 Environmental Documentation Guidelines 3.3.1.1 NEPA Compliance Plan Specific environmental mitigation commitments identified in fusion facility NEPA docu- ments are incorporated into the design and operation of the facility through an approved Mitiga- tion Action Plan (MAP). The MAP describes how mitigation of adverse environmental conse- quences will be implemented and monitored to assure effectiveness. The implementation of the MAP will be the responsibility of the design, construction and operating organizations. The plan 24 DOE-STD-6003-96 a. details Program Manager quarterly reporting requirements, b. documents progress in implementation of mitigation measures required by the MAP, c. determines whether the measures are adequately reducing or eliminating adverse environmental impacts, d. establishes procedures that prepare NEPA review and approval prior to implementa- tion for unforeseen activities not addressed in the fusion facility EIS, and e. is updated as required to accommodate changes to the MAP from unforeseen activities. 3.3.1.2 Environmental Compliance Plan Each fusion facility will develop an Environmental Compliance Plan that describes the method by which a particular fusion facility complies with applicable environmental regulatory requirements. This includes addressing Federal, state, and local environmental statutes. While this guidance document provides a compilation of environmental requirements potentially appli- cable to fusion facilities, the Environmental Compliance Plan provides guidance on how the program managers can meet those requirements. The Plan describes the program’s understanding of environmental requirements for the preconstruction and construction phases of the fusion facility. The Plan is updated periodically to reflect results of periodic consultation with the appropriate Federal and state agencies and affected Indian tribes. The Environmental Compliance Plan consists of five separate sections: Permits Require- ments, Monitoring Requirements (Chapter IV of DOE Order 5400.1), Pollution Prevention Requirements, Training Requirements, and Site Unique Requirements. 3.3.1.3 OSHA Compliance Plan The Occupational Safety and Health Administration (OSHA) has instituted a series of requirements that establish a level of safety and safety assurance. These requirements, those promulgated by state and local regulators, and internal DOE requirements published in DOE Orders must be followed. The OSHA program encompasses the protection of workers, the public, and property from the hazards associated with the construction, operation and mainte- nance, and decommissioning of a facility. The program incorporates four separate disciplines: industrial safety, industrial hygiene, fire protection, and radiation protection. Additionally, the program requires that emergency pro- cedures are in place to mitigate the impact of accidents that threaten the health and safety of the facility occupants, personnel in the immediate areas surrounding the facility, or the public. 25 DOE-STD-6003-96 3.3.2 Environmental Compliance Scheduling Environmental review planning is an integral part of “phased compliance,” that is, a com- prehensive, integrated environmental compliance strategy (DOE Order 4700.1); a sample schedule is shown in Fig. 3.1. The strategy is characterized by a. conducting the environmental evaluations and consultative environmental reviews during the conceptual or preliminary design phase,

b. completing the NEPA documentation process prior to commencement of full detailed design, and c. submitting permit applications and coordinating permit reviews with the detailed design phase. Delayed compliance can result when inadequate attention is given to environmental requirements early in the design phase. In many instances, the permitting authority will not begin review of permit applications until at least a draft NEPA document has been circulated. Delay of the NEPA document, therefore, can delay start of construction and make the NEPA document and other environmental review processes critical path items. 26 FIGURE 3.1. Phased schedule for environmental compliance activities. DOE-STD-6003-96 D O E -S T D -6003-96 D O E -S T D -6003-96 D O E -S T D -6003-96 27 D O E -S T D -6003-96 27 D O E -S T D -6003-96 27 D O E -S T D -6003-96 27 27 DOE-STD-6003-96 Intentionally Left Blank 28 DOE-STD-6003-96 4. PROGRAM MANAGEMENT FOR SAFETY Appropriate management practices and controls should be integrated into the fusion pro- ject life cycle to ensure safety. This integration function is key to ensuring that safety is “built-in” to the fusion facility life cycle process rather than an “add-on,” which is typically expensive and less effective. Related to this goal is the concept of making safety achievement a function of line management with criteria and hardware related to safety incorporated at the lowest practical level of the work breakdown structure. This section provides guidance on management-related areas needed to integrate safety into the fusion facility life cycle. Program management includes controlling the configuration of the facility and the documentation of that configuration so that operation within the authorized safety envelope can be demonstrated. In addition, this section presents tools (processes, systems, and controls) that can be used by program management to implement safety effectively. As used in this section, the facility life cycle includes design and construction, operations, and site restoration. Different organizations may be responsible for the various life cycle phases of the facility. Each organization must be aware of the need of the other organization and incorporate these needs in a safe and controlled manner. 4.1 Design and Construction Management From project inception appropriate controls should be integrated into project execution to ensure that intended safety features are incorporated into the fusion facility. Safety should be integrated into project activities, including initial mission and performance criteria definition, design, and construction. A specific responsibility of project management is to ensure that this integration of safety with other project activities or disciplines takes place and to hold project line management accountable for each aspect of their assigned systems, including safety perfor- mance. The basic facility mission requirements, including protection of the facility workers and the public as well as minimization of the impact to the environment, should be established before design commences. For example, the no-public-evacuation requirement in DOE-STD- 6002-96 should be a strong driver in fusion device size (power) and materials selection to ensure that the potentially releasable in-vessel tritium and hazardous material inventories are consistent with the no-evacuation requirement for the chosen site.

Safety assessment (Chapter 5) and design (Chapter 6) are complementary activities that should be performed iteratively throughout the design process to ensure that safety require- ments are adequately incorporated into the design. Achievement of safety criteria and goals at an individual system level should be a documented part of conceptual, preliminary, and final design and should be evaluated as part of the formal design review process. Additionally, a sys- tems integration approach should be used to evaluate interactions between individual systems including common-mode failures to ensure that safety goals are met globally. The project manager’s responsibilities include developing systems, processes, and orga- nizational structures that will facilitate safety during design and construction. The project man- ager should consider an organizational structure that will allow the safety and design profes- sionals to work as a team and that will make line management responsible for both safety and performance requirements for each system. Furthermore, there will be cases where safety 29 DOE-STD-6003-96 requirements will conflict with other design requirements for the facility. The project manage- ment system should have a process that will allow potential cost/safety/performance trade-offs to be made in a structured rational manner. 4.2 Operations Management Operations management should ensure that the operations organization is knowledgeable of the safety envelope and authorization basis and the need to maintain the facility configuration and operation within these constraints. Proposed changes to facility configuration and operation should be reviewed against the safety envelope and authorization basis and approved prior to implementation. The operations manager may call upon safety professionals for analytical support, but the responsibility and authority for safe operations remains with the line man- agement of the facility. The operations manager should establish a policy under which clear lines of responsibility for normal operations and off-normal conditions are established. Chapter 5 of this volume provides the details of the authorization basis and technical safety requirements. 4.3 Site Restoration Management Site restoration involves the dismantling of the fusion facility and the packaging of radioactive hazardous materials prior to shipment to a repository or recycling center. Manage- ment of the fusion facility during the site restoration phase requires maintaining configuration control while the condition of the facility is rapidly evolving. The safety analyses may have to be updated as safety and confinement systems are removed from service. Documentation of the condition of components and their hazardous inventories as they are packaged is necessary. Removal of hazardous materials from the site may allow some relaxation of controls as the on- site inventory is reduced. 4.4 Tools for Program Management Safety The following sections describe tools that can be used during the design, operations, and site restoration of a fusion facility. These tools include configuration management, quality assur- ance (QA), verification and validation, conduct of operations, emergency preparedness, mainte- nance, training and qualification, tritium control, accountability and physical protection. These tools, if used effectively, will help assure the safety of the fusion facility. 4.4.1 Configuration Management

