DOE-STD-6003-96, Safety of Magnetic Fusion Facilities: Guidance

TS NOT MEASUREMENT SENSITIVE DOE-STD-6003-96 May 1996 DOE STANDARD SAFETY OF MAGNETIC FUSION FACILITIES: GUIDANCE U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. Welcome This Portable Document Format (PDF) file contains bookmarks, thumbnails, and hyperlinks to help you navigate through the document. The modules listed in the Overview are linked to the corresponding pages. Text headings in each module are linked to and from the table of contents for that module. Click on the DOE seal below to move to the Overview. This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (423) 576-8401. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 487-4650. Order No. DE96009494 DOE-STD-6003-96 TABLE OF CONTENTS Page FOREWORD......................................................................................................................... ix DEFINITIONS ....................................................................................................................... xi LIST OF ACRONYMS ......................................................................................................... xix 1. INTRODUCTION ............................................................................................................. 1 1.1 Purpose.................................................................................................................... 1 1.2 Background .............................................................................................................. 1 1.3 Implementation......................................................................................................... 2 1.4 Overview .................................................................................................................. 2 2. RADIATION AND HAZARDOUS MATERIAL .................................................................. 5 2.1 Dose Definitions....................................................................................................... 5 2.2 Public Exposures and Environmental Impacts......................................................... 6 2.2.1 Evaluation Guidelines for Exposures to the Public....................................... 7 2.2.2 Additional Guidance ..................................................................................... 8 2.2.3 Environment ................................................................................................. 8 2.3 Routine Worker Exposure ........................................................................................ 9 2.3.1 Radiation ...................................................................................................... 9 2.3.2 Hazardous Materials .................................................................................... 9 2.3.3 Common Industrial Hazards......................................................................... 10 2.3.4 Magnetic Fields ............................................................................................ 10

2.4 Guidance for Meeting Regulatory Limits.................................................................. 11 2.4.1 Evaluation Guidelines................................................................................... 11 2.4.2 Exposure ...................................................................................................... 12 2.4.3 Meteorological Dispersion............................................................................ 12 2.5 Consequence Thresholds for PAGs and Emergency Response Planning Guidelines ................................................................................................. 12 2.5.1 Radiological (No Ingestion) .......................................................................... 13 2.5.2 Radiological (Ingestion)................................................................................ 13 2.6 Models Used in Relating Exposures to Estimated Consequences .......................... 13 3. ENVIRONMENTAL AND PERMITTING REQUIREMENTS ............................................ 15 3.1 Federal Requirements.............................................................................................. 15 3.1.1 National Environmental Policy Act and Implementing Guidelines, Regulations, and Orders ........................................................... 15 3.1.2 Federal Statutes and DOE Orders Relating to Environmental Quality......... 16 3.2 Federal and State Consultation, Permits, and Approvals......................................... 21 3.2.1 Federal Permits and Approvals.................................................................... 21 3.2.2 State and Local Permits and Approvals ....................................................... 23 3.3 Environmental Compliance Procedures and Scheduling......................................... 24 3.3.1 Environmental Documentation Guidelines ................................................... 24 3.3.2 Environmental Compliance Scheduling........................................................ 26 iii DOE-STD-6003-96 4. PROGRAM MANAGEMENT FOR SAFETY .................................................................... 29 4.1 Design and Construction Management.................................................................... 29 4.2 Operations Management.......................................................................................... 30 4.3 Site Restoration Management ................................................................................. 30 4.4 Tools for Program Management Safety ................................................................... 30 4.4.1 Configuration Management .......................................................................... 30 4.4.2 Quality Assurance ........................................................................................ 32 4.4.3 Verification and Validation............................................................................ 33 4.4.4 Conduct of Operations ................................................................................. 34 4.4.5 Emergency Preparedness............................................................................ 35 4.4.6 Maintenance................................................................................................. 37 4.4.7 Training and Qualifications........................................................................... 39 4.4.8 Tritium Control, Accountability, and Physical Protection.............................. 41

5. SAFETY ANALYSIS ........................................................................................................ 49 5.1 Facility Description................................................................................................... 51 5.1.1 General......................................................................................................... 51 5.1.2 Safety Structures, Systems, and Components ............................................ 52 5.2 Facility Mission/Processes ....................................................................................... 56 5.3 Hazards Analysis ..................................................................................................... 56 5.3.1 Inventory....................................................................................................... 56 5.3.2 Classification ................................................................................................ 57 5.4 Analysis of Off-Normal Conditions ........................................................................... 58 5.4.1 Event Scenario Identification and Classification .......................................... 59 5.4.2 Analysis Approach for the Safety Analysis Report ....................................... 62 5.4.3 Emergency Planning Basis Analysis............................................................ 63 5.5 Safety Analysis Report Process............................................................................... 64 5.5.1 Risk Assessment.......................................................................................... 65 5.5.2 Safety Analysis Report................................................................................. 66 5.6 Safety Envelope Configuration Control.................................................................... 68 5.7 Technical Safety Requirements ............................................................................... 69 5.7.1 Implementation of Technical Safety Requirements...................................... 70 5.7.2 Risk-Based Prioritization in Technical Safety Requirements ....................... 70 5.8 Startup and Restart of Fusion Facilities ................................................................... 71 5.8.1 Implementation of Startup and Restart Reviews.......................................... 71 5.8.2 Risk-Based Prioritization Implications for Startup and Restart Reviews ...... 72 5.9 Authorization Basis .................................................................................................. 72 6. FACILITY DESIGN GUIDANCE ...................................................................................... 73 6.1 Introduction and General Guidance ......................................................................... 73 6.1.1 Design Basis ................................................................................................ 73 6.1.2 Safety Functions and Structures, Systems, and Components ..................... 74 6.1.3 General Design Guidance............................................................................ 76 6.2 Systems Performing Safety Functions..................................................................... 86 6.2.1 Public Safety Function: Confinement Systems ............................................ 86 6.2.2 Worker Safety Function: Systems Controlling Operating Hazards............... 99 iv DOE-STD-6003-96

6.3 Systems Involved with Potential Safety Concerns................................................... 106 6.3.1 Afterheat Removal Systems......................................................................... 107 6.3.2 Rapid Plasma Shutdown System................................................................. 108 6.3.3 Control of Potential Energy Sources ............................................................ 108 6.3.4 Limiting Airborne and Liquid Releases to the Environment ......................... 115 6.4 Systems That Support Safety Functions.................................................................. 116 6.4.1 Instrument and Control Systems.................................................................. 116 6.4.2 Electrical Power Systems............................................................................. 119 6.4.3 Cooling Systems .......................................................................................... 122 6.4.4 Remote-Handling Systems........................................................................... 125 6.5 Impact of Facility Support and Experimental Systems on Safety Functions............ 134 6.5.1 Group 1 Systems.......................................................................................... 135 6.5.2 Group 2 Systems.......................................................................................... 136 7. SITE RESTORATION ...................................................................................................... 139 7.1 General .................................................................................................................... 139 7.2 Decommissioning, Decontamination, and Site Restoration in the Initial Design...... 139 7.3 Site Restoration........................................................................................................ 139 7.4 Waste Sent to Low-Level Waste Repository............................................................ 140 7.4.1 Requirements for Land Disposal of Radioactive Waste............................... 140 7.4.2 Methodology of 10 CFR 61 Extended to Fusion-Specific Isotopes.............. 143 7.4.3 Chemically Hazardous Materials Sent to a Hazardous Waste Site.............. 146 7.4.4 Mixed Waste Requirements ......................................................................... 147 7.5 Requirements on Low-Level Waste Repository ....................................................... 147 APPENDIX A CATEGORY 2 THRESHOLD QUANTITIES OF RADIONUCLIDES .......... 149 APPENDIX B IDENTIFICATION OF POTENTIAL HAZARDS, ENERGY SOURCES, AND GENERIC ACCIDENTS FOR FUSION FACILITIES.......................... 165 B.1 Introduction.......................................................................................... 165 B.2 Hazards ............................................................................................... 165 B.2.1 Radiological Hazards............................................................... 165 B.2.2 Chemical Hazards ................................................................... 166 B.2.3 Industrial Hazards.................................................................... 166 B.3 Energy Sources................................................................................... 167 B.3.1 Plasma Energy ........................................................................ 167 B.3.2 Magnetic Energy...................................................................... 167 B.3.3 Decay Heat.............................................................................. 167 B.3.4 Chemical Energy ..................................................................... 168 B.3.5 Coolant Internal Energy........................................................... 168

B.4 Potential Generic Accident Scenarios ................................................. 168 B.4.1 Loss-of-Coolant Event ............................................................. 169 B.4.2 Loss-of-Flow Event.................................................................. 169 B.4.3 Loss-of-Vacuum Event ............................................................ 170 B.4.4 Plasma Transients................................................................... 170 B.4.5 Magnet Transients................................................................... 170 v DOE-STD-6003-96 B.4.6 Loss of Cryogen....................................................................... 171 B.4.7 Tritium Plant Events................................................................. 171 B.4.8 Auxiliary System Accidents...................................................... 171 APPENDIX C REFERENCES AND SUPPLEMENTAL GUIDANCE ................................. 173 vi DOE-STD-6003-96 LIST OF FIGURES FIGURE Page 3.1 Phased schedule for environmental compliance activities ............................... 27 5.1 Flow logic of the safety analysis process ......................................................... 50 5.2 Event scenario/safety analysis process ........................................................... 60 LIST OF TABLES TABLE Page 2.1 Evaluation guidelines for public protection from radiation ................................ 7 5.1 Safety system functional requirements ............................................................ 55 6.1 Suggested design codes for equipment ............................................................ 80 6.2 Group 1 systems .............................................................................................. 135 6.3 Group 2 systems .............................................................................................. 135 7.1 Surface contamination guidelines ..................................................................... 140 7.2 Classification boundaries as given in 10 CFR 61 ............................................. 142 7.3 Classification based on long-lived radionuclides .............................................. 143 7.4 Specific activity limits for shallow load burial of all radionuclides with Z < 88 and half-lives >5 yr and <1012 yr ................................................... 144 A.1 Thresholds for radionuclides Category 2 .......................................................... 151 vii DOE-STD-6003-96 viii Intentionally Left Blank DOE-STD-6003-96 FOREWORD 1. This DOE Standard is approved for use by all DOE Components and contractors. It was developed by subject matter experts in the Fusion Safety Working Group under the general direction of the Office of Fusion Energy Sciences. It has been reviewed by the Fusion Safety Steering Committee with representation from DOE laboratories, contractors, and universities involved with magnetic fusion research as well as the end user of fusion power, the electric utility industry. 2. This Standard provides guidance to successfully achieve public and worker safety at mag- netic fusion facilities. It is intended for use by managers, designers, operators, and other personnel with safety responsibilities for such facilities. This Standard is concerned mainly with large fusion facilities such as the International Thermonuclear Experimental Reactor. Using a risk-based prioritization, the concepts presented here may also be applied to other magnetic fusion facilities.

3. Beneficial comments (recommendations, additions, deletions) and any pertinent data that may be of use in improving this document should be addressed to: Environment, Safety, and Health Program Manager Office of Fusion Energy Sciences, ER-54 Office of Energy Research U.S. Department of Energy 19901 Germantown Road Germantown, Maryland 20874-1290 by using U.S. Department of Energy Standardization Document Improvement Proposal Form (DOE F 1300.3) appearing at the end of this document or by letter. ix DOE-STD-6003-96 x Intentionally Left Blank DOE-STD-6003-96 DEFINITIONS Active—An adjective used to describe a feature or function of a component whose operation depends on an external input such as an actuation, mechanical movement, or supply of power. Administrative Controls—Provisions relating to organization and management, procedures, recordkeeping, assessment, and reporting necessary to ensure the safe operation of a fusion facility. ALARA—As low as is reasonably achievable. Anticipated Operational Occurrences—Operational processes deviating from normal opera- tion that are expected to occur once or more during the operating life of the fusion facility. Authorization Basis—Those aspects of the facility design basis and operational requirements relied upon by the regulating authority to authorize operation. These aspects are considered to be important to the safety of facility operations. Blanket—The region surrounding the D-T plasma that absorbs the fusion neutrons, transform- ing their energy into heat and breeding tritium to sustain the D-T fuel cycle. Beyond-Design-Basis Event—An event of the same type as a design-basis event (e.g., fire, earthquake, spill, explosion, etc.), but defined by parameters that exceed in severity the param- eters defined for the design basis event. Certification—Process by which management provides written endorsement of the satisfactory achievement of qualification of an individual for a specialized operations position based upon its criticality or safety impact and generally in response to a DOE Order or national consensus code or standard. Common Cause Failure—The failure of multiple devices or components to perform their func- tions as a result of a single specific event or cause. Comparable Industrial Facility—A facility in the industrial sector where workers are exposed to hazards of a similar nature to those encountered in a fusion facility; for example, heavy lifting, vacuum, cryogenics, high electrical potentials and/or currents, and radioactivity. Confinement—A barrier that surrounds radioactive or hazardous materials designed to prevent or mitigate the uncontrolled release of these materials to the environment. Credible Events—Postulated events having estimated probabilities of occurrence >10–6 per facility year. For natural phenomena, separate probability criteria based on site-specific informa- tion and facility characteristics should be used. Cryostat—A chamber, normally metallic, which surrounds the superconducting magnets of a fusion facility to provide vacuum insulation from external heat loads. xi DOE-STD-6003-96 Decommissioning—The process of closing and securing a fusion facility so as to provide adequate protection from radiation exposure and to isolate radioactive contamination from the human environment. Decontamination—The act of removing a chemical, biological, or radiological contaminant from, or neutralizing its potential effect on, a person, object, or environment by washing, chemi- cal action, mechanical cleaning, or other techniques.

Design Basis—The set of requirements that bound the design of systems, structures, and components within the facility. Design Basis Events—Credible events considered in the facility safety analysis and in the design of systems, structures, and components within the facility. Disruption—A rapid loss of the plasma-stored thermal energy to the plasma-facing compo- nents, introducing large thermal loads. Associated with this is a rapid decay of the plasma current that can introduce large mechanical loads to structural components. Disruptions can also generate high energy runaway electrons which impact the first wall. Diversity—The existence of multiple components or systems to perform an identified function, where such components or systems incorporate one or more attributes that are different from each other. Divertor—The component inside the vacuum vessel that diverts the plasma particles in the outer shell of the plasma into a region where they strike a barrier, become neutralized, and are pumped away. Effluent—Material that is released into the environment. Evaluation Guidelines—Dose/exposure values for radiation or hazardous materials that a safety analysis evaluates against. Experimental Equipment—Equipment or components installed in or around the facility for the purpose of research and development, not including regular functioning parts of the fusion facility itself (i.e., even when such regular functioning parts may be less than fully developed). First Wall—Systems and components inside the vacuum vessel directly exposed to the plasma ion and neutron fluxes; the first physical boundary that surrounds a plasma. Fusion Facility—Any facility that utilizes or supports a magnetically confined plasma in which fusion reactions take place. It includes the associated facility plant and equipment and any experimental apparatus used at the facility. Fusion Island—That part of the fusion facility on or inside the cryostat. Typically it includes the cryostat, the magnetic coils, the vacuum vessel and attached pumps, the breeding blanket, heating and fueling systems inside the cryostat, the divertor, and plasma diagnostics. xii DOE-STD-6003-96 Hazard—A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to personnel or damage to an operation or to the environment (without regard for the likelihood or credibility of off-normal conditions or consequence mitigation). Hazard Analysis—The determination of material, system, process, and plant characteristics that can produce undesirable consequences, followed by the assessment of hazardous situa- tions associated with a process or activity. Hazard Classification—Evaluation of the consequences of unmitigated releases to classify facilities or operations into the following hazard categories: – Hazard Category 1: The hazard analysis shows the potential for significant off-site consequences. – Hazard Category 2: The hazard analysis shows the potential for significant on-site consequences. – Hazard Category 3: The hazard analysis shows the potential for only significant localized consequences. Hazardous Material—Any solid, liquid, or gaseous material that is toxic, explosive, flammable, corrosive, or otherwise physically or biologically threatening to health. Inherent—An adjective to describe a design feature or function that operates without the appli- cation of a separate input such as an activation signal. An example of an inherent design feature is a fail-safe valve that closes automatically on loss of power.

ITER—International Thermonuclear Experimental Reactor. Maintenance—The organized activity, both administrative and technical, directed toward keep- ing structures, systems, and components in good operating condition, including both preventive and corrective aspects. Maintenance Personnel—Persons responsible for performing maintenance and repair of mechanical and electrical equipment. Managers—Persons whose assigned responsibilities include ensuring that a fusion facility is safely and reliably operated and that supporting operating and administrative activities are properly controlled. May—Permission; neither a requirement nor a recommendation. Mitigative Feature—Any structure, system, or component that serves to mitigate the conse- quences of a release of hazardous materials in an off-normal event scenario. xiii DOE-STD-6003-96 Monitoring—Continuous or periodic measurement and/or observation of parameters or deter- mination of the status of a system or component. Sampling may be involved as a preliminary step to measurement. Normal Conditions—Conditions associated with the routine operation of the facility. Normal Operations—Activities at a facility performed within specific normal operational limits and conditions, including startup, operation, shutdown, maintenance, and testing. Normal operations do not include anticipated operational occurrences. Off-Normal Conditions—Conditions beyond anticipated operational occurrences that include all credible events. Operations—Activities at a fusion facility performed within specific operational limits and condi- tions, including startup, operation, shutdown, maintenance, and testing. Operations and Facility Support Personnel—Those individuals who perform technical func- tions (such as engineering evaluations, program reviews, technical problem resolution, or data analyses, within their area of expertise) or safety, quality assurance, radiation protection, emer- gency services, and training functions. Operators—Persons responsible for manipulating fusion facility controls, monitoring facility parameters, and operating facility equipment. Certified Operators—Operators who require certification as determined by facility management. Qualified Operators—Operators who require qualification as determined by facility management. Passive—An adjective that describes a function that requires no operation or movement of component parts. Physical Separation—Isolation by geometry (distance, orientation, etc.), by appropriate barriers, or a combination thereof. Plasma—The fourth state of matter; basically an ionized gaseous system composed of an elec- trically equivalent number of electrons and positive ions. Plasma Beta—The ratio of plasma pressure (proportional to the product of density and temperature) to the confining magnetic field pressure (proportional to magnetic field strength squared). As the beta limit is approached, the plasma is more likely to experience a disruption. Potential Safety Concern—A feature and/or process determined to be capable of challenging a public safety function and to which a risk-informed decision-making process is applied during design. xiv DOE-STD-6003-96 Poloidal Field Coils—Coils providing the magnetic field that encircles the plasma axis in toroidal devices. Postulated Initiating Events (PIE)—Identified happenings or conditions that lead to anticipated operational occurrences, off-normal conditions, and their consequential failure effects.

Potential Safety Concern—A feature and/or process determined to be capable of challenging a public safety function and to which a risk-informed decision-making process is applied during design. Preventive Feature—Any structure, system, or component that serves to prevent the release of hazardous material in an off-normal event scenario. Public—All individuals outside the fusion facility site boundary. Public Safety Function—Essential characteristics or performance needed to ensure the safety and the protection of the public and the environment during operations, anticipated operational occurrences, and off-normal conditions. Qualification—Process by which factors, such as education, experience, and any special requirements (e.g., medical examination) are evaluated in addition to training to assure that an individual can competently perform a specialized job function to an anticipated level of proficiency. Qualified—The ability to perform a specific job function based upon completion of a training, qualification, or certification program developed for the job function. Trained personnel are qualified to perform their job function based upon completion of training. Qualified and certified personnel are qualified to perform their job function based upon completion of a specific program. As used in this document, the term “qualified” personnel has two meanings, based upon context: Qualified personnel are those personnel who have successfully completed either training, qualification, or certification requirements appropriate to their job function. Qualified personnel are those personnel who have successfully completed a formal qualifi- cation program appropriate to their job function. Quality Assurance—Those planned and systematic actions necessary to provide adequate confidence that an item or service will satisfy specified requirements for intended service. Redundancy—Provision of more than the minimum number of similar elements or systems, so that loss of any one does not result in the loss of the required function. Risk—The quantitative or qualitative expression of possible loss that considers both the prob- ability that an event will occur and the consequence of that event. xv DOE-STD-6003-96 Risk-Informed Prioritization Approach—A reasoned approach where the degree to which requirements or recommendations are applied and resources expended is commensurate with the risks involved and the facility programmatic importance. Minor hazards require implementa- tion at a lower level than higher risk hazards to workers, the public, and the environment. Runaway Electrons—Those electrons in a plasma that gain energy from an applied electric field faster than they lose energy from collisions; such high-energy electrons can damage plasma-facing components. Safety Analysis—A documented process: (1) to provide systematic identification of hazards within a given facility; (2) to describe and analyze the adequacy of the measures taken to elimi- nate, control, or mitigate identified hazards; and (3) to analyze and evaluate potential off-normal events and their associated risks. Safety Analysis Report (SAR)—A report that documents the adequacy of safety analysis to ensure that a fusion facility can be constructed, operated, maintained, shut down, and decom- missioned safely and in compliance with applicable laws and regulations.

Safety Basis—The combination of information relating to the control of hazards at a fusion facility (including design, engineering analyses, and administrative controls) upon which is based the conclusion that activities at the facility can be conducted safely. Safety-Class Structures, Systems, and Components (safety-class SSCs)—Systems, structures, or components whose failure could adversely affect the environment or safety and health of the public as identified by safety analyses. The phrase “adversely affect” means that Evaluation Guidelines are exceeded. Safety-class SSCs are systems, structures, or components whose preventive or mitigative function is necessary to keep radioactive and hazardous material exposure to the public below the off-site Evaluation Guidelines. Safety Limits—Limits on process variables associated with those physical barriers, generally passive, that are necessary for the intended facility functions and that are found to be required to guard against the uncontrolled release of radioactivity and other hazardous materials. Safety-Significant Structures, Systems, and Components (safety-significant SSCs)— Structures, systems, and components not designated as safety-class SSCs but whose preven- tive or mitigative function is a major contributor to defense-in-depth (i.e., prevention of uncon- trolled releases to the public) and/or worker safety as determined from hazard analysis. Gener- ally, safety-significant SSC designations based on worker safety are limited to those SSCs whose failure could result in an acute worker fatality or serious injury to workers. Safety Structures, Systems, and Components (safety SSCs)—The set of safety-class structures, systems, and components, and safety-significant structures, systems, and compo- nents for a given fusion facility. Shall—A firm requirement that must be met to be in compliance with this Standard. xvi DOE-STD-6003-96 Shall Consider—The need for and applicability of stated features or attributes must be evalu- ated and the results of the evaluation documented. Should—A desirable option or recommendation, departure from which is permissible. Site boundary—A well-marked boundary of the property over which the owner and operator can exercise strict control without the aid of outside authorities. Standard Industrial Hazards—Hazards that are routinely encountered in general industry and construction and for which national consensus codes and/or standards (e.g., OSHA, transporta- tion safety) exist to guide safe design and operation without the need for special analysis to define safe design and/or operational parameters. Supervisors—Persons who are responsible for the quantity and quality of work and who direct the actions of the operators or other personnel. Technicians—Persons responsible for performing specific maintenance or analytical laboratory work. Technical Safety Requirement—Those requirements that define the bounding conditions for safe operation, the bases thereof, and the management or administrative controls required to ensure the safe operation of a facility. Tokamak—The mainline magnetic fusion confinement configuration that employs discrete toroidal coils surrounding a torus-shaped vacuum vessel with poloidal field coils either captured by or external to the toroidal field coils. A large current induced in the plasma provides part of the magnetic field required for plasma confinement.

Toroidal Field Coils—The coils surrounding the vacuum vessel that provide the major confin- ing magnetic field for the plasma. Unreviewed Safety Question—A formalized uncertainty brought about by a proposed change, test, or experiment or the identification of analytic inadequacy when (a) the probability of occur- rence or the consequences of an accident or malfunction of equipment important to safety pre- viously evaluated by safety analyses could be increased; (b) the possibility for an accident or malfunction of a different type than any evaluated previously by safety analyses could be created; or (c) any margin of safety, as defined in the basis for any Technical Safety Require- ment, could be reduced. Vertical Displacement Event—A sudden loss of plasma position control. For highly shaped tokamak plasmas, active vertical position control is required to maintain the vertical position. Loss of the position control is known as a Vertical Displacement Event (VDE). If the main plasma contacts the plasma-facing components, the currents in the plasma can rapidly dis- appear, leading to a disruption. xvii DOE-STD-6003-96 Workers—Persons performing work at the facility or on the site of the facility. Worker Safety Function—Essential characteristics or performance needed to assure the pro- tection of workers during normal operations, anticipated operational occurrences, and off-normal conditions. xviii DOE-STD-6003-96 LIST OF ACRONYMS AC Administrative Control ac alternating current ACGIH American Conference of Governmental Industrial Hygienists AEA Atomic Energy Act AIRFA American Indian Religious Freedom Act ALARA as low as reasonably achievable ANSI American National Standards Institute ASME American Society of Mechanical Engineers BDBA beyond-design-basis accident CAA Clean Air Act CAP-88 Clean Air Act Assessment Package-1988 CCTV closed-circuit television CED committed effective dose CEQ Council on Environmental Quality CERCLA Comprehensive Environmental Response, Compensation, and Liability Act D-D deuterium-deuterium D-T deuterium-tritium DBA design-basis accident dc direct current DOE Department of Energy DOT Department of Transportation EA Environmental Assessment EAL Emergency Action Level ED effective dose EG Evaluation Guideline EIS Environmental Impact Statement EIS/ROD environmental impact statement/record of decision EMM electromechanical manipulator EMS Emergency Management System EOC Emergency Operations Center EPA Environmental Protection Agency FAA Federal Aviation Administration FWS Fish and Wildlife Service HEPA high-efficiency particulate air HVAC heating, ventilating, and air conditioning I&C instrumentation and control ICRP International Commission on Radiological Protection IEEE Institute of Electrical and Electronic Engineers IPCEA Insulated Power Cable Engineers Association ITER International Thermonuclear Experimental Reactor JET Joint European Torus LCE loss-of-coolant event LCOs Limiting Conditions for Operations LCS Limiting Control Setting xix DOE-STD-6003-96

LFE loss-of-flow event LLW low-level waste LVE loss-of-vacuum event MACCS MELCOR Accident Consequence Code System MAP Mitigation Action Plan MC&A Materials Control and Accountability MEI most exposed individual MG motor generator MSM master slave manipulator NAAQS National Ambient Air Quality Standards NCRP National Council on Radiation Protection and Measurements NDE nondestructive examination NEPA National Environmental Policy Act NESHAPS National Emission Standards for Hazardous Air Pollutants NFPA National Fire Protection Association NIOSH National Institute of Occupational Safety and Health NPDES National Pollutant Discharge Elimination System NRC Nuclear Regulatory Commission NSPS New Source Performance Standards OSHA Occupational Safety and Health Act PAG Protective Action Guideline PF poloidal field PFC plasma-facing component PIE postulated initiating event PRA probabilistic risk assessment PSD Prevention of Significant Deterioration PTC permit to construct PVTC pressure/volume/temperature/composition QA quality assurance QAP Quality Assurance Plan QC quality control RCRA Resource Conservation and Recovery Act RF radio frequency SA specific activity SAR safety analysis report SARA Superfund Amendments and Reauthorization Act SHIPO State Historic Preservation Office SIP State Implementation Plan SL safety limit SR Surveillance Requirement SSCs structures, systems, and components TF toroidal field TFTR Tokamak Fusion Test Reactor TSCA Toxic Substances Control Act TSD treatment, storage, and disposal TSR Technical Safety Requirement xx DOE-STD-6003-96 UHMWPE Ultra-high molecular weight polyethylene UPS uninterruptable power supply USQ Unreviewed Safety Question V&V verified and validated VDE vertical displacement event xxi DOE-STD-6003-96 xxii Intentionally Left Blank DOE-STD-6003-96 1. INTRODUCTION 1.1 Purpose This document provides guidance for the implementation of the requirements identified in DOE-STD-6002-96, Safety of Magnetic Fusion Facilities: Requirements. This guidance is intended for the managers, designers, operators, and other personnel with safety responsibili- ties for facilities designated as magnetic fusion facilities. While the requirements in DOE-STD- 6002-96 are generally applicable to a wide range of fusion facilities, this Standard, DOE-STD- 6003-96, is concerned mainly with the implementation of those requirements in large facilities such as the International Thermonuclear Experimental Reactor (ITER). Using a risk-based prioritization, the concepts presented here may also be applied to other magnetic fusion facilities. This Standard is oriented toward regulation in the Department of Energy (DOE) environment as opposed to regulation by other regulatory agencies. As the need for guidance involving other types of fusion facilities or other regulatory environments emerges, additional guidance volumes should be prepared. The concepts, processes, and recommendations set forth here are for guidance only. They will contribute to safety at magnetic fusion facilities. 1.2 Background When the development of fusion facilities began changing from comparatively small-scale experiments in physics to large facilities with megawatt-power levels and significant activation concerns, a need to develop safety requirements and associated guidance for fusion became apparent. Fusion systems are sufficiently different from other nuclear facilities that the require- ments and regulations governing existing nuclear facilities are not fully appropriate for the regu- lation of magnetic fusion facilities.

Efforts were begun to develop a group of documents that would be appropriate for safety regulation in magnetic fusion facilities. The documents that resulted from that process consist of a requirements document, DOE-STD-6002-96, Safety of Magnetic Fusion Facilities: Require- ments, which attempts to assemble in one place those requirements needed for safety, and this guidance document, which sets forth information that will assist fusion developers in meeting those requirements. The intent in this guidance document is to provide a fairly complete, though not exhaus- tive, set of instructions that if followed will contribute to the achievement of safety. There has been a conscious effort to include either directly or by reference those items that are germane to safety so that the manager, designer, or operator will be able to clearly identify actions that should be taken to meet the requirements using risk-based prioritization. The guidance provided here represents the collective wisdom of a broad and diverse group with experience in nuclear facility safety as well as with fusion. The concepts presented are included not only because they have been applied successfully to other kinds of facilities, but because they were deemed to make sense for fusion. 1 DOE-STD-6003-96 A conscious attempt has been made to exclude from this document concepts and advice not directly related to safety. In this sense, this document is not intended to be exhaustive. Of the many sound design or management practices that make good sense for a project, the ones included here are those that are directly safety-related. The intent here has been to identify concerns, practices, or procedures that will contribute to safety. Often, these are only summarized, not detailed here. Where appropriate guidance is available from other sources such as DOE Orders or other Standards, those sources are refer- enced here. This Standard was written in the reference frame of the Orders, Standards, and other documents that were in force at the time of writing. It was recognized that the DOE directives system was under major revision and that some of the references included here may be out of date at the time this Standard is implemented. Therefore, the user is encouraged to use the most current version of documents referred to here or their replacements. 1.3 Implementation The requirements in DOE-STD-6002-96 and the guidance in this Standard should be implemented using a risk-based prioritization approach. The degree to which they are applied should be commensurate with the risk involved. Fusion facilities that involve only minor hazards will require implementation at a lower level than will facilities such as ITER where activation and tritium inventories will be concerns. 1.4 Overview The responsibility for safety at fusion facilities, as all other facilities, lies with those having charge of the program or project. Safety is a requirement during all phases of the facility life cycle. It must be incorporated into the design, implemented during operations, and integrated into facility removal and site restoration. Success in the latter two phases often hinges on the success with which safety foresight and planning have been included in the design. To assist managers, designers, operators, and removal staffs in achieving safety, there are a number of tools (i.e., considerations, practices, processes, or other vehicles) that if implemented will con- tribute substantially to the overall safety of the facility. Those deemed most appropriate for fusion facilities are described in subsequent sections of this Standard.

Chapter 2 of this volume provides guidance on radiation and hazardous materials management to ensure that safety objectives are met. A primary consideration in any nuclear facility, including fusion facilities, is the management of radioactivity and hazardous materials. Protection from radiation and hazardous materials at all times is a primary concern for worker safety. The design and operating protocols of the facility should incorporate features that will limit exposures to radioactivity or hazardous materials in off-normal events as well as under normal operating conditions. Guidance on how to provide that protection is presented in Chapter 2. 2 DOE-STD-6003-96 Environmental considerations are summarized in Chapter 3. References to requirements in the environmental area are listed here with annotations because such a listing is not readily available from other sources. Program management considerations to achieve safety are addressed in Chapter 4. As indicated previously, the ultimate responsibility for safety lies with management. Integration of safety in the design, operation, and site restoration all involve the implementation of safety- related processes and a safety culture. In Chapter 4 the most significant of the tools available for achievement of safety are discussed: configuration management, quality assurance, conduct of operations, emergency planning, and tritium accountability. A major area of involvement for safety professionals with management is in the prepara- tion of safety analysis to evaluate the extent to which a given facility or design meets safety goals. Chapter 5 of this Standard includes guidance on how to establish the facility hazard classification; identify safety-related structures, systems, and components; develop technical safety requirements; and deal with unresolved safety questions. A key concept in safety analy- sis is the design basis and the associated requirements for approving facility operation. The analysis process described in Chapter 5 makes use of that concept and indicates how various off-normal event scenarios should be dealt with in the analysis. Chapter 6 is the most comprehensive of the chapters. It addresses design requirements and considerations for safety in design of fusion facilities. It begins with general design guidance that applies to all systems; then systems performing safety functions are described with design considerations to achieve those functions. Guidance is also provided for systems with potential safety concerns. These systems are not required to operate to achieve safety, but their failure may influence the levels of defense-in-depth available to the facility. Safety design guidance for supporting systems (those systems that support those systems providing safety functions) is also presented. The chapter concludes with guidance on safety in experimental systems and facility support. The final chapter in this Standard, Chapter 7, is concerned with facility removal and site restoration. It provides guidance for returning the site of the fusion facility to its original condition at the end of its useful life. Safety in this phase of the life cycle will be strongly influenced by planning and design features that have been incorporated from the outset of the project.

Appendices in this Standard provide additional supporting information. Appendix A is a list of isotopes for radiological considerations specific to fusion facilities. Appendix B is an overview of hazards typically associated with magnetic fusion facilities. Appendix C supplements this vol- ume with a listing of available orders, standards, and other documents appropriate to manage- ment of projects within DOE and lists specific references cited in the text. 3 DOE-STD-6003-96 Intentionally Left Blank 4 DOE-STD-6003-96 2. RADIATION AND HAZARDOUS MATERIAL The neutron flux in a fusion facility will result in activation of the first wall and structure, resulting in the production of radioactive materials. The level of activation is a function of power level, fuel cycle [deuterium-deuterium (D-D) vs deuterium-tritium (D-T)], and materials choice. Fusion experiments and power plants presently envisioned will also use strong magnetic fields, radio-frequency heating, and some potentially hazardous materials such as beryllium and vanadium. This section summarizes general guidance regarding radiological, magnetic field, and hazardous material concerns expected to be present at fusion facilities. Chemically hazardous materials are sometimes specified in the design of a fusion power core because of their mechanical or nuclear properties. The most prominent of these materials are beryllium, used as a first wall coating and as a neutron multiplier, and vanadium, used as a first wall and blanket structure material. 2.1 Dose Definitions The effective dose E has associated with it the same probability of the occurrence of cancer and genetic effects whether received by the whole body via uniform irradiation or by partial or individual organ irradiation. Although an assumption of uniformity may be a sufficient approximation in many external irradiation cases, in others more precise evaluation of individual tissue doses will be necessary. With external irradiation, differences may arise with depth in the body and with orientation of the body in the generally nonuniform radiation field. When irradia- tion is from radionuclides deposited in various tissues and organs, nonuniform or partial body exposures usually occur. Tissues also vary in their sensitivity to radiation. The effective dose E is a concept similar to the effective dose equivalent HE used by ICRP Publication 26 (ICRP 1977) and NCRP Report No. 91 (NCRP 1987). However, they are conceptually different. The effective dose E is intended to provide a means for handling nonuniform irradiation situations, as did the earlier dose equivalent. The effective dose E is the sum of the weighted equivalent doses for all irradiated tissues or organs. The tissue weighting factor wT takes into account the relative detriment to each organ and tissue including the different mortality and morbidity risks from cancer, the risk of severe hereditary effects for all generations, and the length of life lost due to these effects. The risks for all stochastic effects will be the same whether the whole body is irradiated uniformly or nonuniformly if E = wTHT T ∑ , (1) where wT is the tissue weighting factor representing the proportionate detriment (stochastic) tissue T when the whole body is irradiated uniformly, and HT is the equivalent dose received by tissue T. For further explanation see NCRP Report No. 116 (NCRP 1993). Doses mean the 50-yr committed effective dose (CED) unless otherwise stated. The exposure times and exposure pathways to be included in the calculation of CED should be

5 DOE-STD-6003-96 appropriate for the fusion isotopes involved, the accident scenario, and the public mitigative actions (if any) being considered. Acute dose is defined for specific organs depending on what short-term exposure is the best predictor of acute health effects. For example, the acute lung dose is typically the 1-yr CED, and the bone marrow acute dose is typically considered as the 7-day CED or 100% of the 7-day CED plus 50% of the 8–30th day CED. Thus, for the same exposure time periods, the acute dose is always less than (or equal to for very short half-lives) the 50-yr CED. Early dose is the 50-yr CED from the first 7 days of exposure following the onset of an accident, specifically the inhalation and cloudshine doses during plume passage, inhalation from resuspended/re-emitted isotopes during the first 7 days, and the groundshine dose from the first 7 days. This dose measure is appropriate when contemplating the need for short-term public mitigative actions. The early dose is generally calculated for the most exposed individual (MEI) of the public, assumed to reside at the site boundary or (for release elevated above ground level) where the plume reaches the ground. Two-hour (prompt) dose is the 50-yr CED resulting from the first 2 hours of exposure fol- lowing the onset of an accident, as in DOE 6430.1A. This dose measure implicitly assumes evacuation within 2 hours. Chronic dose is the 50-yr CED from 50-yr exposure after an event, specifically from inhalation of resuspended or re-emitted isotopes, groundshine, and ingestion of radionuclides. This dose measure is appropriate when contemplating whether long-term public mitigative actions are needed and, if so, when and for how long. When calculated for an individual, the chronic dose should include reasonable assumptions about the fraction of time an individual resides at the site boundary and the fraction of food produced at that location. Because of the long time scales, the chronic dose is more appropriately calculated for the “average” resident of the surrounding area. The factor χ is the instantaneous concentration of a radioactive or hazardous material (in becquerels per cubic meter or grams per cubic meter) at a given location distant from the point where the material is released into the environment. The factor Q is the amount of material released, expressed in grams or becquerels; ′ Q is the rate of material release emission from a continuous point source. The ratios χ/Q and χ ′ Q are determined by the atmospheric condi- tions, the distance between the source and distant location atmospheric transport, and the time since release. For further explanation, see Slade (AEC 1968). 2.2 Public Exposures and Environmental Impacts A significant part of 10 CFR 20 is directed toward protecting the public, the environment, and workers from the risks of exposure to radiation. Part of 40 CFR 61 is also concerned with protecting the public from chronic exposure to radiation. In addition, exposures to workers, the public, and the environment must be kept “as low as reasonably achievable” (ALARA). “Reasonably achievable” levels are typically a fraction of those allowed by 10 CFR 20 and 40 CFR 61. 6 DOE-STD-6003-96

For comparison with the evaluation guidelines, only plume passage dose is evaluated. Plume passage dose includes the following pathways: (1) direct cloudshine and (2) 50-yr CED from inhalation for the duration of plume passage. These pathways are considered an immedi- ate threat. Other slow-developing pathways are not included because they are a measure of the effectiveness of public health measures (e.g., interdiction) rather than the severity of the acci- dent itself. If dose is evaluated on public access roads that are not controllable by the licensee, the time of exposure to the plume should be based on realistic vehicle passage time estimates. 2.2.1 Evaluation Guidelines for Exposures to the Public The following goals and requirements have been established in DOE-STD-6002-96 for exposures to the general public during normal and anticipated operational occurrences and for off-normal conditions and accidents. The origin of each of the limits follows Table 2.1. Evaluation guidelines for public exposures to nonradiological materials should be in accordance with federal, state, and local regulatory and permit requirements. TABLE 2.1. Evaluation guidelines for public protection from radiation Fusion radiological release requirement Regulatory limit (evaluation guidelines) Normal and anticipated operational occurrences 100 µSv/yr [10 mrem/yr]a 1 mSv/yr [100 mrem/yr]b Off-normal conditions (per event) 10 mSv [1 rem]c (no public evacuation) 250 mSv [25 rem]d aThis value, which is a limit for the MEI, is consistent with the limit on the emissions of radionuclides to the ambient air for DOE facilities as stated in 40 CFR 61.92. In meeting this limit, a facility would be well below the exposure limit mandated by the Nuclear Regulatory Commission (NRC) safety goals for nuclear facilities (51 FR 30028) and the DOE safety goals. Both of these goals, which consider the average exposure to the population within 10 miles of a facility, state that the risk to the population resulting from nuclear operations should not exceed 0.1% of the sum of all cancer fatality risks resulting from all other causes. The radiological cancer risk coefficient is about 0.4%/0.1 Sv for long-term exposures (BEIR-V, p. 6), and the annual cancer fatality risk due to all causes is about 200/100,000 people. If we conservatively assume that the site-boundary to average exposure ratio is 2, then the routine exposure limit should be (0.1%) (200 per year/100,000 people) (0.1 Sv/0.4%) (2) = 0.1 mSv/yr = 10 mrem/yr. bThis value is based on the 10 CFR 20.1301 dose limits on individual members of the public. cThis requirement is based on the limit in the Protective Action Guideline (PAG) (EPA 1991) at which public sheltering and evacuation should be undertaken. dThis is the required limit for exposure due to an accident. This value is based on the design basis acceptance criteria for nuclear reactor siting in 10 CFR 100. 7 DOE-STD-6003-96 2.2.2 Additional Guidance 10 CFR 100 defines requirements for siting of nuclear reactor facilities. These guide- lines have also been applied to nonreactor nuclear facilities (DOE 6430.1A). According to 10 CFR 100.11, the maximum calculated dose to an off-site individual from exposure that results from internal and external sources of radiation must not exceed 250-mSv (25-rem), 50-yr CED to the whole body. If multiple organs receive doses during the same exposure, the ED shall not exceed 250 mSv (25 rem). The exposure duration should be consistent with the requirement for no public evacuation. DOE 6430.1A recommends using meteorological condi- tions that result in unfavorable dispersion (e.g., the higher of the 0.5% χ/Q for each sector of the site and the 5% direction independent χ/Q for the site). In the absence of site-specific meteor- ology, conservative assumptions (Class F, 1.0-m/s wind speed) should be used for design assessments. Further guidance is contained in Sections 2.4.3 and 5.4.3.

DOE Order 6430.1A notes that these values are guidelines and do not constitute accept- able limits on the doses to the public in the event of an accident. These guidelines are used by DOE to evaluate the facility design in combination with the site characterization with respect to the risk to the public from low-probability accidents. Accidents to be evaluated for comparison to these dose guidelines include events with a probability of occurrence >10–6/yr. When the doses are calculated, the degraded performance of engineered safety features and administrative controls should be assumed unless they can be shown to be capable of performing their safety function. The radionuclides of concern in a fusion facility cover a wide range of characteristics. Tritium is generally the most mobile. Tritium is hazardous if it is taken into the body via inges- tion, inhalation, or absorption through the skin. Because of the relatively low energy of the beta particle, 18-keV maximum energy, it does not present a significant hazard outside the body. Other radionuclides are the products of neutron activation. These radionuclides, usually imbed- ded in a metal, have much higher energies and undergo γ-decay. Typical radionuclides are Fe-55, Co-58, Co-60, Mn-54, Mn-56, Ni-59, and Ni-63. Alloying elements and impurities further increase the range of activation products. 2.2.3 Environment Radiation protection standards have been developed expressly for the protection of humans. It has been generally accepted that by protecting humans we are protecting the environment. Recently, the ICRP stated (ICRP 1991): The Commission believes that the standard of environmental control needed to protect man to the degree currently thought desirable will ensure that other species are not put at risk. Occasionally, individual members of non-human species might be harmed, but not to the extent of endangering whole species or creating imbalance between species. Additional guidance on other areas of environmental protection is provided in Chapter 3. 8 DOE-STD-6003-96 The Environmental Protection Agency (EPA) has set limits on the emissions of beryllium into the environment from industries that process beryllium ores, metal, oxide, alloys, or waste. 40 CFR 61 limits the amount of beryllium emitted to 10 g in a 24-h period or to an amount that would result in atmospheric levels of 0.01-µg beryllium/m3 of air, averaged over a 30-day period. EPA’s Office of Water Regulations and Standards limits the concentration of beryllium in water to between 0.68 and 68 ng beryllium/L for protection of human health. 2.3 Routine Worker Exposure 2.3.1 Radiation In a fusion facility, occupational exposure to radiation can result from gamma radiation, neutron fluxes, tritium ingestion or inhalation, and the mobilization of activation products. The exposures from all these sources are combined into an effective dose (ED) that accounts for the energy, half-life, and biological mobility of each of the radionuclides. Under 10 CFR 20 and 10 CFR 835, the radiological workers at commercial and DOE facilities are limited to an annual ED (internal and external) exposure of 50 mSv (5 rem). Expo- sures to organs, tissues, or extremities are limited to 500 mSv (50 rem). Lower limits apply to declared pregnant women, minors (less than 18 years old) and students, visitors, and the public. Under DOE requirements, permission of the Cognizant Secretarial Officer is required for all occupational doses in excess of 2 rem. Higher exposures are tolerated for emergency situations, such as saving a human life, recovering a deceased victim, and protecting health and property.