Configuration management is a tool that is designed to determine and control baselines and ensure that each system/component properly interfaces physically and functionally. The role of safety in configuration management is to ensure that the original product and each approved change to the product do not jeopardize the safety of the product. Configuration man- agement actions are called for in Department of Energy (DOE) Order 4700.1, Project Manage- ment Plan. 30 DOE-STD-6003-96 4.4.1.1 Configuration Management Process Application Configuration management should be consistent with the quality, size, scope, and com- plexity of the project involved (graded approach). The configuration management process should be tailored to the specific project and to particular products. The selection of equipment and other items for formal configuration management is determined by the need to control its inherent characteristics or to control its interface with other systems. Configuration control applies to hardware, software, and documentation associated with the facility. A permanent copy of the controlled identification documents should be maintained throughout the life cycle, beginning with the initial baseline documentation and including pro- posed and approved changes from those baselines. Configuration control must be exercised on a basis appropriate to the level of importance and to the stage in the life cycle. Affected project activities, such as engineering, logistic sup- port, QA, safety, maintenance, and procurement need to be involved in evaluating proposed changes in the configuration of an item throughout its life cycle. This would normally be accomplished through a Configuration Control Board. 4.4.1.2 Change Control Changes affecting the configuration of an item are to be limited to those that are neces- sary or offer significant benefits. Changes are required to correct deficiencies; incorporate approved changes in experimental, operational or logistic support characteristics; or effect sub- stantial life cycle cost savings. Each change must be evaluated for Unreviewed Safety Questions (USQ). The process of reviewing for USQs is described in Chapter 5. Data required for effective evaluation of changes must be made available to those indi- viduals responsible for change decisions. Every proposed configuration change should be eval- uated on the basis of change criteria, including not making the proposed change. The evalua- tion should take into consideration each aspect of the change on the products or systems with which it interfaces. Such aspects may include safety, design, performance, cost, schedule, operational effectiveness, logistics support, transportability, and training. As changes are authorized, appropriate updates to safety envelopes, authorization basis and operating procedures must occur. This approach assures that operations personnel know the plant configuration and its operating limits. 4.4.1.3 Record Keeping and Reporting Configuration records and reports include identification of the following: a. technical documentation (drawings, calculations, specifications, etc.) comprising the approved configuration identification; 31 DOE-STD-6003-96 b. proposed changes to configuration, the status of such changes, and the individual responsible for change decisions; c. approved changes to configuration, including the specific number or kind of items to which the changes apply, and the activity responsible for implementation.

Only the minimum information necessary to manage configuration effectively and eco- nomically will be recorded and reported. 4.4.2 Quality Assurance A quality assurance (QA) process shall be considered in the design, selection of materi- als, specifications, fabrication, construction, installation, operating procedures, maintenance, and testing of fusion facilities. The requirements of 10 CFR 830.120 shall be used for develop- ment of this program. A Quality Assurance Plan (QAP) is developed by applying the QA criteria specified in Sections 4.4.2.1–4.4.2.3 using a graded approach. The QAP discusses how these criteria are satisfied. Appropriate standards are used, wherever applicable, to develop and implement the QAP. 4.4.2.1 Management A written QAP must be developed, implemented, and maintained. The QAP will describe the organizational structure, functional responsibilities, levels of authority, and interfaces for those managing, performing, and assessing the work, as well as management processes, including planning, scheduling, and resource considerations (cf. Sections 4.1–4.4). Personnel must be trained and qualified to ensure that they are capable of performing their assigned work. Continuing training is provided to ensure that job proficiency is maintained (cf. Section 4.4.7). Processes to detect and prevent quality problems must be established and implemented. Items, services, and processes that do not meet established requirements are identified, con- trolled, and corrected according to the importance of the problem and the work affected. Correc- tion includes identifying the causes of problems and working to prevent recurrence. Item charac- teristics, process implementation, and other quality-related information are reviewed, and the data are analyzed to identify items, services, and processes needing improvement. Documents must be prepared, reviewed, approved, issued, used, and revised to pre- scribe processes, specify requirements, or establish design. Records are specified, prepared, reviewed, approved, and maintained (cf. Section 4.4.1). 32 DOE-STD-6003-96 4.4.2.2 Performance Work will be performed to established technical standards and administrative controls using approved instructions, procedures, or other appropriate means. Items are identified and controlled to ensure their proper use and maintained to prevent their damage, loss, or deteriora- tion. Equipment used for process monitoring or data collection is calibrated and maintained (cf. Section 4.4.1). Items and processes must be designed using sound engineering/scientific principles and appropriate standards. Design work, including changes, incorporates applicable requirements and design bases. Design interfaces are identified and controlled. The adequacy of design pro- ducts is verified or validated by individuals or groups other than those who performed the work. Verification and validation work must be completed before approval and implementation of the design (cf. Chapter 6). Procured items and services must meet established requirements and perform as speci- fied. Prospective suppliers are evaluated and selected on the basis of specified criteria. Pro- cesses to ensure that approved suppliers continue to provide acceptable items and services must be established and implemented (cf. Section 4.4.1). Inspection and testing of specified items, services, and processes must be conducted using established acceptance and performance criteria. Equipment used for inspections and tests must be calibrated and maintained (cf. Section 4.4.1).

4.4.2.3 Assessment Managers must assess their management processes and identify and correct problems that hinder the organization from achieving its objectives. Independent assessments are planned and conducted to measure item and service quality, to measure the adequacy of work performance, and to promote improvement. The group performing independent assessments must have sufficient authority and freedom from the line to carry out its responsibilities. Persons conducting independent assessments must be technically qualified and knowledgeable in the areas assessed. 4.4.3 Verification and Validation Computer codes used to perform design and safety analysis for fusion facilities may be required to be verified and validated (V&V). Verification and validation will be performed using a graded approach that is based on the importance and complexity of the system/component. V&V actions are not specifically defined in DOE Orders. The QA plan documents the functional requirements for each piece of software, the acceptance criteria to be used in the V&V process, the approach to be taken to verification and validation, and the software configuration control strategy that will be used. The results of the 33 DOE-STD-6003-96 V&V process should be documented. Documentation should be prepared to manage the config- uration control of the software itself. Many of the standards and requirements used to verify and validate computer codes were developed for commercial nuclear power plants. Guidance information is embodied in ASME NQA-1 and ASME NQA-2 standards, as well as several American National Standards Institute (ANSI)/Institute of Electrical and Electronic Engineers (IEEE) Standards (ANSI/IEEE STD 730, 828, 829, 830, 983, and 1012). Verification is defined as the process of determining whether the software is coded cor- rectly and conforms to the specified software requirements. Full verification would require a line- by-line check of the entire computer code to ensure correctness. However, other less stringent methods are considered applicable, such as developing a series of calculational cases or input decks that test much of the logic in the code to ensure that the code performs as stated in the users' manual. As a general rule, design and safety analysis should be verified because it is good engineering practice. Validation is defined as the process of evaluating software to ensure compliance with software requirements and physical applicability to the process being modeled on the hardware being used. Validation is generally more involved than verification. Validation of a code consists of comparing its output with known analytical solutions for problems similar, yet perhaps simpler, than the problem at hand. Validation also includes benchmarking the code against relevant experimental data, thus ensuring that the analysis reasonably captures the correct physics and chemistry. Validation can also include comparison with an existing, already validated, computer code. The number and type of benchmarking problems needed to validate a computer code are functions of the complexity of the phenomena being modeled, the codes range of applicability, and the data that are or could be available. For a complicated computer code, verification could require that individual models and submodels in the code be V&V using separate-effects data and that integral validation of the code also be performed. These issues are functions of the specific technical areas and need to be considered in the respective V&V processes.

Due to the current experimental nature of fusion devices, it may not be possible to com- pletely verify and validate a code. In such cases, other options should be explored to assure safety of the facility. These options may include but are not limited to the use of test coupons to be evaluated after specific periods of operation and qualification of materials/equipment using deuterium-deuterium operations before using tritium as a fuel. 4.4.4 Conduct of Operations Experience has shown that the better operating facilities have well-defined, effectively administered policies and programs to govern the activities of the operating organization, includ- ing the areas described by these guidelines. The guidance is based upon well-developed indus- trial operations practices. They are written to be flexible, so that they encompass the range of facilities and operations. 34 DOE-STD-6003-96 Each fusion facility should develop a conduct of operations program in accordance with DOE Order 5480.19, Conduct of Operations, using a graded approach. Specifics for each of the sections can be found in the references for this chapter. Fusion facilities should have a policy that assures operations are managed, organized, and conducted in a manner to assure an acceptable level of safety and operators have proce- dures in place to control the conduct of their operations. The following areas should be addressed by the conduct of operations program: Opera- tions Organization and Administration; Shift Routines and Operating Practices; Control Area Activities; Communications; Control of On-Shift Training; Investigation of Abnormal Events; Notifications; Control of Equipment and System Status; Lockouts and Tagouts; Independent Verification; Logkeeping; Operations Turnover; Operations Aspects of Facility Chemistry and Unique Processes; Required Reading; Timely Orders to Operators; Operations Procedures; Operator Aid Postings; Equipment and Pipe Labeling. 4.4.5 Emergency Preparedness Fusion facilities should develop an emergency management program, using a graded approach, consistent with the determined level of risk at the facility. The requirements for emergency preparedness at DOE facilities are specified in DOE Order 151.1, Comprehensive Emergency Management. Appendix C provides a listing of guidance documents that may be useful in developing the site-specific emergency management program. The Emergency Management System (EMS) should include a graded approach to emergency management concepts such as planning, preparedness, and response. “Planning” includes the development and preparation of emergency plans and procedures and the identifi- cation of necessary personnel and resources to provide an effective response. “Preparedness” includes the training of personnel, acquisition and maintenance of resources, and exercising of the plans, procedures, personnel, and resources essential for emergency response. “Response” represents the implementation of planning and preparedness during an emergency and involves the effective decisions, actions, and application of resources that must be accomplished to miti- gate consequences and recover from an emergency. 4.4.5.1 Operational Emergency Event Classes