The goal for doses due to normal and anticipated operational occurrences is 10 mSv/yr (1 rem/yr). In all cases the dose to workers must be as low as reasonably achievable. This value is based on ICRP 26 and NCRP 116 recommendations. Doses should be kept “as low as reasonably achievable” (ALARA). In the design of facili- ties the design objective for controlling personnel exposure from external sources of radiation in areas of continuous occupational occupancy (2000 hours per year) shall be to maintain expo- sure level below an average of 0.5 mrem (5 microsieverts) per hour and as far below this aver- age as is reasonably achievable. The design objectives for exposure rates for potential expo- sure to a radiological worker where occupancy differs from the above shall be ALARA and shall not exceed 20 percent of the applicable standards of 10 CFR 835.202 (10 CFR 835). 2.3.2 Hazardous Materials There may be a number of hazardous materials in a fusion facility such as metallic dust, diborane, inert gases, and organic compounds. Other regulations are concerned with exposures to these hazardous materials and other industrial hazards. In this guidance emphasis is given to beryllium and vanadium because these materials are more relevant to fusion facilities. Exposure limits should be taken from National Institute of Occupational Safety and Health (NIOSH) recom- mendations (NIOSH 1994), Occupational Safety and Health Act (OSHA) regulations (29 CFR 1910), and industrial standards. 9 DOE-STD-6003-96 2.3.2.1 Beryllium Beryllium and beryllium compounds can pose potential health risks to humans. They may be used as plasma-facing components in ITER. This section summarizes the current U.S. regu- lations about allowable emission to the environment and permissible occupational exposure to workers. OSHA regulations limit permissible exposures to a time-weighted average of 0.002 mg/m3 for the beryllium concentration in workroom air. For short-term exposure (i.e., 30 min), the exposure limit is 0.025 mg/m3. The NIOSH recommends an exposure guideline of 0.0005 mg/m3 in workroom air during an 8-h shift. There are also limits on acceptable beryllium ambient air concentrations and drinking water quality standards for a number of states in the United States (DHHS 1993). This Standard recommends the adoption of the NIOSH exposure guidelines for beryllium in a fusion facility. 2.3.2.2 Vanadium Oxides Since absorption of vanadium is chiefly by the respiratory tract, mechanical enclosure of many vanadium-using operations is required. If this is impractical, the worker must be provided with an air-fed unit to ensure complete respiratory protection from vanadium pentoxide (Finkel 1983). NIOSH 15-min time-weighted average exposure limits for vanadium compounds in air are 0.05 mg vanadium/m3. For metallic vanadium, ferrovanadium dust, and vanadium carbide, the NIOSH exposure limits are 1.0 mg V/m3 (3 mg V/m3 for short-term exposures) (NIOSH 1994). OSHA exposure limits are 0.5 mg V2O5 /m3 for vanadium dust, 0.1 mg V2O5 /m3 for vanadium fume, and 1 mg/m3 for ferrovanadium dust (29 CFR 1910). This Standard recom- mends the adoption of the NIOSH exposure guidelines for vanadium in a fusion facility. 2.3.3 Common Industrial Hazards As with any large industrial facility, a fusion power plant facility will contain other hazards, such as flammable materials, rotating machinery, and nonbreathable gases. These hazards are not unique to fusion power and will therefore be regulated according to existing OSHA criteria (29 CFR 1910, 1926) or commonly accepted industrial safety practices.

2.3.4 Magnetic Fields The magnetic confinement fusion facilities addressed in this Standard may have magnetic fields of considerable strength extending throughout areas of the facilities and possibly beyond interior rooms. These fields may be steady state, or they may vary in time and/or space. In general, the magnetic field at the site boundary will be very low, usually less than the earth’s magnetic field (~50 µT). The recommended limits for occupational exposures to steady-state and low-frequency magnetic fields are those established by the American Conference of Governmental Industrial Hygienists (ACGIH). At present, the ACGIH states: 10 DOE-STD-6003-96 Routine occupational exposure should not exceed BTLV = C f , (2) where BTLV = the threshold limit value for the magnetic field in millitesla (mT) C = a constant equal to 60 mT-Hz f = the field frequency in Hertz (Hz). At frequencies below 1 Hz, the threshold limit value is 60 mT. The magnetic field strengths in these limits are root-mean-square (rms) values. For workers wearing cardiac pacemakers, the threshold limit value may not protect against electromagnetic interference with pacemaker function. The threshold limit for pace- maker wearers should be reduced by a safety factor of 10. In the future, this Standard will adopt modifications of the ACGIH threshold limit value for magnetic fields. 2.4 Guidance for Meeting Regulatory Limits This section provides guidance for calculational procedures to meet the regulatory limits given in DOE-STD-6002-96. Guidance on the types of off-normal analyses required to meet these regulatory limits is provided in Section 5.4 of this Standard. 2.4.1 Evaluation Guidelines Evaluation Guidelines (EGs) are accident impact criteria established for the purpose of evaluating the acceptability of facility safety design. For radionuclide releases, criteria are given for ED and are termed “dose values.” It is important to note that these criteria do not necessarily constitute acceptable limits for human health impacts in the event of an accident. Rather, they are used to evaluate the level of safety associated with the design of the facility with respect to the risk from low-probability accidents. EGs are typically established using a risk-based frame- work. Higher dose values are associated with lower frequency to provide balance in the design with appropriate focus at both the high- and low-probability ends of the accident frequency scale. Dose values are given for normal operation and anticipated operational occurrences. A second set of dose values is given for off-normal conditions. Events with an estimated fre- quency of <10–6/yr are considered hypothetical, and comparison to an EG is not required. The method is comparable to that established in DOE Standard 3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports. EGs are provided for off-site (public) locations. 11 DOE-STD-6003-96 2.4.2 Exposure Off-site doses are evaluated for the most exposed individual (MEI). This is a hypothetical individual located at the closest point on the site boundary (or at off-site distance of maximum air concentration for elevated releases). 2.4.3 Meteorological Dispersion

Site-specific 5% weather conditions (i.e., stability class and wind speed more unfavorable than 95% of the expected weather) without regard to wind direction, defined by at least 1 yr of weather data, should be used for diffusive transport to downwind receptors. Alternatively, site- specific climatological studies using actual measurements of diffusion/dilution characteristics under representative meteorological conditions can be used as a basis for determining site- specific dilution factors (χ/Qs) (see NOAA 1989 for example). These weather conditions should be determined using the anticipated release height of the accident cloud (e.g., ground level or elevated). For evaporating chemicals, a range of stability class/wind speed combinations should be examined due to the chemical-specific effects of these parameters on source emission rates and downwind dispersion. A dense gas model may need to be used for evaluation of impacts at near-field receptor distances if the chemical/air mixture density at the source exceeds the ambi- ent air density by 50%. Dense gas effects are usually insignificant at far-field receptor distances. 2.5 Consequence Thresholds for PAGs and Emergency Response Planning Guidelines As stated in DOE-STD-6002-96, the Fusion Radiological Release Requirement for off- normal events at fusion facilities is that no events result in a public exposure greater than 10 mSv (1 rem). If the projected early dose to the surrounding population can be shown to be less than 10 mSv, then no public protective action planning would be necessary. In determining whether a given event at a fusion facility will require protective action, best estimate meteorology and system operation are assumed. All estimates of the site-specific transport coefficients (χ/Q) are based on at least 1 yr of meteorological data. Best-estimate meteorology can be used to determine public exposures in three ways: a. Use the annual average windspeed and the highest-frequency stability conditions in determining the χ/Q at the site boundary. b. Calculate the hourly χ/Q for meteorological conditions throughout the year. Select the 50 percentile χ/Q to determine off-site transport. c. Using meteorological data for at least 1 yr, use a Monte Carlo technique to select random starting times for the off-normal event. Average the public exposure due to each of the transients to obtain the best-estimate off-site doses. Because of differences among the mean, median, and mode of the χ/Q distributions through the year, the preferred method is “c” above. Further guidance in the application of best estimate off-site dose calculation can be found in NUREG-0654/FEMA-REP-1. 12 DOE-STD-6003-96 2.5.1 Radiological (No Ingestion) Guidance for sheltering, evacuation, and food interdiction is given in the EPA “Manual of Protective Action Guides and Protective Actions for Nuclear Incidents” (EPA 1991). A nuclear incident is divided into three phases: early, intermediate, and late. During the early phases shel- tering or evacuation is the appropriate measure to consider. The PAGs are criteria based upon the potentially avoided dose, which determine whether action must be taken. a. Evacuation (or, for some situations, sheltering) should normally be initiated to avoid a 10-mSv (1-rem) dose to a standard man for ”early” pathways inhalation (CED) and external gamma ED (cloudshine/immersion and ground surface).

b. For radionuclides with long effective half-times in the body, use 50-mSv (5-rem) CED + ED as the action criterion. For committed effective dose equivalent to the skin, use 500 mSv (50 rem) for the action criterion. 2.5.2 Radiological (Ingestion) During the intermediate and late phases of the incident, controls on the ingestion of con- taminated food and water are appropriate (FDA 1982). The avoided doses at which such inter- diction is appropriate are shown below: a. “Preventative PAG”—5 mSv (0.5 rem) to “whole body, bone marrow, or any other organ.” This is the level at which protective actions having minimal impact should be taken. b. “Emergency PAG”—50 mSv (5 rem) to “whole body, bone marrow, or any other organ.” This is the level at which food should be isolated for condemnation or other disposition. 2.6 Models Used in Relating Exposures to Estimated Consequences The following code systems are examples of tools that have been accepted for use in a regulatory context for relating releases, exposures, and estimated consequences. This list is not all inclusive, and other codes of greater capability might be developed in the future. GENII (Napier 1988) is a coupled system of computer codes used to estimate potential radiation doses to individuals or populations from both routine and accidental releases of radionuclides to air or water and residual contamination from spills or decontamination operations. The MACCS (MELCOR Accident Consequence Code System) (Chanin 1990) code sys- tem calculates impacts of severe accidents at nuclear reactors on the surrounding environment. Principle phenomena considered include atmospheric transport dose mitigation actions, dose accumulation, and health effects. The MACCS code has been expanded to include isotopes of interest in fusion facilities. 13 DOE-STD-6003-96 The RSAC (Wenzel 1993) code calculates the consequences of the release of radio- nuclides to the atmosphere. A user can generate a radioactive inventory, decay and ingrow the inventory during transport through process facilities and the environment, model the downwind dispersion of the activity, and calculate doses to downwind individuals. Doses are calculated through the inhalation, immersion, ground surface, and ingestion pathways. The CAP-88 (Clean Air Act Assessment Package-1988) (Parks 1992) computer model is a set of computer programs, data bases, and associated utility programs for estimation of dose and risk from routine radionuclide emissions to air. CAP-88 must be used to show compliance with 40 CFR 61.93(a) unless the EPA approves an alternate. The CAP-88-PC software package allows users to perform full-featured dose and risk assessments in a personal computer environment for the purpose of demonstrating compliance with 40 CFR 61.93(a) for routine radionuclide releases to the air. CAP-88-PC provides the CAP-88 methodology for assessments of both collective populations and MEIs. The complete set of dose and risk factors used in CAP-88 is provided. CAP-88-PC used a modified Gaussian plume equation to estimate the average dispersion of radionuclides released from up to six sources. The sources may be either elevated stacks, such as a smokestack, or uniform area sources, such as a pile of uranium mill tailings. Plume rise can be calculated assuming either a momentum or buoyancy-driven plume. Assessments are done for a circular grid of distances and directions for a radius of 80 km (50 miles) around the facility. 14

DOE-STD-6003-96 3. ENVIRONMENTAL AND PERMITTING REQUIREMENTS This chapter is a compilation of environmental and permitting requirements potentially applicable to magnetic fusion facilities. It is not intended nor should it be interpreted to be the definitive listing of all environmental laws and regulations to which a new fusion facility would be subject. The information is provided to facilitate planning for preparing the environmental and permitting documentation that may be required. Ongoing rulemaking may influence the applica- bility and completeness of the environmental and permitting requirements that must be satisfied for specific fusion facilities. In addition, state and local regulations may impose additional requirements and more stringent standards on those facilities. Requirements in this chapter are only repeated here from original sources for user convenience and do not constitute new requirements. 3.1 Federal Requirements 3.1.1 National Environmental Policy Act and Implementing Guidelines, Regulations, and Orders National Environmental Policy Act (NEPA) of 1969 (42 USC 4321 et seq.; 40 CFR 1500– 1508) establishes national policies and goals for the protection of the environment. Section 102 requires Federal agencies to incorporate environmental considerations into their planning and decision-making processes using a systematic interdisciplinary approach. The Council on Environmental Quality (CEQ) regulations implementing NEPA (40 CFR 1500–1508) contain action-forcing provisions to ensure that Federal agencies consider environmental information before making decisions on proposed actions. The NEPA process includes decision points at which the significance of environmental effects is considered, project alternatives are identified, and any appropriate mitigation measures are identified and adapted. Title 10 CFR 1021 estab- lishes DOE’s policy of complying fully with NEPA, and DOE Order 451.1 describes the roles of the various DOE offices in implementing the Act. The NEPA review process consists of evaluating the potential environmental effects of a Federal undertaking, establishing possible alternatives to the proposed action, and determining the level of NEPA documentation required to proceed with the action. Three levels of NEPA documentation include determination of categorical exclusion, preparation of an environmental assessment/finding of no significant impact (EA/FONSI), and preparation of an environmental impact statement/record of decision (EIS/ROD). For major Federal actions with the potential for significant environmental impacts, an EIS is typically required. The National Environmental Policy Act Compliance Program (10 CFR 1021, DOE Order 451.1) establishes procedures to implement NEPA, including the level of review necessary under NEPA. This Order promotes smooth generation, review, and release of documents pur- suant to NEPA and provides for the cooperation between various elements of DOE. Further guidance on preparing EAs and EISs is provided in DOE’s NEPA “Greenbook” (DOE, 1993b). Executive Order 12114, “Environmental Effects Abroad of Major Federal Actions” (44 FR 1957), establishes procedural and other actions to be taken by Federal agencies to 15 DOE-STD-6003-96

further the purposes of NEPA with respect to the environment outside the United States, its territories, and possessions. Final DOE guidelines for implementing the Order were published in the Federal Register in 1981 (46 FR 1009). Therein, the categories of actions and the manda- tory environmental review requirements are identified. Major Federal actions that could poten- tially affect the global environment or resources require some level of environmental review and documentation, depending on the nature of the action and the environments potentially impacted. 3.1.2 Federal Statutes and DOE Orders Relating to Environmental Quality 3.1.2.1 Federal Statutes The Atomic Energy Act (AEA) of 1954, as amended [42 USC 2011, et seq.; 10 CFR 20, 39, 60, 61, 71, 100, 762, 835, 960, 962 and 40 CFR 190–192], authorizes the conduct of atomic energy activities and governs the design, location, and operation of facilities (including Federal facilities) involved with nuclear materials. DOE facilities are not required by the AEA to be permitted or licensed but are required to comply with the act and its amendments. The Pollution Prevention Act of 1990 declares a national policy to prevent pollution at the source and to recycle pollution in an environmentally safe manner. The Act provides that the fol- lowing hierarchical sequence of steps be taken in dealing with pollution: (1) pollution should be prevented or reduced at the source whenever possible; (2) polluting materials should be recy- cled in an environmentally safe manner whenever feasible; (3) polluting materials should be treated in an environmentally safe manner; (4) disposal or other release to the environment is to be employed only as a last resort and conducted in an environmentally safe manner. The Clean Air Act, as amended [42 USC 7401 et seq. (40 CFR 50–80)], provides require- ments to protect and enhance the quality of the nation’s air resources and to promote public health and welfare. The act establishes National Ambient Air Quality Standards (NAAQS), Pre- vention of Significant Deterioration (PSD) regulations, National Emission Standards for Haz- ardous Air Pollutants (NESHAPS), and New Source Performance Standards (NSPS). The EPA can delegate permitting and regulatory authority to a state. Delegation under the Clean Air Act can take forms other than a State Implementation Plan (SIP). The Water Pollution Control Act, amended by the Clean Water Act of 1977 (33 USC 1251 et seq.; 40 CFR 110, 116, 117, 121, 122, 124, 129, 230, 401, 403; 33 CFR 289, 320, 323, 327, and 330), pertains to restoration and maintenance of the chemical, physical, and biological integrity of the nation’s waters. Using minimum technology-based guidelines set by the Envi- ronmental Protection Agency (EPA), states will issue National Pollutant Discharge Elimination System (NPDES) permits to discharge wastes into U.S. waters; a NPDES permit is required for discharges to waters of the United States. Fusion facilities must comply with applicable U.S. Army Corps of Engineers dredge and fill regulations. Impacts to wetlands greater than 10 acres require a permit from the U.S. Army Corps of Engineers. In addition, some states have more stringent requirements pertaining to wetlands. It is recommended that an expert on water quality be consulted for establishing the water quality requirements for the site in question. 16 DOE-STD-6003-96

The Safe Drinking Water Act, as amended [42 USC 300(f–j) et seq.; 40 CFR 140–149], establishes uniform Federal standards for drinking water quality. The EPA has the authority to delegate enforcement of these standards to the states. This act sets two types of standards for drinking water, primary and secondary. Primary standards are mandatory and apply to sub- stances that may have adverse affects on health. Secondary standards are advisory and affect color, smell, taste, or other physical characteristics of drinking water. This act also pertains to groundwater aquifers, banning underground injection of certain materials in or near groundwater recharge areas. The Solid Waste Disposal Act, as amended by the Resource Conservation and Recovery Act (RCRA) (42 USC 6901 et seq., 40 CFR 240–282 and 124), established a comprehensive program for regulating and managing solid waste (Subtitle D), hazardous waste, including radioactive mixed waste (Subtitle C), and underground storage tanks (Subtitle I), and for pro- moting the use of recycled and recovered materials (Subtitle F). The Toxic Substances Control Act (TSCA) (15 USC 2601 et seq.; 40 CFR 700–799) pro- vides the regulatory vehicle for controlling exposure and use of raw industrial chemicals that fall outside the jurisdiction of other environmental laws. TSCA assures that chemicals are evaluated before use to ensure they pose no unnecessary risk to health or the environment. Fusion facility personnel shall review proposed chemical use to assure that appropriate alternatives have been evaluated. The management of PCBs is also regulated under TSCA. There are specific require- ments for facilities that maintain transformers and other equipment containing PCB dielectric fluid. The Federal Facility Compliance Act waives sovereign immunity for fines and penalties for RCRA violations at Federal facilities. However, the effective date of the waiver has been delayed for mixed waste storage prohibition violations, as long as the Federal facility is in com- pliance with all other applicable requirements of RCRA. During this period, DOE is required to prepare plans for developing the required treatment capacity for mixed wastes stored or gener- ated at each facility. Each plan must be approved by the host state or the EPA after consultation with other affected states, and a consent order must be issued by the regulator requiring com- pliance with the plan. The Federal Facility Compliance Act further provides that the DOE will not be subject to fines and penalties for land disposal restriction storage prohibition violations for mixed waste as long as it is in compliance with such an approved plan and consent order and meets all other applicable regulations. The Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA), as amended (42 USC §9601 ET SEQ.), provides a statutory framework for the cleanup of waste sites containing hazardous substances and—as amended by the Superfund Amendments and Reauthorization Act—provides an emergency response program in the event of a release (or threat of a release) of a hazardous substance to the environment. Using the Hazard Ranking System, Federal and private sites are ranked and may be included on the National Priorities List. The Comprehensive Environmental Response, Compensation, and Lia- bility Act, as amended, requires such Federal facilities having such sites to undertake investiga- tions and remediation as necessary. The Act also includes requirements for reporting releases of certain hazardous substances in excess of specified amounts to State and Federal agencies.

17 DOE-STD-6003-96 The Emergency Planning and Community Right-To-Know Act of 1986 (42 USC 10227; 40 CFR 350–372) was enacted as Title III of the Superfund Amendments and Reauthorization Act (SARA). This act establishes requirements for emergency planning, spill reporting, haz- ardous chemical inventory reporting, and toxic chemical release reporting. The act also provides for the establishment of state and local emergency planning committees to prepare plans to respond to potential chemical emergencies. A facility emergency coordinator must be desig- nated, and a list or copies of Material Safety Data Sheets for hazardous substances at the site must be submitted to the Local Emergency Planning Committee, the State Emergency Response Commission, and the local fire department. Reporting Requirements. An annual hazardous chemical inventory report shall be submitted to the Local Emergency Planning Committee, the State Emer- gency Response Commission, and local fire department. A Toxic Chemical Release Form for specified toxic chemicals shall also be submitted annually. In the event of a hazardous substance release, appropriate notifications of Federal, state, and local authorities shall be made. The Hazardous Materials Transportation Act (49 USC 180 et seq.; 49 CFR 171–178) establishes requirements for the transportation of hazardous materials by road, air, and rail. Packaging, labeling, marking, and shipping requirements are specified for quantities and forms of substances that are designated as hazardous. Hazardous materials, including radioactive materials and wastes, must be shipped from the fusion facility site in accordance with the appli- cable U.S. Department of Transportation packaging, labeling, marking, and placarding requirements. Floodplain/Wetlands Executive Orders (EO 11988 & EO 11990; 10 CFR 1022) protect wetlands and minimize adverse effects of development in floodplains. The proposed site for the fusion facility must be evaluated to determine if it contains wetlands or floodplains. If floodplains/ wetlands do occur at the proposed site, a notice must be published in the Federal Register and Federal, state, and local agencies notified of a proposed floodplain/wetlands assessment. This assessment shall identify alternate measures to minimize harmful impacts to floodplains or wet- lands due to activities. A statement of finding must be published for public record. The Farmland Protection Policy Act (7 USC 4201 et seq.; 7 CFR 658) seeks to minimize the extent to which Federal programs contribute to the unnecessary and irreversible conversion of farmland to nonagricultural uses and assure that Federal programs are administered in a manner that will be compatible with state and local government and private programs and policies to protect farmland. The Soil Conservation Service must be requested to determine whether the site or any part of the site is farmland by using site assessment criteria and the rela- tive value of the site. If the evaluation results in a high score for the site, alternatives shall be considered that could lessen adverse effects on the site as farmland. The Archaeological Resources Protection Act of 1979 (16 USC 47000 et seq.; 43 CFR 7; 36 CFR 296) requires that a determination be made of the measures that shall be taken if archaeological resources present on Federal land may be damaged during project-related activi- 18 DOE-STD-6003-96

ties. Archaeological resources are defined as any material remains of past human life or activi- ties of archaeological interest. The National Historic Preservation Act of 1966, as amended (16 USC 470 et seq.; 36 CFR 60 and 800; Historic Sites, Buildings and Antiquities Act; 16 USC 461 et seq.), endeav- ors to preserve, maintain, and enrich irreplaceable cultural, educational, inspirational, and eco- nomic history. A determination must be made if the project area contains any site, structure, or object identified in, or eligible to be included, in the National Register of Historic Places and determine if the proposed project will affect the site, structure, or object adversely. If the effect would be adverse, the Advisory Council on Historic Preservation must be consulted to deter- mine what actions should be taken. The American Antiquities Act (16 USC 432 et seq.; 25 CFR 261; 36 CFR 296; and 43 CFR 3-7) protects historic and prehistoric ruins, monuments, and objects of antiquity on lands owned and/or controlled by the Federal government. Additionally, the act stipulates that the Federal government is to provide leadership in the preservation, restoration, and mainte- nance of the historical cultural environment of the nation. The American Indian Religious Freedom Act (AIRFA) (42 USC 1996; 36 CFR 296 and 43 CFR 7) protects and preserves for Native Americans their inherent right of freedom to believe, express, and exercise their traditional religious rights guaranteed by the First Amend- ment of the U.S. Constitution. This includes access to sites; use and possession of sacred objects; and freedom to worship through ceremonial and traditional rites. A determination must be made whether the project site is in an area related to Native American religious rites or is a sacred site. The Migratory Bird Treaty Act (16 USC 703 et seq.; 50 CFR 10) prohibits the killing, cap- turing, transporting, etc., of migratory birds, their nests, and eggs, and any part of such bird, nest, and egg. The Fish and Wildlife Coordination Act (16 USC 661 et seq.) mandates that wildlife con- servation receive equal consideration and coordination with other features of water resource programs through planning, development, maintenance, and coordination of wildlife conserva- tion and rehabilitation. The Bald and Golden Eagles Protection Act (16 USC 668–668d; 50 CFR Parts 13 and 22) prohibits the killing, capturing, and transporting of any bald and golden eagles, living or dead, their nests, and eggs, and any part of such a bird, nest, and egg. The National Wildlife Refuge Systems Administration Act of 1966 (16 USC 668OD– 668EE; 50 CFR 25, 27, 28 and 29) establishes the National Wildlife Refuge System by consoli- dating fish and wildlife conservation under the Fish and Wildlife Service (FWS). This will include fish and wildlife in danger of extinction; wildlife ranges, game ranges, wildlife management areas; or waterfowl production areas. 19 DOE-STD-6003-96 The Endangered Species Act of 1973 (16 USC 1531 et seq.; 50 CFR 17, 222, 226, 227, 402, 424, 450, 451, 452, and 453) prohibits Federal agencies from taking any action that would jeopardize the continued existence of any threatened or endangered species or result in the destruction or adverse modification of critical habitat unless an exemption has been obtained.

Objects Affecting Navigable Airspace (49 USC 1501; 14 CFR 77) requires that all persons give adequate public notice of the construction or alteration, or the proposed construction or alteration, of any structure that would be a hazard to air navigation, and regulates structures that could obstruct air navigation. The Federal Aviation Administration (FAA) has the following pro- cedures that must be followed: Notice of Proposed Construction, Construction Permit, and a Notice of Progress of Construction or Alteration. The Rivers and Harbors Appropriations Act of 1899 (33 USC 401–413, 06; 33 USC 33 CFR 209, 320, 325, 326, 329, and 330), the Bridge Act of 1949, and Construction and Operation of Bridges Act of 1946 (33 USC 525; 33 CFR 114–115) prevent alteration or modifi- cation of the course, location, current condition, or capacity of any navigable water in the United States without a permit. “U.S. navigable waters” have been defined in a loose manner by regula- tors. Dry lake beds, arroyos, and ditches have all been considered navigable waters. Bridge construction is also regulated under this act. The U.S. Army Corps of Engineers has established an integrated permitting process that allows a single permit application to be used for compli- ance with regulated activities. A permit must be obtained from the U.S. Army Corps of Engineers for any activity regulated under this act. The Noise Control Act of 1972, as amended [42 USC 4901–4918 (EO 12088)] directs all Federal agencies to carry out programs within their jurisdictions in a manner that furthers a national policy of promoting an environment free from noise that jeopardizes health and welfare. If the noise levels and/or emissions from a fusion facility would jeopardize the health or welfare of the public in the area surrounding the site, a plan to minimize noise emissions must be pre- pared. The plan may require a change in design parameters. 3.1.2.2 DOE Orders and Guidance DOE Orders are internal department documents that set policy and specify procedures for implementing that policy. They may apply to specific sites and facilities or to all areas of DOE operations. In some cases, DOE Orders may mandate compliance with existing Federal, state, and local regulations. Because specific DOE Orders may change or new Orders are issued, a review of the latest DOE Orders should be conducted. The General Environmental Protection Program (DOE Order 5400.1) establishes environ- mental protection requirements, authorities, and responsibilities for DOE operations for ensuring compliance with applicable federal, state, and local environmental protection laws and regula- tions, executive orders, and internal DOE policies. This Order implements DOE policy, which mandates that all operations be conducted in an environmentally safe and sound manner, including protection of the public and the environment. DOE Order 5400.1 requires that DOE operations be conducted in compliance with the letter and spirit of applicable environmental statutes, regulations, and standards. This includes sound environmental management of current 20 DOE-STD-6003-96 activities, the correction of existing problems, the minimization of risks to the environment or public health, and anticipating and addressing potential environmental problems before they threaten the quality of the environment or public welfare. DOE Order 5400.1 describes the envi- ronmental monitoring required to demonstrate compliance with environmental laws and regulations.

The Waste Minimization Crosscut Plan (SEN-37-92, March 13, 1992) was implemented by the DOE Secretary of Energy in accordance with the Pollution Prevention Act of 1990. This plan identifies key objectives and strategies for the Department’s achievement of excellence in waste minimization. The Environmental, Safety, and Health Appraisal Program (DOE Order 5482.1B) estab- lishes the program to evaluate the protection of the environment and the health, and safety of the public. This Order also establishes criteria for a safe and healthful work place for employees of the DOE and the DOE contractors. The Environmental Protection, Safety, and Health Protection Information Reporting Requirements (DOE Order 5484.1) establish the requirements and procedures for the reporting of information having environmental protection, safety, or health protection significance for DOE Operations. The Order identifies accidents and incidents and provides instruction in the areas of format and content of accident/incident investigation reports. 3.2 Federal and State Consultation, Permits, and Approvals 3.2.1 Federal Permits and Approvals National Emission Standards for Hazardous Air Pollutants (NESHAPS) (40 CFR Part 61) regulate substances that potentially will be emitted by fusion facilities, such as beryllium and radionuclides. If the fusion facility will result in a predicted effective dose (ED) to a maximally exposed member of the public equal to or greater than 1% of the standard for radionuclides [i.e., 0.001 mSv/yr (0.1 mrem/yr)], a NESHAPS permit to construct (PTC) application must be submitted prior to the initiation of construction to obtain the approval of the Regional Administrator of the EPA. The EPA will provide notification of approval or intention to deny approval of construction within 60 days after receipt of a complete application. After construction of the fusion facility, the EPA must be notified of the anticipated date of initial start-up of the source at least 30 days prior to that date and the actual date of initial start-up of the source within 15 days after that date. A Prevention of Significant Deterioration (PSD) of Air Quality review is required if the emission rate of any criteria air pollutant (carbon monoxide, hydrocarbons, nitrogen oxides, total suspended particulates, photochemical oxidants, sulfur oxides, and lead) from routine opera- tions of a stationary source is greater than 250 tons/yr. If necessary, a new PSD permit applica- tion or a modification to an existing permit must be submitted to the appropriate state agency before construction of a fusion facility. 21 DOE-STD-6003-96 According to the National Pollutant Discharge Elimination System (NPDES), states will issue NPDES permits to discharge wastes into waters of the United States using minimum technology-based guidelines set by the EPA. An NPDES permit for all discharges to waters of the United States must be obtained. Fusion facilities shall comply with applicable U.S. Army Corps of Engineers dredge and fill regulations. Impacts to wetlands greater than 10 acres will require an additional permit from the U.S. Army Corps of Engineers. Safe Drinking Water Act. If future fusion facilities affect existing or require new drinking water systems, a permit to conduct monitoring must be obtained as required. The Resource Conservation and Recovery Act (RCRA) was established to regulate solid and hazardous wastes.

a. Solid Waste. Subtitle D requires each state to prepare a solid waste management plan to prohibit new open dumps and require upgrading or closing of all existing dumps. Federal guidelines for solid waste collection, transport, separation, recovery, and disposal practices have been promulgated. b. Hazardous Waste. Under the land disposal restrictions (40 CFR 268) the generator of hazardous waste must assure a system of manifesting, reporting, standards, and permits to achieve control of hazardous waste from generation to final disposition. These requirements apply to generators and transporters of hazardous waste and owners and operators of hazardous waste treatment, storage, and disposal (TSD) facilities. Reuse, reclamation, and recycling of hazardous waste is also subject to the regulatory program. Under the land disposal restrictions (40 CFR 268) waste generators must assure that the waste is treated prior to ultimate disposal to the land. Specific requirements have been estab- lished by the EPA, usually requiring treatment to a particular contaminant concentration, but occasionally requiring a specific treatment method. There are also extensive regulations for the various processes or techniques by which hazardous wastes may be managed. These detailed standards include requirements for the proper management of containers, tank systems, surface impoundments, waste piles, land treatment, landfills, incinerators, and miscellaneous units (those not covered by the specifically identified techniques). State regulations may be more extensive than the Federal system and must be reviewed for applicability. The operation of the fusion facilities may require preparation of a new RCRA Part A or Part B permit application, a change in existing interim status, or a modification to an existing permit, depending on site location. 1. Underground storage tanks. All new underground storage tanks must be permitted prior to installation. Any person proposing to install a tank must file a notification prior to installation and prior to operation. The underground tank rules in RCRA Subtitle I 22 DOE-STD-6003-96 cover any substance defined as hazardous under CERCLA (Superfund) and includes underground tanks containing petroleum products. 2. Federal procurement guidelines. The EPA has established and published Federal guidelines for several materials: building installation products containing recovered materials; cement and concrete containing fly ash; paper and paper products contain- ing recovered material; lubricating oils containing re-refined oil; and retreaded tires. Particular attention should be paid to the cement and concrete guideline as it may apply to the construction phase of the program. Major procurement actions for ser- vices and materials for the fusion facilities should include specifications for the use of recycled and recovered materials. The Fish and Wildlife Coordination Act and National Wildlife Refuge Systems Administra- tion Act Permit Requirements include consultation with the FWS concerning project activities that (1) may conflict with the protection and conservation purposes set by the National Wildlife Refuge System (a permit may also be required); (2) may impact birds, especially migratory birds on the site; and (3) may modify, control, or impound, due to construction activities, a body of water greater than or equal to 10 acres. The State Administrator of wildlife resources must also be consulted for (2) and (3).

In the Bald and Golden Eagles Protection Act, a Federal Fish and Wildlife License Permit is required if upon investigation of the proposed site, a golden eagle’s nest is found and must be disturbed. A Federal Fish and Wildlife License Permit Application shall be submitted to the Assistant Regional Director for Law Enforcement of the district in which the site is located. If a permit is granted, the Director of Law Enforcement of the district in which the site is located shall be notified in writing at least 10 days, but no more than 30 days, before any golden eagle nest is taken. Any mitigation measures determined by the Director shall be complied with and a report of activities conducted under the permit shall be submitted to the Director within 10 days follow- ing the permit’s expiration. The Archaeological Resources Protection and National Historic Preservation Acts require consultation with the Advisory Council on Historic Preservation if a proposed project will impact a site with historic/prehistoric ruins, monument, or object of antiquity, or a site on the National Register of Historic Places. The AIRFA provides the following guidance. If a project site falls into the category of a Native American religious or sacred site, consultation is required with Native American leaders to determine if the proposed action would infringe on constitutional rights or impact Native American traditional religions. 3.2.2 State and Local Permits and Approvals Specific state and local permitting and approval requirements may vary by location; how- ever, general guidance is provided in the following sections. 23 DOE-STD-6003-96 3.2.2.1 Air Most states have been granted the authority by EPA to implement some, if not all, of the requirements of the Clean Air Act. a. Permit to Construct (PTC). Applications for a PTC and an Operating Permit for the proposed facility should be submitted to the state 15 to 18 months prior to commence- ment of construction. Generally (although this may vary from state to state), the state will notify the applicant within 30 days whether the application for PTC or operating permit is complete and within 60 days will issue a proposed approval, proposed con- ditional approval, or proposed denial, with an opportunity for public comments to follow. b. NESHAP Analysis. A NESHAP analysis is generally submitted to the state along with the PTC application. State review of the PTC application does not occur until the EPA approves the NESHAP document. Data collection (ambient air and engineering data) for the analysis typically takes 1 yr, and preparation of the analysis about 6 months. 3.2.2.2 Archaeological Finds If archaeological resources are determined to be endangered by a project-related activity, application for a permit from the jurisdictional land manager to remove or excavate an archaeo- logical site must be submitted. Activities are coordinated with the State Historic Preservation Office (SHIPO). The DOE must be qualified to do the permitted removal or excavation. Archaeo- logical resources excavated or removed remain the property of the United States. The remains and the copies of records and data must be archived by a suitable institution. 3.2.2.3 Other State Requirements Other state requirements will likely include water quality standards and wastewater treat- ment requirements, solid and hazardous waste requirements, and special provisions for wildlife. These vary by state and will have to be developed when specific fusion facility sites are selected.

3.3 Environmental Compliance Procedures and Scheduling 3.3.1 Environmental Documentation Guidelines 3.3.1.1 NEPA Compliance Plan Specific environmental mitigation commitments identified in fusion facility NEPA docu- ments are incorporated into the design and operation of the facility through an approved Mitiga- tion Action Plan (MAP). The MAP describes how mitigation of adverse environmental conse- quences will be implemented and monitored to assure effectiveness. The implementation of the MAP will be the responsibility of the design, construction and operating organizations. The plan 24 DOE-STD-6003-96 a. details Program Manager quarterly reporting requirements, b. documents progress in implementation of mitigation measures required by the MAP, c. determines whether the measures are adequately reducing or eliminating adverse environmental impacts, d. establishes procedures that prepare NEPA review and approval prior to implementa- tion for unforeseen activities not addressed in the fusion facility EIS, and e. is updated as required to accommodate changes to the MAP from unforeseen activities. 3.3.1.2 Environmental Compliance Plan Each fusion facility will develop an Environmental Compliance Plan that describes the method by which a particular fusion facility complies with applicable environmental regulatory requirements. This includes addressing Federal, state, and local environmental statutes. While this guidance document provides a compilation of environmental requirements potentially appli- cable to fusion facilities, the Environmental Compliance Plan provides guidance on how the program managers can meet those requirements. The Plan describes the program’s understanding of environmental requirements for the preconstruction and construction phases of the fusion facility. The Plan is updated periodically to reflect results of periodic consultation with the appropriate Federal and state agencies and affected Indian tribes. The Environmental Compliance Plan consists of five separate sections: Permits Require- ments, Monitoring Requirements (Chapter IV of DOE Order 5400.1), Pollution Prevention Requirements, Training Requirements, and Site Unique Requirements. 3.3.1.3 OSHA Compliance Plan The Occupational Safety and Health Administration (OSHA) has instituted a series of requirements that establish a level of safety and safety assurance. These requirements, those promulgated by state and local regulators, and internal DOE requirements published in DOE Orders must be followed. The OSHA program encompasses the protection of workers, the public, and property from the hazards associated with the construction, operation and mainte- nance, and decommissioning of a facility. The program incorporates four separate disciplines: industrial safety, industrial hygiene, fire protection, and radiation protection. Additionally, the program requires that emergency pro- cedures are in place to mitigate the impact of accidents that threaten the health and safety of the facility occupants, personnel in the immediate areas surrounding the facility, or the public. 25 DOE-STD-6003-96 3.3.2 Environmental Compliance Scheduling Environmental review planning is an integral part of “phased compliance,” that is, a com- prehensive, integrated environmental compliance strategy (DOE Order 4700.1); a sample schedule is shown in Fig. 3.1. The strategy is characterized by a. conducting the environmental evaluations and consultative environmental reviews during the conceptual or preliminary design phase,

b. completing the NEPA documentation process prior to commencement of full detailed design, and c. submitting permit applications and coordinating permit reviews with the detailed design phase. Delayed compliance can result when inadequate attention is given to environmental requirements early in the design phase. In many instances, the permitting authority will not begin review of permit applications until at least a draft NEPA document has been circulated. Delay of the NEPA document, therefore, can delay start of construction and make the NEPA document and other environmental review processes critical path items. 26 FIGURE 3.1. Phased schedule for environmental compliance activities. DOE-STD-6003-96 D O E -S T D -6003-96 D O E -S T D -6003-96 D O E -S T D -6003-96 27 D O E -S T D -6003-96 27 D O E -S T D -6003-96 27 D O E -S T D -6003-96 27 27 DOE-STD-6003-96 Intentionally Left Blank 28 DOE-STD-6003-96 4. PROGRAM MANAGEMENT FOR SAFETY Appropriate management practices and controls should be integrated into the fusion pro- ject life cycle to ensure safety. This integration function is key to ensuring that safety is “built-in” to the fusion facility life cycle process rather than an “add-on,” which is typically expensive and less effective. Related to this goal is the concept of making safety achievement a function of line management with criteria and hardware related to safety incorporated at the lowest practical level of the work breakdown structure. This section provides guidance on management-related areas needed to integrate safety into the fusion facility life cycle. Program management includes controlling the configuration of the facility and the documentation of that configuration so that operation within the authorized safety envelope can be demonstrated. In addition, this section presents tools (processes, systems, and controls) that can be used by program management to implement safety effectively. As used in this section, the facility life cycle includes design and construction, operations, and site restoration. Different organizations may be responsible for the various life cycle phases of the facility. Each organization must be aware of the need of the other organization and incorporate these needs in a safe and controlled manner. 4.1 Design and Construction Management From project inception appropriate controls should be integrated into project execution to ensure that intended safety features are incorporated into the fusion facility. Safety should be integrated into project activities, including initial mission and performance criteria definition, design, and construction. A specific responsibility of project management is to ensure that this integration of safety with other project activities or disciplines takes place and to hold project line management accountable for each aspect of their assigned systems, including safety perfor- mance. The basic facility mission requirements, including protection of the facility workers and the public as well as minimization of the impact to the environment, should be established before design commences. For example, the no-public-evacuation requirement in DOE-STD- 6002-96 should be a strong driver in fusion device size (power) and materials selection to ensure that the potentially releasable in-vessel tritium and hazardous material inventories are consistent with the no-evacuation requirement for the chosen site.

Safety assessment (Chapter 5) and design (Chapter 6) are complementary activities that should be performed iteratively throughout the design process to ensure that safety require- ments are adequately incorporated into the design. Achievement of safety criteria and goals at an individual system level should be a documented part of conceptual, preliminary, and final design and should be evaluated as part of the formal design review process. Additionally, a sys- tems integration approach should be used to evaluate interactions between individual systems including common-mode failures to ensure that safety goals are met globally. The project manager’s responsibilities include developing systems, processes, and orga- nizational structures that will facilitate safety during design and construction. The project man- ager should consider an organizational structure that will allow the safety and design profes- sionals to work as a team and that will make line management responsible for both safety and performance requirements for each system. Furthermore, there will be cases where safety 29 DOE-STD-6003-96 requirements will conflict with other design requirements for the facility. The project manage- ment system should have a process that will allow potential cost/safety/performance trade-offs to be made in a structured rational manner. 4.2 Operations Management Operations management should ensure that the operations organization is knowledgeable of the safety envelope and authorization basis and the need to maintain the facility configuration and operation within these constraints. Proposed changes to facility configuration and operation should be reviewed against the safety envelope and authorization basis and approved prior to implementation. The operations manager may call upon safety professionals for analytical support, but the responsibility and authority for safe operations remains with the line man- agement of the facility. The operations manager should establish a policy under which clear lines of responsibility for normal operations and off-normal conditions are established. Chapter 5 of this volume provides the details of the authorization basis and technical safety requirements. 4.3 Site Restoration Management Site restoration involves the dismantling of the fusion facility and the packaging of radioactive hazardous materials prior to shipment to a repository or recycling center. Manage- ment of the fusion facility during the site restoration phase requires maintaining configuration control while the condition of the facility is rapidly evolving. The safety analyses may have to be updated as safety and confinement systems are removed from service. Documentation of the condition of components and their hazardous inventories as they are packaged is necessary. Removal of hazardous materials from the site may allow some relaxation of controls as the on- site inventory is reduced. 4.4 Tools for Program Management Safety The following sections describe tools that can be used during the design, operations, and site restoration of a fusion facility. These tools include configuration management, quality assur- ance (QA), verification and validation, conduct of operations, emergency preparedness, mainte- nance, training and qualification, tritium control, accountability and physical protection. These tools, if used effectively, will help assure the safety of the fusion facility. 4.4.1 Configuration Management

Configuration management is a tool that is designed to determine and control baselines and ensure that each system/component properly interfaces physically and functionally. The role of safety in configuration management is to ensure that the original product and each approved change to the product do not jeopardize the safety of the product. Configuration man- agement actions are called for in Department of Energy (DOE) Order 4700.1, Project Manage- ment Plan. 30 DOE-STD-6003-96 4.4.1.1 Configuration Management Process Application Configuration management should be consistent with the quality, size, scope, and com- plexity of the project involved (graded approach). The configuration management process should be tailored to the specific project and to particular products. The selection of equipment and other items for formal configuration management is determined by the need to control its inherent characteristics or to control its interface with other systems. Configuration control applies to hardware, software, and documentation associated with the facility. A permanent copy of the controlled identification documents should be maintained throughout the life cycle, beginning with the initial baseline documentation and including pro- posed and approved changes from those baselines. Configuration control must be exercised on a basis appropriate to the level of importance and to the stage in the life cycle. Affected project activities, such as engineering, logistic sup- port, QA, safety, maintenance, and procurement need to be involved in evaluating proposed changes in the configuration of an item throughout its life cycle. This would normally be accomplished through a Configuration Control Board. 4.4.1.2 Change Control Changes affecting the configuration of an item are to be limited to those that are neces- sary or offer significant benefits. Changes are required to correct deficiencies; incorporate approved changes in experimental, operational or logistic support characteristics; or effect sub- stantial life cycle cost savings. Each change must be evaluated for Unreviewed Safety Questions (USQ). The process of reviewing for USQs is described in Chapter 5. Data required for effective evaluation of changes must be made available to those indi- viduals responsible for change decisions. Every proposed configuration change should be eval- uated on the basis of change criteria, including not making the proposed change. The evalua- tion should take into consideration each aspect of the change on the products or systems with which it interfaces. Such aspects may include safety, design, performance, cost, schedule, operational effectiveness, logistics support, transportability, and training. As changes are authorized, appropriate updates to safety envelopes, authorization basis and operating procedures must occur. This approach assures that operations personnel know the plant configuration and its operating limits. 4.4.1.3 Record Keeping and Reporting Configuration records and reports include identification of the following: a. technical documentation (drawings, calculations, specifications, etc.) comprising the approved configuration identification; 31 DOE-STD-6003-96 b. proposed changes to configuration, the status of such changes, and the individual responsible for change decisions; c. approved changes to configuration, including the specific number or kind of items to which the changes apply, and the activity responsible for implementation.

Only the minimum information necessary to manage configuration effectively and eco- nomically will be recorded and reported. 4.4.2 Quality Assurance A quality assurance (QA) process shall be considered in the design, selection of materi- als, specifications, fabrication, construction, installation, operating procedures, maintenance, and testing of fusion facilities. The requirements of 10 CFR 830.120 shall be used for develop- ment of this program. A Quality Assurance Plan (QAP) is developed by applying the QA criteria specified in Sections 4.4.2.1–4.4.2.3 using a graded approach. The QAP discusses how these criteria are satisfied. Appropriate standards are used, wherever applicable, to develop and implement the QAP. 4.4.2.1 Management A written QAP must be developed, implemented, and maintained. The QAP will describe the organizational structure, functional responsibilities, levels of authority, and interfaces for those managing, performing, and assessing the work, as well as management processes, including planning, scheduling, and resource considerations (cf. Sections 4.1–4.4). Personnel must be trained and qualified to ensure that they are capable of performing their assigned work. Continuing training is provided to ensure that job proficiency is maintained (cf. Section 4.4.7). Processes to detect and prevent quality problems must be established and implemented. Items, services, and processes that do not meet established requirements are identified, con- trolled, and corrected according to the importance of the problem and the work affected. Correc- tion includes identifying the causes of problems and working to prevent recurrence. Item charac- teristics, process implementation, and other quality-related information are reviewed, and the data are analyzed to identify items, services, and processes needing improvement. Documents must be prepared, reviewed, approved, issued, used, and revised to pre- scribe processes, specify requirements, or establish design. Records are specified, prepared, reviewed, approved, and maintained (cf. Section 4.4.1). 32 DOE-STD-6003-96 4.4.2.2 Performance Work will be performed to established technical standards and administrative controls using approved instructions, procedures, or other appropriate means. Items are identified and controlled to ensure their proper use and maintained to prevent their damage, loss, or deteriora- tion. Equipment used for process monitoring or data collection is calibrated and maintained (cf. Section 4.4.1). Items and processes must be designed using sound engineering/scientific principles and appropriate standards. Design work, including changes, incorporates applicable requirements and design bases. Design interfaces are identified and controlled. The adequacy of design pro- ducts is verified or validated by individuals or groups other than those who performed the work. Verification and validation work must be completed before approval and implementation of the design (cf. Chapter 6). Procured items and services must meet established requirements and perform as speci- fied. Prospective suppliers are evaluated and selected on the basis of specified criteria. Pro- cesses to ensure that approved suppliers continue to provide acceptable items and services must be established and implemented (cf. Section 4.4.1). Inspection and testing of specified items, services, and processes must be conducted using established acceptance and performance criteria. Equipment used for inspections and tests must be calibrated and maintained (cf. Section 4.4.1).

4.4.2.3 Assessment Managers must assess their management processes and identify and correct problems that hinder the organization from achieving its objectives. Independent assessments are planned and conducted to measure item and service quality, to measure the adequacy of work performance, and to promote improvement. The group performing independent assessments must have sufficient authority and freedom from the line to carry out its responsibilities. Persons conducting independent assessments must be technically qualified and knowledgeable in the areas assessed. 4.4.3 Verification and Validation Computer codes used to perform design and safety analysis for fusion facilities may be required to be verified and validated (V&V). Verification and validation will be performed using a graded approach that is based on the importance and complexity of the system/component. V&V actions are not specifically defined in DOE Orders. The QA plan documents the functional requirements for each piece of software, the acceptance criteria to be used in the V&V process, the approach to be taken to verification and validation, and the software configuration control strategy that will be used. The results of the 33 DOE-STD-6003-96 V&V process should be documented. Documentation should be prepared to manage the config- uration control of the software itself. Many of the standards and requirements used to verify and validate computer codes were developed for commercial nuclear power plants. Guidance information is embodied in ASME NQA-1 and ASME NQA-2 standards, as well as several American National Standards Institute (ANSI)/Institute of Electrical and Electronic Engineers (IEEE) Standards (ANSI/IEEE STD 730, 828, 829, 830, 983, and 1012). Verification is defined as the process of determining whether the software is coded cor- rectly and conforms to the specified software requirements. Full verification would require a line- by-line check of the entire computer code to ensure correctness. However, other less stringent methods are considered applicable, such as developing a series of calculational cases or input decks that test much of the logic in the code to ensure that the code performs as stated in the users' manual. As a general rule, design and safety analysis should be verified because it is good engineering practice. Validation is defined as the process of evaluating software to ensure compliance with software requirements and physical applicability to the process being modeled on the hardware being used. Validation is generally more involved than verification. Validation of a code consists of comparing its output with known analytical solutions for problems similar, yet perhaps simpler, than the problem at hand. Validation also includes benchmarking the code against relevant experimental data, thus ensuring that the analysis reasonably captures the correct physics and chemistry. Validation can also include comparison with an existing, already validated, computer code. The number and type of benchmarking problems needed to validate a computer code are functions of the complexity of the phenomena being modeled, the codes range of applicability, and the data that are or could be available. For a complicated computer code, verification could require that individual models and submodels in the code be V&V using separate-effects data and that integral validation of the code also be performed. These issues are functions of the specific technical areas and need to be considered in the respective V&V processes.

Due to the current experimental nature of fusion devices, it may not be possible to com- pletely verify and validate a code. In such cases, other options should be explored to assure safety of the facility. These options may include but are not limited to the use of test coupons to be evaluated after specific periods of operation and qualification of materials/equipment using deuterium-deuterium operations before using tritium as a fuel. 4.4.4 Conduct of Operations Experience has shown that the better operating facilities have well-defined, effectively administered policies and programs to govern the activities of the operating organization, includ- ing the areas described by these guidelines. The guidance is based upon well-developed indus- trial operations practices. They are written to be flexible, so that they encompass the range of facilities and operations. 34 DOE-STD-6003-96 Each fusion facility should develop a conduct of operations program in accordance with DOE Order 5480.19, Conduct of Operations, using a graded approach. Specifics for each of the sections can be found in the references for this chapter. Fusion facilities should have a policy that assures operations are managed, organized, and conducted in a manner to assure an acceptable level of safety and operators have proce- dures in place to control the conduct of their operations. The following areas should be addressed by the conduct of operations program: Opera- tions Organization and Administration; Shift Routines and Operating Practices; Control Area Activities; Communications; Control of On-Shift Training; Investigation of Abnormal Events; Notifications; Control of Equipment and System Status; Lockouts and Tagouts; Independent Verification; Logkeeping; Operations Turnover; Operations Aspects of Facility Chemistry and Unique Processes; Required Reading; Timely Orders to Operators; Operations Procedures; Operator Aid Postings; Equipment and Pipe Labeling. 4.4.5 Emergency Preparedness Fusion facilities should develop an emergency management program, using a graded approach, consistent with the determined level of risk at the facility. The requirements for emergency preparedness at DOE facilities are specified in DOE Order 151.1, Comprehensive Emergency Management. Appendix C provides a listing of guidance documents that may be useful in developing the site-specific emergency management program. The Emergency Management System (EMS) should include a graded approach to emergency management concepts such as planning, preparedness, and response. “Planning” includes the development and preparation of emergency plans and procedures and the identifi- cation of necessary personnel and resources to provide an effective response. “Preparedness” includes the training of personnel, acquisition and maintenance of resources, and exercising of the plans, procedures, personnel, and resources essential for emergency response. “Response” represents the implementation of planning and preparedness during an emergency and involves the effective decisions, actions, and application of resources that must be accomplished to miti- gate consequences and recover from an emergency. 4.4.5.1 Operational Emergency Event Classes

Operational emergencies involving hazardous materials (radiological and nonradiological) should be classified as one of the operational emergency classes (e.g., Alert, Site Area Emer- gency, or General Emergency). Emergency Action Levels (EALs), the specific criteria used to recognize and categorize events, should be developed for the spectrum of potential operational emergencies consistent with the hazards assessment. The need for some emergency levels will be eliminated for radiological emergencies if the site boundary dose limit specified as a fusion radiological release requirement in DOE-STD-6002-96 is met. 35 DOE-STD-6003-96 4.4.5.2 Emergency Plans and Procedures An emergency plan and procedures should be developed for the facility. The plan is a documented “concept of operation” that describes the essential elements that have been con- sidered and the provisions that have been made to mitigate emergency situations. The plan should incorporate information about the emergency response roles of supporting organizations and agencies and should be consistent with a graded approach to managing an incident. Pro- grams should contain emergency implementing procedures [e.g., EALs, event categorization, notification, and Emergency Operations Center (EOC) operation] as well as other procedures currently in use (e.g., equipment operation, radiological monitoring, and maintenance) that would be utilized in, or associated with, emergency response activities. Procedures must maintain consistency with the general graded approach and nomencla- ture of emergency planning and preparedness elements within Federal and State agencies, pri- vate industry, tribal, and local authorities. 4.4.5.3 Hazards Assessment Hazards assessments provide the technical basis for emergency management programs. The extent of emergency planning and preparedness required for a particular facility directly corresponds to the type and scope of hazards present and the potential consequences of off- normal events. A hazards assessment includes identification of any hazards and targets unique to a facility, analyses of potential events, and evaluation of potential event consequences. The Final Safety Analysis Report (see Chapter 5) provides for potential off-normal events at the facility. Methodology, models, and evaluation techniques used in the hazards assessment should be documented. The assessment should include a determination of the size of the Emergency Planning Zones where applicable, that is, the area surrounding the facility for which special planning and preparedness efforts are required to ensure that prompt and effective protective actions can be taken to minimize the risk to workers, the general public, and the environment. Other hazards assessments are documented in Material Safety Data Sheets; Safety Assessments; Spill Prevention, Control, and Countermeasure Plans; Pre-Fire Plans; Environ- mental Assessments and Impact Statements (EAs and EISs); Emergency Response Planning Guidelines; Severe Accident Analyses; and the Emergency and Hazardous Chemical Inventory Forms and Toxic Chemical Release Forms, prepared pursuant to the requirements of the Emergency Planning and Community Right-to-Know Act (SARA Title III). 4.4.5.4 Emergency Response Organization An emergency response organization should have overall responsibility for the initial and ongoing response to, and mitigation of, an emergency, and must perform, but not be limited to, the following functions:

36 DOE-STD-6003-96 a. Provide for prompt initial notification of emergency response personnel and response organizations, including appropriate off-site elements and for continuing effective communication among the response organizations throughout an emergency. b. Event categorization, determination of the emergency class, notification, provision of protective action recommendations, management and decision making, control of on-site emergency activities, consequence assessment, medical support, public information, activation and coordination of on-site response resources, security, communications, administrative support, recovery operations, and coordination and liaison with off-site support and response organizations. 4.4.5.5 Emergency Facilities Equipment and Personnel Preparedness An EOC should be established. The staffing, operation, and response activities pertaining to the EOC should be predetermined and documented. Primary and backup means of commu- nications should be available in the EOC. Training must be provided to affected workers regarding operational emergencies and be available to off-site emergency response organizations. Training should be provided annually to workers who may have to take protective actions (e.g., assembly, evacuation) in the event of an emergency. Training should be in place for the instruction and qualification of personnel com- prising the facility emergency response organization. A coordinated program of drills and exercises should be an integral part of the emergency management program. Drills should be used to develop and maintain personnel skills, expertise, and response capability. Drills should be of sufficient scope and frequency to ensure adequate response capability. A full participation exercise should be conducted annually in accordance with established plans and implementing procedures. Off-site response organizations should be invited to participate in site-wide exercises at least every 3 years. A critique process should be conducted for each exercise to provide accomplishments and shortcomings discovered during the exercise. 4.4.6 Maintenance Safe operation of a fusion facility is directly dependent on the scope, depth, and quality of the facilities maintenance program. Formal maintenance programs lead to increased effective- ness and safety benefits. Maintenance at fusion facilities is the aggregate of those planned and systematic actions required to prevent the degradation or failure of, and to promptly restore the intended function of structures, systems, and components (SSCs). This applies to each part of the plant that could significantly impact safe operation. The basis for this is the fundamental principle of defense in-depth. Primary emphasis should be on the success of the maintenance program to prevent the degradation or failure of, and to promptly restore the intended function of, those SSCs. 37 DOE-STD-6003-96 Fusion facilities present unique situations for maintenance programs. As an example, a program to control magnetic tools and materials around the tokamak is necessary to prevent unexpected missiles during machine operations (due to magnetic fields). In addition, remote maintenance will be used on some components. These actions add a complexity to the program that must be controlled to assure safety. Requirements for maintenance for DOE facilities are specified in DOE Order 430.1, Life Cycle Asset Management. The reference section for Chapter 4 provides a listing of guidance documents that may be helpful in developing the site specific maintenance program.

4.4.6.1 Maintenance Policy, Goals and Objectives, and Procedures Effective implementation and control of maintenance should be achieved by establishing written standards for the scope, objectives, and conduct of maintenance; by defining responsi- bilities; and by periodically observing and assessing performance commensurate with impor- tance to safety. The policies, goals, and objectives should address planning to establish a proactive main- tenance program as opposed to reactive maintenance and to ensure that the maintenance activ- ities for SSCs are consistent with their importance and function. Goals for maintenance should be established in those areas that have the potential for significant impact on plant safety. The goals should be directed toward improving or sustaining equipment reliability and performance by effective maintenance in areas key to plant safety and risk. Procedures should be established and utilized as necessary for the conduct of mainte- nance activities commensurate with the activities importance to safety. The maintenance proce- dures should provide systematic guidance to the craftsman; should be technically correct, com- plete, and up-to date; and should be presented utilizing sound human factors principles. Radiological exposure control during maintenance activities should be considered in developing procedures and work orders and in planning and scheduling maintenance. Health physics personnel should be involved in the planning and execution of appropriate maintenance work to ensure that personnel are not unnecessarily exposed and as-low-as-reasonably- achievable (ALARA) goals are met. 4.4.6.2 Plant Maintenance Organization The management of maintenance should include a defined maintenance organization with specific lines of authority, responsibility, and accountability. The management of mainte- nance requires effective written and oral communication between the maintenance department and other supporting groups such as operations, health physics, and engineering. Criteria for selecting personnel with acceptable qualifications to perform their assignments are necessary for effective staffing. The personnel qualification and training requirements should be specified. 38 DOE-STD-6003-96 4.4.6.3 Types of Maintenance The maintenance program should include surveillance to obtain in-service performance and operational data; predictive maintenance to analyze data collected from surveillance; pre- ventive maintenance based on manufacturer’s recommendations, operating experience, good engineering practice (including aging concerns), and predictive maintenance feedback; and cor- rective maintenance, as necessary. The maintenance program should ensure that recommen- dations and information from industry and individual vendors are reviewed and considered for incorporation into appropriate areas of the program. 4.4.6.4 Work Control Process

The work control process should be based on procedures that provide for the identifica- tion of deficiencies, planning and preparation for work, setting appropriate conditions for work, work procedures, supervisory authority, documentation of completed work, postmaintenance testing, return-to-service procedures, and review of completed work packages. The work control process begins with the identification of deficiencies or the need for planned or predictive main- tenance and the generation of a maintenance request. Planning and scheduling activities should then be performed. The work package should specify the appropriate plant conditions for the work; define the required isolation or tagouts and component deenergization; incorporate appro- priate QA, quality control (QC) functions, and ALARA considerations; and require appropriate supervisory authorization prior to starting work. The work package should contain postmainte- nance testing requirements and clearances or return-to-service procedures, provide for docu- mentation of completed work, and provide for a review of the completed package. The post- maintenance testing program should establish specific performance acceptance criteria that ensure a high level of confidence in the ability of the component to perform its design function when returned to service. Process indicators, which provide information regarding the effectiveness of execution of the elements of the maintenance program, should be monitored to provide insight regarding potential problem areas in the conduct of maintenance activities. Examples are postmainte- nance test results, periodic surveillance test results, ratio of preventive to corrective mainte- nance, maintenance work order backlog, time to restore component function after failure dis- cover, and frequency of rework. 4.4.7 Training and Qualifications The responsibilities and authority for training and certification must be specific, and appropriate plans and procedures must be developed and implemented. Each fusion facility should be responsible for the following: a. Develop and implement a training and qualification program using a graded approach based upon the hazards of the facility. b. Prepare, approve, and implement a training plan that sets forth the staffing, training, and qualification requirements. 39 DOE-STD-6003-96 c. Establish an organization that is responsible for the training and qualification of facility personnel. The duties, responsibilities, qualifications, and authority of training organi- zation personnel should be documented and clearly defined. d. Establish training and qualification criteria for contracted personnel used in facility organizations. Training and qualification requirements for DOE nuclear facilities are specified in DOE Order 5480.20, Personnel Selection, Qualification, Training, and Staffing Requirements at DOE Reactor and Non-Reactor Nuclear Facilities. The reference section for Chapter 4 provides a listing of guidance documents that may be useful in developing the site-specific training and qualification programs. 4.4.7.1 Facility Training Plan The facility training plan is the document that provides the overall description of facility staffing, training, qualification, and certification programs. This plan should be prepared to address the following: a. initial and continuing training programs, including maintenance of training; b. training and qualification programs for personnel who require formal qualification and certification; and

c. examination program requirements for qualification and certification. The facility training plan should be supplemented, as needed, with written procedures that address, as a minimum: examination and operational evaluation development, approval, secu- rity, administration, and maintenance; administration of medical requirements; and record keeping requirements. 4.4.7.2 Personnel Selection and Staffing Each facility should establish a process for the selection and assignment of personnel. The personnel selection process should include an evaluation of their education, experience, previous training, and existing job skills and capabilities. It is the responsibility of management to assure that personnel assigned to a specific job function have the requisite background and/or receive sufficient qualification training for the job. The following categories of facility staff are identified as requiring training, qualification, or certification to perform job functions: a. operators and their supervisors, b. experimenters, 40 DOE-STD-6003-96 c. technicians—training, d. maintenance personnel—training, e. supervisors and managers—training, f. operations and facility support functions. Specific requirements for certifying, qualifying, and training personnel are specified in the Order and general guidance documentation. 4.4.7.3 Records The program and procedures should specify the records used to document the training, qualification, and certification granted. Records should be documented and include the following types of information: a. records of education and experience, including resumes; b. results of medical examinations (when required); c. records of training completed, such as attendance sheets or computer summaries; d. results of examinations, including written examinations and operational evaluations (when required); and e. approvals and effective dates, if applicable. 4.4.8 Tritium Control, Accountability, and Physical Protection The purposes of requirements placed on tritium control, accountability, and physical pro- tection at fusion facilities are to a. meet legal requirements for environmental releases, waste disposal, and transporta- tion of tritium; b. prevent the diversion of the material for unauthorized use; c. gain knowledge of the process efficiency, that is, how much tritium is produced and used in processes under investigation; d. meet the requirements of the DOE Orders for DOE fusion facilities; e. assure operational safety of the facilities by providing knowledge of the location and form of tritium; 41 DOE-STD-6003-96 f. prevent unwanted buildup of tritium within a facility; and g. protect and control tritium commensurate with its monetary value. It is difficult to determine the distribution and precise inventory of tritium in a fusion facility. Usually, measurement before injection into the plasma chamber and after removal from the plasma chamber is possible (referred to as inventory by difference). However, tritium production in the machine is also possible. Therefore, the actual amount of tritium remaining in the machine is difficult to determine (this can affect the safety analysis, because there is usually an upper bound on the amount of tritium allowed in the vessel). Sampling tiles or protective surfaces maybe a way of determining the tritium levels; however, those samples may or may not be representative of the tritium levels throughout the vacuum vessel.

It is therefore critical that the designers of the facility determine appropriate means to reliably measure tritium in the fusion facility. This should be done early in the design process to minimize tritium holdup, allow for pumping and purging systems to evacuate the tritium, and specify appropriate instrumentation for measurement. These actions will assure safety of the facility, reduce the risk of a release and improve worker safety. Methods for measurement of tritium are specified in later paragraphs. Tritium is the predominant nuclear material used at fusion facilities. It is of interest because of safety concerns, its monetary value, and possible unauthorized diversion for other applications. Although public exposures and environmental releases are expected to be small and well below regulatory limits from a fusion facility, tritium is a radioactive material, and the public will need to be assured that safety has not been compromised. Other nuclear material that must be controlled and accounted for at fusion facilities includes depleted uranium (U-238) and deuterium. Depleted uranium is used for storage of tritium, fission chambers, and various radioactive check- and calibration-sources. Deuterium in quantities greater than 100 g is also controlled at DOE facilities (DOE Order 5633.3B and 5660.1B). The control and accountability of these materials is relatively straightforward and does not present significant problems for operating facilities. The scope and extent of the accountability program for these materials should be based on the monetary value of the material and should include inventories and some measurements. 4.4.8.1 Requirements The requirements placed on the control and accountability of tritium fall into three cate- gories. Those required by the U.S. law, those required by DOE Orders, and those required by “good practices.” It is also important to note that requirements are not consistent throughout the international community. a. Legal requirements. The legal requirements on tritium measurement are as follows: 1. Environmental facility emissions, which include air emissions and releases to the ground water or at facilities outfalls, are regulated. These include federal and state 42 DOE-STD-6003-96 requirements in the following laws: Clean Water Act for water quality standards and effluent limitations, and Federal Clean Air Act, which set ambient air quality standards. EPA regulates the type and quantity of facility emission. EPA specifies the mea- surement techniques for air emissions and must approve any requests for devia- tions. EPA sets the limits for exposure to the public and the notification required when certain quantities of radioactive materials are emitted. State laws usually regulate the facility outfalls. State requirements are not uniform across the country. 2. Department of Transportation (DOT) requirements specify packaging requirements that are dependent on the form and quantity of tritium. DOT must also approve packaging containers when the radioactive material is transported on public highways. 3. Waste storage requirements are in place when mixed hazardous waste may be involved. The EPA administers the Resource Conservation and Recovery Act (RCRA). In many cases this authority has been delegated to the state. 4. Waste disposal requirements are generally state specific.

5. 10 CFR 830 Nuclear Safety Rules and 10 CFR 835 Occupational Radiation Protection apply to the radiological activities in a fusion facility. Because these requirements are part of the U.S. law, they must be followed by each facility that handles tritium or radioactive materials as applicable. The details of the state requirements will not be discussed in this section because they vary widely. b. DOE Orders. DOE Orders are requirements placed on DOE facilities that define operations and the methods of conducting business. DOE 5633.3B, “Control and Accountability of Nuclear Materials” specified the minimum requirements and pro- cedures based on the amount of tritium and the form of the tritium in a facility. Important requirements from this order follow: 1. Tritium is protected, controlled, and accounted for as Category III or IV Special Nuclear Material. The level of protection and control depends upon the form and quantity of the tritium. The reportable transaction quantity is 0.01 g (~100 Ci). 2. Each facility must have a Materials Control and Accountability (MC&A) Plan. The scope and content requirements for the plan are determined by the manager of the DOE operations office. 3. DOE Order 5633.3B requires that tritium be inventoried biennially. Where feasible, inventory values should be based on measured values. 43 DOE-STD-6003-96 4. Inventory requirements are placed on the shipper and receivers of controlled material and methods to control and resolve inventory differences. 5. Access controls, depending on the tritium form, must be established. Each fusion facility must establish an independent organization to provide oversight of the nuclear materials control and accountability. The physical protection requirements are specified in DOE Order 5632.1C, “Protection and Control of Safeguards and Security Interests,” and DOE 5332.1C-1, “Manual for Protection and Control of Safeguards and Security Interests.” The current DOE requirements are dependent on the quantity and form. These include control of tritium by personnel with a U.S. DOE L clearance and controlled locks, alarms, and access during nonworking hours. A higher level may be required if there are sabotage risks or classified information interests at the facility. Other Orders specify waste requirements, environmental monitoring, and personnel pro- tection. These are not discussed in this section. The DOE Order requirements are in general not legal requirements. The facility can negotiate with DOE to determine the most cost-effective manner of implementing the requirements and still maintain facility safety and material accountability. 4.4.8.2 Nuclear Material Locations at a Fusion Facility Typical locations, inputs, and outputs, and measurement points for tritium at a fusion facil- ity are identified below. a. Inputs to tritium are shipments into the facility and production of tritium at the facility. b. Locations of tritium within a facility are “in-process,” in-system holdup, in-waste sys- tems, and in-storage. c. The exit streams of tritium from a facility include shipments of tritium from the facility and waste streams (tritium stack emissions, water releases, solid waste and acciden- tal tritium releases). d. Measurement locations include input tritium shipments to the facility, exit shipments from the facility, in-process measurements, in-storage measurements, waste stream measurements, personnel exposure measurements, workplace measurements, and stack emission measurements.

4.4.8.3 Tritium Measurements Method Two primary categories of tritium measurements are made at fusion facilities. One cate- gory is for determining the quantity and location of tritium within the facility. These measure- ments are generally of large quantities of tritium in high concentrations. The second category is for environmental or safety determinations. These are generally lower concentrations and small quantities. 44 DOE-STD-6003-96 This section will discuss methods for both categories. The measurements techniques for tritium can be grouped in the three general areas: composition measurements, thermal mea- surements, and tritium concentration measurements. Composition measurements determine the actual concentration determination for each atomic/molecular species. This method can be used for gases only. Thermal methods (calorimetry) rely on the radioactive heat of decay of tritium. For 1 g of tritium ~0.333 W is gen- erated by decay. The temperature increase or heat generation is measured. Calorimetry can be used for tritium in any form: solid, liquid, or gas. The only radioactive material present must be tritium because other radioactive materials will contribute to the thermal properties of the sample. The final method determined the total tritium concentration by the measurement of the products or the effects of the products of the radioactive decay. The beta particle can cause scintillation effects or ionization effects. These effects can be measured and the concentration of tritium determined. The following methods are used or proposed to be used for measurement of tritium: Pressure/Volume/Temperature/Composition (PVTC), using either a mass spectrometer or laser RAMAN spectrometer for the composition measurement; Beta scintillation counter; Self- assaying tritium storage beds; Scintillation Counting; and Ion Chamber. Most of the techniques discussed here are batch samples, however some techniques can be used for “on-line/real time” measurements. a. Composition Measurements. PVTC measurement is used for measurement of gaseous samples only. A representative sample of the gas is taken. The gas that is to be measured must be mixed well. The volume, pressure, and temperature must be measured accurately. The temperature is difficult to measure accurately because of temperature gradients caused by the heat of decay of tritium. The composition of the gas in the sample is then measured using a mass spectrometer or a laser RAMAN spectrometer. The mass spectrometer will measure all gas species. A high-resolution mass spec- trometer is required to distinguish between different molecules with the same mass number. For example HT and D2 have the same mass number, but must be sepa- rated to determine the tritium concentration. All species that can contain tritium must be measured. This includes, water as HTO, methane as C(H,D,T)4, ammonia as N(H,D,T)3, etc. The sum of all the species containing tritium can then be determined. If the approximate gas composition is unknown, the use of the mass spectrometer may be difficult. The laser RAMAN spectrometer is a relatively new system that can be used to mea- sure molecular concentrations in a gas mixture. The sample is placed in a cell with optical windows. The laser excites the rotational or vibrational atomic levels in the gas molecules. The light emitted as the excited levels decay back to the ground state is detected using a photodetector system. The measurement is absolute in that the fre- quency spectrum of each molecule is unique. The intensity is proportional to the amount of gas present. The disadvantages of the RAMAN method are that the amount of inert gases cannot be determined. Common inert gases at a fusion facility are the

45 DOE-STD-6003-96 isotopes of helium. Both of these techniques can be used for real-time measurements. For the mass spectrometer system a sample is bled to a high vacuum system for mea- surement. The RAMAN system is easily adopted to real-time measurements. The gas stream at atmospheric pressure is passed through an optical cell. The spectrum for a mixture hydrogen isotopes can be determined in ~1 min. The total accuracy of these measurements is ~3 to 5%. The mass spectrometer technique has been the standard method that DOE facilities have used for the determination of the tritium inventory. It is a proven system although it requires an expensive spectrometer ($200K) and accurate determination of the temperature, pressure, and volume. The RAMAN system has not been accepted. Experiments are currently being performed to demonstrate that this will be an acceptable technique. b. Thermal Methods. The primary method to inventory large quantities of tritium in the liquid or solid form is to use a calorimeter. The sample is placed in a thermally iso- lated container. The power required to maintain the temperature of the container is then a measure of the amount of tritium in the sample. Containers can accept sam- ples that vary from several inches in diameter up to a 55-gal drum. The lower limit of accuracy can be as low as 100 Ci. Calorimeters are expensive ($200K+). They require high-tech electronics. They are the primary methods used to measure tritium in waste such as HTO on molecular sieve. They have not been used to measure process tritium except in a very specific application. For example, solid tritium storage beds that can be disconnected and moved have been placed in a calorimeter designed to accept the bed. New methods are being developed to allow for the deter- mination of the amount of tritium stored on a solid storage bed, When tritium is stored on a uranium bed the temperature increase of the bed can be used to determine the amount of tritium stored on the bed. When tritium is stored on a material such as LaAlNi, usually gas is passed through the secondary containment to maintain the temperature. The temperature rise of the gas as it passes through the bed can then be used to determine the amount of tritium. Both of these methods are being pro- posed for tritium accountability. Their acceptance is now based on a case-by-case system, and they are not used widely. Development of these methods will be impor- tant for the operation of fusion facilities. They offer potential savings in time and effort to account for the tritium in a facility. c. Tritium Concentration Measurement. A Beta scintillation counter has been used for tritium measurement if only the total tritium composition is required. In this instrument, the gas is passed over a crystal that will scintillate with the beta from the tritium decay. A photomultiplier tube is used to detect the light. The tritium concentration can then be determined from the signal from the photomultiplier tube. This method is commonly used for gas inventory requirements. Liquid scintillation is commonly used to determine small concentrations of tritium. The tritium liquid or compounds containing tritium are placed in a scintillation liquid. The liquid is then placed in a counter that determines the amount of tritium by the light emitted from the sample. Ion chambers are commonly used to determine environmental tritium releases and to monitor the atmosphere for personnel safety. Process ion chambers are used for determining tritium concentrations in secondary containment. Specially designed ion chambers

46 DOE-STD-6003-96 can be used to determine high concentrations of tritium. Ion chambers will measure any radioactive material that can cause ion pairs. They are also susceptible to con- tamination from materials that adsorb on surfaces and can only be used for gas. 4.4.8.4 Facility Measurement Recommendations a. Measurement of tritium input/output to facility. The primary method used historically for the measurements of the tritium shipment has been the PVTC measurement with the composition determined by either a mass spectrometer or beta scintillation counter. A calorimeter can be used for the measurement of tritium absorbed on solid storage beds that are designed to be used as primary shipping containers and also be placed in the calorimeter. b. In-process tritium measurements. The measurement of tritium within a facility has usually been by PVTC. This requires a shutdown of the process and transferring of all the gas to a volume for sampling and measurement. This is usually a substantial dis- ruption of the process and will take a significant time. Tritium that is “held up” in pro- cess cannot be directly measured. This includes tritium in walls of the system, tritium in process components such as a molecular sieve, and tritium contained within the waste disposal system. It must be estimated by difference measurements. Real-time measurements of tritium amounts are done when tritium is moved around the facility or process. These are usually done by PVTC measurements. The laser RAMAN system offered advantages for the measurement of composition as tritium flows from location to location. The use of self-assaying storage beds will greatly reduce the time required to determine the tritium in storage. c. Tritium in waste streams. The characterization of tritium contained in waste streams is important, and one of the more difficult measurements to make. Ionization chamber measurements, calorimetry, and difference measurements are used to determine the tritium levels. d. Stack emission measurements. Stack emissions are determined by ion chambers. The primary method used by facilities for the reporting to the EPA is based on a pas- sive monitoring system. A small fraction of the air stream exhausted from a facility is passed through a system to remove the tritium. Both liquids such as glycol and solids such as molecular sieve are used to absorb HTO. These system can distinguish between HTO and HT by passing the sample through a catalyst that will convert HT to HTO. The second collection system then collects the HT as HTO. 47 DOE-STD-6003-96 Intentionally Left Blank 48 DOE-STD-6003-96 5. SAFETY ANALYSIS This chapter of the Standard describes the safety analysis requirements applicable to fusion facilities and provides guidance for the implementation of these requirements and criteria for determining that the requirements have been met. Safety analyses are performed to show that the risks associated with operation of a facil- ity have been identified, quantified, and managed. Management of risk can be accomplished (1) by demonstrating that the risk is within the bounds of an approved safety envelope, (2) by showing that the risk consequences are mitigated to meet the established evaluation guidelines, and (3) by having the risks themselves eliminated or reduced by demonstrable controls.

The completion of a safety analysis requires information on the facility, the site character- istics important for evaluating facility safety, and the principal equipment and processes required to fulfill the facility mission. From this baseline descriptive information, hazards can be identified. Facility risk descriptions are then developed from the hazard inventories, system functional pro- cess descriptions, and a listing of off-normal conditions postulated to result from both internal and external causes. The entire analysis process is documented in a Safety Analysis Report (SAR) and in Technical Safety Requirements (TSRs); the guidance for these is addressed in later subsections. The safety analysis has many purposes. In addition to establishing the safety of the facil- ity, the safety analysis is used to develop TSRs and to determine readiness for construction and operational authorization. The graphical illustration of the functional relationship of the major items included in the safety analysis process is shown in Fig. 5.1. As discussed in Section 1.3, a risk-based prioritization approach is to be taken in the implementation of safety analysis requirements as well as in the implementation of the other ele- ments of this Standard. Actions taken to ensure compliance with requirements are a function of the several factors cited in the definition of risk-based prioritization. The factors most relevant to fusion safety analysis considerations are risk and magnitude of hazard. The other factors included in the risk-based approach are mission and facility life cycle. As such, the importance of these factors is discussed where appropriate in the applicable sections of this chapter. The project has the responsibility for the development of specific criteria for the applica- tion of a risk-based prioritization approach to the system specific criteria. Concurrence with the specifics of the risk-based approach taken by a facility should be obtained from the regulator prior to its implementation. The identification of relevant criteria will flow from the nature and purpose of the system itself. 49 DOE-STD-6003-96 FIGURE 5.1. Flow logic of the safety analysis process. 50 DOE-STD-6003-96 5.1 Facility Description 5.1.1 General Safety analyses inherently contain a description of the facility being analyzed that is suffi- cient to convey an understanding of the nature and magnitude of the physical plant and systems involved in the implementation of the facility mission. The description should be sufficient to allow the reader to understand how the hazardous materials, systems, components, and pro- cesses that are discussed later relate to the system as a whole and to understand the role and relevance of the safety systems in the facility. The facility description should also include those site characteristics that constitute or contribute to facility hazards. The site information should be sufficient to provide a basis of understanding of the hazards and the mechanisms by which radiological or hazardous material could have consequences to the public, environment, or workers. Useful guidance on the content of a facility description portion of a safety analyses is available in Department of Energy (DOE) Order 5480.23, attachment 1, page 24 (DOE 1992b):

Safety analyses should contain descriptions of the facility and the principal equipment and processes provided to fulfill the mission of the facility and should delineate the plans, provisions, and requirements for their operation, mainte- nance, and surveillance. Information on the design of principal structures, com- ponents, and systems should be furnished in sufficient detail to support the identification of hazards, principal safety criteria, selection of engineered safety features, and the analysis of off-normal conditions. This information should include the following, using drawings as necessary: a. A listing of the safety structures, systems, components, equipment, and processes discussed in this section of the report; b. Detailed descriptions of structures or containers used to confine radioac- tive materials or hazardous chemicals; c. Detailed descriptions of safety-significant mechanical, electrical, and fluid systems (i.e. decay heat removal methods...) including functions, design bases, and relevant design features; d. Detailed descriptions of chemical process systems, including information on design configuration, dimensions, materials of construction, pressure and temperature limits, corrosion allowances, and any other operating limits, and; e. A functional description of process and operational support systems, including instrumentation and control systems... 51 DOE-STD-6003-96 The facility description information must be an integral part of the safety analysis, but it is possible to accomplish this by providing the information in nonsafety analysis sections of facility documentation or even in totally separate documents, either of which would then be referenced in the specific safety analysis discussions. The configuration control requirements applicable to SARs would also apply to information referenced in the SARs but contained in other documents. (See configuration control requirements of Chapter 4.) 5.1.2 Safety Structures, Systems, and Components Safety structures, systems, and components (SSCs) implement the safety functions associated with a facility. The two categories of safety functions associated with fusion facilities are (1) public safety functions or essential characteristics needed to ensure the safety of the facility and protection of the public and environment during operations and during and following off-normal conditions; and (2) worker safety functions that ensure the health and safety of the workers. The public safety function for fusion is the confinement of radioactive and hazardous material under normal and off-normal conditions. Potential public safety concerns related to confinement include (1) ensuring afterheat removal, (2) providing rapid plasma shutdown, (3) controlling of coolant internal energy, (4) controlling of chemical energy sources, (5) controlling of magnetic energy, and (6) limiting air and water discharges from the facility. Worker safety functions are related to worker hazards and routine releases. The issues associated with the worker safety function that should be evaluated are (1) limiting occupational exposure to radiation, (2) limiting the exposure to electromagnetic fields, and (3) controlling other industrial hazards and hazardous materials. It is recommended that the SSCs required to implement the public safety function should employ the requirements imposed on systems defined as being safety-class SSCs in DOE 1994 (DOE STD-3009-94). The specific definition of a safety-class system is as follows:

Systems, structures, or components including primary environmental moni- tors and portions of process systems, whose failure could adversely affect the environment, or safety and health of the public as identified in the safety analysis. The safety-class SSCs are associated with the public safety function of confinement that protects the public and the environment from exceeding the radiological evaluation guidelines in DOE-STD-6002. It is recommended that the SSCs that address potential safety concerns or are required to protect the worker safety functions should employ the requirements imposed on systems defined as being designated as safety-significant SSCs in DOE 1994 (DOE STD-3009-94). The specific definition of a safety-significant system is as follows: Structures, systems, and components not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to 52 DOE-STD-6003-96 defense in depth (i.e., prevention of uncontrolled material releases) and/or worker safety as determined from hazard analysis. The safety-significant SSCs have the goals of (1) ensuring the availability of the public safety functions via defense-in-depth and (2) supporting the health and safety of workers during routine operations. The safety-significant SSCs would not be required to mitigate the conse- quences of off-normal events to meet the evaluation guidelines for the public or the environ- ment. This function is the responsibility of the safety-class SSCs. However, because the SSCs that address the potential safety concern related to confinement will reduce potential threats to confinement through either accident prevention or mitigation, they are considered to contribute to defense-in-depth and thus are designated as safety-significant. The categorization of a safety-class SSC is a two-step process. The first step is to identify early in the design the SSCs whose failure would result in exceeding evaluation guidelines. This should be by a “top down” functional hazards analysis. The second step is to verify in the final stages of design that the safety-class SSCs are actually needed to be functional, as indicated by the safety analysis process. If the SSCs are verified as being needed in the safety analysis process, then the equipment would be designated as safety-class SSCs. These components also must perform the required safety functions. This design approach would be as follows: a. identify all potential hazards associated with the facility, b. identify all SSCs needed to control those hazards, c. identify the safety-class SSCs necessary to ensure that evaluation guidelines are not exceeded, and d. verify, through detailed safety analysis, the need for the systems in item (c) to meet the evaluation guidelines provided in DOE-STD-6002. The safety-class SSCs should be designed such that a minimum number of active or passive mitigative systems identified from and credited within the safety analysis are available to ensure that the evaluation guidelines are not exceeded. Reliable SSCs are required to be employed to satisfy the requirements of safety-class items. Use of defense-in-depth principles such as redundancy, simplicity in design, independence, fail safe, fault tolerant, and multiple (diverse) methods for increasing the reliability and reducing the consequence to acceptable levels is permitted and encouraged. In most cases, the use of passive methods of accomplish- ing the safety function is preferred over using active systems.

The next step in the process would be to perform the required system safety analysis. The safety analysis results would verify the adequacy of the safety-class SSCs to mitigate the release of hazardous material to meet the evaluation guidelines specified in DOE-STD-6002. Thus, the results of this evaluation determine which of the SSCs would be required to satisfy the public safety function. It may result in multiple SSCs being required to satisfy the safety system requirements for a particular off-normal condition scenario. In most cases, the SSCs identified in the hazards assessment review would be the same as those verified by the safety analysis as 53 DOE-STD-6003-96 being SSCs required to implement safety. In addition, the safety analysis would verify the ade- quacy of safety-significant SSCs in addressing the potential safety concerns. Worker protection and potential safety concerns associated with the public safety function are identified in DOE-STD-6002. Descriptions of each SSC that is providing safety functions are required in the SAR. A basic descriptive model of the facility and its equipment must be provided in which the required SSCs are addressed in detail commensurate with their preventive or mitigative role in meeting off- normal condition evaluation guidelines. For example, consider a facility that cannot meet evaluation guidelines, as discussed in DOE-STD-6002, unless credit is taken for system A. Besides being noted in the general facility description, system A together with associated codes and standards would be described in the section on safety-class SSCs. This system would typi- cally be associated with a specific TSR (discussed in Section 5.7) and would be described in detail commensurate with its importance to the safety basis. However, only the characteristics of the SSC that are necessary to perform the safety function are classified as part of the safety system. For example, if a valve in a system is only required to provide an external pressure boundary, then only the pressure boundary function would be classified as a safety system characteristic and all other functions, such as the valve operability, response time, etc. would not be included in the safety system definition. Conversely, if the consequences of all hazardous releases or off-normal conditions exam- ined meet the evaluation guidelines without relying on the safety-class function of process system B, then system B would not be considered to be a safety system performing a safety function. Detailed identification of its functional basis and construction is not necessary because it is not a significant contributor to the overall facility safety basis. There would also be no need to discuss administrative provisions (e.g., initial testing, maintenance) required to ensure the operability of system B, nor would there be a need for a specific TSR (e.g., Safety Limit, Limiting Condition For Operation, etc.) covering system B. If a system is designated as safety-significant, industry recognized codes and standards are to be applied and minimal, if any, TSRs are to be specified for the operation of the system components (see Section 5.7).