Operational emergencies involving hazardous materials (radiological and nonradiological) should be classified as one of the operational emergency classes (e.g., Alert, Site Area Emer- gency, or General Emergency). Emergency Action Levels (EALs), the specific criteria used to recognize and categorize events, should be developed for the spectrum of potential operational emergencies consistent with the hazards assessment. The need for some emergency levels will be eliminated for radiological emergencies if the site boundary dose limit specified as a fusion radiological release requirement in DOE-STD-6002-96 is met. 35 DOE-STD-6003-96 4.4.5.2 Emergency Plans and Procedures An emergency plan and procedures should be developed for the facility. The plan is a documented “concept of operation” that describes the essential elements that have been con- sidered and the provisions that have been made to mitigate emergency situations. The plan should incorporate information about the emergency response roles of supporting organizations and agencies and should be consistent with a graded approach to managing an incident. Pro- grams should contain emergency implementing procedures [e.g., EALs, event categorization, notification, and Emergency Operations Center (EOC) operation] as well as other procedures currently in use (e.g., equipment operation, radiological monitoring, and maintenance) that would be utilized in, or associated with, emergency response activities. Procedures must maintain consistency with the general graded approach and nomencla- ture of emergency planning and preparedness elements within Federal and State agencies, pri- vate industry, tribal, and local authorities. 4.4.5.3 Hazards Assessment Hazards assessments provide the technical basis for emergency management programs. The extent of emergency planning and preparedness required for a particular facility directly corresponds to the type and scope of hazards present and the potential consequences of off- normal events. A hazards assessment includes identification of any hazards and targets unique to a facility, analyses of potential events, and evaluation of potential event consequences. The Final Safety Analysis Report (see Chapter 5) provides for potential off-normal events at the facility. Methodology, models, and evaluation techniques used in the hazards assessment should be documented. The assessment should include a determination of the size of the Emergency Planning Zones where applicable, that is, the area surrounding the facility for which special planning and preparedness efforts are required to ensure that prompt and effective protective actions can be taken to minimize the risk to workers, the general public, and the environment. Other hazards assessments are documented in Material Safety Data Sheets; Safety Assessments; Spill Prevention, Control, and Countermeasure Plans; Pre-Fire Plans; Environ- mental Assessments and Impact Statements (EAs and EISs); Emergency Response Planning Guidelines; Severe Accident Analyses; and the Emergency and Hazardous Chemical Inventory Forms and Toxic Chemical Release Forms, prepared pursuant to the requirements of the Emergency Planning and Community Right-to-Know Act (SARA Title III). 4.4.5.4 Emergency Response Organization An emergency response organization should have overall responsibility for the initial and ongoing response to, and mitigation of, an emergency, and must perform, but not be limited to, the following functions:

36 DOE-STD-6003-96 a. Provide for prompt initial notification of emergency response personnel and response organizations, including appropriate off-site elements and for continuing effective communication among the response organizations throughout an emergency. b. Event categorization, determination of the emergency class, notification, provision of protective action recommendations, management and decision making, control of on-site emergency activities, consequence assessment, medical support, public information, activation and coordination of on-site response resources, security, communications, administrative support, recovery operations, and coordination and liaison with off-site support and response organizations. 4.4.5.5 Emergency Facilities Equipment and Personnel Preparedness An EOC should be established. The staffing, operation, and response activities pertaining to the EOC should be predetermined and documented. Primary and backup means of commu- nications should be available in the EOC. Training must be provided to affected workers regarding operational emergencies and be available to off-site emergency response organizations. Training should be provided annually to workers who may have to take protective actions (e.g., assembly, evacuation) in the event of an emergency. Training should be in place for the instruction and qualification of personnel com- prising the facility emergency response organization. A coordinated program of drills and exercises should be an integral part of the emergency management program. Drills should be used to develop and maintain personnel skills, expertise, and response capability. Drills should be of sufficient scope and frequency to ensure adequate response capability. A full participation exercise should be conducted annually in accordance with established plans and implementing procedures. Off-site response organizations should be invited to participate in site-wide exercises at least every 3 years. A critique process should be conducted for each exercise to provide accomplishments and shortcomings discovered during the exercise. 4.4.6 Maintenance Safe operation of a fusion facility is directly dependent on the scope, depth, and quality of the facilities maintenance program. Formal maintenance programs lead to increased effective- ness and safety benefits. Maintenance at fusion facilities is the aggregate of those planned and systematic actions required to prevent the degradation or failure of, and to promptly restore the intended function of structures, systems, and components (SSCs). This applies to each part of the plant that could significantly impact safe operation. The basis for this is the fundamental principle of defense in-depth. Primary emphasis should be on the success of the maintenance program to prevent the degradation or failure of, and to promptly restore the intended function of, those SSCs. 37 DOE-STD-6003-96 Fusion facilities present unique situations for maintenance programs. As an example, a program to control magnetic tools and materials around the tokamak is necessary to prevent unexpected missiles during machine operations (due to magnetic fields). In addition, remote maintenance will be used on some components. These actions add a complexity to the program that must be controlled to assure safety. Requirements for maintenance for DOE facilities are specified in DOE Order 430.1, Life Cycle Asset Management. The reference section for Chapter 4 provides a listing of guidance documents that may be helpful in developing the site specific maintenance program.

4.4.6.1 Maintenance Policy, Goals and Objectives, and Procedures Effective implementation and control of maintenance should be achieved by establishing written standards for the scope, objectives, and conduct of maintenance; by defining responsi- bilities; and by periodically observing and assessing performance commensurate with impor- tance to safety. The policies, goals, and objectives should address planning to establish a proactive main- tenance program as opposed to reactive maintenance and to ensure that the maintenance activ- ities for SSCs are consistent with their importance and function. Goals for maintenance should be established in those areas that have the potential for significant impact on plant safety. The goals should be directed toward improving or sustaining equipment reliability and performance by effective maintenance in areas key to plant safety and risk. Procedures should be established and utilized as necessary for the conduct of mainte- nance activities commensurate with the activities importance to safety. The maintenance proce- dures should provide systematic guidance to the craftsman; should be technically correct, com- plete, and up-to date; and should be presented utilizing sound human factors principles. Radiological exposure control during maintenance activities should be considered in developing procedures and work orders and in planning and scheduling maintenance. Health physics personnel should be involved in the planning and execution of appropriate maintenance work to ensure that personnel are not unnecessarily exposed and as-low-as-reasonably- achievable (ALARA) goals are met. 4.4.6.2 Plant Maintenance Organization The management of maintenance should include a defined maintenance organization with specific lines of authority, responsibility, and accountability. The management of mainte- nance requires effective written and oral communication between the maintenance department and other supporting groups such as operations, health physics, and engineering. Criteria for selecting personnel with acceptable qualifications to perform their assignments are necessary for effective staffing. The personnel qualification and training requirements should be specified. 38 DOE-STD-6003-96 4.4.6.3 Types of Maintenance The maintenance program should include surveillance to obtain in-service performance and operational data; predictive maintenance to analyze data collected from surveillance; pre- ventive maintenance based on manufacturer’s recommendations, operating experience, good engineering practice (including aging concerns), and predictive maintenance feedback; and cor- rective maintenance, as necessary. The maintenance program should ensure that recommen- dations and information from industry and individual vendors are reviewed and considered for incorporation into appropriate areas of the program. 4.4.6.4 Work Control Process