A risk-based prioritization approach can be used to develop requirements for the safety- class and safety-significant SSCs. One of the dominant factors governing risk-based prioritiza- tion is the severity of the off-normal condition consequences associated with the facility and the number and type of the SSCs needed to prevent evaluation guidelines from being exceeded. If, for example, the defense-in-depth principles are satisfied by providing other SSCs to mitigate the consequences, then added inspections and other quality pedigree requirements of the first system would not be as important as if the original SSCs were the only means of accomplishing the safety function. If the consequences of the off-normal condition exceed the evaluation guide- lines by a large margin and there is no other system that will mitigate or prevent the release for the off-normal condition, then special precautions should be taken in the design and in develop- ing the inspection program to ensure that the system will be available to function when called upon. This may involve special inspections, alternate design approaches, or other actions that would significantly enhance system reliability. The rigor of compliance with the design and inspection requirements could be relaxed for systems that have multiple backups for preventing off-normal conditions or mitigating the off-normal condition consequences. 54 DOE-STD-6003-96 The design of the SSCs that perform the safety-class and safety-significant safety func- tions should meet the appropriate requirements established in Table 5.1. TABLE 5.1. Safety system functional requirements Requirement Safety-Class Safety Function Safety-Significant Safety Function System design Reliable methods of accomplishing the required safety function should be provided. Some of the design techniques that would ensure system reliability would include redundancy, diversity, simplicity in design, independence, fail safe, fault tolerant. Each method should be analyzed to identify potential failure mechanisms from performing the safety function in the system and to minimize those failures in the design. For further guidance on providing reliable system designs, see Section 6.7.3.1. Nonredundant systems are normally used to perform the worker safety function. The safety system should be analyzed to preclude failures mechanisms that could disrupt the system function. Multiple systems may be employed, at the discretion of the facility developer, to ensure that the system functions are performed. Codes and Standards Nationally accepted design codes should be used in the design (see Chapter 6). The applicability, adequacy, and sufficiency of the codes and standards used should be evaluated. These codes and standards should be supplemented or modified as necessary to ensure system performance in keeping with the importance of the safety functions to be performed. The codes and standards used for these systems should be those which have been validated through satisfactory performance in commercial application. Reliability Safety system should be demonstrated to have a high reliability. One of the ways to demonstrate this is by providing multiple, redundant, diverse systems/barriers to accomplish the safety function. The safety system should be equivalent to that associated with commercial industrial safety practices.

Quality The SSCs should require an appropriate level of quality for the design and construction to ensure the system function is performed. Quality assurance in accordance with the requirements of 10 CFR 830.120 should be implemented. The systems required should be designed in accordance with industrial quality requirements. Testability/ surveillance The SSCs should be tested/surveyed periodically to determine that the function can be provided. Acceptance criteria should be established to evaluate the test results that demonstrate when the system is performing its intended function. The test frequency should be established to ensure that the system demand and reliability requirements are achieved. The SSCs should be tested/surveyed periodically to determine that the function can be provided. Natural phenomena The SSCs should be designed to withstand appropriate natural phenomena and continue to provide the required safety function. Design for natural phenomena should be in accordance with facility performance goals per DOE Order 420.1 (DOE 1995a). Design for natural phenomena should be in accordance with facility performance goals per DOE Order 420.1 (DOE 1995a). 55 DOE-STD-6003-96 5.2 Facility Mission/Processes Descriptive information on the overall mission is required as part of the SAR. It is also a major factor in the development of the risk-based prioritization approach being implemented throughout each aspect of facility safety design. Information on the facility processes is used primarily in the hazards analysis phase of the safety analysis. Facility process information and facility description information are used to develop the inventory of facility hazards. Facility risks can then be established by identifying the accessibility of each hazard. The first criterion for determining the sufficiency of mission and process information in the safety documentation is whether there is enough to support closure of the safety analysis. That is, are there undocumented aspects of the facility mission or its processes that would in any way affect the conclusions of the safety analysis with respect to the particular component, system, and so on. The conclusion should be that there are not; should there be any situation that pro- duces an answer to the contrary, then the mission/process descriptive information is deficient. A second criterion for the sufficiency of mission information is whether there is enough to implement a risk-based prioritization approach throughout the safety design activity. The previ- ously described design and analysis activities would normally provide the necessary information to satisfy the requirement. 5.3 Hazards Analysis The hazards analysis performed for a given facility provides a measure of the risk poten- tial for operation of that facility. The results of the hazards analysis will dictate the level of detail required for the safety analysis that must be performed for approval to operate. The following steps must be performed in the development of the hazards analysis: a. Identify the potential energy sources, the initiating events, and inventories of radioac- tive and hazardous material that could be present in the facility both during routine operations and shutdown conditions, based on the classification methodology devel- oped in such documents as DOE-STD-1027-92 (DOE 1992d). b. Classify the facility into categories according to the its hazard potential using an approach that does not account for safety system mitigation.

The categories with the higher hazard potential for a facility require a more detailed safety analysis to demonstrate that the facility can be operated safely. 5.3.1 Inventory The inventory of the radioactive and hazardous material is one of the determining factors in the hazards analysis classification of a facility. A set of radioactive inventory limits has been developed for use in the classification of fusion facilities into various hazard categories 56 DOE-STD-6003-96 described in the following section. Because the radionuclide inventory limits contained in DOE-STD-1027 are primarily associated with the fission process, the radionuclide list has been expanded to include additional isotopes that could be present in fusion facilities. The expanded limits for Category 2 fusion facilities are provided in Appendix A to this Standard. The radioactive and hazardous material inventories can be segmented provided it can be shown that the potential consequences associated with the hazardous material are limited to the segmented amount rather than the inventory present in the more than one segment or the entire facility. Based on the guidance presented in DOE 1992d, inventory segmentation is allowed if the hazardous material in one segment could not interact with the inventory in other segments to result in larger potential consequences than from any of the individual segments. For example, independence of the heating, ventilating, and air conditioning (HVAC) and piping must exist to demonstrate independence for facility segmentation purposes. This independence must be demonstrated and places the “burden of proof” on the analyst. 5.3.2 Classification The classification of fusion facilities should follow the guidance provided in DOE-STD- 1027-92 (DOE 1992d). This guide provides for three facilities hazard categories summarized as follows: a. Hazard Category 1—Hazard analysis shows the potential for significant off-site con- sequences. Fusion facilities in this category would be designated by the cognizant DOE official. b. Hazard Category 2—Hazard analysis shows the potential for significant on-site con- sequences. Examples include facilities with the sufficient quantities of hazardous radioactive materials that meet or exceed the inventory values contained in the guid- ance document used for classifying facilities (DOE 1992d). c. Hazard Category 3—Hazard analysis shows the potential for significant localized con- sequences at a facility. Examples include facilities with quantities of hazardous radio- active materials that meet or exceed the inventory values contained in the guidance document used for classifying facilities. In addition to these three categories, there is an additional category for all of the facilities that have less hazard potential than the least of the previous three categories. This category is defined as follows: d. Below Hazard Category 3—Hazard analysis shows the potential consequences to be below the guidelines of the requirements described in DOE-STD-1027-92, as modified by this Standard. An example of this is those facilities that have inventories of radio- active material less than those specified for Category 3 facilities for hazard catego- rization. Thus, these facilities would be classified as non-nuclear facilities. It should be noted that many of the smaller fusion facilities could fall into this category. 57 DOE-STD-6003-96 5.4 Analysis of Off-Normal Conditions

The requirements of this Standard indicate that the safety of fusion facilities should be analyzed to demonstrate that the facility meets the evaluation guidelines discussed in DOE-STD-6002. This section provides guidance on the type of analysis of off-normal conditions required for use in meeting the evaluation guidelines and the fusion requirements related to no off-site evacuation. The types of analyses used to demonstrate compliance with these require- ments are different and need discussion in this section. The level of analysis of off-normal conditions for fusion facilities should be based on the risk to the public, the environment, and the worker. Facilities with minimal risk will only require that a scoping conservative analysis be performed to satisfy the safety analysis requirements. However, a facility with a large potential safety risk to the public, the workers, or the environ- ment (Category 1 and 2 facilities) will require a more detailed analysis of off-normal conditions to satisfy the safety analysis requirements for such facilities as given in this section. It is important that the safety analysis address the institutional and human factors safety issues. Experience has confirmed that the risk associated with operating nuclear facilities is a combination of the institutional approach to safety, human factors safety, and safety in design. As used here, the institutional approach to safety includes a. management and organization of facility operations; b. the safety culture sustained by management; c. performance objectives and the measurement of operational performance; d. management oversight and assessment; e. feedback of operational experience; f. management controls of operations, surveillance, and maintenance; g. related management efforts to achieve and sustain safe operations. Human factors safety, as used here, refers to a. the allocation of control functions to personnel vs automatic devices; b. staffing and qualification of operating crews; c. personnel training; d. the preparation, validation, and use of written procedures to guide operations, surveillance, and maintenance; 58 DOE-STD-6003-96 e. the design of human-machine interface to build on strengths and protect against the susceptibility of human error in operating crews. Safety in design includes a. identifying the potential off-normal conditions and incorporating systems performing safety functions in the facility design to reduce the overall risk from those conditions; b. designing reliable safety features using appropriate codes and standards that will ensure the availability of the safety when required; c. categorizing the facilities to their appropriate risk potential because the level of safety features that are required for a given facility will be a direct function of the significant risks present in a facility; d. using defense-in-depth concepts in the design to ensure the safety of the public, worker, and the environment; e. incorporating the as-low-as-reasonably-achievable (ALARA) principles in the facility design to reduce the risk potential to the workers during normal and off-normal conditions. The specific features associated with the design of a facility are discussed in detail in Chapter 6. 5.4.1 Event Scenario Identification and Classification Figure 5.2 is a flow chart that can be used to understand the steps required in the analy- sis process. First, a list of postulated initiating events should be developed. Based on the generic hazard and accident scenario identification (presented in Appendix B), these initiating events could include the following:

a. loss of coolant (e.g., water and cryogen); b. loss of flow; c. magnet transients (arcing, quench, coil displacement, and magnet missile); d. transient overpower; e. plasma disruptions [including vertical displacement events (VDEs) and runaway electrons]; f. loss of vacuum; g. initiating events in the tritium plant; 59 DOE-STD-6003-96 FIGURE 5.2. Event scenario/safety analysis process. 60 DOE-STD-6003-96 h. initiating events in auxiliary systems [e.g., neutral beams, radio frequency (RF), pumping, and fueling]; i. initiating events in balance of plant systems (e.g., loss of off-site power); j. operator errors; and k. external events. The initiating events should consider all aspects of fusion facility operation, including plasma operation, bakeout and conditioning, and maintenance. Because fusion facilities operate in modes that are different from other facilities (e.g., bakeout and conditioning, in pulsed mode for some machines), these potential plant states should be examined carefully. In the develop- ment of these postulated initiating events, completeness is somewhat problematic. Practical completeness can then best be achieved by collective review of the results by safety analysts and designers who understand the facility. From these postulated initiating events, event scenarios should be developed that exam- ine the response of the fusion facility to these initiating events, accounting for potential failure of other systems (e.g., confinement). The use of event trees or event sequence diagrams may be useful here. The event scenarios should span a wide range of expected frequencies, including those events expected to occur once or more during the operating life of the facility [i.e., an anticipated operational occurrence (f > ~10–2/yr); those events not expected to occur, but may occur, during the life of the plant (10–2/yr > f > 10–4/yr); those events that would not be expected to occur during the life of the plant but which form the limiting events needed in the design basis (10–4/yr > f > 10–6/yr); and events beyond the design basis (f < ~10–6/yr)]. Once the events have been developed, they should be categorized into three types based on their estimated frequency: anticipated operational occurrence, off-normal conditions, and beyond-design-basis events. The off-normal conditions type includes both the anticipated operational occurrences and events expected to occur once or more during the lifetime of the facility. Based on these events, bounding or limiting events of each kind (e.g., loss of flow, loss of coolant, and loss of vacuum) should then be selected for detailed quantitative analysis. Two types of analysis methodologies should be used for the safety assessment for the fusion facilities: a deterministic, conservative approach and a best-estimate, realistic approach. Each type of analysis methodology is required for a different portion of the required safety assessment. The deterministic, conservative approach is to be used in the design-basis assess- ment for the SAR to ensure that a bounding estimate of the facility safety is determined. The best-estimate, realistic approach is to be used for analysis of beyond-design-basis events for the SAR and in the determination of the emergency planning assessment. However, a conser- vative risk-based approach can be used in place of the deterministic conservative approach since either approach would satisfy the intent of performing a conservative safety assessment. These are discussed in the next two sections.

61 DOE-STD-6003-96 5.4.2 Analysis Approach for the Safety Analysis Report Because there is no previously identified design basis for large fusion facilities like the International Thermonuclear Experimental Reactor (ITER), a subset of the event scenarios identified in Section 5.4.1 needs be selected to form the design basis and to undergo detailed quantitative analysis as part of the SAR. There is varying information that can be used to develop an appropriate criteria to be used in this selection. DOE Order 420.1 (DOE 1995a) and DOE-STD-3009 (DOE 1994) indicate that events down to ~10–6/yr should be considered. Many advanced fission plants are also considering similar criteria. It is recommended that for fusion facilities, internally initiated event sequences down to ~10–6/yr be used. For external events, guidance given in DOE Order 420.1 (DOE 1995a) should be consulted. Two different types of calculations should be performed: best estimate and conservative. Conservative calculations should be performed for those events identified as part of the design basis. As part of the calculation, all key assumptions need to be stated and the level of conser- vatism noted (e.g., 110% nominal power). The results of these conservative calculations are then compared to the evaluation guidelines (discussed in DOE-STD-6002) to determine classifi- cation of safety systems (see Section 5.1). The best-estimate calculations are then performed so that the degree of conservatism or the safety margin in the facility can be established. The deterministic approach used for evaluating the safety of the facility design basis pro- vides a conservative approach for assessing the safety of the facility by using bounding esti- mates of the releases from the postulated off-normal conditions, bounding estimates for the release fractions, and bounding estimates for the transport through the environment. This approach is designed to result in a bounding estimate of the safety consequences from the postulated events. Guidance on the conservative release assumptions to be used in the design-basis accident (DBA) analysis is available from several safety analysis reference sources. One of these sources is a report published in the late 1980s, Elder 1986. This report was published to provide guidance for assessing the radiological consideration for siting and the design of DOE nonreactor nuclear facilities. Some of the information may be dated, but in general it provides useful guidance for the assumptions and release fractions that are appropriate for deterministic analysis methodology. Guidance for the selection of conservative assumptions to be used in assessing the transport of the release to the receptor can be found in Nuclear Regulatory Commission (NRC) 1974 or NRC 1983. Guidance for documenting the analysis methodology used in assessing the consequences is provided in DOE 1994. To assess the residual risk associated with the operation of a facility and to provide per- spective on possible facility vulnerabilities, an evaluation of beyond-design-basis accidents (BDBAs) should be performed per DOE 1992c. Such BDBAs evaluations are not required to provide assurance of the public health and safety. These results are to serve as basis for eval- uating the completeness of the events identified in the DBAs and to ensure that there is no sig- nificant threshold increase in the facility risk. For a well-designed facility, there should be no sharp increase in consequences when moving from DBA to BDBA scenarios. It is expected that the BDBAs would not be analyzed to the same level of detail as the DBAs. The insight into the

62 DOE-STD-6003-96 magnitude of consequences of BDBAs has the potential for identifying additional facility features that could prevent or reduce severe BDBA consequences. A key issue relates to the severity and associated probability of the accidents that need to be analyzed. There is no lower limit to a BDBA frequency specified in current DOE documents. However, it is understood that as frequencies become very low, little or no meaningful insight can be gained (DOE 1994). In terms of accident severity, the following guidance is applicable. 40 CFR 1502.22 gives some limited guidance on identifying BDBAs. These events have highly catastrophic consequences, although there is a low frequency of occurrence. BDBAs must be possible from a scientific viewpoint, not based on conjecture. DOE guidance in DOE Order 5500.3 (DOE 1992c) indicates that scenarios somewhat more severe than that considered in the design basis should be used. DOE 1994 states that BDBAs can simply be DBA events with more severe conditions or equipment failures than were in the DBA. For fusion facilities, this is interpreted as design-basis scenarios in which the loss of active safety systems is assumed. Another criterion, expressed in terms of the frequency is that internally initiated scenarios with estimated frequencies of occurrence greater than 10–7/yr should be considered. Another option of evaluating BDBAs is to evaluate maximum credible events determined by assuming one additional system failure beyond the maximum design-basis events. BDBAs are not evaluated for external events, as stated in DOE 1994. The BDBA analysis is to be performed using realis- tic best-estimate assumptions. After the completion of the safety analysis for the postulated events, the results of the DBA assessment should be compared to the evaluation guidelines established in DOE-STD- 6002. The guidelines should include those associated with the protection of the public and the environment. As a result of the comparison of the safety analysis results to the guidelines, the events should be divided into the following groups: those that exceed the public safety evalua- tion guidelines, those that result in a significant fraction of the public safety function evaluation guidelines, and those that could affect the worker safety. For the events that would exceed the public or environmental evaluation guidelines, any SSC that is required to mitigate the consequences to meet the evaluation guidelines would be classified as being safety-class. For those events that have a significant contribution but do not exceed the public or environmental guidelines, any SSCs installed to minimize the conse- quences or installed to provide defense-in-depth for the public safety functions would be classi- fied as being safety-significant. For those items that could affect the worker safety, any SSCs needed to prevent acute worker fatalities and serious injuries from other than standard industrial hazards (see DOE-STD-3009-94) would also be classified as safety-significant. 5.4.3 Emergency Planning Basis Analysis The Environmental Protection Agency (EPA) has developed requirements for protection of the public during events involving a release of significant hazardous material. The require- ments establish the Protective Action Guide limits under which protective action should be initi- ated to protect the public. These requirements, established in EPA 1991, the event scenario severity and assumptions, the method of performing the analysis, and the evaluation guidelines

63 DOE-STD-6003-96 to be used in determining when public protection is required are discussed in the following paragraphs. DOE, EPA, and NRC guidance on emergency planning indicates that a spectrum of acci- dent scenarios should be considered to determine the emergency planning basis. To ensure that emergency response would encompass breadth, versatility, and flexibility, events should include both design-basis (those events specifically designed for) and beyond-design-basis events. The discussion of the types of BDBA events to be selected for analysis is also applica- ble here. Best-estimate calculations should be performed for emergency planning basis events, similar to that used for BDBA analysis. Because the conservatisms associated with the tradi- tional deterministic design-basis type of analyses can mask the actual behavior of the plant, such calculations are not appropriate for emergency planning. For example, two key inputs into such emergency planning decisions are (a) the timing, quantity, and duration of the release of radioactive material and (b) the meteorological conditions at the time of the release. Differences in the conservative calculations of these inputs and the expected values could cause emergency planners to execute the wrong public countermeasure (e.g., evacuation vs sheltering). Thus, EPA requirements and NRC guidance on the issue indicate that for the purposes of emergency planning, it is important to know the expected response of the facility so that prudent emergency plans can be developed. Thus, the need exists for best-estimate analysis of facility response under a range of off-normal conditions using realistic models for evaluating the off-normal scenario and resulting consequences to the potential receptors (NRC 1978). The results should include the unavoidable dose received during the evacuation, if evacuation is dictated over other mitigative measures (e.g., sheltering). In practical applications, dose projections will usually begin at the time of the anticipated (or actual) initiation of the release. The criterion used to determine whether emergency planning is required for a given facil- ity is if the results of the off-normal event analysis exceed 10 mSv (1 rem). This criterion would eliminate the necessity for performing emergency planning for either personnel evacuation or sheltering. If the consequence results exceed this criterion, then an emergency plan must be developed to protect those off-site personnel. Thus, if the analysis of off-normal events for a fusion facility does not result in exceeding 10 mSv (1 rem), the fusion requirement of no off-site evacuation/sheltering is satisfied. 5.5 Safety Analysis Report Process The safety analysis report (SAR) process is a two-step approach to identifying the safety concerns associated with a facility. The first is an identification of the potential safety risks associated with a facility and classification into the proper hazard categorization. The second step is to perform the required safety analysis to demonstrate that the safety concerns associ- ated with a facility design and operations are adequately addressed. The amount and type of safety analysis required is dictated by the facility hazard categorization. The content and format for documenting the safety analysis in the SAR is provided based on the applicable DOE requirements. As discussed earlier, the type of safety analysis required for the SAR is primarily deterministic in nature, although probabilistic approaches may have been used but are not

64 DOE-STD-6003-96 mandatory for establishing the design basis. Each of these topics associated with the SAR process is discussed in the following subsections. 5.5.1 Risk Assessment The level of detail of the risk assessment performed for a fusion facility is dependent on the potential risk that is associated with the facility. For facilities with large-consequence off- normal conditions, a more detailed quantitative risk assessment [e.g., a probabilistic risk assess- ment (PRA)] should be required. However, a complete and accurate risk assessment, for example, a PRA, in which the true risk is very close to the analysis may be difficult to perform because of the lack of failure data for some unique components and because relatively few PRAs have been performed to date for these types of facilities. When failure rate data are not available, conservative estimates of failure rates should be assumed and used in the evaluation. Also, conservative estimates should be made regarding the operability of safety systems. Risk assessment performed on the facilities with low hazards should include, as a minimum, the probability of occurrence and predicted consequences of hazards expressed in qualitative terms. Quantitative results should be used unless no data or information are readily available. For a facility categorization, the minimum requirement is to provide a general qualitative approach to categorize facility risk. An example of the minimum approach that could be used is presented in DOE-STD-3009-94 (DOE 1994). The required quantification of risk is determined from a knowledge of the probability of the event and of its potential consequences. If potential consequences could have a significant effect on the public or the environment, a quantitative evaluation of the risk would be required. For lesser consequences, the risk could be evaluated on a qualitative basis. The level of quan- tification of the risk is directly proportional to the potential magnitude of the consequences. The risk quantification will assist in identifying the critical components in the design and the SSCs that would be the most beneficial in mitigating off-normal condition consequences. The worker risk should be evaluated in a qualitative manner in accordance with guidelines of DOE-STD- 3009 (DOE 1994). The following guidelines are provided for the risk assessment required for fusion facilities having the indicated hazard categories: a. Hazard Category 1—Perform a detailed risk analysis (e.g., PRA type analysis) using available data and conservative extrapolations of similar data sources. The results should be quantitative in nature and identify the significant contributions to the overall risks. They may also include sensitivity studies to show uncertainties in data and other parameters in the analysis if the required data are available. The risk analysis should be quantitative in nature and identify the significant contributions to the overall risks. b. Hazard Category 2—Ensure that the risks associated with the on-site workers are adequately identified. The risk could be established, as a minimum, in a qualitative manner. 65 DOE-STD-6003-96 c. Hazard Category 3—Ensure that the risks associated with the localized conse- quences are adequately identified. A qualitative risk evaluation would be adequate to satisfy the risk evaluation requirements.

d. Below Hazard Category 3—Ensure that the risks associated with this category of facilities are below the threshold consequence limits values for the categories 1, 2, and 3. Thus, the associated risks associated with below category 3 facilities are low and as a result, the safety requirements that must be imposed on these facilities are substantially less than for the facilities in the hazard categories 1, 2, or 3. Only a quali- tative risk evaluation would be required, at most, to satisfy the risk evaluation require- ment for this hazard category. Satisfying the risk requirements for a Below Hazard Category 3 facility should employ the graded approach as defined in DOE 1992d and DOE 1994. 5.5.2 Safety Analysis Report SARs for fusion facilities should address the vulnerabilities in the design, management, and human factors to ensure that the areas that could affect plant safety are evaluated. Histori- cally, the main emphasis has been on the evaluation of just the safety design considerations. The safety analysis documentation associated with a fusion facility should be updated on a periodic basis so that a current evaluation of the safety vulnerabilities and mitigative measures is maintained. The schedule for the updates should be at least annually for facilities having a Hazard Category 1, 2, or 3, and every 2 yr for Below Category 3 facilities. The specific require- ments are provided in the following sections. SARs should include the results of the safety analysis that identifies dominant contributors to the risk of the facility so these vulnerabilities can be better managed. The SAR for Hazard Category 1, 2, and 3 facilities should address the following based on DOE 1992b using a deterministic analysis approach: 1. Executive Summary; 2. Applicable statutes, rules, and regulations; 3. Site characteristics; 4. Facility description and operation, including design of principal structures, com- ponents, all systems, engineered safety features, and processes; 5. Hazards analysis and classification of the facility; 6. Principal health and safety criteria; 7. Radioactive and hazardous material waste management; 8. Radiation protection; 66 DOE-STD-6003-96 9. Hazardous material protection; 10. Analysis of normal, abnormal, and accident conditions, including design basis accidents; assessment of risks; consideration of natural and man-made exter- nal events; assessment of contributory and causal events, mechanisms, and phenomena; and evaluation of the need for an analysis of beyond design basis accidents, however, the SAR is to exclude acts of sabotage and other malevolent acts since these actions are covered under security protection of the facility; 11. Management, organization, and institutional safety provisions; 12. Procedures and training; 13. Human factors; 14. Initial testing, in-service surveillance, and maintenance; 15. Derivation of the TSRs; 16. Operational safety; 17. Quality assurance; 18. Emergency preparedness; 19. Provisions for decontamination and decommissioning; 20. Applicable facility design codes and standards. A recommended guide for the format and content for the SAR is contained in DOE-STD- 3009 (DOE 1994). This Standard was specifically generated to provide guidance on the format for Hazard Category 2 and 3 facilities. Due to the lack of SAR format guidance for Category 1 facilities, it is recommended that the format guidance for Hazard Category 1 facilities use the same format guidance as provided in DOE 1994. This Standard also provides a “risk-based pri- oritization approach” application for facilities with varying degrees of hazards and potential consequences.

For Below Hazard Category 3 facilities, the following items should be addressed in the safety analysis in appropriate detail to the extent practical: a. facility mission or purpose; b. a description and evaluation of the site; c. design criteria for SSCs; 67 DOE-STD-6003-96 d. normal and emergency operation procedures to be used; e. identification of hazards; f. probability of occurrence and predicted consequences of hazards expressed in quali- tative or quantitative terms; g. physical design features and administrative controls provided to prevent or mitigate potential off-normal conditions; h. potential off-normal conditions, including those resulting from natural phenomena; and i. operational limitations. Based on the required content of the safety analysis that must be performed for a Below Hazard Category 3 facility, the format and content for the SAR could be significantly simplified. Usually, the risks associated with these facilities are rather small, and scoping off-normal condi- tion assessments would adequately cover the analysis requirements. 5.6 Safety Envelope Configuration Control Configuration control of the safety envelope, which provides the basis of operational authorization, is important for fusion just as it should be for any technological activity involving hazards. The concept adopted in the United States for addressing this issue for nuclear activi- ties is the Unreviewed Safety Question (USQ). The fusion facility needs in this area of configu- ration control can be adequately addressed by compliance with the following guidance. The operative requirement for fusion is to ensure that activities are per- formed within the bounds of an operational safety envelope that adequately reflects a disciplined hazards identification, risk quantification and risk accep- tance. The process for accomplishing this is termed safety analysis and the results of it are documented in a Safety Analysis Report with the operational limits that characterize the bounds of the safety analysis being labeled Technical Safety Requirements. For every activity in a fusion facility a system must be established to ensure that opera- tions, experiments, and any other work are encompassed by the explicit documented safety envelope that has been submitted to the activity-approving authority and thereby has become an inherent part of the facility operating approval and risk acceptance. This process is the authorization basis as described in Section 5.9. If at any time it is determined that either (a) a proposed change in physical or operational configuration in the safety analysis or (b) existing physical or operational conditions (including previous analytical work) would create or has created conditions that are not encompassed in the safety analysis that is the basis of the facility Authorization Basis, then the activity associ- ated with the discovered condition will be ceased (or will not be initiated). The activity will not be 68 DOE-STD-6003-96

resumed until the Authorization Basis has been modified to address the concern, and has been documented, reviewed, and approved in the same manner as the original Authorization Basis. These actions, which constitute elements of configuration management of the activity, should be guided by procedures that provide for ensuring that (1) the probability of hazardous events associated with the activity, (2) the potential consequences of hazardous events associated with the event, and (3) the scope of events that could constitute a hazardous challenge to the activity are encompassed in the documented safety analysis of the activity. Because the basis of risk acceptance of an activity can involve information sources external to the activity itself, it is also imperative that the management system for ensuring configuration management of the safety of an activity contain the elements that will guarantee professional awareness of the lessons learned throughout the technology of the activity, particularly those that would affect analytical bases for risk acceptance decisions. Specifically, the activity risk managers must be aware of the ongoing history of everything used in establishing the activity risk acceptance basis so that changes in such things as the professional codes, materials properties, analytical models can be factored into the periodic revisitation and reaffirmation of the safety envelope. The following are some useful guidelines to be considered when assessing the adequacy of the configuration management of the fusion activity safety envelope. These guidelines have been extracted from experiences with the fission USQ process. An activity (ongoing or contemplated) is or will be outside of the configuration bounds of the activity safety envelope under any of the following circumstances: a. if the risk resulting from the product of the event occurrence frequency or the conse- quences of an off-normal condition assessed and documented in the approved safety analysis is increased; b. if the possibility is identified for an off-normal condition of a different type or for a dif- ferent cause than those assessed and documented in the approved safety analysis and the off-normal condition type or cause is not clearly encompassed by those off- normal conditions and causes that are addressed in the approved safety analysis; c. if the margin of safety, as defined in the basis for any TSRs, is reduced. In addition the guidance explicitly acknowledges the reality and acceptability of encom- passed but not explicitly stated issues. While not explicitly stated in this guidance, the basis for acceptability of encompassed issues is the professional judgment inherent in the generation and various reviews and approvals that are an integral part of the safety analysis and operational approval process. The implementation guidance for the USQ process is contained in DOE 1991, “Unreviewed Safety Questions.” 5.7 Technical Safety Requirements Whenever significant safety hazards associated with the fusion facilities are present, the requirements that define the conditions, safe boundaries, and management or administrative controls necessary should be identified and agreed upon with the controlling authority to ensure 69 DOE-STD-6003-96

that the facility is operated safely and to reduce the risk to the public and workers from off- normal conditions. The implementation of the TSRs would satisfy this objective for fusion facili- ties. The TSRs will be applicable to Hazard Category 1, 2, and 3 facilities to ensure the safe operation of a facility without exceeding the evaluation guidelines. Below Hazard Category 3 facilities, by definition, will not exceed the evaluation guidelines and as such will not require TSRs to impose operational restrictions and equipment operability safety requirements. How- ever, economic considerations or other facility protection concerns may warrant including some administrative controls in a TSR document. TSRs are those requirements that define the conditions, safe boundaries, and the man- agement or administrative controls necessary to ensure the safe operation of a fusion facility and to reduce the potential risk to the public and facility workers from uncontrolled release of radioactive or hazardous materials. A TSR consists of safety limits, operation limits, surveillance requirements, administrative controls, use and application instructions, and the basis thereof. 5.7.1 Implementation of Technical Safety Requirements The complexity of the TSRs should be commensurate with the hazards associated with the facility. For example, the facilities with potentially more severe risks will require more detailed and specific requirements in the TSRs, and the facilities with less severe risks should require simpler and less complicated TSRs. The requirements contained in the TSRs should be derived from the safety analysis performed for the facility. If the basis for the surveillance inter- vals is not contained in the safety analysis, then engineering judgment or other bases (e.g., industrial experience or manufacturer’s recommendations) should be used. Guidance for the development and implementation of TSRs is contained in DOE 5480.22, “Technical Safety Requirements” (DOE 1992a). 5.7.2 Risk-Based Prioritization in Technical Safety Requirements The facility characteristics that determine the level of detail and sophistication needed in the safety assessment, under the risk-based approach concept, are the same as those that determine the makeup of the TSR. The characteristics are (1) the magnitude of the potential hazard, (2) the complexity of the facility and the systems relied on to provide safety assurance, and (3) the stage in the life cycle of the facility. The overall guiding concept is that an acceptable and uniform level of safety assurance should be provided for each type of facility, all hazards categories, and all fusion sites. Facilities with small potential hazards and little complexity do not need sophistication or detailed informa- tion in their TSR (or their safety analysis) to achieve the uniform level of safety assurance. Only Hazard Category 1 facilities should normally need the full complement of TSR ele- ments; that is, Safety Limits (SLs), Limiting Control Settings (LCSs), Limiting Conditions for Operations (LCOs), Surveillance Requirements (SRs), and Administrative Controls (ACs). Although some Hazard Category 2 facilities may require SLs or LCSs, the majority of these facilities should be able to achieve the required level of safety assurance with only LCOs, SRs, 70 DOE-STD-6003-96

and ACs. Hazard Category 3 facilities should normally require only ACs to achieve an accept- able level of safety assurance. Normally Below Hazard Category 3 facilities would not require TSRs for the safe operation of the facility. However, some ACs may be desirable for the protec- tion of the facility from an economic point of view. 5.8 Startup and Restart of Fusion Facilities It is a recommended policy that new fusion facilities should be started up and existing fusion facilities that have been shutdown should be restarted only after documented reviews of readiness have been conducted and approvals have been received. The readiness review should, in each case, demonstrate that it is safe to startup (or restart) the applicable facility. The readiness reviews are not intended to be tools of line management to confirm readiness. Rather, the readiness reviews provide an independent verification of readiness to start or restart operations. The startup and restart of complex fusion facilities warrant an independent operational review of the facility readiness to ensure that operational safety can be achieved. The startup and restart of fusion facilities will require a documented independent review of the readiness of the facility for operation prior to startup. This can be in the form of either an operational readi- ness review or a readiness assessment, depending on the hazard class of the facility and the requirements established by the controlling authority. 5.8.1 Implementation of Startup and Restart Reviews The startup and restart reviews required for Hazard Category 1, 2, and 3 fusion facilities should generally follow the requirements of DOE Order 425.1 (DOE 1995b). These reviews are generally required whenever the following conditions exist: a. initial startups of new hazard category 1, 2, and 3 fusion facilities; b. restart after an unplanned shutdown directed by a regulatory official for safety or other appropriate reasons; c. restart after an extended shutdown for Hazard Category 1 (6 months) and Category 2 (12 months) facilities; d. restart of Hazard Category 1 and 2 nuclear facilities after substantial plant or facility modifications required for future program work and/or for enhanced safety which require changes in the safety basis previously approved by the controlling authority; e. restart after a fusion facility shutdown because of operations outside the safety basis; or f. when deemed appropriate by regulatory officials, including facilities with a Hazard Category less than 1 or 2. 71 DOE-STD-6003-96 Startups and restarts of fusion facilities not requiring an Operational Readiness Review should be evaluated as to the need for performing a Readiness Assessment prior to startup or restart. Guidance for the development and implementation of Startup and Restart Requirements is contained in DOE 1995b, and guidance for the planning and development of the Operational Readiness Review is contained in DOE 1993. 5.8.2 Risk-Based Prioritization Implications for Startup and Restart Reviews Implementation of risk-based prioritization principles in formulating startup and restart review criteria is based on the hazard classification for the facility and described in Section 5.6. Those facilities that have been assessed as having high levels of hazards require reviews before initial startup, when significant modifications have been made to the plant, when the facil- ities have been shutdown for extended periods of time, and when the facility has been shutdown because of safety concern. Facilities with low hazards (at least a Hazard Category 3 facility) should, as a minimum, receive an initial startup review and another review when the facility has been shutdown due to safety concerns or an unplanned shutdown. Facilities designated as Below Hazard Category 3 are not required to undergo the startup review process.

5.9 Authorization Basis “Authorization Basis” is the term given to the total body of information used as the basis for approving operation of a facility. All aspects of the design basis and operational require- ments, safety analysis, and any other item relied upon by the authorizing agency to authorize operation constitute the Authorization Basis. These are considered to be important to protecting the environment and/or the health and safety of workers and the public. The Authorization Basis is described in documents such as the SARs, the TSRs, the authorization agency’s issued eval- uation reports, and other specific commitments made in order to comply with the authorization requirements. Guidance for the development and implementation of Authorization Basis Requirements is contained in DOE 1986, 1992a, 1992b, and 1995b. 72 DOE-STD-6003-96 6. FACILITY DESIGN GUIDANCE 6.1 Introduction and General Guidance This section describes an acceptable but not necessarily unique way to implement DOE-STD-6002-96, “Safety of Magnetic Fusion Facilities: Safety Requirements,” in the design and construction of near-term deuterium-tritium (D-T) fusion facilities that will satisfy the intent of Department of Energy (DOE) nonreactor nuclear safety requirements. To achieve adequate safety, it is important to take safety into account as an inherent element in the design process, beginning with conceptual design. Basic early design decisions, such as materials selection and performance specifications, can have a significant impact on safety. A graded approach should be used in the application of these safety design criteria to ensure that the level of detail required and the magnitude of resources expended for the design are commensurate with the facility’s programmatic importance and the potential environmental, safety, and/or health impact of normal operations and off-normal events, including design-basis events. 6.1.1 Design Basis The facility design basis should specify the necessary capabilities of the facility to cope with a specified range of operational states, maintenance, and other shutdown activities, as well as off-normal conditions to meet the radiological and toxic material acceptance criteria in DOE-STD-6002-96. The facility design should recognize that both internal (down to a probability of 10–6/yr per event) and external challenges to all levels of defense may occur, and design measures should be provided to ensure that key safety functions are accomplished and that safety objectives can be met. In establishing a set of external challenges, the design basis should include consideration of natural phenomena (e.g., earthquakes, floods, high winds); environmental effects; and dynamic effects (e.g., pipe ruptures, pipe whip, and missiles). The importance of these off- normal events in the design basis should be evaluated based on the risk (both probability and consequences) of these types of scenarios as identified by the event trees developed for the facility safety analysis (see Chapter 5). Design-basis events should be specified in the safety analysis and mitigated in the system design. The following are potential design-basis events for fusion D-T facilities: a. fusion overpower transient; b. loss of flow or coolant pressure to actively cooled components; c. loss of vacuum or vacuum pumping; d. chemical reactions including hydrogen detonation; e. site-generated missile impact from, for example, a catastrophic motor generator (MG) set failure;

73 DOE-STD-6003-96 f. design-basis natural phenomenon: earthquake, flooding, severe winds, and so on. However, any of these may be categorized as beyond-design-basis events depending on the probability per event as assessed in the safety analysis. There are no specific design requirements for beyond-design-basis events although such events may be considered in the safety analysis process to quantify a range of hazards for site or public evacuation analysis. The detailed design process should establish a set of requirements and limitations for safe operation of the facility including consideration of a. constraints on process variables and other important system parameters; b. safety-class structures, systems and components (SSCs) settings; c. requirements for maintenance, testing, and in-service inspection of the facility to ensure the SSCs required to implement safety functions are within the design envelope; d. training requirements for facility personnel. 6.1.2 Safety Functions and Structures, Systems, and Components Public safety functions as defined in DOE-STD-6002-96 are those essential characteris- tics needed to ensure the safety of the facility and protection of the public and the environment. DOE-STD-6002-96 defines the public safety function for fusion facilities as confinement of radioactive (e.g., tritium, activated dust, activation and corrosion products) and toxic (e.g., Be and V dust) materials. SSCs required for the performance of a public safety function necessary to meet DOE- STD-6002-96 evaluation guidelines should be designated as safety-class. This includes supporting systems such as power, instrumentation and control (I&C), and cooling that directly support a system performing such a public safety function (see Section 6.4). Safety-class items should be subject to more formal and rigorous design, fabrication, and industrial test standards and codes as well as an enhanced quality assurance (QA) program to increase the reliability of the item and allow credit to be taken for its capabilities in the safety analysis process. These SSCs should be designed to function in operational states and during and following off-normal conditions, including design-basis events if credited to function in the safety analysis. Associated with the public safety function are potential safety concerns that must be addressed during the design process to minimize challenges to the public safety function. Potential safety concerns associated with confinement of radioactive and/or toxic materials should be considered: 74 DOE-STD-6003-96 a. ensuring afterheat removal when required; b. providing rapid plasma shutdown when required; c. controlling coolant energy (e.g., pressurized water, cryogens); d. controlling chemical energy sources; e. controlling magnetic energy (e.g., toroidal and poloidal field stored energy); f. limiting airborne and liquid releases to the environment. These safety concerns are normally addressed by SSCs, preferably passive, with a design goal to eliminate the potential concern as a safety issue. If degradation or failure of such SSCs could threaten the continued ability to perform a public safety function or significantly reduce defense-in-depth relative to public safety, the SSCs should be designated as safety- significant. If degradation or failure of such SSCs results in the exceeding of the public evalua- tion guideline, the SSCs should be designated as safety-class.