The work control process should be based on procedures that provide for the identifica- tion of deficiencies, planning and preparation for work, setting appropriate conditions for work, work procedures, supervisory authority, documentation of completed work, postmaintenance testing, return-to-service procedures, and review of completed work packages. The work control process begins with the identification of deficiencies or the need for planned or predictive main- tenance and the generation of a maintenance request. Planning and scheduling activities should then be performed. The work package should specify the appropriate plant conditions for the work; define the required isolation or tagouts and component deenergization; incorporate appro- priate QA, quality control (QC) functions, and ALARA considerations; and require appropriate supervisory authorization prior to starting work. The work package should contain postmainte- nance testing requirements and clearances or return-to-service procedures, provide for docu- mentation of completed work, and provide for a review of the completed package. The post- maintenance testing program should establish specific performance acceptance criteria that ensure a high level of confidence in the ability of the component to perform its design function when returned to service. Process indicators, which provide information regarding the effectiveness of execution of the elements of the maintenance program, should be monitored to provide insight regarding potential problem areas in the conduct of maintenance activities. Examples are postmainte- nance test results, periodic surveillance test results, ratio of preventive to corrective mainte- nance, maintenance work order backlog, time to restore component function after failure dis- cover, and frequency of rework. 4.4.7 Training and Qualifications The responsibilities and authority for training and certification must be specific, and appropriate plans and procedures must be developed and implemented. Each fusion facility should be responsible for the following: a. Develop and implement a training and qualification program using a graded approach based upon the hazards of the facility. b. Prepare, approve, and implement a training plan that sets forth the staffing, training, and qualification requirements. 39 DOE-STD-6003-96 c. Establish an organization that is responsible for the training and qualification of facility personnel. The duties, responsibilities, qualifications, and authority of training organi- zation personnel should be documented and clearly defined. d. Establish training and qualification criteria for contracted personnel used in facility organizations. Training and qualification requirements for DOE nuclear facilities are specified in DOE Order 5480.20, Personnel Selection, Qualification, Training, and Staffing Requirements at DOE Reactor and Non-Reactor Nuclear Facilities. The reference section for Chapter 4 provides a listing of guidance documents that may be useful in developing the site-specific training and qualification programs. 4.4.7.1 Facility Training Plan The facility training plan is the document that provides the overall description of facility staffing, training, qualification, and certification programs. This plan should be prepared to address the following: a. initial and continuing training programs, including maintenance of training; b. training and qualification programs for personnel who require formal qualification and certification; and

c. examination program requirements for qualification and certification. The facility training plan should be supplemented, as needed, with written procedures that address, as a minimum: examination and operational evaluation development, approval, secu- rity, administration, and maintenance; administration of medical requirements; and record keeping requirements. 4.4.7.2 Personnel Selection and Staffing Each facility should establish a process for the selection and assignment of personnel. The personnel selection process should include an evaluation of their education, experience, previous training, and existing job skills and capabilities. It is the responsibility of management to assure that personnel assigned to a specific job function have the requisite background and/or receive sufficient qualification training for the job. The following categories of facility staff are identified as requiring training, qualification, or certification to perform job functions: a. operators and their supervisors, b. experimenters, 40 DOE-STD-6003-96 c. technicians—training, d. maintenance personnel—training, e. supervisors and managers—training, f. operations and facility support functions. Specific requirements for certifying, qualifying, and training personnel are specified in the Order and general guidance documentation. 4.4.7.3 Records The program and procedures should specify the records used to document the training, qualification, and certification granted. Records should be documented and include the following types of information: a. records of education and experience, including resumes; b. results of medical examinations (when required); c. records of training completed, such as attendance sheets or computer summaries; d. results of examinations, including written examinations and operational evaluations (when required); and e. approvals and effective dates, if applicable. 4.4.8 Tritium Control, Accountability, and Physical Protection The purposes of requirements placed on tritium control, accountability, and physical pro- tection at fusion facilities are to a. meet legal requirements for environmental releases, waste disposal, and transporta- tion of tritium; b. prevent the diversion of the material for unauthorized use; c. gain knowledge of the process efficiency, that is, how much tritium is produced and used in processes under investigation; d. meet the requirements of the DOE Orders for DOE fusion facilities; e. assure operational safety of the facilities by providing knowledge of the location and form of tritium; 41 DOE-STD-6003-96 f. prevent unwanted buildup of tritium within a facility; and g. protect and control tritium commensurate with its monetary value. It is difficult to determine the distribution and precise inventory of tritium in a fusion facility. Usually, measurement before injection into the plasma chamber and after removal from the plasma chamber is possible (referred to as inventory by difference). However, tritium production in the machine is also possible. Therefore, the actual amount of tritium remaining in the machine is difficult to determine (this can affect the safety analysis, because there is usually an upper bound on the amount of tritium allowed in the vessel). Sampling tiles or protective surfaces maybe a way of determining the tritium levels; however, those samples may or may not be representative of the tritium levels throughout the vacuum vessel.

It is therefore critical that the designers of the facility determine appropriate means to reliably measure tritium in the fusion facility. This should be done early in the design process to minimize tritium holdup, allow for pumping and purging systems to evacuate the tritium, and specify appropriate instrumentation for measurement. These actions will assure safety of the facility, reduce the risk of a release and improve worker safety. Methods for measurement of tritium are specified in later paragraphs. Tritium is the predominant nuclear material used at fusion facilities. It is of interest because of safety concerns, its monetary value, and possible unauthorized diversion for other applications. Although public exposures and environmental releases are expected to be small and well below regulatory limits from a fusion facility, tritium is a radioactive material, and the public will need to be assured that safety has not been compromised. Other nuclear material that must be controlled and accounted for at fusion facilities includes depleted uranium (U-238) and deuterium. Depleted uranium is used for storage of tritium, fission chambers, and various radioactive check- and calibration-sources. Deuterium in quantities greater than 100 g is also controlled at DOE facilities (DOE Order 5633.3B and 5660.1B). The control and accountability of these materials is relatively straightforward and does not present significant problems for operating facilities. The scope and extent of the accountability program for these materials should be based on the monetary value of the material and should include inventories and some measurements. 4.4.8.1 Requirements The requirements placed on the control and accountability of tritium fall into three cate- gories. Those required by the U.S. law, those required by DOE Orders, and those required by “good practices.” It is also important to note that requirements are not consistent throughout the international community. a. Legal requirements. The legal requirements on tritium measurement are as follows: 1. Environmental facility emissions, which include air emissions and releases to the ground water or at facilities outfalls, are regulated. These include federal and state 42 DOE-STD-6003-96 requirements in the following laws: Clean Water Act for water quality standards and effluent limitations, and Federal Clean Air Act, which set ambient air quality standards. EPA regulates the type and quantity of facility emission. EPA specifies the mea- surement techniques for air emissions and must approve any requests for devia- tions. EPA sets the limits for exposure to the public and the notification required when certain quantities of radioactive materials are emitted. State laws usually regulate the facility outfalls. State requirements are not uniform across the country. 2. Department of Transportation (DOT) requirements specify packaging requirements that are dependent on the form and quantity of tritium. DOT must also approve packaging containers when the radioactive material is transported on public highways. 3. Waste storage requirements are in place when mixed hazardous waste may be involved. The EPA administers the Resource Conservation and Recovery Act (RCRA). In many cases this authority has been delegated to the state. 4. Waste disposal requirements are generally state specific.