Worker safety functions as defined in DOE-STD-6002-96 are those essential characteris- tics needed to ensure the safety of the facility and protection of workers. DOE-STD-6002-96 defines the worker safety function for fusion facilities as control of operating hazards such as worker exposure to: ionizing radiation, hazardous materials, high magnetic fields, high power lasers, high voltage sources, cryogenic fluids, etc. SSCs required for the performance of a worker safety function should be designated as safety-significant if acute worker fatality or serious injury could result from SSC failure. These SSCs should be designed to function in operational states and during and following off-normal events as specified in the safety analysis. The concept of safety-significant SSCs is discussed in DOE 1994a. Incremental design and QA standards (over and above conventional industrial practice) as well as functionality test- ing, enhanced surveillance, etc. for safety-significant SSCs should be evaluated and applied for each safety-significant SSC in a given facility considering a. the degree to which failure can threaten a public or worker safety function (i.e., consequence of failure), b. the potential degradation of defense-in-depth protection, c. the probability of degradation or failure, and d. the ability to restore or repair the SSC in a timely manner to resume operations. The design of SSCs that are not safety-class items should, as a minimum, be subject to conventional industrial design standards, codes, and quality standards. Failure of these items should not adversely affect the environment or the safety and health of the public. In addition, their failure should not prevent safety-class items from performing their required safety functions. 75 DOE-STD-6003-96 6.1.3 General Design Guidance Before providing system-specific design guidance, some general principles of design are given below. These principles will assist in achieving facility safety requirements and goals and also have broader value in meeting device performance specifications and providing a measure of investment protection, which is a requirement for eventual electric utility acceptance of fusion power plants. These principles apply specifically to safety-class SSCs but should be considered using a graded approach for safety-significant SSCs. 6.1.3.1 Design for Reliability Unavailability limits for safety-class SSCs should be established to ensure the required reliability for the performance of the key safety functions. The measures below should be used, if necessary in combination, to achieve and maintain the required SSC reliability. The required reliability should be developed in accordance with the importance of the safety function per- formed by the SSC to protect on-site personnel and the public. a. Simplicity. The principle of design simplicity should be applied, as appropriate, to enhance the reliability of systems. Less complex systems are generally more reliable. An example of simplicity may be choosing a burst disk over a relief valve for over- pressure protection or designing the system for a greater pressure than all credible design-basis events. b. Diversity. The principle of diversity can enhance reliability and reduce the potential for common cause failures. It should be adopted wherever feasible. Note that there is an operational cost for diversity in terms of spare parts, operator training, and device complexity. An example of diversity involves a relief valve and burst disk on a mechanical system, each of which can relieve overpressure at the required rate.

c. Independence. The principle of independence should be applied, as appropriate, to enhance the reliability of systems, in particular with respect to common cause failures. Independence is accomplished in the design of systems by using functional isolation and physical separation (e.g., separation by geometry and barriers). An example of independence is a situation in which two relief valves on a mechanical system are at opposite ends of the piping runs. d. Redundancy. The principle of redundancy should be applied as an important design principle for improving the reliability of safety-class SSCs and guarding against com- mon cause failures. Multiple sets of equipment that cannot be tested individually should not be considered redundant. The degree of redundancy should reflect the potential for undetected failures that could degrade reliability of the safety function. An example of redundancy is a situation in which each of two relief valves on a mechani- cal system can relieve overpressure at the required rate. e. Fail-safe and Fault-tolerant Design. The fail-safe principle should be applied to safety- class and safety-significant SSCs; that is, if a system or component failed, the device 76 DOE-STD-6003-96 should pass into a safe state without a requirement to initiate any actions. The system design should be fault-tolerant to the maximum extent feasible. An example of a fail- safe feature would be a safety-related isolation valve that automatically fails closed on loss of power or actuating air. Additionally, the design should ensure that a single fail- ure does not result in the loss of capability of a safety-class SSC to accomplish its required public safety function. Fluid and electrical systems are considered to be designed against an assumed single failure if neither 1. a single failure of any active component (assuming passive components function properly) nor 2. a single failure of a passive component (assuming active components function properly) results in a loss of the capability of the system to perform its safety function. Note that for some passive mechanical components such as piping or pressure vessels, there may not be a credible failure mode. For other passive mechanical components such as burst disks, vacuum windows, or bellows, the credibility of a single failure should be determined on a case-by-case basis. f. Testability. All safety-class and safety-significant SSCs should be designed and arranged so that they can be adequately inspected, tested, and serviced as appropri- ate before commissioning and at suitable and regular intervals thereafter. If it is not feasible to provide adequate testability of a component, then the safety analysis should take into account the possibility of undetected failures of such equipment. For example, an installed burst disk cannot be tested, but there may be no credible failure modes that prevent it from performing the intended safety function. 6.1.3.2 Defense-In-Depth Fusion facilities should apply the “defense-in-depth” concept in design. The design pro- cess should incorporate defense in depth such that multiple levels of protection are provided against the release of radioactive and toxic material if required. The necessary level of protec- tion is a function of the risk to the public and workers. Aspects of the defense-in-depth concept that are applicable to fusion facilities include the following:

a. the selection of materials (especially fusion island materials) and other design inputs to reduce radiological and toxic materials inventories; b. the use of conservative system design margins, taking into account uncertainties in material performance and the operating environment; c. the use of a succession of independent physical barriers (passive is preferred) for pro- tection against release of radioactive and/or toxic materials; 77 DOE-STD-6003-96 d. the provision for multiple means (inherent, passive, or active) for ensuring the public safety functions for fusion facilities; e. the use of basic design features, equipment, operating and administrative procedures to prevent off-normal events and to control and mitigate off-normal events should they occur; f. the implementation of a rigorous and formalized QA program during the design, con- struction, and operation phases on safety-class SSCs; it may be of benefit to apply the QA program consistently to the entire fusion island or facility for investment pro- tection and assurance of completing the programmatic mission; g. use of emergency plans as required to mitigate the effects of radioactive and/or toxic releases to the workers and the public; h. additional levels of defense may be needed to compensate for technological uncertainties. A graded approach should be used in the implementation of the defense-in-depth concept for fusion facilities depending on the level of hazard in the facility and the risk to on-site person- nel and the public. 6.1.3.3 Design Verification As stated in DOE-STD-6002-96, the applicability of the design methods shall be verified and the methods validated. Computer codes or other computational methods supporting the design of safety-class SSCs should have validation and verification (IEEE 1984) for the range of normal operations and off-normal events, including design-basis events. This validation and verification should support the use of the computational method in each intended application. Furthermore, an equipment qualification procedure should be established for safety-class items to confirm that the equipment is capable of meeting the public safety function for the facility while subject to the environmental conditions (e.g., vibration, temperature, pressure, jet impinge- ment, radiation, humidity, chemical attack, magnetic fields) existing at the time of need. Experimental data used in the design process or in the safety analysis should undergo formal certification. This general area is also discussed in Chapter 4 of this document. 6.1.3.4 Codes and Design Standards Where appropriate, safety-class SSCs should be designed in accordance with recognized industry standards such as the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (ASME 1992) for mechanical or structural systems. The applicable code and/or design standard should be identified for each safety-class SSC and its use justified by the fusion facility project manager prior to initiating the detailed design phase of a project. If different codes and standards are used for different aspects of the same part of a safety-class SSC, the consistency among them, insofar as safety is affected, should be demonstrated. Areas addressable by codes and standards may include but are not limited to the following: 78 DOE-STD-6003-96

a. mechanical design; b. structural design; c. earthquake resistant design; d. selection of materials; e. fabrication of equipment and components; f. inspection of fabrication and installed safety-class items; g. thermohydraulic and neutronic design; h. electrical design; i. design of instrumentation and control systems; j. shielding and radiological protection; k. fire protection; l. inspection, testing, and maintenance as related to design; m. cryogenic design; n. magnetic system design; o. vacuum system design; p. safety. For safety-class SSCs in fusion facilities for which there are no appropriate established codes or design standards, an approach derived from existing codes and design standards for similar equipment may be applied, or, in the absence of such codes and design standards, the results of experience, tests, analysis, or a combination thereof may be applied. Either approach should be justified. The approach should be shown to meet the intent of a recognized safety- related code or design standard. Where codes are available and applicable, SSCs that are not safety-class should be designed, fabricated, inspected, and tested in accordance with a recognized national consensus code for general construction such as (as an example for mechanical systems) ANSI 1993a. a. Structural Design Considerations DOE 1989 states that safety-class SSCs shall be designed to the ASME Boiler and Pressure Vessel Code (ASME 1992), Section III or other comparable safety-related codes. For structural design of safety-class SSCs using ASME 1992, the complex nature of many fusion components may require specific analysis under the alternate design rules of Section III, Class 1 or 2 or the comparable elements of Section VIII, Division 1 or Division 2 for pressure vessels. In defining a comparable code to ASME Section III, the use of ASME Section VIII is acceptable if additional standards are provided in areas such as attached valves, pumps, piping and supports, enhanced QA, and radiation effects that are comparable to relevant parts of Section III. In general, a detailed comparison should be made between ASME, Section III and the comparable code to be used to design safety-class SSCs to demonstrate actual comparability. This code comparison should be performed early in the design phase and should be endorsed by the controlling authority to ensure the design product will be acceptable for construction. Finally, the actual stamping of a vessel designed, fabricated, inspected, and tested to ASME Section III or VIII is not addressed by this Standard and is considered to be a decision between the owner, fabricator, and the controlling authority. Table 6.1 provides general recom- mendations for use of design codes for various mechanical components. 79 DOE-STD-6003-96 TABLE 6.1. Suggested design codes for equipmenta Equipment Design and fabrication Materials Welder qualification and procedures Inspection and testing Pressure vessels ASME Code Sect. VIII or III ASME Code Sect. II ASME Code Sect. IX ASME Code Sect. VIII or III Atmospheric tanks API 650, or AWWA D-100b ASME Code Sect. IIb ASME Code Sect. IX API 650, or AWWA D-100b 0- to 15-psig tanks API 620b ASME Codeb Sect. II ASME Code Sect. IX API 620b Heat exchangers ASME Code Sect. VIII, and TEMA ASME Code Sect. II ASME Code Sect. IX ASME Code Sect. VIII Piping and valves ANSI/ASME B31.3 ASTM and ASME Code Sect. II ASME Code Sect. IX ANSI/ASME B31.3 Pumps Manufacturers’ Standardsc

ASME Code Sect. II or Manufacturers’ Standards ASME Code Sect. IX (as required) Hydraulic Institute aThe preferred design code for safety-class pressure retaining components is the ASME Code. bFiberglass-reinforced plastic tanks may be used in accordance with appropriate articles of Section X of the ASME Boiler and Pressure Vessel Code for applications at ambient temperature. cManufacturers’ standard for the intended service. Hydro or pneumatic pressure testing should be 1.5 times the design pressure. b. Loads The following are typical loads to consider in the structural design process. The example given is for an in-vessel component; for ex-vessel components, loads due to plasma disruptions, for example, may not be a design factor. This list is provided as a starting point for the delin- eation of loads for specific SSCs and may be incomplete for a particular design. The structural designer must consider all normal and off-normal events identified in the safety analysis process in defining load combinations for particular safety-class SSCs. The SSC under consideration should be designed to withstand the static load, pressure load, thermal load, electromagnetic loads (normal operating and fault), disruption/vertical dis- placement event (VDE) loads, interaction loads from adjacent systems, and transient loads due to normal operations and off-normal events, including design-basis events. 1. Static loads—The static load should include the weight of the equipment identified as constituting the system (or component), any supported hardware, and process media such as liquid inventory. 80 DOE-STD-6003-96 2. Pressure load—The pressure load should include the full range of credible internal and external pressures during normal operations and off-normal events including design-basis events. Additionally, the pressure load range should include temperature-induced pressures, hydrostatic or pneumatic test pressures, and any credible pressure augmentation resulting from small leaks between two coupled systems. 3. Thermal load—The thermal load should include transient thermal loads as well as the temperature distribution during bakeout and wall conditioning. 4. Electromagnetic loads—Electromagnetic loads induced during operation of the device are experienced as a result of currents in the component under evaluation interacting with external magnetic fields. Loads should include the electromagnetic effects of dis- charge cleaning where appropriate. 5. Electromagnetic loads during faults—Electromagnetic loads should include those induced during off-normal operating events such as control failures, power supply fail- ures, bus opens or shorts, or magnet faults. 6. Disruption/VDE loads—Disruption/VDE loads are any thermal or electromagnetic loads induced in the component due to loss of control of the plasma. A range of plasma motions and current behaviors should be considered to determine the worst case events. Analysis should include conservative assumptions for event amplitude, time scale, and event frequency. 7. Interaction loads—Interaction loads are loads imposed on the component by other adjacent systems or components during normal or off-normal conditions. For exam- ple, a magnet failure may result in a nonsymmetrical load distribution in the magnet support structure that could cause deflections resulting in an additional load transmit- ted to adjacent vacuum vessel structure.

8. Natural phenomena hazard loads—Natural phenomena hazard loads are site-specific loads due to earthquakes, wind, floods, and so on. Guidelines for methods of estab- lishing load levels on facilities from natural phenomena hazards and for methods of evaluating the behavior of structures and equipment to these load levels are con- tained in DOE 1993b, DOE 1993c, DOE 1994b, DOE 1995a, and DOE 1995b. 9. Off-normal event loads—Component internal and external loading from credible off normal events, including design-basis events, should be considered as appropriate. The SSC structural design evaluations will be based on predicted responses for concurrent event load combinations that are compared against the corresponding allowable stresses. In applications involving the ASME Code, for example, the evaluation load combinations would be performed in a conservative manner using design-basis event propagation assumptions in the facility safety analysis. Service levels defined in ASME 1992 to be used in the structural design process should also be assigned using information derived from the safety analysis process. 81 DOE-STD-6003-96 SSCs are subject to thermal and pressure cyclic loadings during normal operation and anticipated off-normal events such as disruptions/VDEs. Also, systems and components are subject to vibration loading from motors, cavitation, water/steam hammer, and so on. The ASME/ANSI design codes or comparable computational methods provide criteria for the evalua- tion that should use conservative analysis for the number of cycles and service life including the expected changes in material properties with time. 6.1.3.5 Materials Material properties used in the analysis of safety-class SSCs must be appropriate for the operating environment, including off-normal events, and compensated for the degradation of the material properties with time due to radiation, fatigue, embrittlement, corrosion, or any other environmental factor. This applies to the relevant properties of safety-class SSCs that perform specific safety functions. For safety-class SSCs that provide confinement or structural support, the degradation of yield strength would be an important property to consider in the anticipated operating environment. For safety-class SSCs that provide a control or monitoring function, the degradation of insulation or changes in the dielectric behavior would be an important property to consider in the anticipated operating environment. a. Radiation—Materials selected should be qualified for the anticipated lifetime in the anticipated radiation environment. This includes external radiation from the fusion reaction and component activation and internal radiation due to tritium beta decay. Conservative end-of-life properties should be used in the design analysis. b. Thermal—Material properties used in analysis should always be those appropriate for the given temperature range. If no published property data for a particular tempera- ture range exist, then materials should be tested for properties at the operating tem- peratures, or the design analysis should be based on estimated (conservative) mate- rial properties and the actual component performance should be monitored by formal in-service testing. For those items to be designed in accordance with ASME 1992, temperature limits are imposed within the code. If the item will be subjected to tem- peratures higher or lower than the limit, material properties, such as allowable stress and creep, used in the analysis should be justified by testing the material at the antici- pated temperature.

c. Hydrogenic and helium embrittlement—The structural design analysis should base the material properties on end-of-life hydrogen and helium embrittlement (note He3 is a product of tritium beta decay). The actual embrittlement of the SSC in the hydrogenic and helium environment should be determined by a monitoring and testing program. Where feasible, designers should eliminate embrittlement as a design issue by considering in the choice of materials a lifetime projection of pressures and tempera- tures and exposure to hydrogen isotopes and helium. d. Material compatibility—An SSC may use a variety of materials in close proximity. In addition to changes in material properties due to external factors, the design should evaluate and resolve any material compatibility problems within an SSC such as 82 DOE-STD-6003-96 accelerated corrosion due to galvanic effects of dissimilar metals or erosion due to long-term fluid motion. 6.1.3.6 Testing and Inspection a. General requirements—Safety-class SSCs should be designed to permit initial and periodic inspection and testing of areas related to the intended safety function to assess their continued ability to perform the function. The tests and inspections should assess parameters related to the safety function (e.g., structural integrity, hydrogen embrittlement, leak tightness, effectiveness of electric or thermal insulation, brittleness of windows, etc. as appropriate). The design should provide for and opera- tions should have an appropriate materials surveillance program. If the configuration does not permit periodic inspections and tests in accordance with applicable codes, particularly for systems contaminated with tritium, the safety analy- sis process should develop and prescribe an acceptable testing program. The facility authorization basis should include the test and inspection program. b. Nondestructive examination (NDE) of safety-class SSCs—Nondestructive testing and inspection of safety-class welds, vessels, piping and valves, including test personnel qualification, should be in accordance with ASME 1992 or equivalent. Where design to ASME 1992 is not feasible, such as in the case of unique materials or designs, alternate codes such as those listed in Table 6.1 may be used with justification. Weld acceptance criteria should be in accordance with the requirements of codes listed in Table 6.1. c. Leak testing—All safety-class SSCs that provide a containment barrier should be leak checked before initial operations and periodically thereafter and should meet the requirements specified in the safety analysis d. Pressure testing—All safety-class SSCs that provide a safety function at a specified design pressure should be pneumatically or hydrostatically tested in accordance with ASME 1992 or comparable safety-related code for initial acceptance. The need for periodic retesting should be evaluated in the safety analysis process; if this is required, the design should provide appropriate fittings for this function. e. Equipment Qualification Testing—Safety-class SSCs that perform safety functions should be qualified to operate under the limiting environmental conditions associated with normal operating and off-normal events for the facility, including the designated off-normal natural phenomena. The qualification of passive structures could be satis- fied by analysis, testing, or experience associated with similar components. The quali- fication of active components could be satisfied by either tests performed on the com- ponents or experience with similar components. Justification shall be provided to demonstrate the applicability or experience from testing of similar components for the components requiring equipment validation.

83 DOE-STD-6003-96 The above areas have emphasized SSCs performing a structural safety function derived from the confinement evaluation guidelines. The testing and inspection program also applies to safety-class SSCs performing a control, monitoring, or power function. The tests and inspections that assess parameters related to the safety function should be identified. For safety-class I&C components, this could include periodic or continuous testing of circuit continuity, presence of grounds, or determination of circuit noise levels. 6.1.3.7 Remote Maintenance The design should make provisions for appropriate accessibility, adequate shielding, and reliable remote handling equipment to facilitate planned maintenance and conceivable repairs. Remote maintenance requirements should be developed early in the design process taking into account the need to keep worker exposures as low as reasonably achievable (ALARA). It is strongly recommended that mockups or models be constructed during the detailed design phase to confirm the feasibility of human and remote maintenance system design. More detailed guidance is provided in Section 6.4.4. 6.1.3.8 Human Factors Fusion facilities should consider human factors and operator-machine interfaces in the early design and throughout the entire design process. The final design should eliminate, to the extent practicable, the need for human interaction in the detection and mitigation of off-normal events, including design-basis events. To the extent that human interactions are required, these interactions should be specifically identified and justified by appropriate analysis, such as human reliability analysis, to ensure the human interaction can be performed under the antici- pated environmental conditions and within required time constraints at an acceptable level of reliability. 6.1.3.9 Fire Protection The probability and effect of fires and explosions at fusion facilities should be minimized. Safety-class SSCs should be designed and located to minimize, consistent with their intended safety function, the probability and effect of fires and explosions. Noncombustible and heat- resistant materials should be used whenever practical throughout the facility, particularly in areas vital to the control of hazardous materials and maintenance of safety functions. Fire detection and mitigation systems should be designed and provided with sufficient capacity and capability to minimize the adverse effects of fires and explosions on safety-class SSCs. Fire fighting systems should be designed to ensure that their rupture or operation does not signifi- cantly impair the safety function provided by safety-class SSCs. The effect of fire suppression systems on the facility should be considered. Current requirements for fire protection programs are provided in DOE 1995a. 84 DOE-STD-6003-96 6.1.3.10 Hydrogen Explosions For a potential hydrogen explosion in a safety-class SSC, DOE 1989 specifies design requirements that require clarification. This is provided in some detail below. A hydrogen detonation is a potential hazard that may be a design-basis event (typical probability >10–6/yr). If it is within the design basis and the SSC under evaluation is a confine- ment barrier, then the required integrity of the barrier must be maintained during and after this event, although the non-safety-related functions of the SSC (such as ability to maintain high vacuum) can be compromised. If the SSC is not safety-class and a hydrogen detonation is credible, it must be shown that no failure due to this event can degrade the function of an adja- cent safety-class SSC.

To determine if a potential hydrogen detonation is a design-basis event, it is important to evaluate the likelihood of having the three ingredients for detonation at the same time: hydrogen and oxygen in the appropriate mixtures and an ignition source (NRC 1989). Generally, the energy required to ignite hydrogen-air mixtures is modest (NRC 1989). Since the plasma typi- cally contains much higher levels of stored energy, for analysis of the vacuum vessel it should be assumed that a point ignition source is always present during normal operations and wall conditioning. The factors determining the likelihood of a detonation are then the availability of hydrogen isotopes and air. Hydrogen isotopes are present in the solid matrix of the plasma- facing components at substantial levels. This is not ordinarily available for combustion or deto- nation although a portion (including tritium) may be released if a detonation occurs. If hot plasma-facing components or the vacuum vessel are cooled with water, a leak could result in the generation of hydrogen from water (steam) and beryllium (or carbon or tungsten) reactions (Smolik 1991, 1992). The precise amount of hydrogen generated depends on the first wall material and temperature and the size and duration of the water leak, but typical conditions in a D-T fusion plasma could generate sufficient quantities of hydrogen for a detonation. Air also has to be present for a detonation. If air is adjacent to the SSC under evaluation, the in-leakage of air is possible due to the same event that generated the hydrogen. For example, beryllium- steam reactions from a water leak during wall conditioning can result in internal pressures of several bar or more (NET 1993), which may be beyond the design value of the SSC under eval- uation. This air source can be eliminated in the device design by incorporating an inert gas vol- ume in the region between the SSC under evaluation and the next confinement barrier. To determine the probability of a hydrogen detonation, an analysis of the above factors must be performed for a particular design. The likelihood of a loss-of-coolant event cannot be generally excluded given performance of actively cooled systems to date and the anticipated in-vessel service conditions in a D-T fusion facility. To preclude a hydrogen detonation for consideration as a design-basis event, it will typi- cally be necessary to demonstrate a low event probability by a. minimizing hydrogen generation by careful design, including material selection of the plasma-facing components or the fluids used for active in-vessel component cooling, or 85 DOE-STD-6003-96 b. using an inert gas boundary as discussed above. 6.2 Systems Performing Safety Functions As stated above, SSCs required for the performance of a public safety function necessary to meet the evaluation guidelines of DOE-STD-6002-96 should be designated as safety-class. Section 6.2.1 provides design guidance for systems providing the radioactive and hazardous materials confinement public safety function. Section 6.2.2 provides design guidance for sys- tems providing the worker safety function involving control of operating hazards. 6.2.1 Public Safety Function: Confinement Systems

The major public safety function is the confinement of radioactive (e.g., tritium, activated dust, activation, and corrosion products) and hazardous (e.g., beryllium and vanadium dust) materials (see Section 6.1.2). The systems that typically provide the first barrier of the confine- ment boundary (sometimes called primary confinement or containment) are the vacuum vessel (and associated penetrations) and ex-vessel systems (such as the isotope separation and fuel storage systems), which provide tritium confinement. Design guidance for these systems is pro- vided in Section 6.2.1.1, Vacuum Vessel, and Section 6.2.1.2, Tritium Systems, respectively. The major systems that (typically but not always) provide the second or (if required) the third barriers of confinement (sometimes called secondary or tertiary confinement) are the cryostat, ex-vessel gloveboxes/rooms, double-walled piping systems, and/or the fusion building. Design guidance for these systems is provided in Section 6.2.1.3, Cryostat, and Section 6.2.1.4, Secondary Confinement Systems. It is emphasized that the number of confinement barriers is design specific and depends on the anticipated radioactive and hazardous material inventories, the distance of these sources from the public or workers, the proximity of major energy sources to these inventories, and the quality and independence of each confinement barrier. For example, segmentation of radioactive and hazardous material inventories where feasible is a potential design tool to reduce the number of independent barriers around each individual inven- tory location. Care must be taken to define the system boundaries carefully and ensure that adjacent systems are independent and have no common failure modes. Primary and secondary (or greater) confinement systems are properly viewed as an inte- grated barrier to provide confidence that net leakage rates specified in the facility safety analysis are not exceeded. The safety analysis process will estimate radioactive and toxic source terms and specify barrier integrity in terms of net leak rates to meet DOE-STD-6002-96 requirements for exposure to on-site workers and the public during normal and off-normal events, including design-basis events. Releases of hazardous materials postulated to occur as a result of design- basis events that would exceed DOE-STD-6002-96 release guidelines should be limited by designing facilities such that at least one confinement barrier remains fully functional following any credible event. (i.e., unfiltered/unmitigated releases of hazardous levels of such materials should not be allowed following such events). Fusion vacuum vessels are typically subject to complex and transient stresses and have many penetrations, some of which are of large cross-sectional area. It is, therefore, unlikely that the net leakage from such a complex vessel could approach that of a simple pressure vessel or 86 DOE-STD-6003-96 pipe. It is likely that several (2 to 3) confinement barriers will be needed to confine in-vessel radioactive and toxic materials. The design of successive confinement barriers must therefore ensure that each separate barrier be independent. This independence should be preserved during normal and off-normal events. For example, the design-basis earthquake will cause off- normal loading to all fusion island components, and it should be verified that concentric penetra- tions from multiple confinement barriers do not have mutual interactions that result in exceeding specified leak rates.

6.2.1.1 Vacuum Vessel The vacuum vessel is normally the primary confinement system for in-vessel radioactive and toxic materials. It is, for the tokamak configuration, a torus-shaped container usually made of a metal or metallic alloy, and its volume is up to several times the plasma volume. It can be thin-walled or thick-walled. It may be double-walled with coolant passages in the annulus. The perimeter of the vacuum vessel is outfitted with a number of ports (extensions) for mounting hardware for plasma fueling, plasma heating, plasma conditioning, plasma diagnostics, vacuum pumping, and blanket/divertor maintenance. These ports can vary in size and shape and are usually located above, below, and on the horizontal plane as well as on top and bottom of the vacuum vessel. It may be of all-welded, continuous construction or use bolts between segments with vacuum seals at the joints. If the safety analysis indicates that vacuum vessel is a primary confinement barrier to meet the evaluation guidelines, the robustness of the barrier will be defined in the safety analy- sis and implemented in the design. In performing this public safety function, the vacuum vessel should be classified as a safety-class system. Hardware internal or adjacent to the vacuum ves- sel whose credible failure could result in evaluation guidelines being exceeded should be classi- fied as safety-class. If the vacuum vessel is not considered a confinement barrier in the safety analysis, those vacuum vessel components whose single failure results in loss of capability of another safety-class system to perform its safety function should be designated as safety-class components. If the safety analysis requires that the vacuum vessel be a confinement barrier, the follow- ing safety features should be considered: The vacuum vessel serves as the first barrier for tritium and tritiated compounds, radioac- tive impurities, and activated dust during normal operation, anticipated operational occurrences, maintenance external to the vessel, and off-normal events. In addition to the general design guidance in Section 6.1, the following system-specific design guidance is provided: a. Confinement Boundary The vacuum vessel confinement boundary should be defined as the vacuum vessel proper including attached windows, flanges, and ports and all penetrations up to and including the first or second isolation valve as appropriate (depending on system pressure and as defined 87 DOE-STD-6003-96 in the facility authorization basis) in system piping that penetrates the vacuum vessel. For vac- uum vessel penetrations, each line that is part of the vacuum vessel pressure boundary and that penetrates the vacuum vessel should be provided with isolation valves, unless it can be demon- strated that the confinement isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other defined basis. A simple check valve should not be used as the automatic isolation valve. Isolation valves outside the vacuum vessel should be located as close to the vessel as practical and upon loss of actuating power, automatic isolation valves should be designed to take the position on failure that provides greater safety. The power to operate isolation valves whose function is required to meet the evaluation guidelines should meet the requirements of Class 1E Electric Power Systems (IEEE 1980). b. Structural Design

See Section 6.1.3.4 for general guidance. The vacuum vessel and its appendages should be designed, fabricated, inspected, and tested in accordance with a recognized safety-related code such as ASME 1992. Vacuum vessel deflections should be calculated and analyzed to determine potential interferences and to verify seal integrity. Loads on the vacuum vessel should be carefully determined using input from the safety analysis process. Pressure loadings are typically inward for normal service and outward for off- normal events. Off-normal events could include large disruptions or VDEs, release of plasma energy (e.g., runaway electrons) or coolant energy inside the vacuum vessel. Loadings from the response of adjacent systems to off-normal events should be evaluated. For example, a plasma disruption or VDE may result in some loading of the vacuum vessel from attached penetrations and supports. Load combinations should be developed conservatively based on event sequences postulated in the safety analysis. The vacuum vessel is subject to cyclic loading during normal operations. Thermal cycling and unavoidable disruption loads are to be expected. The necessity of a fatigue analysis should be evaluated based on the criteria of ASME 1992 or comparable safety-related code using con- servative values for variables such as number of pulses, percentage of pulses that have disrup- tions, and service life including expected changes in material properties with time. Windows—The use of windows should be minimized to a level consistent with the need to evaluate plasma properties with optical diagnostics. Where windows are used the area should be minimized, and the windows should be qualified by analysis or testing in the anticipated operating and design-basis event environment to demonstrate required confinement integrity. Bellows—The use of bellows should be minimized to a level consistent with needs to accommodate differential movement and alignment between fusion island components. Where bellows are used the area experiencing differential pressure should be minimized, and the bel- lows should be qualified by analysis or testing in the anticipated operating and design-basis off- normal event environment to demonstrate required confinement integrity. As a minimum, bel- lows should conform to relevant criteria in ASME 1992 or a comparable safety-related code. The use of double-walled bellows should be considered as a design approach to minimize compo- nent leakage. 88 DOE-STD-6003-96 Ceramic Breaks—The use of ceramic breaks should be minimized. When ceramic breaks are used, they should be qualified by analysis or testing in the anticipated operating and design- basis off-normal event environment to demonstrate required confinement integrity. c. Testing See Section 6.1.3.6 for general guidance. All vacuum vessels and attached components that provide a confinement barrier should be leak checked at design pressures before initial operation to demonstrate that leakage requirements specified in the safety analysis are met by the as-built design. Potential hazards of in-service leak testing at the design vessel pressure after D-T operations have commenced may not justify such periodic leak testing. In its place, a program of periodic vacuum leak testing and a formal configuration control program to ensure vacuum vessel repairs or modifications do not compromise the design pressure rating should be implemented. Replacement structural components should be pressure tested before assembly in the vacuum vessel. Local repairs in the vessel should be subject to rigorous NDE.

d. Instrument and Control Systems Instrument and control systems (I&C), where appropriate, should be provided to monitor system parameters important to the safety function of the vacuum vessel over their anticipated ranges for normal operation and off-normal conditions to ensure continuity of the required safety function. The design should incorporate sufficient redundancy and/or diversity to ensure that a single failure will not result in a loss of monitoring capability for safety-class systems. The electric power to operate safety class instrumentation should meet the requirements of IEEE 1980. More information is provided in Section 6.4.1, Instrument and Control Systems, and Section 6.4.2, Electrical Power Systems. e. Ventilation and Exhaust Systems The design of a vacuum vessel confinement ventilation system should ensure the ability to maintain desired airflow characteristics when personnel access ports or hatches are open. When necessary, air locks or enclosed vestibules should be used to minimize the impact of this on the ventilation system and to prevent the spread of airborne contamination within the facility. Ventilation system components required to be safety-class should provide the required con- finement capability under all normal operations and off-normal conditions with the assumption of a single failure in the system. If the maintenance of a controlled continuous confinement airflow is required to meet evaluation guidelines in DOE-STD-6002-96, electrical equipment and com- ponents required to provide this airflow should be supplied with safety-class electrical power and provided with a backup power source. Air cleanup systems should be provided in confinement ventilation exhaust systems to limit the release of radioactive or other hazardous material to the environment and to minimize the spread of contamination within the facility as determined by the safety analysis. Guidance for confinement systems is included in DOE 1989. 89 DOE-STD-6003-96 f. System Maintenance Opening a confinement system such as the vacuum vessel requires prior removal of tritium, radioactive dust, and loose toxic materials (if any) to the maximum extent feasible. If required by the safety analysis, cleansing steps that exhaust to atmosphere should exhaust through a tritium and particulate removal system to limit the release of tritium and other radioac- tive and toxic materials to the environment consistent with release limits and ALARA principles. The safety analysis should prescribe limits for tritium and other radioactive and toxic material releases to the environment during vacuum vessel maintenance openings. The exhaust from the vacuum vessel may be through a dedicated tritium removal system or through a secondary confinement subsystem that has a tritium removal system. The tritium removal systems should have capacity to recover from a design basis tritium release from the vacuum vessel. 6.2.1.2 Tritium Systems Tritium systems include all process equipment outside the vacuum vessel with surfaces routinely in contact with tritium and other hydrogen isotopes. Examples include tritium process- ing and transfer systems, plasma fueling systems, blanket tritium transport and recovery sys- tems, and the vacuum vessel pumping systems. Useful design guidance for tritium systems is provided in IAEA 1981, IAEA 1991, and DOE 1994c.

Tritium system confinement strategies generally include primary and secondary confine- ment. Sealed high-integrity piping and process equipment normally constitute the primary confinement for vacuum and pressure conditions. The secondary confinement includes glove- boxes and/or dedicated enclosures or rooms housing the primary confinement. Process piping between gloveboxes or other secondary enclosures is generally surrounded by another pipe or jacket sealing to the gloveboxes or secondary enclosures. Additional sealed cabinets or rooms may extend the confinement in accordance with the facility safety analysis. Tritium system design should include features that limit the quantities of tritium available for release during off-normal events, limit the environmental release of tritium and exposure of personnel during normal and off-normal conditions, and limit the unintended conversion of ele- mental tritium to an oxide form. Consistent with facility safety analysis, design features may include the following: a. Segmentation Tritium system design may provide for segmentation of the facility tritium inventory as necessary to make acceptable the amount of tritium releasable in a single event. Design should provide for isolation of each segment using valves or piping blanks. Where isolation valves are employed, the failed position should be as specified in the facility safety analysis. Check valves and other one-way valves are not acceptable as isolation devices. Segmentation may be accomplished by utilization of processes or devices with small inventory, separation of the tritium inventory into isolatable volumes, or storage of tritium in an immobile condition relative to the single event (e.g., metal hydride beds). 90 DOE-STD-6003-96 b. Confinement Tritium confinement generally includes a primary confinement subsystem and a sec- ondary confinement subsystem. Design may also provide higher orders of confinement if the safety analysis indicates these are necessary to reduce tritium exposure and environmental release to acceptable levels. The confinement subsystems include the SSCs necessary to establish the confinement barriers and the power sources necessary to maintain the barrier operation within prescribed safety limits. The primary confinement should provide a low leak rate, pressure-rated static barrier. Normally, primary confinement systems are sealed and are opened only for maintenance, test- ing, and inspection. Welded joints are preferable to compression fittings, which are preferable to threaded fittings. Welded joints or mechanical joints are acceptable for piping enclosed in sec- ondary confinement gloveboxes or enclosures. However, only welded joints should be used for piping outside gloveboxes or enclosures. Pumps should comply with National Electric Code requirements for explosion-proof installation if required by safety analysis and should generally not use organics, hydrocarbons, or other volatiles for surfaces that will contact the tritium pro- cess gas. Valves should meet prescribed leak requirements across the valve seat and from the valve bonnet and body. Secondary confinement barriers should have a recirculating nitrogen or inert gas atmo- sphere. The term “inert” represents any reduced oxygen environment. Tertiary and higher orders of confinement should have atmospheres as specified by the safety analysis. Secondary and higher order confinement barriers should operate at subatmospheric pressure maintained by a pressure control system. If required by safety analysis, the confinement exhaust should be through a tritium removal system to limit the environmental release of tritium consistent with release limits and ALARA principles. The safety analysis will prescribe limits for tritium releases to the environment.

Opening a confinement subsystem requires prior removal of tritium and cleansing. If required by safety analysis, cleansing steps that exhaust to atmosphere should exhaust through a tritium removal system to limit the release of tritium to the environment consistent with release limits and ALARA principles. The exhaust from a confinement subsystem may be through a dedicated tritium removal system or through a secondary confinement subsystem that has a tri- tium removal system. The tritium removal systems should have capacity to recover from a design-basis tritium release from primary confinement. c. Instrument and Control Systems Design should provide for I&C to monitor parameters important to safety and to indicate a need to isolate or otherwise control a tritium system or tritium confinement subsystem to prevent monitored variables exceeding a safety limit. The safety analysis should identify and the design should implement monitoring of the safety-related variables. Primary confinement typically includes instrumentation for pressure, vacuum, and temperature monitoring, and for qualitative gas analysis. Secondary confinement typically provides instrumentation for relative pressure monitoring, tritium detection, and oxygen concentration analysis (if the secondary has an inert 91 DOE-STD-6003-96 gas or reduced oxygen atmosphere). Subsequent levels of confinement will provide monitoring capabilities commensurate with the hazard anticipated and the operating requirements of the barrier. d. Structural Design See Section 6.1.3.4 for general guidance. Tritium systems that are safety-class should have design, fabrication, inspection, and testing in accordance with a recognized safety-related code. The specific codes and criteria selected should be commensurate with the level of safety required and should have a documented technical justification. Tritium systems that are not safety-class should have design, fabrication, inspection, and testing in accordance with a recognized national consensus code. e. Tritium Embrittlement The structural design analysis should use material properties that account for tritium and helium embrittlement at the projected end-of-life. Tritium embrittlement adds a physical mecha- nism to the generally understood hydrogen embrittlement. Tritium permeates the metal struc- ture, like other hydrogen isotopes, but tritium decays to produce interstitial helium-3. The helium damage is additive to the damage caused by the tritium. f. Conversion of Elemental Tritium to Tritium Oxide The design should include engineered features as necessary to minimize the potential for tritium contact with ignition sources, water, moisture, hydrocarbons, and other oxidizing sources. Because oxidized tritium presents a significantly higher biological hazard than elemental tritium, the design must reduce to a practical minimum the unintended conversion of tritium to any oxi- dized form. It is recognized that some tritium cleanup systems convert elemental tritium to an oxide form with deliberate intent to facilitate removal from flowing gas streams. g. Exchange with Hydrogen, Hydrogenated Compounds, and Hazardous Wastes Designers should avoid use of water, moisture, mercury, hydrocarbons (oils), plastics, asbestos or elastomeric gaskets, and other hydrogenated compounds that could contact tritium. Gaskets and o-rings in contact with tritium should not use elastomers, plastics, or asbestos; tri- tium will degrade them, cause premature failure, and may create a source of mixed waste. Ultra- high molecular weight polyethylene (UHMWPE) and certain polyimides such as VESPEL are exceptions to this rule. Valves with UHMWPE stem tips will remain leak tight longer than valves with metal (e.g., stellite) tips.

h. Hydrogen Fires and Detonations Hydrogen fire or detonation requires the following concurrent conditions: hydrogen iso- topes in sufficient concentration, oxygen in sufficient concentration, and high temperature or ignition source. 92 DOE-STD-6003-96 Design features that discourage or prevent hydrogen fires and detonations include (1) leak tight primary confinement to prevent out-leakage of tritium to the secondary confine- ment, (2) inert gas in the space between primary confinement and secondary confinement barrier walls, (3) monitors to detect tritium out-leakage or oxygen in-leakage, (4) minimization of ignition sources or high temperatures near the primary or secondary confinement barriers, (5) utilization of National Fire Protection Association (NFPA) rated enclosures for electrical equipment with potential for contact with flammable mixtures. Additional guidance is provided in Section 6.1.3.10. i. Fire Protection Because fire oxidizes elemental tritium to tritium oxide, a form with a much greater biolog- ical hazard, design should place high priority on preventing fires. The effect of fire suppression systems on the facility and the environment should be considered. Chemicals may have a deleterious effect on tritium cleanup systems, while water may present waste disposal difficul- ties. Because of the natural affinity of tritium for water and the increased biological hazard of tritiated water, the use of water as a tritium fire extinguisher should require a technical or eco- nomic justification. Facilities that have the potential for introducing fire suppression water into a tritium-contaminated environment should provide a tritiated water collection system with the capacity to store the total volume of fire suppression run-off. Design should provide for facilities to dispose of any tritiated water in an environmentally acceptable manner. Additional guidance is provided in Section 6.1.3.9. j. System Cleaning Design should provide for cleaning of tritium systems before and after installation. Tritium systems should be able to withstand vacuum conditions necessary for cleaning purposes and elevated temperatures during bakeout if required prior to equipment removal. Once tritium has contaminated the primary confinement, only limited cleaning is permissible for tritium-wetted surfaces. 6.2.1.3 Cryostat The main function of the cryostat is to provide a vacuum region for thermally insulating the superconducting coils surrounding the vacuum vessel from the normal building environment. Based on the safety analysis process, it may be necessary to assign the public safety function of confinement to the cryostat since it naturally encloses the vacuum vessel. Thus, the cryostat can be a confinement system for in-vessel radioactive and toxic materials. It could be a primary confinement if no credit is taken for the vacuum vessel confinement ability, or it could be a sec- ondary confinement if the cryostat barrier is needed to meet evaluation guidelines. It can also be a secondary confinement barrier for piping and tubing containing tritium or other radionuclides that penetrate and are inside the cryostat boundary. It could be a primary confinement boundary for in-vessel radioactive and toxic materials if the vacuum vessel is opened for maintenance or inspection. The cryostat is normally a metal chamber surrounding the fusion device which pro- vides a thermal barrier to conduction and thermal radiation between the superconducting coils and other cold structures and the fusion building. It may also serve as part of the biological

93 DOE-STD-6003-96 shield. The chamber is usually cylindrical with a top and bottom. There are usually large pene- trations in the top, bottom, and sides of the cryostat, primarily for access to the vacuum vessel and magnets for maintenance and inspection. The cryostat may be double-walled with an evac- uated or filled annulus. It may be lined with cryogenic panels or superinsulating material. If the safety analysis indicates that the cryostat is a confinement barrier to meet the eval- uation guidelines, the required robustness of the barrier will be defined in the safety analysis and implemented in the design. In performing this public safety function, the cryostat should be classified as a safety-class system. Hardware internal or adjacent to the cryostat whose credible failure could result in evaluation guidelines being exceeded should be classified as safety-class. If the cryostat is not considered a confinement barrier in the safety analysis, those cryostat components whose single failure results in loss of capability of another safety-class system to perform its safety function should be designated as safety-class components. If the safety analysis requires that the cryostat be a confinement barrier, the following safety functions should be considered: The cryostat may serve as a barrier (normally a secondary barrier but this is design specific) for tritium and tritiated compounds, radioactive impurities and activated dust during nor- mal operation, anticipated operational occurrences, maintenance external to the cryostat, and off-normal events including design-basis events. The cryostat may serve as part of the structure of the biological shielding; if this is the case see Section 6.2.2.2 for shielding guidance. During maintenance inside the vacuum vessel, the cryostat may serve as a partial con- finement barrier as defined in the safety analysis. That is, the vacuum vessel may be breached for specific repairs, but the confinement function should be provided by the cryostat, to ensure evaluation guidelines are not exceeded from residual in-vessel radioactive and toxic materials; this confinement barrier may include temporary features to allow maintenance access. In addition to the general design guidance in Section 6.1, the following system-specific design guidance is provided: a. Confinement Boundary The cryostat system confinement boundary should be defined as the cryostat proper, including all penetrations up to and including the first or second isolation valve as appropriate (depending on system pressure and as defined in the facility authorization basis) in system pip- ing that penetrates the cryostat. For cryostat penetrations, each line that is part of the cryostat system boundary and that penetrates the cryostat should be provided with isolation valves, unless it can be demonstrated that the confinement isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other defined basis. A simple check valve should not be used as the automatic isolation valve. Isolation valves outside the cryostat should be located as close to the cryostat as practical and upon loss of actuating power, auto- matic isolation valves should be designed to take the position on failure that provides greater safety. The power to operate isolation valves whose function is required to meet the evaluation guidelines should meet the requirements of Class 1E Electric Power Systems (IEEE 1980). 94

DOE-STD-6003-96 b. Structural Design See Section 6.1.3.4 for general guidance. The cryostat and its appendages should be designed, fabricated, inspected, and tested in accordance with a recognized safety-related code such as ASME 1992. Cryostat deflections should be calculated and analyzed to determine potential interferences and to verify seal integrity. Loads on the cryostat should be carefully determined using input from the safety analysis process. Pressure loadings are typically inward for normal service and outward for off-normal events. Off-normal events could include release of magnet energy inside the cryostat as well as energy from release of cryogenic fluid (liquid helium or nitrogen) to the interior of the cryostat. Loadings from the response of adjacent systems to off-normal events should be evaluated. For example, a plasma disruption or vertical displacement event may result in some loading of the cryostat and attached supports. Load combinations should be developed conservatively based on event sequences postulated in the safety analysis. The cryostat is subject to cyclic loading during normal operations. Thermal cycling and disruption loads (for tokamak devices) are to be expected. The necessity of a fatigue analysis should be evaluated based on the criteria of ASME 1992 or comparable safety-related code using conservative values for variables such as number of pulses, percentage of pulses that have disruptions, and service life including expected changes in material properties with time. The use of bellows should be minimized to a level consistent with needs to accommodate differential movement and alignment between fusion island components. Where bellows are used the area experiencing differential pressure should be minimized, and the bellows should be qualified by analysis or testing in the anticipated operating and design-basis event environ- ment to demonstrate required confinement integrity. As a minimum, bellows should conform to relevant criteria in ASME 1992 or a comparable safety-related code. The use of double-walled bellows should be considered as a design approach to minimize component leakage. c. Testing See Section 6.1.3.6 for general guidance. The cryostat vessel and attached components that provide a confinement barrier should be leak checked at design pressures before initial operation to demonstrate that leakage requirements specified in the safety analysis are met by the as-built design. Potential hazards of in-service leak testing at the design vessel pressure after D-T operations have commenced may not justify such periodic leak testing. In its place, a program of periodic vacuum leak testing and a formal configuration control program to ensure cryostat repairs or modifications do not compromise the design pressure rating should be imple- mented. Replacement structural components should be pressure tested before assembly in the cryostat. Local repairs should be subject to rigorous NDE. d. Instrument and Control Systems I&C, where appropriate, should be provided to monitor system parameters important to the safety function of the cryostat over their anticipated ranges for normal operation and 95 DOE-STD-6003-96 off-normal conditions to ensure continuity of the required safety function. The design should incorporate sufficient redundancy and/or capability for safety-class systems. The electric power to operate safety class instrumentation should meet the requirements of IEEE 1980. More infor- mation is provided in Section 6.4.1, Instrument and Control Systems, and Section 6.4.2, Electrical Power Systems.

e. Ventilation and Exhaust Systems The design of cryostat confinement ventilation systems should ensure the ability to main- tain desired airflow characteristics when personnel access ports or hatches are open. When necessary, air locks or enclosed vestibules should be used to minimize the impact of this on the ventilation system and to prevent the spread of airborne contamination within the facility. The ventilation system design should provide the required confinement capability under all normal operations and off-normal conditions with the assumption of a single failure in the system. If the maintenance of a controlled continuous confinement airflow is required, electrical equipment and components required to provide this airflow should be supplied with safety-class electrical power and provided with a backup power source. Air cleanup systems should be provided in confinement ventilation exhaust systems to limit the release of radioactive or other hazardous material to the environment and to minimize the spread of contamination within the facility as determined by the safety analysis. Guidance for confinement systems is included in DOE 1989. f. System Maintenance Opening a confinement system such as the cryostat requires prior removal of tritium, radioactive dust, and loose toxic materials (if any) to the maximum extent feasible. If required by the safety analysis, cleansing steps that exhaust to atmosphere should exhaust through a tri- tium removal system to limit the release of tritium and other radioactive and toxic materials to the environment consistent with release limits and ALARA principles. The safety analysis should prescribe limits for tritium and other radioactive and toxic material releases to the environment during cryostat maintenance openings. The exhaust from the cryostat may be through a dedi- cated tritium removal system or through a confinement subsystem that has a tritium removal system. The tritium removal systems should have capacity to recover from a design-basis tritium release from the cryostat. If the cryostat is part of the biological shield, maintenance planning should consider the effect of planned tasks on the shielding integrity. 6.2.1.4 Confinement/Heating, Ventilating, and Air Conditioning (HVAC) Systems Confinement/HVAC systems include SSCs designed to serve as barriers against the spread or uncontrolled release of radioactive or other hazardous materials throughout the facility or to the environs. The facility confinement strategy may consist of successive confinement bar- riers based on the hazards present. The successive barriers are defined by the facility safety analysis. The confinement/HVAC system boundary is generally defined for each confinement bar- rier and includes the contiguous structural barrier and its associated ventilation and filtration equipment. 96 DOE-STD-6003-96 Design features for confinement systems and their associated HVAC systems include the following: a. Provide barriers against the release or spread of gaseous and particulate contamina- tion during normal and off-normal conditions. (DOE 1989, ASHRAE 1988, ASHRAE 1991) b. Provide the necessary ventilation system functional capabilities to control differential pressures such that air flows from cleaner areas to potentially more contaminated areas during normal and off-normal conditions. (ASHRAE 1991) c. Provide filters or other means to remove contaminants before exhausting the environs.

d. Maintain the required ambient conditions within confinement (e.g., temperature, pres- sure, humidity, and concentrations of radiological, toxic, corrosive, or explosive substances), to protect personnel and ensure the capability of personnel or equipment to perform safety functions. (ASHRAE 1991) e. Provide the capability to isolate and control tritium or any other contaminant released within confinement. f. Provide instrumentation and/or testing and surveillance to monitor the condition and capabilities of the confinement system, the ambient conditions within confinement, and the effluents from confinement to the environs. Applicable items should be moni- tored during normal and off-normal conditions as required to ensure and verify safety function. In addition potential airborne contaminants or corrosive agents that may compromise the ability of personnel or equipment to perform safety functions should be monitored and controlled. (DOE 1989, ASHRAE 1991, and DOE 1990) Design-basis loads are derived from the internal and external events identified in the safety analysis. Loads and the combinations thereof used in the design should envelop loads considered in structures per ANSI 1993b. Methods of analysis depend on the performance category and loads being considered (e.g., ASCE 1980). Elastic system analysis methods may be adequate for lower per- formance categories, whereas for higher performance categories inelastic analysis methods may be required. Guidelines to seismic analysis are available in DOE 1994b. Dynamic seismic structural analysis may be performed for predicted ground motions based on geotechnical site-specific information including variability using response spectra or time history. For large embedded structures, soil structure analysis may be considered. Capacity calculations, DOE 1994b, depend primarily on the national consensus code, UBC 1991. For reinforced concrete structures, DOE 1984 and ACI 1989 provide the criteria for safety-class and other building structures, respectively. For steel structures, 97 DOE-STD-6003-96 ANSI 1984 and AISC 1986a provide the criteria for safety-class and other building structures. AISC 1986b is an alternate for AISC 1986a if load and resistance factor design procedure is used. ASME 1992 should be used for equipment and components and ANSI 1993a for piping. Deformation may be allowed and inelastic energy absorption credited for ductile structural materials, especially for lower performance categories. Inelastic absorption capacity should not be credited if concrete or other nonductile materials are used as a pressure boundary. For lower performance categories and for normal operations, damage may be permit- ted but should be limited so that hazardous materials can be controlled and confined, occupants are protected, and safety functions are maintained. For the higher performance categories and for off-normal conditions, structures should be permitted to undergo limited inelastic deformations. Risk analysis may be per- formed to determine the extent of permissible damage. Energy absorption factors may be used to achieve appropriate conservatism in the design or evaluation process. Stability and other postyield behavior criteria should be met. Ventilation systems should be designed to operate in conjunction with their associated physical barriers to limit the release of radioactive or other hazardous material to the environment. The ventilation system capabilities should be sufficient to allow for any intentional breaches of the confinement system that are required during maintenance on any portion of the facility.