5. 10 CFR 830 Nuclear Safety Rules and 10 CFR 835 Occupational Radiation Protection apply to the radiological activities in a fusion facility. Because these requirements are part of the U.S. law, they must be followed by each facility that handles tritium or radioactive materials as applicable. The details of the state requirements will not be discussed in this section because they vary widely. b. DOE Orders. DOE Orders are requirements placed on DOE facilities that define operations and the methods of conducting business. DOE 5633.3B, “Control and Accountability of Nuclear Materials” specified the minimum requirements and pro- cedures based on the amount of tritium and the form of the tritium in a facility. Important requirements from this order follow: 1. Tritium is protected, controlled, and accounted for as Category III or IV Special Nuclear Material. The level of protection and control depends upon the form and quantity of the tritium. The reportable transaction quantity is 0.01 g (~100 Ci). 2. Each facility must have a Materials Control and Accountability (MC&A) Plan. The scope and content requirements for the plan are determined by the manager of the DOE operations office. 3. DOE Order 5633.3B requires that tritium be inventoried biennially. Where feasible, inventory values should be based on measured values. 43 DOE-STD-6003-96 4. Inventory requirements are placed on the shipper and receivers of controlled material and methods to control and resolve inventory differences. 5. Access controls, depending on the tritium form, must be established. Each fusion facility must establish an independent organization to provide oversight of the nuclear materials control and accountability. The physical protection requirements are specified in DOE Order 5632.1C, “Protection and Control of Safeguards and Security Interests,” and DOE 5332.1C-1, “Manual for Protection and Control of Safeguards and Security Interests.” The current DOE requirements are dependent on the quantity and form. These include control of tritium by personnel with a U.S. DOE L clearance and controlled locks, alarms, and access during nonworking hours. A higher level may be required if there are sabotage risks or classified information interests at the facility. Other Orders specify waste requirements, environmental monitoring, and personnel pro- tection. These are not discussed in this section. The DOE Order requirements are in general not legal requirements. The facility can negotiate with DOE to determine the most cost-effective manner of implementing the requirements and still maintain facility safety and material accountability. 4.4.8.2 Nuclear Material Locations at a Fusion Facility Typical locations, inputs, and outputs, and measurement points for tritium at a fusion facil- ity are identified below. a. Inputs to tritium are shipments into the facility and production of tritium at the facility. b. Locations of tritium within a facility are “in-process,” in-system holdup, in-waste sys- tems, and in-storage. c. The exit streams of tritium from a facility include shipments of tritium from the facility and waste streams (tritium stack emissions, water releases, solid waste and acciden- tal tritium releases). d. Measurement locations include input tritium shipments to the facility, exit shipments from the facility, in-process measurements, in-storage measurements, waste stream measurements, personnel exposure measurements, workplace measurements, and stack emission measurements.

4.4.8.3 Tritium Measurements Method Two primary categories of tritium measurements are made at fusion facilities. One cate- gory is for determining the quantity and location of tritium within the facility. These measure- ments are generally of large quantities of tritium in high concentrations. The second category is for environmental or safety determinations. These are generally lower concentrations and small quantities. 44 DOE-STD-6003-96 This section will discuss methods for both categories. The measurements techniques for tritium can be grouped in the three general areas: composition measurements, thermal mea- surements, and tritium concentration measurements. Composition measurements determine the actual concentration determination for each atomic/molecular species. This method can be used for gases only. Thermal methods (calorimetry) rely on the radioactive heat of decay of tritium. For 1 g of tritium ~0.333 W is gen- erated by decay. The temperature increase or heat generation is measured. Calorimetry can be used for tritium in any form: solid, liquid, or gas. The only radioactive material present must be tritium because other radioactive materials will contribute to the thermal properties of the sample. The final method determined the total tritium concentration by the measurement of the products or the effects of the products of the radioactive decay. The beta particle can cause scintillation effects or ionization effects. These effects can be measured and the concentration of tritium determined. The following methods are used or proposed to be used for measurement of tritium: Pressure/Volume/Temperature/Composition (PVTC), using either a mass spectrometer or laser RAMAN spectrometer for the composition measurement; Beta scintillation counter; Self- assaying tritium storage beds; Scintillation Counting; and Ion Chamber. Most of the techniques discussed here are batch samples, however some techniques can be used for “on-line/real time” measurements. a. Composition Measurements. PVTC measurement is used for measurement of gaseous samples only. A representative sample of the gas is taken. The gas that is to be measured must be mixed well. The volume, pressure, and temperature must be measured accurately. The temperature is difficult to measure accurately because of temperature gradients caused by the heat of decay of tritium. The composition of the gas in the sample is then measured using a mass spectrometer or a laser RAMAN spectrometer. The mass spectrometer will measure all gas species. A high-resolution mass spec- trometer is required to distinguish between different molecules with the same mass number. For example HT and D2 have the same mass number, but must be sepa- rated to determine the tritium concentration. All species that can contain tritium must be measured. This includes, water as HTO, methane as C(H,D,T)4, ammonia as N(H,D,T)3, etc. The sum of all the species containing tritium can then be determined. If the approximate gas composition is unknown, the use of the mass spectrometer may be difficult. The laser RAMAN spectrometer is a relatively new system that can be used to mea- sure molecular concentrations in a gas mixture. The sample is placed in a cell with optical windows. The laser excites the rotational or vibrational atomic levels in the gas molecules. The light emitted as the excited levels decay back to the ground state is detected using a photodetector system. The measurement is absolute in that the fre- quency spectrum of each molecule is unique. The intensity is proportional to the amount of gas present. The disadvantages of the RAMAN method are that the amount of inert gases cannot be determined. Common inert gases at a fusion facility are the

45 DOE-STD-6003-96 isotopes of helium. Both of these techniques can be used for real-time measurements. For the mass spectrometer system a sample is bled to a high vacuum system for mea- surement. The RAMAN system is easily adopted to real-time measurements. The gas stream at atmospheric pressure is passed through an optical cell. The spectrum for a mixture hydrogen isotopes can be determined in ~1 min. The total accuracy of these measurements is ~3 to 5%. The mass spectrometer technique has been the standard method that DOE facilities have used for the determination of the tritium inventory. It is a proven system although it requires an expensive spectrometer ($200K) and accurate determination of the temperature, pressure, and volume. The RAMAN system has not been accepted. Experiments are currently being performed to demonstrate that this will be an acceptable technique. b. Thermal Methods. The primary method to inventory large quantities of tritium in the liquid or solid form is to use a calorimeter. The sample is placed in a thermally iso- lated container. The power required to maintain the temperature of the container is then a measure of the amount of tritium in the sample. Containers can accept sam- ples that vary from several inches in diameter up to a 55-gal drum. The lower limit of accuracy can be as low as 100 Ci. Calorimeters are expensive ($200K+). They require high-tech electronics. They are the primary methods used to measure tritium in waste such as HTO on molecular sieve. They have not been used to measure process tritium except in a very specific application. For example, solid tritium storage beds that can be disconnected and moved have been placed in a calorimeter designed to accept the bed. New methods are being developed to allow for the deter- mination of the amount of tritium stored on a solid storage bed, When tritium is stored on a uranium bed the temperature increase of the bed can be used to determine the amount of tritium stored on the bed. When tritium is stored on a material such as LaAlNi, usually gas is passed through the secondary containment to maintain the temperature. The temperature rise of the gas as it passes through the bed can then be used to determine the amount of tritium. Both of these methods are being pro- posed for tritium accountability. Their acceptance is now based on a case-by-case system, and they are not used widely. Development of these methods will be impor- tant for the operation of fusion facilities. They offer potential savings in time and effort to account for the tritium in a facility. c. Tritium Concentration Measurement. A Beta scintillation counter has been used for tritium measurement if only the total tritium composition is required. In this instrument, the gas is passed over a crystal that will scintillate with the beta from the tritium decay. A photomultiplier tube is used to detect the light. The tritium concentration can then be determined from the signal from the photomultiplier tube. This method is commonly used for gas inventory requirements. Liquid scintillation is commonly used to determine small concentrations of tritium. The tritium liquid or compounds containing tritium are placed in a scintillation liquid. The liquid is then placed in a counter that determines the amount of tritium by the light emitted from the sample. Ion chambers are commonly used to determine environmental tritium releases and to monitor the atmosphere for personnel safety. Process ion chambers are used for determining tritium concentrations in secondary containment. Specially designed ion chambers

46 DOE-STD-6003-96 can be used to determine high concentrations of tritium. Ion chambers will measure any radioactive material that can cause ion pairs. They are also susceptible to con- tamination from materials that adsorb on surfaces and can only be used for gas. 4.4.8.4 Facility Measurement Recommendations a. Measurement of tritium input/output to facility. The primary method used historically for the measurements of the tritium shipment has been the PVTC measurement with the composition determined by either a mass spectrometer or beta scintillation counter. A calorimeter can be used for the measurement of tritium absorbed on solid storage beds that are designed to be used as primary shipping containers and also be placed in the calorimeter. b. In-process tritium measurements. The measurement of tritium within a facility has usually been by PVTC. This requires a shutdown of the process and transferring of all the gas to a volume for sampling and measurement. This is usually a substantial dis- ruption of the process and will take a significant time. Tritium that is “held up” in pro- cess cannot be directly measured. This includes tritium in walls of the system, tritium in process components such as a molecular sieve, and tritium contained within the waste disposal system. It must be estimated by difference measurements. Real-time measurements of tritium amounts are done when tritium is moved around the facility or process. These are usually done by PVTC measurements. The laser RAMAN system offered advantages for the measurement of composition as tritium flows from location to location. The use of self-assaying storage beds will greatly reduce the time required to determine the tritium in storage. c. Tritium in waste streams. The characterization of tritium contained in waste streams is important, and one of the more difficult measurements to make. Ionization chamber measurements, calorimetry, and difference measurements are used to determine the tritium levels. d. Stack emission measurements. Stack emissions are determined by ion chambers. The primary method used by facilities for the reporting to the EPA is based on a pas- sive monitoring system. A small fraction of the air stream exhausted from a facility is passed through a system to remove the tritium. Both liquids such as glycol and solids such as molecular sieve are used to absorb HTO. These system can distinguish between HTO and HT by passing the sample through a catalyst that will convert HT to HTO. The second collection system then collects the HT as HTO. 47 DOE-STD-6003-96 Intentionally Left Blank 48 DOE-STD-6003-96 5. SAFETY ANALYSIS This chapter of the Standard describes the safety analysis requirements applicable to fusion facilities and provides guidance for the implementation of these requirements and criteria for determining that the requirements have been met. Safety analyses are performed to show that the risks associated with operation of a facil- ity have been identified, quantified, and managed. Management of risk can be accomplished (1) by demonstrating that the risk is within the bounds of an approved safety envelope, (2) by showing that the risk consequences are mitigated to meet the established evaluation guidelines, and (3) by having the risks themselves eliminated or reduced by demonstrable controls.

The completion of a safety analysis requires information on the facility, the site character- istics important for evaluating facility safety, and the principal equipment and processes required to fulfill the facility mission. From this baseline descriptive information, hazards can be identified. Facility risk descriptions are then developed from the hazard inventories, system functional pro- cess descriptions, and a listing of off-normal conditions postulated to result from both internal and external causes. The entire analysis process is documented in a Safety Analysis Report (SAR) and in Technical Safety Requirements (TSRs); the guidance for these is addressed in later subsections. The safety analysis has many purposes. In addition to establishing the safety of the facil- ity, the safety analysis is used to develop TSRs and to determine readiness for construction and operational authorization. The graphical illustration of the functional relationship of the major items included in the safety analysis process is shown in Fig. 5.1. As discussed in Section 1.3, a risk-based prioritization approach is to be taken in the implementation of safety analysis requirements as well as in the implementation of the other ele- ments of this Standard. Actions taken to ensure compliance with requirements are a function of the several factors cited in the definition of risk-based prioritization. The factors most relevant to fusion safety analysis considerations are risk and magnitude of hazard. The other factors included in the risk-based approach are mission and facility life cycle. As such, the importance of these factors is discussed where appropriate in the applicable sections of this chapter. The project has the responsibility for the development of specific criteria for the applica- tion of a risk-based prioritization approach to the system specific criteria. Concurrence with the specifics of the risk-based approach taken by a facility should be obtained from the regulator prior to its implementation. The identification of relevant criteria will flow from the nature and purpose of the system itself. 49 DOE-STD-6003-96 FIGURE 5.1. Flow logic of the safety analysis process. 50 DOE-STD-6003-96 5.1 Facility Description 5.1.1 General Safety analyses inherently contain a description of the facility being analyzed that is suffi- cient to convey an understanding of the nature and magnitude of the physical plant and systems involved in the implementation of the facility mission. The description should be sufficient to allow the reader to understand how the hazardous materials, systems, components, and pro- cesses that are discussed later relate to the system as a whole and to understand the role and relevance of the safety systems in the facility. The facility description should also include those site characteristics that constitute or contribute to facility hazards. The site information should be sufficient to provide a basis of understanding of the hazards and the mechanisms by which radiological or hazardous material could have consequences to the public, environment, or workers. Useful guidance on the content of a facility description portion of a safety analyses is available in Department of Energy (DOE) Order 5480.23, attachment 1, page 24 (DOE 1992b):

Safety analyses should contain descriptions of the facility and the principal equipment and processes provided to fulfill the mission of the facility and should delineate the plans, provisions, and requirements for their operation, mainte- nance, and surveillance. Information on the design of principal structures, com- ponents, and systems should be furnished in sufficient detail to support the identification of hazards, principal safety criteria, selection of engineered safety features, and the analysis of off-normal conditions. This information should include the following, using drawings as necessary: a. A listing of the safety structures, systems, components, equipment, and processes discussed in this section of the report; b. Detailed descriptions of structures or containers used to confine radioac- tive materials or hazardous chemicals; c. Detailed descriptions of safety-significant mechanical, electrical, and fluid systems (i.e. decay heat removal methods...) including functions, design bases, and relevant design features; d. Detailed descriptions of chemical process systems, including information on design configuration, dimensions, materials of construction, pressure and temperature limits, corrosion allowances, and any other operating limits, and; e. A functional description of process and operational support systems, including instrumentation and control systems... 51 DOE-STD-6003-96 The facility description information must be an integral part of the safety analysis, but it is possible to accomplish this by providing the information in nonsafety analysis sections of facility documentation or even in totally separate documents, either of which would then be referenced in the specific safety analysis discussions. The configuration control requirements applicable to SARs would also apply to information referenced in the SARs but contained in other documents. (See configuration control requirements of Chapter 4.) 5.1.2 Safety Structures, Systems, and Components Safety structures, systems, and components (SSCs) implement the safety functions associated with a facility. The two categories of safety functions associated with fusion facilities are (1) public safety functions or essential characteristics needed to ensure the safety of the facility and protection of the public and environment during operations and during and following off-normal conditions; and (2) worker safety functions that ensure the health and safety of the workers. The public safety function for fusion is the confinement of radioactive and hazardous material under normal and off-normal conditions. Potential public safety concerns related to confinement include (1) ensuring afterheat removal, (2) providing rapid plasma shutdown, (3) controlling of coolant internal energy, (4) controlling of chemical energy sources, (5) controlling of magnetic energy, and (6) limiting air and water discharges from the facility. Worker safety functions are related to worker hazards and routine releases. The issues associated with the worker safety function that should be evaluated are (1) limiting occupational exposure to radiation, (2) limiting the exposure to electromagnetic fields, and (3) controlling other industrial hazards and hazardous materials. It is recommended that the SSCs required to implement the public safety function should employ the requirements imposed on systems defined as being safety-class SSCs in DOE 1994 (DOE STD-3009-94). The specific definition of a safety-class system is as follows:

Systems, structures, or components including primary environmental moni- tors and portions of process systems, whose failure could adversely affect the environment, or safety and health of the public as identified in the safety analysis. The safety-class SSCs are associated with the public safety function of confinement that protects the public and the environment from exceeding the radiological evaluation guidelines in DOE-STD-6002. It is recommended that the SSCs that address potential safety concerns or are required to protect the worker safety functions should employ the requirements imposed on systems defined as being designated as safety-significant SSCs in DOE 1994 (DOE STD-3009-94). The specific definition of a safety-significant system is as follows: Structures, systems, and components not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to 52 DOE-STD-6003-96 defense in depth (i.e., prevention of uncontrolled material releases) and/or worker safety as determined from hazard analysis. The safety-significant SSCs have the goals of (1) ensuring the availability of the public safety functions via defense-in-depth and (2) supporting the health and safety of workers during routine operations. The safety-significant SSCs would not be required to mitigate the conse- quences of off-normal events to meet the evaluation guidelines for the public or the environ- ment. This function is the responsibility of the safety-class SSCs. However, because the SSCs that address the potential safety concern related to confinement will reduce potential threats to confinement through either accident prevention or mitigation, they are considered to contribute to defense-in-depth and thus are designated as safety-significant. The categorization of a safety-class SSC is a two-step process. The first step is to identify early in the design the SSCs whose failure would result in exceeding evaluation guidelines. This should be by a “top down” functional hazards analysis. The second step is to verify in the final stages of design that the safety-class SSCs are actually needed to be functional, as indicated by the safety analysis process. If the SSCs are verified as being needed in the safety analysis process, then the equipment would be designated as safety-class SSCs. These components also must perform the required safety functions. This design approach would be as follows: a. identify all potential hazards associated with the facility, b. identify all SSCs needed to control those hazards, c. identify the safety-class SSCs necessary to ensure that evaluation guidelines are not exceeded, and d. verify, through detailed safety analysis, the need for the systems in item (c) to meet the evaluation guidelines provided in DOE-STD-6002. The safety-class SSCs should be designed such that a minimum number of active or passive mitigative systems identified from and credited within the safety analysis are available to ensure that the evaluation guidelines are not exceeded. Reliable SSCs are required to be employed to satisfy the requirements of safety-class items. Use of defense-in-depth principles such as redundancy, simplicity in design, independence, fail safe, fault tolerant, and multiple (diverse) methods for increasing the reliability and reducing the consequence to acceptable levels is permitted and encouraged. In most cases, the use of passive methods of accomplish- ing the safety function is preferred over using active systems.