Leak-tightness of the confinement pressure boundary should be considered in the design. Air locks to achieve the required leak-tightness between confine- ment/containment zone boundary interfaces should be considered. Appropriate filtration may be accomplished by multistage high-efficiency particulate air (HEPA) filtration of the exhaust or by an equivalent filtering capability. The exhaust ventilation system must be sized to ensure adequate inflow of air in the event of the largest credible breach of confinement. Safety-class systems and components should be designed per ASME 1993 or a com- parable code or standard which considers the safety function(s) of the particular sys- tem or component (ASME 1989a and ASME 1989b). Non-safety-class systems and components should be designed per codes and standards used for industrial and commercial grade applications. 98 DOE-STD-6003-96 6.2.2 Worker Safety Function: Systems Controlling Operating Hazards The worker safety function is control of operating hazards. This function is somewhat more subtle than the other confinement of radioactive and toxic materials due to the spectrum of potential radioactive and industrial hazards to which the facility worker may be exposed. 6.2.2.1 ALARA Design Considerations It is DOE’s policy that exposure to radiation resulting from operations be maintained ALARA. The application of ALARA to fusion facilities has two principal divisions: occupational exposure and public exposure. For occupational exposure, specific evaluation criteria for radia- tion protection of the worker from ionizing radiation are provided in DOE-STD-6002-96, which references 10 CFR 20 and 10 CFR 835. The DOE Radiological Control Manual also provides guidance on implementing ALARA with regard to occupational exposure to radiation. For public exposure, DOE-STD-6002-96 (Table 1) provides specific guidelines consistent with the overall goal of ALARA. The design of the fusion facility should have the following features to minimize worker exposure during maintenance (routine and corrective) and decommissioning activities as well as release to the environment: a. choice of materials and design that minimize the activation of components and struc- tures and eliminates the need for deep geologic burial; b. designs that ease cut-up, dismantlement, removal, and packaging of contaminated equipment; c. equipment design that minimizes the accumulation of radioactive or hazardous materials; d. use of modular separable confinements; e. use of localized liquid transfer systems; f. location of exhaust air cleanup components at or near individual enclosures; and g. fully drainable piping systems, including tanks. The following techniques should be considered in the design, as applicable, in order to facilitate decommissioning at the end of operating life. These techniques are grouped by primary objective. Waste volume reduction is the objective for these six techniques: a. Use sealed nonporous insulation—Use of such insulation materials prevents the absorption of contaminated liquids by the insulation. 99 DOE-STD-6003-96 b. Enclose cable trays—Totally enclosing the trays with solid sheet metal (to the extent that such enclosures do not interfere with plant maintainability) will prevent the con- tamination of large quantities of cabling, but heat buildup should be considered in this closed geometry. c. Minimize cable trays in contaminated areas—Locating the trays in clean areas to the extent possible minimizes contamination.

d. Relocate motor control centers—The amount of contaminated equipment will be reduced by locating motor control centers in areas that are not susceptible to contamination. e. Use bolted steel construction—This construction technique reduces radioactive waste by using an easily decontaminated construction material. This technique will also reduce exposure by decreasing disassembly time. f. Smooth and coat concrete surfaces —These are preventive and protective measures against the radioactive contamination of concrete surfaces and thus decrease the quantity of radwaste associated with the decontamination of such surfaces. Exposure reduction is the objective for these 19 techniques: a. Material selection—Apply design techniques and selection of materials to minimize activation or to ensure that activated material can readily be removed and disposed. b. Substitution and purification of materials—For example, use of low-cobalt steels will result in lower Co-60 activation products and thus in lower occupational exposures during decommissioning. c. Scale models—Exposure savings can be realized during and after the operational life of the facility by using models as planning aids. d. Flanged construction—This construction technique (to the extent it does not com- promise technical specifications on leakage, especially tritium) will reduce exposure by decreasing the time required to disconnect components and by reducing the use of dismantling methods that spread contamination (e.g., power hacksaws and circular cutters). e. Quick disconnect components—This construction technique (to the extent it does not compromise technical specifications on leakage, especially tritium) will reduce expo- sure by decreasing the time required to disconnect components. f. Remote sampling—This capability reduces exposure associated with environmental sampling activities by allowing the data to be collected remotely. 100 DOE-STD-6003-96 g. Waste storage capacity—Provision should be made in the site layout for a waste stor- age facility (which may not be constructed until just prior to decommissioning if it is intended only for decommissioning wastes) to provide temporary storage space so that accumulated waste will neither slow down decommissioning nor be stored in areas that may pose exposure hazards. h. Nonembedment of pipes, ducts, and equipment in concrete—This design feature (to the extent it does not compromise release of fluids from the pipes) reduces the effort and exposure time required to remove items at the time of decommissioning. i. Removable roof, wall panels, and plugs—This design feature provides improved access for removal of radioactive components and thus reduces exposure time. j. Access to and into all tanks—Such access will shorten setup time and thus reduce exposure. k. Facility breathing air supply system—Breathing air supplies for decommissioning work should be considered in the facility design and, if incorporated, should be installed at the time of construction to avoid the problems with portable units at the time of decommissioning. l. Preinstalled manipulator supports—This design feature is intended to reduce expo- sure during segmentation of the fusion island components by performing the prelimi- nary work in a low-radiation environment during construction rather than in a high- radiation environment after shutdown. m. Lifting fixtures on large components—Installation of the lifting fixtures prior to facility startup rather than in a radioactive environment after shutdown will prevent significant radiation exposures.

n. Anchor points for lifts—Incorporation of anchor devices for lifting large components prior to facility startup rather than in a radioactive environment after shutdown will pre- vent significant radiation exposures. o. Tracks for remote cutting devices—Installation of guide tracks for segmentation cutting devices prior to facility startup rather than in a radioactive environment after shutdown will prevent significant radiation exposures. p. Preplaced concrete core samples—To obtain activated concrete profiles for radiologi- cal characterization of the concrete, core samples should be drilled or cast in place prior to facility startup rather than in a radioactive environment after shutdown. q. Complete drainage capacity—Exposure due to pockets and traps containing contami- nated liquids is minimized. Complete flushing and drying of the system is possible prior to dismantling. 101 DOE-STD-6003-96 r. Containment and isolation of liquid spills—Containment features instituted during the design phase (e.g., curbing, dikes, reserve tankage, increased sump capacity) will reduce contamination during the operational life of the facility and thus reduce the contaminated surface area to be removed during decommissioning. s. Preplaced blast holes—By incorporating blasting holes into monolithic concrete structures during the construction of the facility before they have become radioactive, the occupational exposure associated with their demolition is reduced. 6.2.2.2 Access Controls and Shielding from Radioactive Hazards 10 CFR 835 specifies that radiation exposure in controlled areas shall be kept below regulatory limits and also ALARA through facility and equipment design and administrative controls. The primary (preferred) methods to be used are physical design features such as con- finement, ventilation, shielding, and remote operation. Administrative controls, including proce- dural requirements, are to be used as secondary methods. Confinement and ventilation are addressed in Section 6.2.1.4., access controls and radiation shielding are addressed below. a. Access Controls 10 CFR 835 specifies that personnel access control shall be maintained for each radiolog- ical area, with the degree of control to be commensurate with the potential or actual hazard. One or more of the following methods is to be used. 1. Signs and barricades, 2. Control devices on entrances, 3. Conspicuous visual or audible alarms or both, 4. Locks on entrances, and 5. Administrative controls. Items 1 and 5 are not a part of facility design and are not addressed below. For a High or a Very High Radiation Area, one or more of the following seven features should be used for each entrance or access point where radiation levels exist such that an individual could receive an external dose to the whole body of 1 rem or more in any 1 h at 30 cm from the source or from any surface through which the source radiation penetrates: 1. a control device that prevents entry to the area when high radiation levels exist or that upon entry of a person causes the radiation level to be reduced to below the lower limit for a High Radiation Area; 2. a device that functions automatically to prevent use or operation of the radiation source or field while personnel are in the area; 102 DOE-STD-6003-96 3. a control device that energizes a conspicuous visual or audible alarm signal so that the individual entering the High or Very High Radiation Area and the supervisor of the activity (e.g., in a control room) are made aware of the entry;

4. entryways that are locked when not accessed and over which positive control can be maintained when accessed; 5. continuous direct or electronic surveillance that is capable of preventing unauthorized entry; 6. a control device that automatically generates audible and visual alarm signals to alert personnel in the area before use or operation of the radiation source in sufficient time to permit evacuation of the area or activation of a secondary control device that pre- vents use or operation of the source; 7. for Very High Radiation Areas, additional measures as necessary to prevent access to the area when dose rates are above the lower limit for a Very High Radiation Area. Consideration should be given, in the selection of controls, to the allowance of space for the controls, the necessity for administrative oversight of the controls, the need for periodic inspection of the controls, and the ease with which a control may be bypassed. No control should be installed such that it would prevent rapid evacuation of personnel. b. Shielding Shielding design should be based on the appropriate design objectives given in 10 CFR 835. The choice of design, arrangement, and material for shielding should be optimized considering the following factors at a minimum: efficacy of dose rate reduction, potential corro- sive or galvanic effects, the advantages of homogeneity vs the advantages of layers, weight, the need for mobility of the shield, radiation heating potential, temperature resistance, and activation potential. Occupancy considerations should be considered, including purpose of access(es), required frequency of access, stay times, and number of workers requiring access. The design of concrete radiation shields should be in accordance with the requirements of ANS 6.4. The quality factors given in 10 CFR 835 should be used for determining the dose equivalent of the various types of radiation for dose rate calculations in conjunction with the appropriate methodology of ANSI/ANS-6.1.1-1977; alternatively, ANSI/ANS-6.1.1-1991 may be used, where justified, with quality factors corresponding to its methodology (e.g., as given in NCRP 116). The shielding design for fusion facilities should consider the anticipated high-energy neu- tron spectrum; appropriate high-density shielding should be provided as necessary for these neutrons and made compatible with shielding for neutrons of lower energies and for gammas. 103 DOE-STD-6003-96 The design of shielding and work spaces should permit the later installation of additional temporary or permanent shielding to accommodate anticipated increases in workload or pro- duction of hot spots by activation or the accumulation of radioactivity. This includes considera- tion of size and weight of shielding and of such provisions as rigging fixtures, racks, portable shielding carts, and the like. The design of shielding should also include consideration of even- tual decommissioning of the facility. The need to protect equipment and materials from radiation that may damage them or cause them to become unduly activated should be considered in shielding design. The provision of shielding should be balanced against the alternate choices of moving the equipment or mate- rials, selecting other types of equipment or materials, and replacing the equipment or materials more frequently.

Local shielding or portable (temporary) shielding should be considered, where appropri- ate, such as for the removal of hot equipment, the protection of personnel doing contact mainte- nance, and the protection of sensitive equipment. Modular construction and mobility of shielding should also be considered. Fortuitous shielding by structural materials and equipment (i.e., shielding by items not designed for that purpose) should be employed where appropriate; how- ever, such shielding should be fixed, in general. Removable shielding should be provided for large, infrequently moved pieces of equip- ment. In general, removable block may be used if access is required less than once a year. If access is required at more frequent intervals, steel doors, removable concrete panels, or the like should be considered. Blocks in removable block walls should be staggered both horizontally and vertically. Grout used for block walls should be of a type, density, and application thickness appropriate for the radiation type and strength of the source to be shielded. Shielding should be provided for appropriate areas to allow personnel entry after off- normal events. Shielding should be provided as needed to reduce doses to equipment required to function following off-normal events. In general, piping should not be embedded in shielding (e.g., concrete floors, walls, columns, or earthen foundations); however, embedment of pipe sleeves in concrete, from which the piping could be removed, may be acceptable. The use of labyrinths should be considered for entryways to areas or cubicles containing a source producing a potentially high dose rate. Labyrinths should generally be double where there may be a high scatter fraction of the incident radiation and single where there is not; how- ever, the choice also depends on the magnitude of the potential dose rate. If the labyrinth top is lower than the height of the ceiling in the room served, the labyrinth should generally be sup- plied with its own roof. Entrances with shield doors generally do not require a labyrinth. An access hole for inserting a telescoping detector through a shield plug should generally be provided in the plug; it should have a shielding subplug or cap to cover it when not in use. Similarly, such an access hole should be considered for the roofs or labyrinth walls of cubicles containing equipment producing high dose rates. 104 DOE-STD-6003-96 Penetrations should generally be located as high up on a wall as possible. Penetrations should not line up directly with the source or with any area or space that may be potentially occupied (e.g., stairways and platforms). In particular, doors should be located or shielded so that personnel standing in front of a closed door are not exposed to direct radiation from the equipment within. The number of penetrations should be minimized, particularly in shields serving as pri- mary or secondary confinements; however, several smaller and dispersed penetrations are pre- ferred to one large one. Penetrations should have the minimum diameter necessary. The radio- logical effects of voids (partially penetrating openings or areas of lesser density) should be considered. The selection and design of penetrations should include consideration of the need for the penetration to be sealed for radiation reduction, air flow or airborne radioactivity control, fire pro- tection, or flooding. A radiation seal or shield should generally be provided for a penetration or void under these conditions:

1. There is otherwise a direct shine from the source to a general access area through the penetration. 2. It creates a hot spot in a frequently or continuously occupied area. 3. The dose rate exceeds an assumed hot spot criterion in an infrequently but regularly occupied area (e.g., stairways, platforms, etc.). 4. It is into an area of varying but possibly high dose rate. 5. It is in a floor or roof slab. 6. It would create an area of unacceptably high dose rate after off-normal events in an area where people or equipment must perform a mitigation or recovery function. A radiation seal or shield should be considered for a penetration or void in these situations: 1. Radioactivity buildup in a pipe passing through it might cause it to exceed an assumed hot spot criterion. 2. The centerline is <8 ft above the floor and the penetration is >2 in. (except for high-dose-rate cubicles). 3. The void is a glove port in a glovebox potentially containing, even when not in use, radioactivity producing a high dose rate outside the box. 4. It is a gap between the top of a wall and the soffit of the floor above the wall, if offset- ting is not adequate to satisfy applicable shielding requirements. 105 DOE-STD-6003-96 6.2.2.3 Nonradioactive Worker Hazards Nonradioactive worker hazards at large fusion facilities typically include the following: a. a large number of high-voltage electrical systems, some of which are custom designs; b. cryogenic materials such as liquid helium and nitrogen in significant quantities for magnet operation and plasma diagnostics; c. class III and IV laser systems for plasma diagnostics; d. large electromagnetic fields for plasma magnetic confinement and heating; e. high power radio frequency and microwaves for plasma heating; f. rotating devices including centrifuges for vacuum pumping and plasma fueling; and g. large vacuum chambers and extensive vacuum piping. As stated in DOE-STD-6002-96, existing Federal regulations (e.g., OSHA standards in 29 CFR 1910 and 1926) provide requirements on control of industrial hazards to workers in such areas as asphyxiation, electrocution, exposure to cryogenic materials, vacuum, and rotat- ing machinery as well as hazardous substances. One area where there are not specific regulations is exposure to electromagnetic fields. Fusion facilities should be designed to limit static electromagnetic field exposures to personnel during routine operations. More information in this area is provided in Section 2.3.4. The major concern for the fusion designer is to minimize large fringing electromagnetic fields because they could create difficulties for access near the fusion island during troubleshooting and mainte- nance activities. Measurements of real-time worker exposure to electromagnetic fields should be provided to ensure the limits given in Chapter 2 are not exceeded. 6.3 Systems Involved with Potential Safety Concerns Because of the large impact facility design options have on potential hazards affecting public and worker safety and the developmental nature of fusion, only two safety functions could be identified at this time as applying to all fusion facilities: confinement of radioactive and haz- ardous material (Section 6.2.1), a public safety function, and control of operating hazards (Section 6.2.2), a worker safety function. Additionally, potential design-specific safety concerns that should be considered during the design process to minimize challenges to the public safety function of confinement of radioactive and/or hazardous materials have been identified:

a. ensuring afterheat removal when required; b. providing rapid plasma shutdown when required; 106 DOE-STD-6003-96 c. controlling coolant energy (e.g., pressurized water, cryogens); d. controlling chemical energy sources; e. controlling magnetic energy (e.g., toroidal and poloidal field stored energy); and f. limiting airborne and liquid releases to the environment. The above functions have been identified as “potential safety concerns” if their failure could threaten the public safety function of confinement of radioactive and hazardous material. However, the ultimate impact of these safety concerns on the public safety function can only be judged in the context of a specific design of the fusion facility. Evaluation of these safety con- cerns will normally be an iterative process. Fusion facilities contain a number of systems that may interact in a complex way to sustain the fusion reaction. Identification of safety require- ments for such systems requires a systematic methodology to ensure that, for a given facility, each hazard is properly identified, that its impact on safety is assessed, and that the require- ments to protect the worker, public, and environment from those hazards are balanced and integrated into the facility design. Because of the range of potential hazards in fusion facilities and the design options available, functional analysis combined with results from recent safety studies of conceptual fusion power plants were used to identify the potential safety concerns noted above for fusion plants. Because the hazards and their impact on public and worker safety are facility design-specific, development of detailed prescriptive system-level safety requirements is felt to be inappropriate. Instead, an approach has been used to develop broad functional safety requirements that can be used by fusion facility designers to integrate safety into the design up front in a cost-effective way. Design measures (as opposed to administrative measures) are the primary means to deal with these potential safety concerns, and such mea- sures are discussed in the following paragraphs. 6.3.1 Afterheat Removal Systems The safe removal of afterheat (decay heat) is an issue to be evaluated in D-T fusion facili- ties. Typically the afterheat amounts to several percent of the normal operating fusion power. One day following shutdown, it decreases by a factor of 3 to 10 depending on the materials and the operating scenario (pulsed vs continuous operation). Unlike fission cores, the decay heat relative to thermal power level is smaller and distributed over large surfaces, and large heat sinks are available in the fusion island structures. The design of fusion facilities should provide a reliable means to remove any undesirable afterheat generated by activation products produced by neutron absorption in structures such that the confinement public safety function is ensured. The need for and reliability of afterheat removal systems should be commensurate with the role of afterheat removal in complying with evaluation guidelines. Passive afterheat removal (i.e., no major hazard or component melting can be expected even when all active cooling capacity is lost, and removal is accomplished by only heat conduction and thermal radiation) is preferable to active systems. For fusion facilities with high levels of afterheat (i.e., levels where active cooling is required), the concepts of redundancy, diversity, and independence should be con- sidered in the design of afterheat removal systems.

107 DOE-STD-6003-96 In addition to the general design guidance in Section 6.1, the following system-specific design guidance is provided. A complete loss of all in-vessel cooling is an off-normal event and should be evaluated to provide an upper bound on the importance of this safety concern. In most off-normal event sce- narios, there will be at least some active cooling. The vacuum vessel may have a safety function in afterheat removal. Cooling system diversity (i.e., multiple, independent cooling loops) for in-vessel components may provide a measure of defense-in-depth for this safety concern even though active cooling of individual in-vessel components may not be reliable because of the severe plasma-facing operational environment and their experimental nature. If an active afterheat removal system is required, there should be specific reliability requirements for a given duration after shutdown. For example, up to one day after shutdown is important because the afterheat may decrease by up to an order of magnitude. Another 2 months is required for an additional order of magnitude in austinetic stainless steel compo- nents. Lower activation materials will decay more quickly. The required heat removal capacity should be evaluated based on actual materials specified in the design and the rated thermal operating power. 6.3.2 Rapid Plasma Shutdown System A means of rapid plasma shutdown should be provided for fusion facilities, if required to ensure that evaluation guidelines are met. An example of a rapid plasma shutdown system would be a system that reliably injects a fast high-Z impurity pellet into a plasma for rapid termi- nation in response to a precursor signal for a large plasma disruption. The level of required reli- ability, redundancy, and diversity of such a system, its effectiveness, and speed of action should be such that safety functions required to meet evaluation guidelines are ensured. Consideration should be given to heat, particle, magnetic, and mechanical loads on confinement barriers resulting from worst-case credible transient overpower events, VDEs, or disruptions in assess- ing the need for a rapid plasma shutdown. An off-normal fusion power rampdown system will act on a time scale of the order of a few tens of seconds and might be sufficient to cover loss-of-flow events in the plasma-facing components if sufficient pump inertia is installed. In case of the unlikely event of coolant flow channel blockage, an off-normal fusion power shutdown system acting on the few seconds time scale is needed. Possible mechanisms are impurity injection by gas puffing/pellets or controlled equilibrium disturbance. A design constraint is fast termination without otherwise undesirable consequences. If all above mentioned active fusion power shutdown actions fail during an off- normal event, the plasma would always be shutdown by passive means due to overheating of plasma-facing components and consequent impurity influx. 6.3.3 Control of Potential Energy Sources Five energy sources could drive fusion facility off-normal events including design-basis events: coolant energy (6.3.3.1), chemical reactions (6.3.3.2), magnets (6.3.3.3) and plasma (6.3.3.4) as well as afterheat (6.3.1), discussed previously. 108 DOE-STD-6003-96 6.3.3.1 Coolant Energy

For fusion facilities that use fluids for active cooling of in-vessel components (e.g., high- pressure water or steam, liquid metals) or cryogenic liquids inside the cryostat, the design should incorporate a means to accommodate the accidental release of the fluids to ensure that confinement barriers such as the vacuum vessel or cryostat are not breached in a manner that could result in exceeding evaluation guidelines. Consideration should be given to the effect of large spills of cryogenic liquids inside the cryostat on the structural integrity of affected SSCs due to loss of ductility at lower temperatures. a. Discussion of Sources of Coolant Energy For water coolant systems, the overpressure depends on mass and energy. Energy sources include the stored energy in the water, energy from plasma operation if the water is not being adequately cooled (overpower transient, loss of flow, loss of heat sink), energy from chemical reactions, decay heat, and heat transferred from surrounding surfaces. Heat transfer to energy sinks takes place via vaporization of water, conduction, and condensation on surfaces. For typical water-cooled designs, the potential sources for overpressure of the confine- ment barriers (vacuum vessel and cryostat) are 1. release of cryogenic fluid in the cryostat; 2. steam production from leakage of coolant in the vacuum vessel, or, if applicable in the cryostat; and 3. hydrogen production, with ingress of air and explosion in the vacuum vessel (see Section 6.1.3.9). The dynamics of the scenarios involving overpressure are different and lead to consid- eration of two time scales. Short-term scenarios lead to overpressure in a time span of minutes following the release of coolant or cryogenic fluid in the vacuum vessel or in the cryostat. Medium-term scenarios are driven by decay heat and chemical reactions and lead to overpres- sure in a time span of days if no sufficient decay heat removal can be provided. The short-term scenarios include the release of cryogenic fluid in the cryostat and the short-term pressurization of the vacuum vessel due to ingress of coolant with and without hydrogen production. The release of the cryogenic fluid from the magnet systems in the cryostat leads to typical pressures in the cryostat of the order of several atmospheres. Note that in the absence of blow- down volumes or venting, this pressure has to be supported by the cryostat as an internal load and by the vacuum vessel as an external load. 109 DOE-STD-6003-96 The ingress of coolant in the vacuum vessel would lead to rapid pressurization of the vacuum vessel to pressures that, for large quantities of water released, come close to saturation pressure (about 1.6 MPa at 200°C). Venting to the cryostat or a blowdown volume (suppression pool) would lead to significantly lower maximum pressures. Another possible source is hydrogen production (see Section 6.1.3.9) and energy release from chemical reaction between the water coolant or air and the plasma-facing components (e.g., beryllium tiles and coatings on the first wall). Although the reaction rates between water or air and beryllium are uncertain and need further analysis, it is known that the form of beryllium (porous or dense) has a big impact on these rates.

The 600–650°C range is critical with respect to beryllium reactions. Since the beryllium– water and beryllium–air reactions are exothermic (377 kJ/gmole beryllium), the major concern for short-term hydrogen production comes from reactions that are self-sustained. Self-sustained reactions require that the heat production (from the reaction) exceeds the heat loss (from cooling). Scenarios including short-term hydrogen production start with overheating of the beryl- lium in the first wall or divertor to the 650°C range. The following scenarios are examples. Loss-of-Flow Events (LFEs) in shield lead to Loss-of-Cooling Events (LCEs) by local penetration of the overheated first wall and subsequent self-sustained beryllium–water reaction. Preliminary calculations show that this scenario (without mitigation) gives rapid production of a few kilograms of hydrogen (in the solid beryllium case) to tens of kilograms of hydrogen (if the beryllium is in porous form). Another possibility is an LFE with ingress of air in the vacuum vessel (LVE). Worst-case scenarios of this type (without mitigation) with a porous beryllium–air reaction could lead to pro- duction of hundreds of kilograms of hydrogen in time scale of minutes. The medium-term scenarios involve extensive steam production from the coolant inven- tory by energy sources like decay heat, stored heat, and heat produced by chemical reactions as well as hydrogen production due to chemical reactions. Examples of such scenarios are in- vessel LCEs in the vacuum vessel or shield, combined with reduced or no decay heat removal. b. Pressure Suppression Strategies The strategies with respect to pressure limitation and suppression can be divided into preventive and mitigative strategies. In both preventive and mitigative strategies, use can be made of passive or active means to implement the strategies. Whenever possible, the priority should be given to preventive strategies and to passive means. Preventive strategies have the goal to reduce the amounts of steam and hydrogen pro- duced. Prevention of pressure buildup can be achieved by acting upon the phenomena that lead to hydrogen production (see Section 6.1.3.9) and by limiting the amounts involved in chemical reactions or in steam formation. 110 DOE-STD-6003-96 1. Limit temperature of first wall—As pointed out above, 650°C is a critical temperature with respect to hydrogen-producing reactions. Therefore, the operating temperature and the rapid plasma shutdown (if required, see Section 6.3.2) should be designed to prevent the first wall from reaching this critical temperature in the reference off-normal event sequences defined in the safety analysis. In low-frequency severe accidents where plasma-facing component (e.g., beryllium) reactions can not be excluded, a backup strategy is to provide sufficient passive heat transfer between the reacting material and the structures to avoid self-sustained reaction. Segmentation of the shield coolant loops and of the vacuum vessel coolant loops should be performed in such a way to optimize the likelihood of heat transfer from the shield. 2. Prevent ingress of air (see Section 6.1.3.9)—The ingress of air is a necessary condi- tion for the forming of an explosive mixture with hydrogen (the detonation limits of hydrogen-air mixtures range from about 14% to 70% H2). Therefore, prevention of air ingress by maintaining the cryostat vacuum boundary and by providing inert atmo- sphere around the cryostat are possible strategies to avoid hydrogen explosion.

3. Limit inventory—For the steam generation scenarios, the total amount of steam pro- duced can be limited by limiting the amount of water spilled in the vacuum vessel in case of a LCE. One way of limiting this amount is to segment the coolant loops for the shield and for the vacuum vessel. 4. Limit chemical reactivity—The chemical reactivity of beryllium is dependent on its form: porous or dense. Characterization of beryllium coating should be performed and if possible the existence of porous beryllium in the vacuum vessel should be limited. 5. Provide adequate afterheat removal in all scenarios—The afterheat is the driving force for the medium-term overpressurization scenarios. The strategies to provide adequate afterheat removal are covered in Section 6.3.1. The mitigative strategies have the goal to limit the pressures that are caused by steam production and hydrogen explosion. 1. Blowdown volumes—The expansion volume provided by the vacuum vessel itself may be insufficient to limit the pressure to reasonable design values from the blowdown of the coolant circuit in case of an in-vessel LCE. If the vacuum vessel vents to a suppression pool or an adjacent larger volume such as the cryostat, peak pressures can be reduced. 2. Vacuum vessel draining—Another process to mitigate peak pressures is one in which the water from a LCE in the vacuum vessel is drained and led over cold surfaces to reduce the pressure. The same cold surfaces are used as condensation surfaces for the steam formed in the LCE. 111 DOE-STD-6003-96 6.3.3.2 Chemical Energy Fusion facilities should be designed such that chemical energy sources are controlled during normal and off-normal conditions to minimize energy and pressurization threats to radioactivity and toxic material confinement barriers. Design measures should ensure that evaluation guidelines are met. Chemical reactions should be prevented from releasing energy that threatens a confinement boundary, either by preventing the reaction or by accommodating the additional energy and pressure. Additional design guidance for chemical energy sources is provided. a. Chemical Reactions Much of the chemical energy source term in a typical fusion device is from plasma-facing components made of beryllium or carbon. Examples of chemical reactions include beryllium– steam (or carbon–steam), H2-air, and beryllium–air. The lower flammability limit for H2 is about 4% volume in air. Beryllium–steam reactions are exothermic, and the energy release will tend to increase overpressures, cause higher accident structural temperatures, and volatilize some chemically toxic beryllium. Unlike beryllium–steam, carbon–steam cannot become chemically ignited because it is an endothermic reaction. Both beryllium–steam and carbon–steam reac- tions will mobilize the tritium in these materials. Several scenarios could lead to beryllium–steam (or carbon–steam) reactions, such as the following: In-vessel LCE (water ingress) triggers a plasma disruption; the disruption heats the first wall or divertor surface above operating temperature; a thermal gradient starts to relax but beryllium–steam reactions may be sufficient to either ignite the beryllium or generate an unde- sirable amount of H2 (plus mobilize tritium and beryllium)—depending on operating temperature and temperature rise from the disruption. Even if short-term temperatures are too low for signifi- cant beryllium–steam reactions, afterheat (without adequate decay heat removal) could raise temperatures sufficiently for beryllium–steam reactions to start later. Similar scenarios start from in-vessel LCE (flow blockage), overpower transient, or ex-vessel LFE or LCE.

At present, it appears difficult to argue that much of the beryllium on the first wall and divertor surface will not be porous (85–90% of theoretical density) because of possible effects from neutron irradiation, ion irradiation, and redeposited and accumulated beryllium dust. Addi- tional research on this is needed, as well as further testing of beryllium–steam and beryllium–air reaction rates as a function of porosity, temperature, and gas pressure. Another potential chem- ical reaction is liquid metal-water reactions; for example, this reaction should be evaluated if a liquid metal such as lithium is used in the blanket with pressurized water used for in-vessel cooling. 112 DOE-STD-6003-96 b. Explosions Another related chemical energy source term is from explosions. Examples include H2, metal/carbon dust, and cryogenic ozone. The lower flammability limit for H2 is about 4% volume in air; the lower explosive limit for H2 in air depends on geometry and is about 15% by volume (deflagrations are possible with lower concentrations of H2). The lowest H2 concentration shown experimentally to detonate in air is 13.5%. Where explosion hazards theoretically exist, the design must do one or more of the following: 1. keep oxidizers (e.g., air) out preventing an explosive mixture (only applicable if oxi- dizer is required); 2. contain the explosion; 3. show consequences are acceptable in terms of public and plant personnel safety. An explosion hazard exists related to the use of liquid nitrogen in the thermal shield, specifically irradiation-induced ozone production (Brereton 1989). Explosions in liquid nitrogen systems in a radiation environment have been reported over the years. These explosions are thought to be caused by the production of ozone (O3) by the action of radiation on the intrinsic oxygen impurity. Ozone can spontaneously decompose back into oxygen releasing 144 kJ/ mole. Production rates for large thermal shields could be of order several moles of O3/day. Ozone is even less volatile than oxygen and may accumulate in the shield. Seven moles of O3 represents an explosion hazard with a potential energy release of 1 MJ (250 g TNT). This much energy represents a significant hazard and seems to indicate the necessity of operating with very pure nitrogen or replacing liquid nitrogen with cold helium gas or a passively cooled structure. 6.3.3.3 Magnetic Energy The magnet system (for a tokamak device) consists of the toroidal field (TF) coils, the poloidal field (PF) coils, and the central solenoid. TF coils are normally superconducting cables cooled with liquid helium and are wound into D shapes. The PF coils are also typically super- conducting cables cooled with liquid helium and wound into horizontal rings, which are located above and below the vacuum vessel with typically some coil sets inside and outside the TF coils. The TF and PF coils provide the basic magnetic field geometry for plasma confinement and position control. The central solenoid cables are typically superconducting cables wound horizontally and situated at the center of the vacuum vessel torus supported by, for example, a bucking cylinder. The central solenoid set provides the transient field to induce all or part of the plasma current. Fusion magnets contain significant stored energy that can cause materials, either in the magnet itself or in adjacent structures, to become volatile. Such faults could release missiles which could then cause damage that would release cryogenic liquids whose overpressure could

113 DOE-STD-6003-96 threaten confinement. Excessive motion of magnets or associated supports could break tritium lines or diagnostic penetrations into the vacuum vessel. In general, due to the developmental nature of this system, it is desirable that the fusion magnets not be classified as a safety-class or safety-significant system in the performance of their primary design function of plasma ion and electron confinement. Therefore, magnet systems in fusion facilities should be designed such that faults in the magnets and the associated ancillary systems (power supply, electrical systems) should not threaten safety functions. Where feasible, a design goal should be to design for symmetrical fault conditions to minimize loads. The mechanical integrity of the magnets should not depend on the shear strength of the insulating materials or the shear bond between insulation and structural materials. The dielectric strength of the insulation should be provided either by materials with an intrinsic dielectric strength, or by materials tested before assembly into the magnet. Since leaks at coolant con- nections are a common cause of magnet faults, such connections should be kept away from mechanical load paths, placed outside the winding pack and, as far as possible, in regions where some access is possible for inspection or repair. Manufacturing can allow many faults to occur. Machining chips left in the coil slowly abrade insulation and then cause a failure after some years of machine operation. Very strict tests to determine the cleanliness of finished units should be performed. 6.3.3.4 Plasma Energy For the next several generations of magnetic confinement devices, the plasma will be part of the experimental program, and there will be a need to decouple plasma physics issues, where possible, from facility safety issues, especially public safety. Where there is overlap between facility safety and the plasma system, such as during VDEs or strong disruptions, it is recommended that plasma-related consequences be confined to the interior of the vacuum vessel or cryostat to minimize potential public safety concerns. Several considerations regarding how the plasma is operated may affect the overall device safety. In particular, the issue of plasma stability is the primary concern. In the domain of stability, there are two primary categories: (1) thermal stability of the plasma and (2) plasma disruptions. The disruption area concerns the sudden loss of thermal and /or magnetic energy from the plasma. This category of events can produce undesirable transient heat and/or mechanical loads on fusion island components. a. Thermal Stability The thermal stability area concerns a prevention of a plasma transient to higher fusion powers than provided by the facility design. In the event of uncontrolled thermal runaway, plasma-facing components could be subjected to higher heat loads than during normal opera- tions. The plasma can be operated in either a thermally stable or unstable regime. There are several options to ensure a stable level of fusion power. One option is to operate at the high- temperature, thermally stable operational point. Another option is to operate in a driven mode. This is the case when auxiliary power must be injected into the plasma to drive currents in the plasma or to simply maintain the plasma power balance. With a driven plasma the only 114 DOE-STD-6003-96

possibility of an increase in the plasma temperature would be if the auxiliary power is increased. Finally, it is possible to operate at or near the thermally unstable point, if active feedback mechanisms are employed. This issue is primarily an operational one; the main task for the in-vessel component designer is to design for a conservative, but credible, value of fusion power taking into account all credible plasma transients. b. Disruptions Any magnetic confinement geometry has the consequence of both thermal and magnetic stored energy in the plasma. If the confinement scheme is known to have the possibility of sud- denly losing this stored energy, the in-vessel device hardware that receives these loads should be designed to accommodate these events. For example, the tokamak configuration is known to “disrupt” due to magnetohydrodynamic instabilities. In this event, the stored thermal energy in the plasma is rapidly lost to the plasma-facing components, introducing large thermal loads. Loss of the magnetic energy associated with fields generated by current flowing in the plasma can induce large currents in the surrounding first wall, breeding blanket, and vacuum vessel, which results in large mechanical loads. Disruptions can also generate high-energy runaway electrons that impact the first wall (with currents of the order of the plasma current). All of these disruption-related issues impose special design requirements on the affected fusion island hardware components. The fusion island hardware should be designed to withstand credible disruptions. Care has to be taken during the safety analysis process to conservatively identify credible disruptions/ VDEs and resultant loadings to components; some insight can be gained from the disruption data base of contemporary large tokamaks. It is also prudent to operate in a parameter regime where these events can be minimized. For instance, in tokamaks, disruptions can be initiated by (1) exceeding a plasma density limit, (2) operating at too low an edge safety factor, or (3) operating at too high a plasma beta. It is especially important to avoid this latter type disrup- tion during plasma startup and shutdown. In practice, these disruption causes can be identified and avoided, greatly reducing the probability of a disruption. Also, it may be possible to identify the onset of disruption and use active means to subsequently control it. Another known concern for sudden loss of plasma control is related to position control. For highly shaped tokamak plasmas, active vertical position control is required to maintain the vertical position. Loss of the position control due to noise in the feedback system or power sup- ply saturation is known as a VDE. If the main plasma contacts the plasma-facing components, the currents in the plasma can rapidly disappear, leading to a disruption. 6.3.4 Limiting Airborne and Liquid Releases to the Environment The facility design should include means to control the release of radioactive materials in gaseous and liquid effluent and to handle radioactive solid wastes produced during normal operation. Furthermore, the design should aim at minimizing the generation of radioactive and hazardous wastes in all forms. Suggested means to accomplish this and also minimize worker exposures are discussed in Section 6.2.2. A specific long-term goal for fusion facilities is the elimination of all materials in the fusion island whose activation would require disposal by deep

115 DOE-STD-6003-96 geologic burial. Sufficient holdup capacity should be provided for retention of gaseous and liquid effluent containing radioactive materials, particularly where unfavorable site environmental con- ditions can be expected to impose unusual operational limitations upon the release of such effluent to the environment. The design should limit the release of radioactive materials in efflu- ents and emissions to ALARA levels during normal operation. There should be no interconnec- tions between liquid effluent streams such as streams containing radioactive and/or hazardous waste, potable water streams, other incoming non-potable streams, and other outgoing streams. Means for measuring the amount of radionuclides in effluents and emissions during nor- mal operation and off-normal conditions should be provided. Means should be provided for mon- itoring the fusion island components, fusion island building, and the site areas for radioactivity that may be released from normal operations and off-normal events including design-basis events. Alarms should be provided that will annunciate if radioactivity levels above specified limits are detected in exhaust streams. Appropriate manual or automatic protective features that prevent the uncontrolled release of radioactive material to the environment or workplace should be provided. Systems designed to monitor the release of radioactive materials should have means for calibration and testing their operability. Sampling and monitoring should ensure ade- quate and accurate measurements under normal operations and off-normal events including design-basis events. Monitoring systems should be calibrated annually at a minimum with appropriate national standards to ensure validity of reported values. Radiation monitoring, alarm, and warning systems that are required to function during a loss of normal power should be provided with an emergency uninterruptable power supply (UPS) unless it is demonstrated that they can tolerate a temporary loss of function without losing needed data, and they are provided with standby or emergency (switched) power. Determination of the power supply type and quality should be based on the safety classification of the monitoring system or device. In addition to a local station alarm, radiation monitoring systems should have central (i.e., control room or radiation monitoring office) readout and alarm panels that are accessible after design off-normal event conditions to evaluate internal conditions. 6.4 Systems That Support Safety Functions As noted in Section 6.1.2, SSCs required for the performance of a public safety function should be designated as safety-class. This includes supporting systems such as power, I&C, and cooling that directly support the system in the performance of the public safety function. In a similar manner, systems directly supporting a safety-significant SSC should be classified as safety-significant. Guidance for these support systems is given in Sections 6.4.1–6.4.4. 6.4.1 Instrument and Control Systems I&C systems include equipment and components that monitor and display facility parame- ters, indicate parameter value changes, actuate equipment to maintain the parameters within specified limits, return the facility to operation within these limits, and mitigate conditions result- ing from operation outside limits. Specific equipment includes sensors, signal transfer media, signal processors, control circuits, and actuation devices.