The next step in the process would be to perform the required system safety analysis. The safety analysis results would verify the adequacy of the safety-class SSCs to mitigate the release of hazardous material to meet the evaluation guidelines specified in DOE-STD-6002. Thus, the results of this evaluation determine which of the SSCs would be required to satisfy the public safety function. It may result in multiple SSCs being required to satisfy the safety system requirements for a particular off-normal condition scenario. In most cases, the SSCs identified in the hazards assessment review would be the same as those verified by the safety analysis as 53 DOE-STD-6003-96 being SSCs required to implement safety. In addition, the safety analysis would verify the ade- quacy of safety-significant SSCs in addressing the potential safety concerns. Worker protection and potential safety concerns associated with the public safety function are identified in DOE-STD-6002. Descriptions of each SSC that is providing safety functions are required in the SAR. A basic descriptive model of the facility and its equipment must be provided in which the required SSCs are addressed in detail commensurate with their preventive or mitigative role in meeting off- normal condition evaluation guidelines. For example, consider a facility that cannot meet evaluation guidelines, as discussed in DOE-STD-6002, unless credit is taken for system A. Besides being noted in the general facility description, system A together with associated codes and standards would be described in the section on safety-class SSCs. This system would typi- cally be associated with a specific TSR (discussed in Section 5.7) and would be described in detail commensurate with its importance to the safety basis. However, only the characteristics of the SSC that are necessary to perform the safety function are classified as part of the safety system. For example, if a valve in a system is only required to provide an external pressure boundary, then only the pressure boundary function would be classified as a safety system characteristic and all other functions, such as the valve operability, response time, etc. would not be included in the safety system definition. Conversely, if the consequences of all hazardous releases or off-normal conditions exam- ined meet the evaluation guidelines without relying on the safety-class function of process system B, then system B would not be considered to be a safety system performing a safety function. Detailed identification of its functional basis and construction is not necessary because it is not a significant contributor to the overall facility safety basis. There would also be no need to discuss administrative provisions (e.g., initial testing, maintenance) required to ensure the operability of system B, nor would there be a need for a specific TSR (e.g., Safety Limit, Limiting Condition For Operation, etc.) covering system B. If a system is designated as safety-significant, industry recognized codes and standards are to be applied and minimal, if any, TSRs are to be specified for the operation of the system components (see Section 5.7).

A risk-based prioritization approach can be used to develop requirements for the safety- class and safety-significant SSCs. One of the dominant factors governing risk-based prioritiza- tion is the severity of the off-normal condition consequences associated with the facility and the number and type of the SSCs needed to prevent evaluation guidelines from being exceeded. If, for example, the defense-in-depth principles are satisfied by providing other SSCs to mitigate the consequences, then added inspections and other quality pedigree requirements of the first system would not be as important as if the original SSCs were the only means of accomplishing the safety function. If the consequences of the off-normal condition exceed the evaluation guide- lines by a large margin and there is no other system that will mitigate or prevent the release for the off-normal condition, then special precautions should be taken in the design and in develop- ing the inspection program to ensure that the system will be available to function when called upon. This may involve special inspections, alternate design approaches, or other actions that would significantly enhance system reliability. The rigor of compliance with the design and inspection requirements could be relaxed for systems that have multiple backups for preventing off-normal conditions or mitigating the off-normal condition consequences. 54 DOE-STD-6003-96 The design of the SSCs that perform the safety-class and safety-significant safety func- tions should meet the appropriate requirements established in Table 5.1. TABLE 5.1. Safety system functional requirements Requirement Safety-Class Safety Function Safety-Significant Safety Function System design Reliable methods of accomplishing the required safety function should be provided. Some of the design techniques that would ensure system reliability would include redundancy, diversity, simplicity in design, independence, fail safe, fault tolerant. Each method should be analyzed to identify potential failure mechanisms from performing the safety function in the system and to minimize those failures in the design. For further guidance on providing reliable system designs, see Section 6.7.3.1. Nonredundant systems are normally used to perform the worker safety function. The safety system should be analyzed to preclude failures mechanisms that could disrupt the system function. Multiple systems may be employed, at the discretion of the facility developer, to ensure that the system functions are performed. Codes and Standards Nationally accepted design codes should be used in the design (see Chapter 6). The applicability, adequacy, and sufficiency of the codes and standards used should be evaluated. These codes and standards should be supplemented or modified as necessary to ensure system performance in keeping with the importance of the safety functions to be performed. The codes and standards used for these systems should be those which have been validated through satisfactory performance in commercial application. Reliability Safety system should be demonstrated to have a high reliability. One of the ways to demonstrate this is by providing multiple, redundant, diverse systems/barriers to accomplish the safety function. The safety system should be equivalent to that associated with commercial industrial safety practices.

Quality The SSCs should require an appropriate level of quality for the design and construction to ensure the system function is performed. Quality assurance in accordance with the requirements of 10 CFR 830.120 should be implemented. The systems required should be designed in accordance with industrial quality requirements. Testability/ surveillance The SSCs should be tested/surveyed periodically to determine that the function can be provided. Acceptance criteria should be established to evaluate the test results that demonstrate when the system is performing its intended function. The test frequency should be established to ensure that the system demand and reliability requirements are achieved. The SSCs should be tested/surveyed periodically to determine that the function can be provided. Natural phenomena The SSCs should be designed to withstand appropriate natural phenomena and continue to provide the required safety function. Design for natural phenomena should be in accordance with facility performance goals per DOE Order 420.1 (DOE 1995a). Design for natural phenomena should be in accordance with facility performance goals per DOE Order 420.1 (DOE 1995a). 55 DOE-STD-6003-96 5.2 Facility Mission/Processes Descriptive information on the overall mission is required as part of the SAR. It is also a major factor in the development of the risk-based prioritization approach being implemented throughout each aspect of facility safety design. Information on the facility processes is used primarily in the hazards analysis phase of the safety analysis. Facility process information and facility description information are used to develop the inventory of facility hazards. Facility risks can then be established by identifying the accessibility of each hazard. The first criterion for determining the sufficiency of mission and process information in the safety documentation is whether there is enough to support closure of the safety analysis. That is, are there undocumented aspects of the facility mission or its processes that would in any way affect the conclusions of the safety analysis with respect to the particular component, system, and so on. The conclusion should be that there are not; should there be any situation that pro- duces an answer to the contrary, then the mission/process descriptive information is deficient. A second criterion for the sufficiency of mission information is whether there is enough to implement a risk-based prioritization approach throughout the safety design activity. The previ- ously described design and analysis activities would normally provide the necessary information to satisfy the requirement. 5.3 Hazards Analysis The hazards analysis performed for a given facility provides a measure of the risk poten- tial for operation of that facility. The results of the hazards analysis will dictate the level of detail required for the safety analysis that must be performed for approval to operate. The following steps must be performed in the development of the hazards analysis: a. Identify the potential energy sources, the initiating events, and inventories of radioac- tive and hazardous material that could be present in the facility both during routine operations and shutdown conditions, based on the classification methodology devel- oped in such documents as DOE-STD-1027-92 (DOE 1992d). b. Classify the facility into categories according to the its hazard potential using an approach that does not account for safety system mitigation.