116 DOE-STD-6003-96 In addition to the general design guidance in Section 6.1, the following system-specific design guidance is provided: a. I&C system functions may generally be considered either control or safety functions. Physical separation, electrical isolation, and independence of these functions is essential in I&C system design to ensure that safety functions, once initiated, will not be stopped or impeded by control functions. Conversely, safety functions must not interfere with the operation of the control function when the facility is operating within the normal design envelope. b. The design of the I&C systems should be integrated with the design of other facility systems to ensure an integrated response to process demands. c. The process variables that are selected as inputs to the I&C system should be a complete set that permits automatic or manual detection and response to off-normal conditions that challenge the integrity of designated confinement barriers. The selec- tion process should consider the measurability, variability, and time response of the variables, and the operational demands and limitations. Postevent monitoring and control should be provided where the safety analysis has assumed their continued function in the postevent environmental conditions. d. The instrumentation selected to measure a process variable should be analyzed to determine if its reliability, accuracy, and response time characteristics satisfy the con- trol or safety needs for all required operating conditions. Taps, ports, and penetrations should be positioned to obtain the most desirable measurement parameters. e. Enabling or interlock functions should be designed to prevent facility systems from entering into off-normal conditions or allowing a transient condition to continue its off- normal excursion. f. Setpoint, instrumentation uncertainty, and response time analysis should ensure ade- quate margins between normal control and safety setpoints and limits. Control func- tions should maintain normal operations without unnecessary challenges to or actua- tion of a safety function. Safety margins and system response times should be suffi- cient to ensure that conditions do not exceed the robustness of facility systems or do not exceed consequences documented in the facility authorization basis. g. Instrumentation should monitor variables over their full anticipated ranges for normal and off-normal conditions to ensure adequate safety and design margins are main- tained. The instrumentation should measure, display, and alarm conditions approach- ing or exceeding limits defined by the safety analysis. h. Multiple, diverse technologies should be considered in the selection of the sensors and measuring systems for the in-vessel and near-vessel parameters because these instrument components will be exposed to harsh environments (potential radiation 117 DOE-STD-6003-96 exposure, magnetic fields, temperature gradients, ion pulses, etc.). Unexpected failure mechanisms within a single measurement technology could lead to erroneous actions. i. A task analysis should be conducted to determine functions that may be assigned to the operator and those that are to be machine assigned. The operator should be pro- vided with manual action-initiating capability for all safety functions, including auto- matic functions. Manual initiation should be provided for actions not appropriate for automatic initiation or for chosen automatic action interruption or adjustment. The operator should also be provided with feedback information to confirm the occurrence of the proper actuation and completion of the selected safety function.

j. The control room and supporting local control and monitoring panels should be designed for man/machine interface and local area or room habitability. Sufficient central control room displays and command features should be provided to allow monitoring and response to off-normal events, Adequate radiation and environmental protection should be provided to permit access and occupancy of the control room under accident conditions where the operator monitoring, mitigative, or response actions are required during or following an off-normal event. A human factors analysis of the control room and local operator interfaces should be performed consistent with the safety analysis. The design of the control room should be implemented in accor- dance with IEC 1989 with appropriate modifications for fusion technologies and hazards. k. Equipment at locations outside the control room should be provided if required to achieve and/or maintain the facility systems in a safe or shutdown condition in the absence of the control room functions designated for that purpose. l. The I&C system and components should be designed to provide the capability for performance of periodic testing of all instruments, logic, interlocks, permissive fea- tures, bypasses, and other facility systems. The safety system portion of the I&C system should be capable of confirming the required calibration, setpoint, and time responses with test frequencies that meet the uncertainty analysis requirements. Test features of the safety-class system I&C should be able to detect failures of the system that could degrade or prevent a safety function from occurring in the presence of a single failure. The I&C system design should include the provision for sufficient bypass or disable capability and test point access to allow for the valid performance of necessary and adequate testing. m. The I&C power system design should provide for the necessary redundant power sources to ensure that the system will be capable of performing its required function under all normal and off-normal conditions. Power sources that should be considered for the I&C system include UPSs, critical instrument busses capable of being powered from diesel generator backup power, and battery backup systems. The power supply for safety-class instrumentation and controls should meet the IEEE Standard require- ments for Class 1E power systems (IEEE 1980). 118 DOE-STD-6003-96 n. Safety-class and safety-significant equipment should be designed to fail safe on loss of motive force or power. In addition, safety-class equipment should be designed to meet single failure criteria. o. If required by the safety analysis, safety function actuation should be sealed in so that the safety function actuation is maintained even if the logic that initiates the actuation is lost. Controlled bypasses may be provided for operator interruption or adjustment of automatic actions. 6.4.2 Electrical Power Systems The electrical power system includes on-site alternating current (ac)/direct current (dc) sources and distribution networks and feeders(s) from the off-site grid. The switchyard is the interface between the off-site grid and the fusion facility. From the switchyard, the electrical power distribution system divides into two main parts: the fusion facility system and the balance- of-plant system.

The fusion facility distribution system supplies the heavy (and often pulsed) loads for fusion facility operation, including the magnet power supplies and various plasma-fueling and heating power supplies. The system may provide for safety-class loads in addition to non-safety- class loads, in accordance with the facility safety analysis. An emergency generator or UPS or both should provide power for safety-class loads in the event of loss of off-site supply. Additional design guidance specific to the electrical system is provided. a. Safety-class electrical systems If the facility safety analysis concludes that safety-class electrical systems are necessary, design of these electrical systems should comply with IEEE Standards 308 (IEEE 1980), 379 (IEEE 1988), 384 (IEEE 1992) and 603 (IEEE 1991). The safety-class systems should be testable in compliance with the following standards: 1. ac systems and components—IEEE Standards 308 (IEEE 1980) and 338 (IEEE 1993), 2. dc systems and components—IEEE Standards 308 (IEEE 1980) and 338 (IEEE 1993). b. Radiation/contamination and equipment life Safety-class electrical equipment required to be in areas of radiation and contamination should comply with IEEE Standard 323 (IEEE 1983). c. Instrument and Control Systems 119 DOE-STD-6003-96 The safety-class electrical systems should have I&C elements to monitor and ensure the necessary parameters for normal operation and for off-normal conditions, in accordance with IEEE Standard 603 (IEEE 1991). d. Backup power generation Safety-class backup power supplies should comply with the requirements of U.S. Nuclear Regulatory Commission (USNRC) Regulatory Guide 1.9 and IEEE Standard 387. Provisions should be made for auto/manual synchronizing each emergency/backup power source to its respective bus for periodic testing during normal facility operation. The manufacture and testing of safety-class diesel generators should comply with nation- ally recognized ANSI Standards C50.10 and C50.12, NEMA Standard Publication MG-1, and IEEE Standards 115 and 386. e. Switch gear and load centers Safety-class electrical equipment with 480 V or higher should comply with IEEE Stan- dards 323 (IEEE 1983) and 344 (IEEE 1987). Fault calculations should be in accordance with the latest issue of ANSI Standards C37.010 and C37.13. All switch gear and load centers should be located indoors if possible. f. Direct Current Systems The safety-class dc power systems should be of adequate size to provide control and switching power to safety-class systems and components in addition to safety-class dc loads. The dc systems should operate ungrounded. All batteries and chargers should have sufficient capacity to comply with IEEE Standard 308 (IEEE 1980). Battery capacity determinations should be in accordance with the method of IEEE Standard 485. Restoration of the battery from the design-minimum charge state to the fully charged state should be within the time period stated in fusion safety analysis. g. Vital instrumentation and control power supply If the fusion facility safety analysis requires systems of vital instrumentation and controls, emergency or backup power supply to these systems should be by independent and ungrounded power supplies. Each vital ac power supply should consist of an invertor, distribu- tion panel, and manual transfer switch. h. Motors

All safety-class motors should comply with NEMA Standard MG-1 and other applicable USA and ISC standards for sizing, manufacturing and testing. The sizing of all motors should ensure operation within the temperature limits given in NEMA Standard MG-1. 120 DOE-STD-6003-96 Enclosed motor windings should have moisture-resistant Class B insulation systems, suitable for power plant service, in compliance with NEMA Standard MG-1. Motors installed indoors should be open, drip-proof, and fully guarded or should be totally enclosed and fan cooled. Motors installed outdoors should be NEMA weather-protected Type I or should be totally enclosed and fan cooled. i. Power, control, and instrumentation cables Except for thermocouples, metal conductors should be Class B stranded, tin-coated or lead-alloy-coated, soft or annealed copper. Safety-class cables should be capable of passing the cable tray vertical flame test set forth in IEEE Standard 383 (IEEE 1974). Individual conduc- tor in cables should be capable of passing the vertical flame test of Subsection 6.19.6 of IPCEA S-19-81 and/or S-66-524. Safety-class cables should be qualified for intended service in compliance with IEEE Standard 383 (IEEE 1974). Insulation and jacket thickness for power cables should be in accor- dance with Insulated Power Cable Engineers Association (IPCEA) standards. Control cable insulation and jacket thicknesses should also comply with IPCEA standards. The overcurrent capacity of cables and individual conductors should comply with the NFPA 70 standard. Cable current carrying capacity (ampacity) information contained in IPCEA Publications P-46-426 and P-54-440 should be used to select cable size. j. Raceways and trays Safety-class cables and conductors inside the facility should be in trays or in rigid steel conduit and should route only through safety-class raceways and should comply with IEEE Standard 344 (IEEE 1987). No other circuits should route through safety-class raceways. Trough-type cable trays should be utilized where practicable. Tray strength should be ver- ified by tests in accordance with the latest revisions of NEMA Standards Publication VEI-1976. The dead weight-carry capacity of the cable trays should comply with NEMA 3-14-1079 and VE-1-1991. k. Electrical penetrations Safety-related and other electrical penetrations of the fusion confinement barriers should comply with IEEE Standards 317 and USNRC Regulatory Guide 1.63. Penetrations should meet the same requirements of robustness and leak tightness as the confinement system. Physical separation of penetrations should comply with USNRC Regulatory Guide 1.75. l. Separation of facility safety systems/components Physical separation and independence of electrical systems should comply with IEEE Standards 384 (IEEE 1992) and 603 (IEEE 1991). 121 DOE-STD-6003-96 m. Facility and building grounding The facility grounding grid should comply with the procedures and recommendations of IEEE Standard 80. Grounding within buildings should be in accordance with the NFPA 70. n. System and equipment grounding System and equipment grounding should comply with IEEE Standard 142. o. Cathodic protection Cathodic protection should be in accordance with the results of soils analysis and resis- tivity readings. Cathodic protection may be necessary for metal underground pipes and storage tanks, surface-mounted storage tank bottoms, sheet piling, and the fusion facility confinement barriers. p. Lightning protection

The lightning protection system should comply with ANSI Standard C-62 series and NFPA Standard 780. 6.4.3 Cooling Systems The cooling systems include all SSCs that remove heat from the facility and transfer it to a heat sink such that • thermal, hydraulic, and mechanical parameters are within design limits for the cooling system, fusion device, confinement barriers, and other safety-class equipment; • a leaktight barrier is maintained against uncontrolled release of radioactive and other hazardous materials to the environment. The cooling system includes coolant makeup systems and collection and disposal sys- tems for spilled or drained coolant. A number of fusion facility components may require cooling during normal operation and off-normal events. These include the first wall, divertor, shield wall, cryostat, vacuum pumps, magnet coils, and so on. In addition to the general design guidance in Section 6.1, the following system-specific design guidance is provided. a. Structural design should consider service temperatures and other conditions of the boundary materials; the uncertainties in determining material properties; effects of irradiation on those properties; residual, steady-state, and transient stresses; and size of flaws. 122 DOE-STD-6003-96 Additionally, the pressure load range should include temperature-induced pressures, hydrostatic test pressures, and any credible pressure augmentation resulting from small leaks between two coupled cooling systems. Cooling systems that are safety-class should have design, fabrication, inspection, and testing in accordance with a recognized safety-class code such as ASME 1992. The specific codes and criteria selected should be commensurate with the level of safety required and should have a technical justification. Table 6.1 gives suggested design codes for the cooling system. Where ASME design is not feasible, such as in the case of unique materials or designs, the alternate codes listed in Table 6.1 may be used. Piping and equipment supports should be designed to ANSI/AISC N690 (ANSI 1984) or equivalent. Cooling system components that are safety-significant should have design, fabrication, inspection, and testing in accordance with a recognized national consensus code such as ANSI/ASME B31.3 (ANSI 1993a). b. An analysis of cooling system deflections over the full range of temperatures, vacu- ums, and pressures should confirm no interferences or loss of pressure boundary integrity. c. The cooling system boundary materials and design should provide sufficient margin to ensure that, when stressed, the boundary behaves in a nonbrittle manner with a very low probability of rapidly propagating fracture. Coolant should be compatible with structural materials that it may contact during normal operation and off-normal events throughout the range of anticipated physical parameters. Table 6.1 lists the materials requirements. Alternative codes and standards may be used with appropriate justification. d. Cooling system design should provide for instrumentation to monitor safety-related variables and controls to maintain the variables within design limits (see also Section 6.4.1). The cooling system design should provide for instruments to detect and measure abnormal leakage and controls to isolate and mitigate the leak. To the extent practical, the primary mode of actuation of safety functions should be automatic and should be initiated by detection and control channels of suitable diversity and redundancy.

e. Design should provide means to collect spilled coolant to prevent damage to safety- class SSCs and to limit contamination and environmental releases. f. Design should provide makeup coolant for breaks, leaks, or draining required for maintenance activities. The coolant makeup rate should be sufficient to maintain the heat removal and rejection capacity to prevent or limit damage of safety-class SSCs while allowing only negligible materials reactions with the coolant. g. For shutdown conditions, the cooling system design should incorporate passive fea- tures to the extent practical for heat removal, transfer, and rejection functions. The design objective should be to provide adequate cooling of all safety-class SSCs 123 DOE-STD-6003-96 without human intervention for the period specified in the safety analysis and for as long a period as practical following shutdown of the fusion device. h. Unavailability of the on-site electrical power supply or the off-site power supply should be a consideration in ensuring safety-class cooling system functions, assuming a sin- gle failure within the cooling system. Coincident failure of off-site and on-site power systems should not be a design consideration. i. Cooling system design should consider the thermal, hydraulic, and mechanical effects of unintended operation of active components, such as valves and pump motors. j. Cooling system design should consider the thermal, hydraulic, and contamination effects of cross leaks between adjacent systems, such as the primary and secondary sides of a heat exchanger. k. Materials properties for cooling systems should include the effects of radiation embrit- tlement at all levels of service temperatures. l. Coolant system pumping should provide for coolant flow coastdown to prevent exceeding design limits. m. Discharge of coolant for pressure relief should be to a confinement tank that maintains the confinement function of the coolant system. n. The coolant system should include protection for overpressure to prevent degradation of safety function. o. The coolant system should include provisions for sampling to analyze coolant proper- ties and to identify entrained radioactivity or other contaminants. p. Use of a primary cooling system and a secondary cooling system is the recommended design for containment of radioactivity where required by the safety analysis. Closed heat exchangers are the recommended coupling between primary and secondary cooling systems. q. Multiple cooling loops are recommended for consideration as a design feature to reduce the operational thermal-hydraulic transient associated with single-loop failure. r. Components and headers of systems should be designed to provide individual isola- tion capabilities to ensure system function, control system leakage, and allow system maintenance. s. The use of leak-before-break may be considered in the analysis of pipe break and pipe whip events. The methodology described in Section 3.6 of the Standard Review Plan, NUREG-0800 is recommended. 124 DOE-STD-6003-96 6.4.4 Remote-Handling Systems Remote-handling systems may perform a number of functions to minimize personnel exposure to radiation and other hazards during normal and off-normal conditions. In addition, remote operations functions may be required to prevent or mitigate the consequences of off- normal events. Potential remote operations include the following: • Erect portable radiation shielding panels.

• Place or relocate experimental devices or other equipment in high radiation fields. • Test or inspect SSCs as necessary to ensure performance of safety functions. • Replace equipment or components in high radiation fields. • Decontaminate SSCs in preparation for maintenance. • Install/place diagnostic instruments. • Install consequence mitigation devices in high radiation fields or otherwise unsafe conditions. Remote-handling systems should be considered where it is anticipated that personnel exposures may otherwise exceed dose or contamination guidelines. Design guidance for remote-handling systems includes the following items: a. General Remote-handling systems may be operated and stored near the fusion device in an area subject to intense magnetic, thermal, neutron, and gamma radiation environments. Persistent low levels of hydrogen, deuterium, and tritium gases, as well as potential high levels of these gases during off-normal events, may be present and should be considered in design. Activated dust from plasma-facing components may be present during maintenance or off-normal condi- tions and should be considered. The design should accommodate the following general guidance: 1. The remote-handling system should be designed such that the operator will not be exposed to a radiation dose rate greater than the facility ALARA exposure limits. 2. Remote-handling systems and components should not cause a collision with safety systems or components while performing normal or abnormal plant mainte- nance. Wiring through sections and/or modules of remote handling equipment should be provided within the equipment. 125 DOE-STD-6003-96 3. Allowances should be made for equipment movement so that, in performing intended operations, safe distances can be maintained from personnel in normally accessible work areas. 4. Equipment should be operated and stored in areas accessible, or that may be made accessible, for testing, inspection, and maintenance. Where this is not pos- sible, a means of safely retrieving the equipment to a safe area should be pro- vided. This must include backup methods of safely disconnecting from radioactive or other hazardous materials, for which the remote equipment is intended. 5. The operator should be provided a full view of the remote operation. 6. Equipment should fail safe upon the loss of motive power. 7. Features should be incorporated such that failure of one of the drive mechanisms or any component of the equipment will not result in exposure of personnel to excessive radiation while recovering from such failure. 8. Redundancy of critical controls should be provided to prevent single-mode control failure of remote or robotic equipment causing unplanned or unanticipated equip- ment motion. 9. The expected high levels of RF and magnetic interference potentially present should not interfere with control systems or the normal operation of systems. 10. The presence of large quantities of cryogenic materials during both normal and off-normal conditions must be considered in the design of remote equipment. 11. Design should consider radiation shields between the fusion device and the remote-handling system components as necessary to reduce exposure to and neutron activation of the system components. b. Structural design

The design, fabrication, testing, and inspection of safety-class and safety-significant remote-handling equipment should be in accordance with commercial codes and standards applicable to that particular type of equipment. The majority of the systems and components should be considered as non-safety-class and should be designed and fabricated to industrial standard requirements. Allowable design stresses in mechanical components should provide a safety factor of at least 5 when under rated load. Brittle fracture and fatigue during all operation and testing condi- tions should be design considerations. Joint and weld details should be designed to prevent lamellar tearing. 126 DOE-STD-6003-96 c. Materials Materials of construction should be resistant to the chemical, high-temperature, low- temperature, and other anticipated hazards. The specific hazards to be addressed are relative to the equipment’s expected location within the fusion facility. Major concerns are the activation of materials by the intense neutron bombardment, the degradation of materials by all forms of radiation, the contamination of surfaces from the transfer of radiological materials, and the embrittlement of materials from exposure to hydrogen isotopes. Activation and degradation issues should be addressed by careful choice of materials. Materials should be radiation tolerant to the cumulative exposure expected during their service life with an acceptable margin for safety. Design values that have proven acceptable in practice are 1 × 108 rads for replaceable materials and 1 × 109 rads for inaccessible materials. Structural materials should be chosen for their nonoxidizing surface characteristics and resistance to neu- tron activation, to the extent possible. Stainless steels should be used unless other materials are acceptable. Nonmetallic materials should be chosen for their resistance to neutron activation and to radiological degradation. The failure mode of the materials should not directly cause fail- ures of other systems (e.g., elastomers that become liquids upon radiological exposure). Non- metallic materials that cause degradation of adjoining metallic materials, such as materials that release chlorine, should not be used. The contamination issue should be addressed by careful surface selection and prepara- tion to prevent the entrapment of radioactive materials and facilitate the removal of material. Metal surface characteristics should be smooth and free of paints or coatings, with the excep- tion of strippable coatings used for decontamination. High-polish or electropolished surfaces are preferred, due to their ease of decontamination. Materials should be resistant to degradation by decontamination processes to be used prior to maintenance. These methods include cleaning with high-pressure water, cryogenic materials, and mild acids. Special care must be used to prevent gaps and crevices from entrap- ping and retaining radiological materials. General guidelines for the selection of materials include the following: 1. The effects of galvanic or chemical corrosion should be evaluated as part of the material selection process. 2. Lubricants, sealants, and protective coatings should be compatible with their intended service and environment. 3. Materials selection, including lubricants, sealants, and electrical insulation for equipment, should consider the design-life radiation exposure (during normal operation and, where applicable, off-normal event conditions) to ensure no loss in function for the design life of the equipment. Materials that will preclude or mini- mize generation of mixed wastes should also be considered.

127 DOE-STD-6003-96 4. The surface finish of all external materials should allow for ease of decontamina- tion. Highly polished, nonoxidizing, and nonpainted surfaces should be used so as to not entrap radiological material. 5. The potential for hydrogen embrittlement and weakening of structural members should be considered in all locations where exposure to hydrogen, deuterium, or tritium is anticipated. High-stress components that see a significant tritium envi- ronment should be monitored for hydrogen embrittlement. 6. The radiological activation of materials in areas of high gamma and neutron fluxes should be considered in the choice of materials. This includes metals, greases, fluids, and elastomers. d. Instrument and Control Systems The following I&C features should be provided in the design of the remote-handling equipment as necessary to prevent damage to the handling equipment, to nearby safety-class or safety-significant SSCs, and to the handled components; to provide for personnel safety; and to remotely recover equipment (to prevent the necessity of personnel recovery of equipment): 1. Underload—An interlock actuated upon a reduction in load, while lowering with grapple attached, at other than full down position, to prevent any further downward travel. 2. Overload—An interlock actuated upon an unacceptable increase in hoisting force to prevent upward travel. 3. Up-position—An interlock set at a predetermined operational limit to prevent any further upward travel. 4. Down-position—An interlock set at the predetermined operational limit to prevent any further down travel. 5. End-travel (hardstop)—Physical limit to translation. 6. Up-limit (hardstop)—Physical limitation to hoisting. 7. Slow zone—Region of travel where a reduction in hoist speed is mandatory and automatic. 8. Nonsimultaneous motion—Automatic restriction against simultaneous hoisting and translating motions. 9. Grapple release—An interlock to prevent opening a grapple under load. 10. Bridge travel—An interlock at a predetermined operational bridge travel limit. 128 DOE-STD-6003-96 11. Trolley travel—An interlock at a predetermined operational trolley travel limit. 12. Slack cable—An interlock actuated at a loss of cable load to prevent further downward travel. 13. Translation Inhibit—An interlock to prevent bridge or trolley movement unless its associated hoist is at or above a predetermined operational up position. 14. Robotic systems—Provide with intelligent systems to avoid known structures and obstacles. This may include direct sensing of obstacles or knowledge-based sys- tems that have been preloaded with the location of obstacles. 15. Remotely controlled systems—Provide with a backup means of safe release of attached radiological hazardous materials, to facilitate remote recovery of failed remote-handling equipment for repair. 16. Redundancy of critical controls—Prevent single-mode control failure of remote or robotic equipment, causing unplanned or unanticipated equipment motion. 17. Equipment maintenance—Provide maintenance of anticipated large-capacity remote or robotic equipment in the presence of personnel, without creating impact hazard to the personnel. It is anticipated that most equipment will require a mini- mum of maintenance functions while energized, typical of robotic systems. This must be provided for in a personnel-safe manner.

18. RF control—The expected high presence of RF and magnetic fields during both normal and off-normal operation should not create hazards to personnel through unplanned movements or other means. Remote-handling system controls that, on failure, can cause either (1) a system to per- form unintended motions or (2) a system to fail in a nonrecoverable mode should be redundant. Manual bypasses for interlocks may be supplied at the discretion of the designer. e. Electrical The remote systems should be designed to the equivalent of the NFPA Class 1, Division 1 requirements. It is assumed, but not required, that this would be met with the pressurized, interlocked systems approach. Wiring should be resistant to radiation damage. Cabling should be protected from physi- cal hazards. Cabling should be adequately shielded from any high magnetic and RF fields it is expected to encounter. The shielding should be such that the equipment serviced by that cabling is adequately protected from cabling-induced interference. 129 DOE-STD-6003-96 Electrical connectors and wiring methods (per National Electric Code definitions, or equivalent) should be used to minimize repair or replacement time. Sealed, quick-disconnect- type connectors should be used wherever possible, and individual wiring methods (e.g., terminal strips) should be avoided. These requirements are intended to minimize the exposure of per- sonnel related to maintenance. The wiring count from remote equipment to personnel areas should be minimized. The failure probability for remote-handling equipment is directly related to the amount of vulnerable wiring and connectors required from the work area. f. Tests and inspections Provisions should be made to allow testing on a scheduled basis in accordance with applicable codes and standards to verify the following: 1. Limit switches are operable and functioning as required. 2. Controlling signals from sensing devices are within specifications. 3. Control switches are operable. 4. Indicating instrumentation is operable and within specified accuracy. 5. Annunciators are operable as specified. 6. Electrical interlocks are operable and functioning as required. 7. Load cells are performing properly. 8. Motors are operable and functioning as required. 9. Hoists and brakes are functioning correctly. 10. Any special function is performing properly. g. Hydrogen fires and detonation Remote-handling systems should not initiate a fire or detonation in normal or off-normal conditions in the presence of hydrogen gases. Safety-significant remote-handling systems and components may fail in a fire or detonation event, but the failure should not degrade the function of an adjacent safety-class SSC. Safety-class remote-handling equipment should withstand the effects of design-basis fire or detonation and retain its basic safety functions. h. Equipment maintenance considerations Remote-handling equipment will potentially require maintenance while radiologically acti- vated or contaminated (tritium or other) and should be designed accordingly. Maintenance requirements should allow for personnel using rubber gloves, plastic suits, or similar personal protective means. Additionally, the time required to perform maintenance may be directly related to the resultant exposure of personnel to radiological hazards. Maintenance methods should allow for rapid replacement of components or modules uti- lizing quick disconnects for all services. Fasteners should be designed for gloved handling and be of the captive type if possible.

130 DOE-STD-6003-96 i. Assembly and disassembly techniques Systems should be of modular construction, if possible, to facilitate maintenance. Mod- ules can be replaced or relocated to other maintenance facilities with less potential for person- nel exposure. Systems for use in highly congested areas must also allow for modular construc- tion to a sufficient degree to allow for access and recovery of components. Systems or modules of systems should provide for handling by fully protected personnel (e.g., plastic suits) with a minimum of special requirements. Permanent lifting points are desired, and lifting slings (ropes, cables, straps) should be avoided. Gloved or double-gloved, hand-compatible electrical and service connectors should be used to facilitate connections. Sharp edges or rough surfaces are to be particularly avoided, to prevent compromising protective clothing. j. Special handling requirements The handling of typically large and powerful remote equipment in confined spaces and the subsequent maintenance of that equipment should be a design factor. System designs should allow for required personnel work without hazard to personnel. k. Mode of operation Remote-handling systems should be operable in the operational modes of less sophisti- cation than their normal mode to facilitate recovery from off-normal events without personnel entry. Programmed assistance should be provided in the form of graphics-based workcell mod- eling, or similar analysis, coupled to the movements of any automated system. This should dis- play the location of all known obstacles or objects within a work cell and the present location of the remote system. The control systems should display all programmed motions in the modeled environment, in real time, with display-before-movement capabilities. This will allow all actions to be tested before started. l. Collision avoidance The most desirable mode of operation is with active system control to prevent operation in areas of exclusion. In this type of operation, the control system will intervene when commands direct a system into a predetermined exclusion area. The environment can be either statically modeled, when unchanging, or actively modeled, when dynamic. The active modeling can be vision-based, structured-light-sensed, or similar. The control system should be the primary means of obstacle avoidance. Active sensors on systems should also be provided where needed to avoid high-damage-potential collisions. 131 DOE-STD-6003-96 m. Multiple remote device coordination Multiple remote-handling systems in the same or overlapping workspace(s) should have coordinated motions to prevent their direct interaction. When two systems have an interaction potential, one system will be designated as the lead and the other the follower. n. Closed-circuit television (CCTV) CCTV is generally used to monitor the remotely performed handling and operations activi- ties. The CCTV equipment should meet the electrical performance standards for monochrome television studio facilities EIA Standard RS-170-57 (Revision TR-135), 1957. CCTV electrical wiring should be in accordance with NFPA 70, National Electric Code. The radiation hardness of the required CCTV system is a function of the particular appli- cation, with significant cost and complexity advantages to the nonradiation-hardened systems, when they are applicable. Each application should define its realistic radiation-hardness needs.

o. Electromechanical manipulator (EMM) Design, fabrication, inspection, and testing of EMM should comply with the requirements of following codes and standards: Controls NEMA ICS-6 Electrical NFPA 70 For additional guidance, see ANS 1985 and NASA 1991. p. Cranes The following codes and standards should be considered in the design, fabrication, inspection, and testing of cranes: Cranes and Hoists CMAA 70 and /or ASME NOG-1 Seismic Analysis CMAA 70 and /or ASME NOG-1 Overhead and Gantry Cranes ANSI B30.2 Hooks ANSI B30.10 Electrical NFPA 70, Art 610 IPCEA S-61-402 NEMA MG1, NEMA ICS-1, NEMA WC-3 ANSI C2 Fire Protection NFPA 12A NFPA 72E FM-Approval Guide UL-Fire Protection Equipment 132 DOE-STD-6003-96 The cranes should be provided with all components and appurtenances required for safe operation and handling, in accordance with the Occupational Safety and Health Administration (OSHA) Regulations Section 1910.179 and ANSI B30.2, ANSI B30.1, B30.16 Safety Codes as applicable. q. Master slave manipulators (MSMs) Design, fabrication, inspection, and testing of MSMs should be in conformance with applicable requirements of the following codes and standards: Hooks ANSI 30.1 Hydraulic Power JIC-H-1 r. Hoists Auxiliary hoists should be designed and manufactured to comply with the Hoist Manufac- turers Institute Specification HMI 100 for Electric Wire Rope Hoists. s. Remote connector systems Remote connector systems (sometimes referred to as “Hanford” type) can be used in the process piping as mechanical jumpers. This type of jumper system allows remote assembly and disassembly of mechanical components such as pumps, valves, and pressure vessels. These mechanical jumpers and/or connectors can be remotely operated. The design, fabrication, inspection, and testing of these connector/jumpers and associated equipment should be per manufacturer standards. The electrical type connector systems must protect the connecting pins or sockets from damage during the coupling operations. The entire assembly must meet the electrical classifica- tion requirements of the particular service. t. Robots Standards and Codes recommended for robot design, fabrication, and safety require- ments include the following: 133 DOE-STD-6003-96 Groupa Standard Subject ANSI/RIA RI506-1986 American national standards for indus- trial robots and robot systems BSR/RIA R15-06-19XX Proposed standard for industrial robots and robot systems ANSI/RIA R15.02-1990 American national standard human engineering design criteria for hand- held robot control pendants OSHA Pub. 2254 (rev.) Training Requirements in standards and training guidelines NIOSH Pub. 88-108 Safe maintenance guidelines for robotics workstations OSHA Pub. 8-1.3, 1987 Guidelines for robotics safety OSHA 29 CFR 1910.147 Control of hazardous energy source (lockout/tagout final rule) AFOSH 127-12,1991 Occupational safety machinery OSHA DOE/EH-0353P OSH Technical Reference Manual aANSI/RIA = American National Standards Institutes/Robotics Industrial Association. BSR/RIA = Bureau of Standards Review/Robotics Industrial Association. NIOSH = National Institute for Occupational Safety and Health. OSHA = Occupational Safety and Health Administration. AFOSH = Department of the Air Force. 6.5 Impact of Facility Support and Experimental Systems on Safety Functions

Several fusion facility support and experimental systems that are not discussed explicitly above will be covered below. They are generally in one of two groupings. The first group (Group 1) are systems that have a specific function in support of the fusion facility mission but also perform a potential (depending on inventory of radioactive and hazardous materials) public safety function or worker safety function (see Table 6.2). The second group (Group 2) are systems that may not perform a specific safety function but have either a large energy content and/or are physically adjacent to safety-class systems such that care has to be taken in their potential influence on facility safety (see Table 6.3). 134 DOE-STD-6003-96 TABLE 6.2. Group 1 systems System Facility specific function Potential safety function Plasma fueling Provide H/D/T Primary confinement of tritium Pumping systems Maintain specified vacuum and torus exhaust Primary confinement of tritium Plasma heating Heat plasma to ignition and main- tain driven plasma current Primary confinement of tritium Tritium plant Separate H/D/T from plasma exhaust; remove tritium from process streams Primary confinement of tritium Breeding blanket Breed tritium for fusion reaction; transfer heat to balance of plant Primary confinement of tritium; (depending on design) Magnet shielding Shield cryogenic magnets from nuclear heat loads Part of biological shield for plant staff TABLE 6.3. Group 2 systems System Stored energy Proximity to safety-class SSCs Plasma Less than a few GJ Can focus energy on plasma-facing com- ponents (e.g., runaway electrons) Magnets 100s of GJ Close to cryostat and tritium piping Vessel cooling 100s of GJ Close to vacuum vessel Divertor 10s of GJ Close to vacuum vessel Breeding blanket 10s–100s of GJ Close to vacuum vessel and interface to tritium processing systems 6.5.1 Group 1 Systems The important design consideration for these systems is that they should be subject to the same design criteria in performing their public safety function as more visible safety-class sys- tems, such as the vacuum vessel, while providing primary confinement. Thus plasma-fueling and vacuum-pumping systems should be designed as safety-class SSCs while performing the public safety function of tritium confinement if this is shown as required in the safety analysis process. Parts of these systems not performing public safety functions (e.g., control subsystems used for the plasma-fueling or vacuum-pumping functions) would not be designated safety- class. Additional factors to be considered are the presence of new energy sources (e.g., high- pressure propellant gases, rotating energy of centrifuges, kinetic energy of pellets in plasma- fueling systems) in these systems and the vulnerable tritium inventory in determining how many confinement barriers are needed. Designers should try to minimize the portion of these Group 1 systems that supports a public safety function and have clearly defined boundaries between safety-class and non-safety-class components in such systems. Group 1 systems could 135 DOE-STD-6003-96 potentially be safety-significant relative to the worker safety function if the inventory level and proximity of workers result in this designation. 6.5.2 Group 2 Systems

The important design consideration for these systems is that they are typically experimen- tal in nature (magnets, plasma, divertor, breeding blanket) and their performance in a future fusion reactor environment is not known a priori. Environmental conditions that these systems potentially experience include high heat fluxes, high neutron and gamma irradiation, high-energy particle flux including very high energy runaway electrons, cyclic loading, and significant thermal gradients. Typically these conditions result in design decisions to use materials for plasma- facing components such as carbon and beryllium that do not have an extensive nuclear industry data base. Thus, it is strongly recommended that decisions be made early in the design phase to preclude these systems from being designated as safety-class. Some of these systems have significant stored energy as shown in Table 6.3, and innovative strategies should be developed to ensure that this energy is locally contained within these systems and their support structure during off-normal events. An example of design guidance for a typical Group 2 system, the divertor, follows. a. Divertor system The divertor (more specifically referred to as a poloidal divertor in the case of interest here) for a tokamak device consists of a set of structures that, taken together, form a toroidally continuous element(s). The plasma-facing surfaces of the divertor are configured to intercept or enclose the magnetic flux surfaces that lie outside the last closed flux surface that contains the confined plasma. This surface, referred to as a separatrix, is formed by one or two nulls in the poloidal magnetic field and separates the confined plasma from that diverted toward the exhaust region. A configuration with a single null in the poloidal field is referred to as a single-null diver- tor configuration, whereas a double-null arrangement is referred to as a double-null divertor configuration. Poloidal divertors are usually located on the top and/or bottom regions of the plasma chamber. Since the plasma exhausts most of its heat and particles to the divertor, active cooling and vacuum pumping are required in the divertor region for long-pulse operation. The divertor system consists of targets (plasma-facing structures), coolant piping, support structure, and nuclear shielding. The surfaces of the divertor target are directly exposed to the particle and energy fluxes resulting from the plasma exhaust processes. These surfaces are usually constructed from two separate materials, each with different functions. The plasma- facing or armor tile material is selected for its plasma interface characteristics, such as sputter- ing erosion and thermal shock capability. Plasma-facing material candidates include metals such as beryllium or tungsten, carbon-containing materials such as graphite or carbon-carbon composites, or ceramic materials such as silicon carbide. The plasma-facing material is attached to a structural metal, whose primary functions are to contain the coolant and to act as a heat-conducting element between the coolant and the plasma-facing material. The primary function of the divertor system is to protect the vacuum vessel from direct interaction with the plasma while providing a means for plasma particle and energy exhaust. 136 DOE-STD-6003-96

Due to the challenging nature of its loading conditions and developmental status, it is desirable that the divertor system not be classified as a safety-class system. However, since the divertor structure will become radioactive and its plasma-facing surfaces will become contaminated with absorbed tritium, the impact of the divertor system on other safety-class systems must be considered. The goal of the divertor design should be that a single failure of the divertor system does not threaten any in-vessel or ex-vessel safety-class system. The divertor system design should prevent damage to safety-class components, which might include the vacuum vessel, fueling and vacuum pumping system piping, and in-vessel coolant system pipes. If this goal cannot be met and individual components within the divertor system are designated as safety-class, the design guidance listed in Section 6.1 should apply to these components. Divertor components designated as safety-class should be designed, fabricated, inspected, and tested in accordance with an approved structural acceptance criteria. Because the divertor environment and material candidates differ significantly from more conventional applications with regard to (1) handling the high, steady-state heat and energetic particle fluxes on the surface of the divertor target, (2) withstanding the intense thermal and electromagnetic loads during plasma disruptions, and (3) experiencing fluences of high-energy neutrons leading to property changes, embrittlement, and irradiation-induced creep, existing safety-related codes are largely inapplicable. The design of the divertor should meet the safety design criteria of this Standard and should employ a design and analysis methodology that is consistent with a recognized safety-related code. Design standards and practices for non-safety-class divertor components are not addressed in this document. b. Special considerations for divertors In addition to conventional materials and effects, special consideration of the following items, which are unique to the fusion divertor environment, must be included in the design and analysis of the divertor and in defining appropriate design practices and criteria: 1. Armor Tile Materials—Many of the armor tile material candidates considered for use in protecting the divertor target structure are brittle metals or nonmetals. The behavior of these materials and their influence on the structures to which they are attached must be considered in evaluating the integrity of the coolant confinement structure. 2. Erosion and Redeposition—Reduced or increased armor tile thickness due to erosion or redeposition of previously eroded material could have a significant effect on the thermal stresses in the coolant containment structure to which the armor tiles are attached. 3. Plasma Disruptions/VDEs—The transient dynamic mechanical and thermal effects during plasma disruptions/VDEs, which are extremely intense but of very short duration, must be considered in evaluating the integrity of the divertor structure and in defining appropriate structural design criteria. 137 DOE-STD-6003-96 4. Irradiation Effects—The effects of irradiation-induced hardening, loss of ductility, swelling, creep, and changes to other material properties must be considered in design and analysis of the divertor as well as in the formulation of structural design practices and criteria. c. Recommended design practice for divertors

To minimize the potential for and/or consequences of off-normal events, the following practices are recommended for divertor design: 1. minimization of coolant temperatures and pressures, 2. use of double-contained coolant wherever reasonable, 3. minimization of chemically reactive materials, 4. minimization of radioactive dust and tritium inventories through appropriate, 5. selection of plasma-facing materials. The items listed above serve only as guidance in the design process. Divertor designs which result from compromises between the above practices and overall performance of the fusion device are acceptable as long as they do not lead to a conflict of any of the safety design guidance presented in this document. Because of the effects of neutron irradiation, welding of structural materials in the divertor region should be avoided. If unavoidable, welds should be located in regions of low stress. Stress limits for irradiated weld material should receive special consideration in the structural design criteria. 138 DOE-STD-6003-96 7. SITE RESTORATION 7.1 General This section provides guidance for returning the site of a fusion facility to its original con- dition at the end of its useful life. The guidance includes recommendations for the initial design of the facility, the degree to which both radioactive and chemically hazardous materials must be removed from the facility before returning the facility or land to unrestricted public use, the limi- tations on the concentrations of radionuclides in the waste going to a low-level waste (LLW) repository, and the requirements for acceptance by the repository. In this section we assume that the fusion facility and the LLW repository are separate facilities and that the fusion facility will not serve as a long-term storage location for radioactive or hazardous wastes. However, if a repository does not yet exist at the time of fusion facility operation, we assume that the facility will provide short-term storage for wastes. 7.2 Decommissioning, Decontamination, and Site Restoration in the Initial Design The designers of a facility can greatly reduce the difficulty of site restoration by providing for the ultimate decommissioning of the facility in the initial design. The Department of Energy (DOE) General Design Criteria (DOE 1993) provides guidance for the demolition, decontamina- tion, and decommissioning of DOE facilities. Note particularly Sections 1300-11.1 Decontamina- tion, 1300-11.2 Decommissioning, 1326-9 Tritium Facilities, and 1328-9 Fusion Test Facilities. 10 CFR 50.75 (10 CFR 50) contains requirements for design, financial data, and recordkeeping in anticipation of the decommissioning of U.S. Nuclear Regulatory Commission (NRC) licensed facilities. A dedicated area furnished with appropriate equipment and utilities for decontamination of tools and as much equipment as practical should be considered for inclusion in the design of the facility. Tritium adsorbed on metal surfaces can be rapidly liberated when the metal is heated; water, detergents, and certain solvents are only moderately effective in removing tritium con- tamination. This property should be considered in the design of decontamination facilities. 7.3 Site Restoration The requirements for the condition of the fusion facility site after restoration can be divided into two categories: the requirements for the removal of radioactive materials and the requirements for the removal of chemically hazardous materials. Both sets of requirements identify the maximum amounts of hazardous materials that can remain in the facility if it is to be released for public use.

Decontamination of DOE facilities is addressed in DOE Order 5400.5, “Radiation Protec- tion of the Public and the Environment.” (DOE 1990) Table 7.1 shows the maximum contamina- tion levels of beta-gamma activity allowable if the facility is to be released for public use. Order 5400.5 also specifies allowable levels of thorium, uranium, and transuranic activities, which would not ordinarily be found in fusion facilities. The DOE Radiation Control Manual allows ten times the above values for tritium surface contamination (DOE/EH-0256T Rev. 1). 139 DOE-STD-6003-96 TABLE 7.1. Surface contamination guidelines Radionuclidesa Allowable total residual surface contaminationb (dpm/100 cm2) Averagec,d Maximumd,e Removabled,f Beta-gamma emitters (radionuclides with decay modes other than alpha emission) 5,000 15,000 1,000 aWhere surface contamination by both alpha- and beta-gamma-emitting radionuclides exists, the limits established for alpha- and beta-gamma-emitting radionuclides should apply independently. bAs used in this table, disintegrations per minute (dpm) means the rate of emission by radioactive material as determined by correcting the counts per minute measured by an appropriate detector for background, efficiency, and geometric factors associated with the instrumentation. cMeasurements of average contamination should not be averaged over an area of more than 1 m 2. For objects of less surface area, the average should be derived for each such object. dThe average and maximum dose rates associated with surface contamination resulting from beta-gamma emitters should not exceed 0.002 mGy/h and 0.01 mGy/h, respectively, at 1 cm. eThe maximum contamination applied to an area of not more than 100 cm2. f The amount of removable material per 100 cm2 of surface area should be determined by wiping an area of that size with dry filter or soft absorbent paper, applying moderate pressure, and measuring the amount of radioactive material on the wiping with an appropriate instrument of known efficiency. When removable contamination on objects of surface area less than 100 cm2 is determined, the activity per unit area should be based on the actual area and the entire surface should be wiped. It is not necessary to use wiping techniques to measure removable contamination levels if direct scan surveys indicate that the total residual surface contamination levels are within the limits for remov- able contamination. 7.4 Waste Sent to a Low-Level Waste Repository Waste considered for present low-level waste (LLW) repositories has been generated primarily in fission reactors, through nuclear medicine, or through the use of accelerators. The isotopes considered to date are not typical of those expected in fusion facilities. Therefore, it is important that the basic methods and limits used for present LLW be extended to the broader spectrum of isotopes expected in fusion-generated waste. 7.4.1 Requirements for Land Disposal of Radioactive Waste 10 CFR 61 was issued in final form in 1982 primarily to deal with the burial within 30 m of the surface of LLW produced in fission power plants, medical diagnosis and treatment, and tracers used in research [10 CFR 61.7(a)(1)]. The regulation explicitly does not deal with high- level radioactive waste, transuranic waste, or spent nuclear fuel. LLW is divided into three classes, for which packaging requirements and radioisotope concentration limits are specified.