The categories with the higher hazard potential for a facility require a more detailed safety analysis to demonstrate that the facility can be operated safely. 5.3.1 Inventory The inventory of the radioactive and hazardous material is one of the determining factors in the hazards analysis classification of a facility. A set of radioactive inventory limits has been developed for use in the classification of fusion facilities into various hazard categories 56 DOE-STD-6003-96 described in the following section. Because the radionuclide inventory limits contained in DOE-STD-1027 are primarily associated with the fission process, the radionuclide list has been expanded to include additional isotopes that could be present in fusion facilities. The expanded limits for Category 2 fusion facilities are provided in Appendix A to this Standard. The radioactive and hazardous material inventories can be segmented provided it can be shown that the potential consequences associated with the hazardous material are limited to the segmented amount rather than the inventory present in the more than one segment or the entire facility. Based on the guidance presented in DOE 1992d, inventory segmentation is allowed if the hazardous material in one segment could not interact with the inventory in other segments to result in larger potential consequences than from any of the individual segments. For example, independence of the heating, ventilating, and air conditioning (HVAC) and piping must exist to demonstrate independence for facility segmentation purposes. This independence must be demonstrated and places the “burden of proof” on the analyst. 5.3.2 Classification The classification of fusion facilities should follow the guidance provided in DOE-STD- 1027-92 (DOE 1992d). This guide provides for three facilities hazard categories summarized as follows: a. Hazard Category 1—Hazard analysis shows the potential for significant off-site con- sequences. Fusion facilities in this category would be designated by the cognizant DOE official. b. Hazard Category 2—Hazard analysis shows the potential for significant on-site con- sequences. Examples include facilities with the sufficient quantities of hazardous radioactive materials that meet or exceed the inventory values contained in the guid- ance document used for classifying facilities (DOE 1992d). c. Hazard Category 3—Hazard analysis shows the potential for significant localized con- sequences at a facility. Examples include facilities with quantities of hazardous radio- active materials that meet or exceed the inventory values contained in the guidance document used for classifying facilities. In addition to these three categories, there is an additional category for all of the facilities that have less hazard potential than the least of the previous three categories. This category is defined as follows: d. Below Hazard Category 3—Hazard analysis shows the potential consequences to be below the guidelines of the requirements described in DOE-STD-1027-92, as modified by this Standard. An example of this is those facilities that have inventories of radio- active material less than those specified for Category 3 facilities for hazard catego- rization. Thus, these facilities would be classified as non-nuclear facilities. It should be noted that many of the smaller fusion facilities could fall into this category. 57 DOE-STD-6003-96 5.4 Analysis of Off-Normal Conditions

The requirements of this Standard indicate that the safety of fusion facilities should be analyzed to demonstrate that the facility meets the evaluation guidelines discussed in DOE-STD-6002. This section provides guidance on the type of analysis of off-normal conditions required for use in meeting the evaluation guidelines and the fusion requirements related to no off-site evacuation. The types of analyses used to demonstrate compliance with these require- ments are different and need discussion in this section. The level of analysis of off-normal conditions for fusion facilities should be based on the risk to the public, the environment, and the worker. Facilities with minimal risk will only require that a scoping conservative analysis be performed to satisfy the safety analysis requirements. However, a facility with a large potential safety risk to the public, the workers, or the environ- ment (Category 1 and 2 facilities) will require a more detailed analysis of off-normal conditions to satisfy the safety analysis requirements for such facilities as given in this section. It is important that the safety analysis address the institutional and human factors safety issues. Experience has confirmed that the risk associated with operating nuclear facilities is a combination of the institutional approach to safety, human factors safety, and safety in design. As used here, the institutional approach to safety includes a. management and organization of facility operations; b. the safety culture sustained by management; c. performance objectives and the measurement of operational performance; d. management oversight and assessment; e. feedback of operational experience; f. management controls of operations, surveillance, and maintenance; g. related management efforts to achieve and sustain safe operations. Human factors safety, as used here, refers to a. the allocation of control functions to personnel vs automatic devices; b. staffing and qualification of operating crews; c. personnel training; d. the preparation, validation, and use of written procedures to guide operations, surveillance, and maintenance; 58 DOE-STD-6003-96 e. the design of human-machine interface to build on strengths and protect against the susceptibility of human error in operating crews. Safety in design includes a. identifying the potential off-normal conditions and incorporating systems performing safety functions in the facility design to reduce the overall risk from those conditions; b. designing reliable safety features using appropriate codes and standards that will ensure the availability of the safety when required; c. categorizing the facilities to their appropriate risk potential because the level of safety features that are required for a given facility will be a direct function of the significant risks present in a facility; d. using defense-in-depth concepts in the design to ensure the safety of the public, worker, and the environment; e. incorporating the as-low-as-reasonably-achievable (ALARA) principles in the facility design to reduce the risk potential to the workers during normal and off-normal conditions. The specific features associated with the design of a facility are discussed in detail in Chapter 6. 5.4.1 Event Scenario Identification and Classification Figure 5.2 is a flow chart that can be used to understand the steps required in the analy- sis process. First, a list of postulated initiating events should be developed. Based on the generic hazard and accident scenario identification (presented in Appendix B), these initiating events could include the following:

a. loss of coolant (e.g., water and cryogen); b. loss of flow; c. magnet transients (arcing, quench, coil displacement, and magnet missile); d. transient overpower; e. plasma disruptions [including vertical displacement events (VDEs) and runaway electrons]; f. loss of vacuum; g. initiating events in the tritium plant; 59 DOE-STD-6003-96 FIGURE 5.2. Event scenario/safety analysis process. 60 DOE-STD-6003-96 h. initiating events in auxiliary systems [e.g., neutral beams, radio frequency (RF), pumping, and fueling]; i. initiating events in balance of plant systems (e.g., loss of off-site power); j. operator errors; and k. external events. The initiating events should consider all aspects of fusion facility operation, including plasma operation, bakeout and conditioning, and maintenance. Because fusion facilities operate in modes that are different from other facilities (e.g., bakeout and conditioning, in pulsed mode for some machines), these potential plant states should be examined carefully. In the develop- ment of these postulated initiating events, completeness is somewhat problematic. Practical completeness can then best be achieved by collective review of the results by safety analysts and designers who understand the facility. From these postulated initiating events, event scenarios should be developed that exam- ine the response of the fusion facility to these initiating events, accounting for potential failure of other systems (e.g., confinement). The use of event trees or event sequence diagrams may be useful here. The event scenarios should span a wide range of expected frequencies, including those events expected to occur once or more during the operating life of the facility [i.e., an anticipated operational occurrence (f > ~10–2/yr); those events not expected to occur, but may occur, during the life of the plant (10–2/yr > f > 10–4/yr); those events that would not be expected to occur during the life of the plant but which form the limiting events needed in the design basis (10–4/yr > f > 10–6/yr); and events beyond the design basis (f < ~10–6/yr)]. Once the events have been developed, they should be categorized into three types based on their estimated frequency: anticipated operational occurrence, off-normal conditions, and beyond-design-basis events. The off-normal conditions type includes both the anticipated operational occurrences and events expected to occur once or more during the lifetime of the facility. Based on these events, bounding or limiting events of each kind (e.g., loss of flow, loss of coolant, and loss of vacuum) should then be selected for detailed quantitative analysis. Two types of analysis methodologies should be used for the safety assessment for the fusion facilities: a deterministic, conservative approach and a best-estimate, realistic approach. Each type of analysis methodology is required for a different portion of the required safety assessment. The deterministic, conservative approach is to be used in the design-basis assess- ment for the SAR to ensure that a bounding estimate of the facility safety is determined. The best-estimate, realistic approach is to be used for analysis of beyond-design-basis events for the SAR and in the determination of the emergency planning assessment. However, a conser- vative risk-based approach can be used in place of the deterministic conservative approach since either approach would satisfy the intent of performing a conservative safety assessment. These are discussed in the next two sections.

61 DOE-STD-6003-96 5.4.2 Analysis Approach for the Safety Analysis Report Because there is no previously identified design basis for large fusion facilities like the International Thermonuclear Experimental Reactor (ITER), a subset of the event scenarios identified in Section 5.4.1 needs be selected to form the design basis and to undergo detailed quantitative analysis as part of the SAR. There is varying information that can be used to develop an appropriate criteria to be used in this selection. DOE Order 420.1 (DOE 1995a) and DOE-STD-3009 (DOE 1994) indicate that events down to ~10–6/yr should be considered. Many advanced fission plants are also considering similar criteria. It is recommended that for fusion facilities, internally initiated event sequences down to ~10–6/yr be used. For external events, guidance given in DOE Order 420.1 (DOE 1995a) should be consulted. Two different types of calculations should be performed: best estimate and conservative. Conservative calculations should be performed for those events identified as part of the design basis. As part of the calculation, all key assumptions need to be stated and the level of conser- vatism noted (e.g., 110% nominal power). The results of these conservative calculations are