The guiding philosophy behind 10 CFR 61 is that no member of the public, including an inadvertent intruder, should be exposed to an unacceptable risk due to accidental exposure to radioactive waste. Annual dose limits of 0.25 mSv (25 mrem) to the whole body, 0.75 mSv 140 DOE-STD-6003-96 (75 mrem) to the thyroid, and 0.25 mSv (25 mrem) to any other organ of the body (10 CFR 61.41) were used to establish radionuclide concentration limits based on several exposure scenarios (NRC 1981 and NRC 1982). The intruder construction scenario produced the highest dose to individuals. This scenario begins with the construction of a house on the waste disposal site after the period of institutional control, assumed to be 100 yr. Construction workers are exposed to direct gamma radiation from the waste and inhale waste particles while digging the foundation. If the waste is still recognizable as being radioactive, construction is assumed to stop after 6 h. Class C waste is assumed to be stable for 500 yr. If the waste is not recognizable as being radioactive, construction is assumed to continue for 500 h. The completed house is occupied, and the inhabitants inhale suspended waste parti- cles and are exposed to direct gamma radiation from the waste. In addition, they are assumed to grow one-half of all their food on the waste site. The inhabitants there ingest radionuclides deposited on the leaves of plants and absorbed through their roots, either directly in the case of vegetables or indirectly through the meat and milk of cows in the case of grass. 10 CFR 61 lim- its the specific activity of radionuclides so that the 50-yr whole-body dose commitment (“intruder dose”) to workers from construction or the 50-yr dose commitment to inhabitants from exposure during the first year does not exceed 5 mSv (0.5 rem), which is currently the maximum permis- sible annual dose for members of the public. 7.4.1.1 Classification of LLW for Near-Surface Disposal Determination of the classification of radioactive waste involves two considerations. First, consideration must be given to the concentration of long-lived radionuclides (and their shorter- lived precursors) whose potential hazard will persist long after such precautions as institutional controls, improved waste form, and deeper disposal have ceased to be effective. These precautions delay the time when long-lived radionuclides could cause exposures. In addition, the magnitude of the potential dose is limited by the concentration and availability of the radionuclide at the time of exposure. Second, consideration must be given to the concentra- tion of shorter-lived radionuclides for which requirements on institutional controls, waste form, and disposal methods are effective. 7.4.1.2 Classes of Waste Class A waste is waste that is usually segregated from other waste classes at the dis- posal site. The physical form and characteristics of Class A waste must meet the minimum requirements set forth in 10 CFR 61.56(a). If Class A waste also meets the stability require- ments set forth in 10 CFR 61.56(b), it is not necessary to segregate the waste for disposal. Class B waste is waste that must meet more rigorous requirements on waste form to ensure stability after disposal. The physical form and characteristics of Class B waste must meet both the minimum and stability requirements set forth in 10 CFR 61.56. Class C waste is waste that not only must meet more rigorous requirements on waste form to ensure stability but also requires additional measures at the disposal facility to protect

141 DOE-STD-6003-96 against inadvertent intrusion. The physical form and characteristics of Class C waste must meet both the minimum and stability requirements set forth in 10 CFR 61.56. Waste that is not generally acceptable for near-surface disposal is waste for which form and disposal methods must be different, and in general more stringent, than those specified for Class C waste. In the absence of specific requirements in 10 CFR 61, such “greater than Class C” waste must be disposed of in a geologic repository as defined in 10 CFR 60 unless proposals for disposal of “greater than Class C” waste in a near-surface disposal site are licensed by the NRC. Licensing criteria for disposal of “greater than Class C” waste are currently under development. a. Classification determined by long-lived radionuclides—If radioactive waste contains only radionuclides listed in Table 7.2, classification shall be determined as follows: TABLE 7.2. Classification boundaries as given in 10 CFR 61 Radionuclide Concentration (Ci/m3, unless stated otherwise) C-14 8 C-14 in activated metal 80 Ni-59 in activated metal 220 Nb-94 in activated metal 0.2 Tc-99 3 I-129 0.08 Alpha-emitting transuranic nuclides with half-life >5 yr 100 nCi/g Pu-241 3,500 nCi/g Cm-242 20,000 nCi/g If the concentration does not exceed 0.1 times the value in Table 7.2, the waste is Class A. If the concentration exceeds 0.1 times the value in Table 7.2 but does not exceed the value in Table 7.2, the waste is Class C. If the concentration exceeds the value in Table 7.2, the waste is not generally acceptable for near-surface disposal. For wastes containing mixtures of radionuclides listed in Table 7.2, the total concentration shall be determined by the sum-of- fractions rule. b. Classification determined by short-lived radionuclides. If radioactive waste does not contain any of the radionuclides listed in Table 7.2, classifi- cation shall be determined based on the concentrations shown in Table 7.3. However, if radio- active waste does not contain any nuclides listed in either Table 7.2 or 7.3, it is Class A. 142 DOE-STD-6003-96 TABLE 7.3. Classification based on long-lived radionuclides Concentration (Ci/m3) Radionuclide Column 1 Column 2 Column 3 Total of all nuclides with <5 yr half-life 700 a a H-3 40 a a Co-60 700 a a Ni-63 3.5 70 700 Ni-63 in activated metal 35 700 7000 Sr-90 0.04 150 7000 Cs-137 1 44 4600 aThere are no limits established for these radionuclides in Class B or C wastes. Practical con- siderations such as the effects of external radiation and internal heat generation on trans- portation, handling, and disposal will limit the concentration for these wastes. These wastes will be Class B unless the concentrations of other nuclides in Table 7.3 determine the waste to be Class C independent of these nuclides. If the concentration does not exceed the value in Column 1, the waste is Class A. If the concentration exceeds the value in Column 1, but does not exceed the value in Column 2, the waste is Class B. If the concentration exceeds the value in Column 2, but does not exceed the value in Column 3, the waste is Class C. If the concentration exceeds the value in Column 3, the waste is not generally acceptable for near-surface disposal. Again, the limits for mixtures of nuclides are listed in Table 7.3; the total concentration shall be determined by the sum-of-fractions rule.

No limits are specifically given for heat generation with a waste package, aside from the requirement that the package must be shown to be capable of removing the decay heat. 7.4.2 Methodology of 10 CFR 61 Extended to Fusion-Specific Isotopes 10 CFR 61 gives specific activity limits for only a dozen radionuclides, many of which are fission products or transuranics and thus of little relevance in fusion materials selection. Fetter et al. have used the NRC’s intruder scenario to calculate Class C limits for other long-lived radionuclides (Fetter 1988). The specific activity limits in Table 7.4 are those for Class C waste that is activated metal. The limits in Table 7.4 should be compared with those in column 3 of Table 7.3. Differences between Tables 7.3 and 7.4 result from (a) the fact that the waste is assumed to be an activated metal and (b) corrections made to the dose conversion factors made by Fetter et al. Footnotes to the table indicate specific activity limits derived by other authors. 143 DOE-STD-6003-96 TABLE 7.4. Specific activity limits for shallow land burial of all radionuclides with Z < 88 and half-lives >5 yr and <1012 yra,b Radionuclide Half-life Specific activity limit (Ci/m3) Other values H-3 12.3 yr TMSAc TMSAd Be-10 1.6 Myc 3,000 7,000e, 3f C-14 5.7 kyc 700–7,000 80d Al-26 720 ky 0.09 0.1g Si-32 104 yr 900–4,000 600e, 30f Cl-36 301 ky 10–100 3f Ar-39 269 yr 10,000 2,000f Ar-42 33 yr 20,000 0.8g, 7,000f K-40 1.3 Gyc 1.5 Ca-41 103 ky 8,000–20,000 3f Ti-44 47 yr 200 0.60g, 300f Mn-53 3.7 My TMSA 600e, 30f Fe-60 100 ky 0.1 0.01g, 0.1f Co-60 5.3 yr 3 × 108 TMSAd Ni-59 75 ky 900 220d Ni-63 100 yr 1 × 106 to 1 × 107 7,000d Se-79 65 ky 100–1,000 3f Kr-81 210 ky 30 300f Kr-85 10.7 yr TMSA Rb-87 48 Gy TMSA Sr-90 28.5 yr 1 × 106 to 9 × 106 70,000b,d Zr-93 1.5 My 2,000 200e, 10f Nb-91 680 yr 200 Nb-92 36 My 0.2 0.3e Nb-93m 13.6 yr TMSA Nb-94 20 ky 0.2 0.2d Mo-93 3.5 ky 300 30e, 30f Tc-97 2.6 My 1–10 Tc-98 4.2 My 0.03–0.1 0.02g Tc-99 213 ky 0.2–2 30b,d Pd-107 6.5 My TMSA Ag-108m 127 yr 3 3g, 3f Cd-113m 13.7 yr TMSA Sn-121m 55 yr 100,000 3,000f Sb-126 100 ky 0.1 0.01g I-129 15.7 My 30 0.8b,d Cs-135 3.0 My TMSA 3f Cs-137 30.0 yr 50,000 46,000b,d 144 DOE-STD-6003-96 TABLE 7.4. Specific activity limits for shallow land burial of all radionuclides with Z < 88 and half-lives >5 yr and <1012 yra,b (Continued) Ba-133 10.5 yr 2 × 108 55g La-137 60 ky 30 La-138 106 Gy TMSA Pm-145 17.7 yr TMSA Pm-146 5.5 yr TMSA Sm-146 103 My TMSA Sm-147 106 Gy TMSA Sm-151 90 yr TMSA 3,000f Eu-150m 36 yr 3,000 3,000f Eu-152 13.3 yr 300,000 Eu-154 8.8 yr 5 × 106 Gd-148 98 yr 7 × 105 to 7 × 106 Gd-150 1.8 My TMSA Tb-157 150 yr 1,000 Tb-158 150 yr 4 5f Dy-154 10 My TMSA Ho-166m 1.2 ky 0.2 0.2f Lu-176 35.9 Gy TMSA Hf-178m2 31 yr 9,000 0.25g, 3,000f Hf-182 9 My 0.2 0.02g Re-186m 200 ky 9.0 10f Re-187 40 Gy TMSA Os-194 6.0 yr TMSA Ir-192m2 241 yr 2 1f Pt-190 600 Gy TMSA Pt-193 50 yr 9.E+6 Hg-194 520 yr 0.5 Pb-202 53 ky 0.6 0.07g Pb-205 19 My TMSA 5e, 3f Pb-210 22.3 yr 9 × 106 to 8 × 107 Bi-207 32.2 yr 8,000 17,000g Bi-208 368 ky 0.09 0.1g, 0.1f Bi-210m 3.0 My 1 2g, 0.5f Po-209 102 yr 3,000 aSpecific activity limit depends on waste form indices; values shown are for nonfuel reactor components and high-activity industrial waste. bThe 10 CFR 61 specific activity limits for Sr-90, Tc-99, I-129, and Cs-137 are multiplied by a factor of ten because they are assumed to be contained in activated metal.

cTMSA = Theoretical Maximum Specific Activity: ky = 1000 years; My = 1,000,000 years; Gy = 10 9 years. Other values: d10 CFR 61.55, 61.56; ePonti 1986; fManinger 1985; gKennedy 1983. 145 DOE-STD-6003-96 7.4.3 Chemically Hazardous Materials Sent to a Hazardous Waste Site The ultimate disposal of components from the fusion facility will be in accordance with state and federal permits. State and local laws will naturally depend on location of the facility. Among the federal laws governing the disposal of hazardous materials are those listed in Sections 7.4.3.1–7.4.3.6. 7.4.3.1 Clean Air Act The Clean Air Act (CAA) established national goals for air quality to protect public health and welfare, and it required the use of quality standards and criteria for the control of pollutants in the environment. The approach of the CAA is to determine the relationships between public health and welfare and air quality, while restoring, maintaining, and improving the quality of the environment. The Clean Air Regulations are listed in 40 CFR Parts 50, 53. 56, 58, 60–62, 65– 67, 69, and 81. 7.4.3.2 Clean Water Act The goal of the Clean Water Act is to restore, maintain, and enhance the chemical, physi- cal, and biological integrity of the nation's water. To accomplish this goal, regulations were set forth establishing stream water quality and effluent limitations. Particular importance is placed on the control of effluents containing hazardous pollutants. Regulations concerning the discharge of radioactive and hazardous materials are set forth in 40 CFR Parts 116 and 141–143. 7.4.3.3 Safe Drinking Water Act The Safe Drinking Water Act regulates the quality of drinking water with provisions aimed at protecting the quality of groundwater. 40 CFR 141 and 142 establish the National Primary Drinking Water Regulations and the enforcement responsibilities for these regulations. 40 CFR 143 establishes the National Secondary Drinking Water Regulations, and Part 144 sets forth the requirements for an Underground Injection Control Program. 7.4.3.4 Resource Conservation and Recovery Act The Resource Conservation and Recovery Act (RCRA) regulations define hazardous wastes and regulate their transport, treatment, storage, and disposal. RCRA defines all haz- ardous wastes as solid waste; this includes all types of hazardous wastes, whether they are solid, semisolid, liquid or even gaseous (so long as they are in containers). 40 CFR 262 details standards for generators of hazardous waste. These requirements include obtaining an Environmental Protection Agency identification number, meeting waste accumulation standards, labeling wastes, and keeping appropriate records. 40 CFR 262.34a allows generators to store wastes for up to 90 days without a permit and without gaining interim status as a treatment, storage, and disposal facility, provided specific conditions are met. 146 DOE-STD-6003-96 40 CFR 262.34(b)–(f) provides specific allowances for a generator to store waste on-site for greater than 90 days without a permit under certain limited circumstances. Otherwise, if treat- ment residues are stored on site for 90 days or more, 40 CFR 265 requirements apply. Any facility (on-site or off-site) designated for permanent disposal of hazardous wastes must be in compliance with RCRA. Disposal facilities must fulfill permitting, storage, maintenance, and closure requirements contained in 40 CFR Parts 264–270. 40 CFR 264 Subparts F and S, include requirements for corrective action for RCRA-regulated facilities. If treatment residues are disposed of off-site, 40 CFR 263 transportation standards apply.

7.4.3.5 Comprehensive Environmental Response, Compensation, and Liability Act The Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA) was enacted in response to the concern for the dangers of negligent hazardous waste disposal practices in the past. This Act could apply to new facilities at the time of facility shutdown if other regulations were violated which caused environmental damage or a threat to public health. 7.4.3.6 Superfund Amendment and Reauthorization Act of 1986 The Superfund Amendment and Reauthorization Act (SARA) deals primarily with the reporting requirements for organizations handling hazardous materials. 7.4.4 Mixed Waste Requirements Various mixed (i.e., both chemically hazardous and radioactive) waste streams will be produced by fusion facilities. These could include beryllium contaminated with tritium, activated tungsten-rhenium mixtures, and dust produced on the first wall of the vacuum chamber. The requirements for the disposal are now being formulated and will be included in this Standard when developed. 7.5 Requirements on Low-Level Waste Repository The requirements for the LLW Repository itself are given in 10 CFR 61. The design of the repository is outside the scope of this Standard. 147 DOE-STD-6003-96 Intentionally Left Blank 148 DOE-STD-6003-96 APPENDIX A CATEGORY 2 THRESHOLD QUANTITIES OF RADIONUCLIDES Following is a list of radionuclides and their associated Category 2 threshold quantities as defined in DOE 1992. This list was taken from RSAC-5f, a modified version of the Radiological Safety Analysis Computer Program (Wenzel 1993). The RSAC-5 program was modified to cal- culate doses for airborne releases of International Thermonuclear Experimental Reactor (ITER) activation products (Abbott and Wenzel 1994). RSAC-5f used external dose conversion factors from DOE 1988a and internal dose conversion factors from DOE 1988b. Some internal dose conversion factors were taken from Fetter 1988 and 1991 for those radionuclides not covered in DOE 1988b. These threshold quantities were calculated in accordance with guidance in Attachment 1 of DOE 1992. Specifically, the following equation, taken from page A-6 of DOE 1992, was used: Q = (1 rem)/[RF*SA*χ/Q*(CEDE*RR + CSDE)] , where Q = quantity of material used as threshold (grams) RF = Airborne release fraction of material averaged over an entire facility (unitless) SA = Specific activity of radionuclide released (Ci/gm) χ/Q = Expression accounting for dilution of release at a point under given meteorologi- cal conditions (Specific Concentration) (sec/m3) CEDE = Committed effective dose equivalent for a given radionuclide (inhalation)(rem/Ci). Note: The CEDE for tritium (H-3) includes a 50% addi- tion for direct skin absorption in addition to the inhalation pathway. RR = Respiration rate, which is assumed equal to the standard value used for an active man (3.5E-4 m3/sec) CSDE = Cloud shine (immersion) dose equivalent (rem*m3/Ci*sec) A χ/Q of E-4 was used as indicated in Attachment 1 to DOE 1992. 149 DOE-STD-6003-96 Release fractions (RFs) were also taken from Attachment 1 and are given in the table below. Physical form RF Gases (tritium, krypton, etc.) 1.0 Highly volatile (phosphorus, halides, 0.5 potassium, sodium, etc.) Semivolatile (selenium, mercury, etc.) 10–2 Solid/powder/liquid 10–3

When a comparison was made between the quantities listed here and corresponding val- ues in DOE 1992, some significant differences were noted. An investigation revealed that the calculations supporting DOE 1992 appear to have used the highest dose conversion factors to be found in DOE 1988b, whereas the calculations performed for this study used dose conver- sion factors (also from DOE 1988b) corresponding to the oxide forms of the radionuclides, the form expected to be found associated with fusion reactor materials. As a consequence of this difference in approach, the DOE 1992 threshold quantities are sometimes orders of magnitude less than those listed in this letter. Radionuclides showing significant differences for this reason were 32P, 33P, 35S, 36Cl, 44Ti, 55Fe, 59Fe, 63Ni, 89Sr, 90Sr, 93Zr, 95Zr, 109Cd, 113Cd, 114MIn, 153Gd, 198Au, 203Hg, 227Ac, 230Th, 232Th, 238Pu, 239Pu, and 241Pu. As a check, the dose conversion factors used in this study were compared with corre- sponding factors found in Fetter 1988 and 1991. Fetter’s calculated dose conversion factors were intended to apply specifically to fusion reactor materials. The comparison showed general agreement with the dose conversion factors used here. It should also be noted that the DOE 1992 calculations for 36Cl used an RF of 1.0, while an RF of 0.5 was used for this study to be consistent with the other halides. An order of magni- tude difference in the threshold quantity for 75Se is due to the evident use in DOE 1992 of an RF of 0.001, while this study used an RF of 0.01 to be consistent with the instructions in Attachment 1 of DOE 1992. There are also differences in some of the threshold quantities given in grams. These dif- ferences can be traced to the use in DOE 1992 of values for specific activity (SA) that are 2 and 3 orders of magnitude higher than the values used here. The use of these SA values when cal- culating threshold values in DOE 1992 appear to be due to error. The SA values used here were found to agree with values given in Shleien 1992. The discrepancy in the values for 52Mn is inexplicable. That was the only case in which the value in DOE 1992 was significantly higher than the corresponding value calculated here, and a reason could not be found for the difference. In summary, the threshold quantities given in the Table A.1 are believed to apply accu- rately to radioactive materials generated in fusion facilities. Until Category 3 threshold limits are 150 DOE-STD-6003-96 established for magnetic fusion facilities, the HC-3 threshold limits provided in DOE-STD 1027- 92 should be used for HC-3 classification if the isotopes in question have threshold limit values in 1027. If the isotopes are not listed in 1027, calculate the threshold limits using the methodol- ogy contained in this Standard. TABLE A.1. Thresholds for radionuclides Category 2 Threshold quantities Fusion values DOE 1027 Nuclide Half-life T (days) Q (grams) Q (TBq) Q (Ci) Q (TBq) Q (Ci) Release fractions

H 3 4.49E+03 3.09E+01 1.12E+04 3.03E+05 1.11E+04 3.00E+05 1.00E+00 Be 7 5.34E+01 2.77E+02 3.61E+06 9.76E+07 1.00E–03 Be 10 5.84E+08 3.61E+06 3.02E+03 8.16E+04 1.00E–03 C 11 1.42E–02 7.28E–03 2.29E+05 6.19E+06 1.00E–02 C 14 2.09E+06 3.02E+05 5.03E+04 1.36E+06 5.18E+04 1.40E+06 1.00E–02 N 13 6.92E–03 4.21E–05 2.29E+03 6.19E+04 1.00E+00 N 16 8.25E–05 1.14E–07 4.21E+02 1.14E+04 1.00E+00 O 15 1.41E–03 9.94E–06 2.29E+03 6.19E+04 1.00E+00 F 18 7.63E–02 1.15E–03 4.08E+03 1.10E+05 5.00E–01 Na 22 9.50E+02 1.00E+00 2.35E+02 6.35E+03 2.33E+02 6.30E+03 5.00E–01 Na 24 6.25E–01 2.09E–03 6.80E+02 1.84E+04 5.00E–01 Mg 27 6.57E–03 8.53E–02 2.35E+06 6.35E+07 1.00E–03 Mg 28 8.75E–01 1.15E+00 2.29E+05 6.19E+06 1.00E–03 Al 26 2.61E+08 2.44E+07 1.75E+04 4.73E+05 1.00E–03 Al 28 1.56E–03 1.04E–02 1.17E+06 3.16E+07 1.00E–03 Si 31 1.09E–01 4.57E+00 6.59E+06 1.78E+08 1.00E–03 Si 32 6.28E+04 9.88E+03 2.40E+04 6.49E+05 1.00E–03 P 32 1.43E+01 3.60E–02 3.84E+02 1.04E+04 1.63E+00 4.41E+01 5.00E–01 P 33 2.54E+01 5.95E–01 3.47E+03 9.38E+04 1.11E+03 3.00E+04 5.00E–01 S 35 8.74E+01 4.57E+00 7.29E+03 1.97E+05 9.25E+02 2.50E+04 5.00E–01 S 37 3.51E–03 3.25E–03 1.22E+05 3.30E+06 5.00E–01 Cl 36 1.10E+08 8.16E+05 1.01E+03 2.73E+04 5.18E+01 1.40E+03 5.00E–01 Cl 38 2.58E–02 4.75E–04 2.36E+03 6.38E+04 5.00E–01 Cl 39 3.86E–02 6.72E–03 2.18E+04 5.89E+05 5.00E–01 Cl 40 9.38E–04 1.59E–03 2.07E+05 5.59E+06 5.00E–01 Ar 37 3.50E+01 4.57E+05 1.72E+09 4.65E+10 1.00E+00 Ar 41 7.61E–02 1.13E–03 1.77E+03 4.78E+04 1.00E+00 K 40 4.66E+11 6.69E+08 1.75E+02 4.73E+03 1.74E+02 4.70E+03 5.00E–01 K 42 5.15E–01 7.61E–03 1.72E+03 4.65E+04 5.00E–01 K 43 9.42E–01 1.75E–02 2.10E+03 5.68E+04 5.00E–01 Ca 41 3.76E+07 2.57E+08 8.13E+05 2.20E+07 1.00E–03 Ca 45 1.63E+02 2.60E+02 1.73E+05 4.68E+06 1.74E+05 4.70E+06 1.00E–03 Ca 47 4.54E+00 7.70E+00 1.76E+05 4.76E+06 1.78E+05 4.81E+06 1.00E–03 151 DOE-STD-6003-96 Ca 49 6.05E–03 3.67E–02 6.04E+05 1.63E+07 1.00E–03 Sc 44 1.64E–01 1.11E+00 7.50E+05 2.03E+07 1.00E–03 Sc 44m 2.44E+00 3.28E+00 1.49E+05 4.03E+06 1.00E–03 Sc 46 8.38E+01 3.98E+01 5.05E+04 1.36E+06 5.18E+04 1.40E+06 1.00E–03 Sc 47 3.42E+00 1.99E+01 6.04E+05 1.63E+07 1.00E–03 Sc 48 1.83E+00 3.66E+00 2.04E+05 5.51E+06 1.00E–03 Sc 49 3.99E–02 4.52E+00 1.13E+07 3.05E+08 1.00E–03 Sc 50 1.19E–03 9.88E–01 8.13E+07 2.20E+09 1.00E–03 Ti 44 1.73E+04 9.67E+02 6.22E+03 1.68E+05 1.18E+03 3.19E+04 1.00E–03 Ti 45 1.28E–01 2.29E+00 1.94E+06 5.24E+07 1.00E–03 Ti 51 4.00E–03 2.34E–01 5.61E+06 1.52E+08 1.00E–03 V 48 1.60E+01 1.77E+01 1.13E+05 3.05E+06 1.11E+05 3.00E+06 1.00E–03 V 49 3.37E+02 1.28E+04 3.78E+06 1.02E+08 1.00E–03 V 52 2.60E–03 4.23E–02 1.53E+06 4.14E+07 1.00E–03 V 53 1.12E–03 1.82E+00 1.50E+08 4.05E+09 1.00E–03 Cr 49 2.92E–02 5.87E–01 2.00E+06 5.41E+07 1.00E–03 Cr 51 2.77E+01 1.11E+03 3.85E+06 1.04E+08 3.70E+06 1.00E+08 1.00E–03 Mn 52 5.59E+00 8.71E+00 1.46E+05 3.95E+06 6.66E+05 1.80E+07 1.00E–03 Mn 52m 1.47E–02 1.42E–01 9.08E+05 2.45E+07 1.00E–03 Mn 53 1.35E+09 3.60E+10 2.46E+06 6.65E+07 1.00E–03 Mn 54 3.13E+02 5.38E+02 1.56E+05 4.22E+06 1.00E–03 Mn 56 1.08E–01 1.21E+00 9.78E+05 2.64E+07 1.00E–03 Mn 57 1.01E–03 3.12E–01 2.66E+07 7.19E+08 1.00E–03 Fe 52 3.45E–01 1.66E+00 4.52E+05 1.22E+07 1.00E–03 Fe 55 9.96E+02 9.88E+03 8.81E+05 2.38E+07 4.07E+05 1.10E+07 1.00E–03 Fe 59 4.46E+01 5.45E+01 1.01E+05 2.73E+06 6.66E+04 1.80E+06 1.00E–03 Fe 60 5.48E+08 2.64E+07 3.92E+03 1.06E+05 1.00E–03 Co 56 7.73E+01 3.37E+01 3.80E+04 1.03E+06 1.00E–03 Co 57 2.71E+02 4.42E+02 1.40E+05 3.78E+06 1.00E–03 Co 58 7.08E+01 1.18E+02 1.40E+05 3.78E+06 1.00E–03 Co 58m 3.81E–01 6.38E+01 1.41E+07 3.81E+08 1.00E–03 Co 60 1.92E+03 1.65E+02 6.99E+03 1.89E+05 7.03E+03 1.90E+05 1.00E–03 Co 60m 7.27E–03 2.42E+01 2.71E+08 7.32E+09 1.00E–03 Co 61 6.88E–02 7.06E+00 8.22E+06 2.22E+08 1.00E–03 Co 62m 9.66E–03 4.05E+00 3.30E+07 8.92E+08 1.00E–03 Ni 56 6.10E+00 1.61E+01 2.29E+05 6.19E+06 1.00E–03 Ni 57 1.48E+00 7.00E+00 4.05E+05 1.09E+07 1.00E–03 Ni 59 2.77E+07 5.05E+08 1.51E+06 4.08E+07 1.00E–03 Ni 63 3.65E+04 2.62E+05 5.56E+05 1.50E+07 1.67E+05 4.51E+06 1.00E–03 Ni 65 1.05E–01 3.45E+00 2.47E+06 6.68E+07 1.00E–03 Cu 61 1.40E–01 3.59E+00 2.05E+06 5.54E+07 1.00E–03 Cu 62 6.76E–03 1.77E–01 2.06E+06 5.57E+07 1.00E–03 Cu 64 5.29E–01 2.32E+01 3.35E+06 9.05E+07 1.00E–03 Cu 66 3.54E–03 2.38E+00 4.96E+07 1.34E+09 1.00E–03 Cu 67 2.58E+00 3.24E+01 9.17E+05 2.48E+07 1.00E–03 Zn 62 3.84E–01 2.57E+00 5.27E+05 1.42E+07 1.00E–03

152 DOE-STD-6003-96 Zn 63 2.67E–02 5.13E+00 1.49E+07 4.03E+08 1.00E–03 Zn 65 2.44E+02 1.88E+02 5.79E+04 1.56E+06 5.92E+04 1.60E+06 1.00E–03 Zn 69 3.89E–02 1.61E+01 2.94E+07 7.95E+08 1.00E–03 Zn 69m 5.73E–01 9.75E+00 1.20E+06 3.24E+07 1.00E–03 Zn 71m 1.65E–01 8.45E+00 3.52E+06 9.51E+07 1.00E–03 Zn 72 1.94E+00 7.19E+00 2.52E+05 6.81E+06 1.00E–03 Ga 66 3.96E–01 4.46E+00 8.32E+05 2.25E+07 1.00E–03 Ga 67 3.26E+00 8.65E+01 1.93E+06 5.22E+07 1.00E–03 Ga 68 4.71E–02 1.32E+00 2.01E+06 5.43E+07 1.00E–03 Ga 70 1.47E–02 8.90E+00 4.23E+07 1.14E+09 1.00E–03 Ga 72 5.88E–01 2.99E+00 3.45E+05 9.32E+06 1.00E–03 Ga 73 2.03E–01 9.73E+00 3.20E+06 8.65E+07 1.00E–03 Ge 68 2.71E+02 8.13E+01 2.16E+04 5.84E+05 2.15E+04 5.81E+05 1.00E–03 Ge 69 1.63E+00 3.92E+01 1.71E+06 4.62E+07 1.00E–03 Ge 71 1.14E+01 1.46E+03 8.81E+06 2.38E+08 1.00E–03 Ge 75 5.75E–02 1.51E+01 1.71E+07 4.62E+08 1.00E–03 Ge 77 4.71E–01 5.66E+00 7.63E+05 2.06E+07 1.00E–03 Ge 78 6.04E–02 4.25E+00 4.40E+06 1.19E+08 1.00E–03 As 72 1.08E+00 3.90E+00 2.44E+05 6.59E+06 1.00E–03 As 73 8.03E+01 4.09E+02 3.41E+05 9.22E+06 1.00E–03 As 74 1.78E+01 4.15E+01 1.54E+05 4.16E+06 1.00E–03 As 76 1.10E+00 5.01E+00 2.94E+05 7.95E+06 1.00E–03 As 77 1.62E+00 2.71E+01 1.06E+06 2.86E+07 1.00E–03 As 78 6.29E–02 4.62E+00 4.60E+06 1.24E+08 1.00E–03 Se 73 2.96E–01 5.75E–01 1.30E+05 3.51E+06 1.00E–02 Se 75 1.20E+02 2.32E+01 1.26E+04 3.41E+05 1.26E+05 3.41E+06 1.00E–02 Se 79 2.37E+07 4.56E+06 1.19E+04 3.22E+05 1.00E–02 Se 81 1.28E–02 1.07E+00 5.03E+06 1.36E+08 1.00E–02 Se 81m 3.98E–02 9.83E–01 1.49E+06 4.03E+07 1.00E–02 Se 83 1.55E–02 6.96E–01 2.64E+06 7.14E+07 1.00E–02 Br 77 2.38E+00 2.24E–01 5.97E+03 1.61E+05 5.00E–01 Br 80 1.23E–02 6.95E–03 3.45E+04 9.32E+05 5.00E–01 Br 80m 1.84E–01 2.25E–02 7.46E+03 2.02E+05 5.00E–01 Br 82 1.47E+00 2.15E–02 8.69E+02 2.35E+04 5.00E–01 Br 83 1.00E–01 4.53E–02 2.66E+04 7.19E+05 5.00E–01 Br 84 2.21E–02 7.93E–04 2.09E+03 5.65E+04 5.00E–01 Br 85 1.99E–03 2.33E–03 6.74E+04 1.82E+06 5.00E–01 Kr 79 1.46E+00 2.17E–01 9.18E+03 2.48E+05 1.00E+00 Kr 81 7.67E+07 2.91E+08 2.29E+05 6.19E+06 1.00E+00 Kr 83m 7.75E–02 3.27E+01 2.49E+07 6.73E+08 1.00E+00 Kr 85 3.92E+03 7.10E+04 1.04E+06 2.81E+07 1.04E+06 2.81E+07 1.00E+00 Kr 85m 1.87E–01 4.66E–02 1.44E+04 3.89E+05 1.00E+00 Kr 87 5.30E–02 2.47E–03 2.62E+03 7.08E+04 1.00E+00 Kr 88 1.18E–01 2.20E–03 1.03E+03 2.78E+04 1.00E+00 Kr 89 2.19E–03 4.61E–05 1.15E+03 3.11E+04 1.00E+00 Kr 90 3.77E–04 1.22E–05 1.76E+03 4.76E+04 1.00E+00 153 DOE-STD-6003-96

Rb 81 1.90E–01 8.84E+00 2.81E+06 7.59E+07 1.00E–03 Rb 82 8.74E–04 3.12E–02 2.12E+06 5.73E+07 1.00E–03 Rb 83 8.62E+01 3.02E+02 2.06E+05 5.57E+06 1.00E–03 Rb 84 3.29E+01 8.64E+01 1.53E+05 4.14E+06 1.00E–03 Rb 86 1.87E+01 5.23E+01 1.59E+05 4.30E+06 1.00E–03 Rb 87 1.75E+13 9.99E+13 3.20E+05 8.65E+06 1.00E–03 Rb 88 1.23E–02 5.80E–01 2.62E+06 7.08E+07 1.00E–03 Rb 89 1.07E–02 1.94E–01 9.95E+05 2.69E+07 1.00E–03 Rb 90 1.81E–03 3.04E–02 9.11E+05 2.46E+07 1.00E–03 Rb 90m 2.99E–03 3.47E–02 6.30E+05 1.70E+07 1.00E–03 Sr 82 2.54E+01 2.92E+06 6.86E+09 1.85E+11 1.00E–03 Sr 85 6.48E+01 5.60E+02 4.96E+05 1.34E+07 1.00E–03 Sr 85m 4.70E–02 8.08E+00 9.87E+06 2.67E+08 1.00E–03 Sr 87m 1.17E–01 1.21E+01 5.80E+06 1.57E+08 1.00E–03 Sr 89 5.05E+01 1.65E+02 1.79E+05 4.84E+06 2.85E+04 7.70E+05 1.00E–03 Sr 90 1.06E+04 9.00E+02 4.60E+03 1.24E+05 8.14E+02 2.20E+04 1.00E–03 Sr 91 3.96E–01 6.70E+00 9.08E+05 2.45E+07 1.00E–03 Sr 92 1.13E–01 1.93E+00 9.07E+05 2.45E+07 1.00E–03 Sr 93 5.14E–03 9.59E–02 9.79E+05 2.65E+07 1.00E–03 Y 86 6.14E–01 3.44E+00 3.18E+05 8.59E+06 1.00E–03 Y 87 3.35E+00 3.49E+01 5.85E+05 1.58E+07 1.00E–03 Y 88 1.07E+02 9.09E+01 4.73E+04 1.28E+06 1.00E–03 Y 90 2.67E+00 6.35E+00 1.29E+05 3.49E+06 1.00E–03 Y 90m 1.33E–01 3.55E+00 1.45E+06 3.92E+07 1.00E–03 Y 91 5.85E+01 2.62E+01 2.40E+04 6.49E+05 2.41E+04 6.51E+05 1.00E–03 Y 91m 3.45E–02 2.49E+00 3.87E+06 1.05E+08 1.00E–03 Y 92 1.48E–01 3.98E+00 1.43E+06 3.86E+07 1.00E–03 Y 93 4.25E–01 3.99E+00 4.93E+05 1.33E+07 1.00E–03 Y 94 1.30E–02 3.95E+00 1.58E+07 4.27E+08 1.00E–03 Y 95 7.15E–03 4.08E+00 2.94E+07 7.95E+08 1.00E–03 Zr 86 6.88E–01 6.32E+00 5.22E+05 1.41E+07 1.00E–03 Zr 88 8.34E+01 1.56E+02 1.04E+05 2.81E+06 1.00E–03 Zr 89 3.27E+00 2.48E+01 4.16E+05 1.12E+07 1.00E–03 Zr 93 5.48E+08 1.36E+08 1.31E+04 3.54E+05 3.29E+03 8.89E+04 1.00E–03 Zr 95 6.40E+01 9.86E+01 7.92E+04 2.14E+06 5.55E+04 1.50E+06 1.00E–03 Zr 97 7.00E–01 3.99E+00 2.87E+05 7.76E+06 1.00E–03 Nb 90 6.08E–01 2.81E+00 2.51E+05 6.78E+06 1.00E–03 Nb 92m 1.01E+01 7.62E+01 3.99E+05 1.08E+07 1.00E–03 Nb 93m 5.88E+03 4.23E+03 3.78E+04 1.02E+06 1.00E–03 Nb 94 7.30E+06 4.49E+05 3.20E+03 8.65E+04 3.18E+03 8.59E+04 1.00E–03 Nb 94m 4.35E–03 2.57E+01 3.07E+08 8.30E+09 1.00E–03 Nb 95 3.50E+01 1.48E+02 2.18E+05 5.89E+06 1.00E–03 Nb 95m 3.61E+00 3.33E+01 4.75E+05 1.28E+07 1.00E–03 Nb 96 9.75E–01 6.43E+00 3.35E+05 9.05E+06 1.00E–03 Nb 97 5.13E–02 2.84E+00 2.79E+06 7.54E+07 1.00E–03 Nb 97m 6.73E–04 4.11E–02 3.08E+06 8.32E+07 1.00E–03 154 DOE-STD-6003-96

Nb 98 3.36E–05 7.12E–03 1.06E+07 2.86E+08 1.00E–03 Mo 93 1.28E+06 9.19E+05 3.78E+04 1.02E+06 1.00E–03 Mo 93m 2.88E–01 1.61E+01 2.94E+06 7.95E+07 1.00E–03 Mo 99 2.75E+00 1.60E+01 2.88E+05 7.78E+06 2.89E+05 7.81E+06 1.00E–03 Mo101 1.01E–02 2.95E–01 1.41E+06 3.81E+07 1.00E–03 Tc 95 8.33E–01 2.59E+01 1.60E+06 4.32E+07 1.00E–03 Tc 95m 6.10E+01 4.06E+03 3.42E+06 9.24E+07 1.00E–03 Tc 96 4.28E+00 2.48E+01 2.95E+05 7.97E+06 1.00E–03 Tc 96m 3.61E–02 1.85E+01 2.60E+07 7.03E+08 1.00E–03 Tc 97 9.49E+08 2.24E+10 1.19E+06 3.22E+07 1.00E–03 Tc 97m 9.00E+01 4.50E+02 2.52E+05 6.81E+06 1.00E–03 Tc 98 1.53E+09 1.84E+09 5.99E+04 1.62E+06 1.00E–03 Tc 99 7.78E+07 2.22E+08 1.41E+05 3.81E+06 1.41E+05 3.81E+06 1.00E–03 Tc 99m 2.50E–01 6.65E+01 1.31E+07 3.54E+08 1.00E–03 Tc101 9.86E–03 1.28E+00 6.25E+06 1.69E+08 1.00E–03 Tc104 1.26E–02 4.91E+00 1.82E+07 4.92E+08 1.00E–03 Ru 97 2.89E+00 1.16E+01 2.01E+05 5.43E+06 1.00E–02 Ru103 3.93E+01 1.09E+01 1.32E+04 3.57E+05 1.00E–02 Ru105 1.85E–01 5.43E–01 1.37E+05 3.70E+06 1.00E–02 Ru106 3.72E+02 1.94E+00 2.40E+02 6.49E+03 2.41E+02 6.51E+03 1.00E–02 Rh101 1.21E+03 8.23E+02 3.30E+04 8.92E+05 1.00E–03 Rh101m 4.35E+00 1.42E+02 1.58E+06 4.27E+07 1.00E–03 Rh102 1.06E+03 2.69E+02 1.22E+04 3.30E+05 1.00E–03 Rh102m 2.07E+02 1.09E+02 2.52E+04 6.81E+05 1.00E–03 Rh103m 3.90E–02 2.02E+02 2.46E+08 6.65E+09 1.00E–03 Rh105 1.47E+00 3.62E+01 1.14E+06 3.08E+07 1.00E–03 Rh105m 4.63E–04 8.11E–01 8.15E+07 2.20E+09 1.00E–03 Rh106 3.46E–04 8.34E–02 1.11E+07 3.00E+08 1.00E–03 Rh106m 9.08E–02 1.39E+01 7.05E+06 1.91E+08 1.00E–03 Rh107 1.51E–02 1.75E+01 5.29E+07 1.43E+09 1.00E–03 Pd103 1.70E+01 2.70E+02 7.55E+05 2.04E+07 1.00E–03 Pd107 2.37E+09 4.23E+09 8.13E+04 2.20E+06 1.00E–03 Pd109 5.63E–01 1.21E+01 9.61E+05 2.60E+07 1.00E–03 Pd111 1.63E–02 4.42E+00 1.20E+07 3.24E+08 1.00E–03 Ag106 1.67E–02 1.47E+01 4.07E+07 1.10E+09 1.00E–03 Ag106m 8.41E+00 2.88E+01 1.58E+05 4.27E+06 1.00E–03 Ag108 1.66E–03 2.83E+00 7.72E+07 2.09E+09 1.00E–03 Ag108m 4.75E+04 5.53E+03 5.27E+03 1.42E+05 1.00E–03 Ag109m 4.61E–04 5.37E+00 5.23E+08 1.41E+10 1.00E–03 Ag110 2.85E–04 4.22E–01 6.59E+07 1.78E+09 1.00E–03 Ag110m 2.50E+02 1.10E+02 1.95E+04 5.27E+05 1.96E+04 5.30E+05 1.00E–03 Ag111 7.47E+00 3.04E+01 1.79E+05 4.84E+06 1.00E–03 Ag112 1.30E–01 5.75E+00 1.92E+06 5.19E+07 1.00E–03 Ag115 1.39E–02 5.67E+00 1.73E+07 4.68E+08 1.00E–03 Cd109 4.62E+02 2.60E+02 2.52E+04 6.81E+05 1.07E+04 2.89E+05 1.00E–03 Cd111m 3.37E–02 6.28E+00 8.21E+06 2.22E+08 1.00E–03 155 DOE-STD-6003-96

Cd113 3.29E+18 2.17E+17 2.86E+03 7.73E+04 6.66E+02 1.80E+04 1.00E–03 Cd113m 5.15E+03 3.31E+02 2.78E+03 7.51E+04 1.00E–03 Cd115 2.23E+00 1.42E+01 2.72E+05 7.35E+06 1.00E–03 Cd115m 4.46E+01 3.17E+01 3.02E+04 8.16E+05 1.00E–03 Cd117 1.04E–01 3.01E+00 1.21E+06 3.27E+07 1.00E–03 Cd117m 1.42E–01 2.65E+00 7.80E+05 2.11E+07 1.00E–03 In111 2.80E+00 7.17E+01 1.13E+06 3.05E+07 1.00E–03 In113m 6.91E–02 1.20E+01 7.49E+06 2.02E+08 1.00E–03 In114 8.32E–04 1.13E+00 5.80E+07 1.57E+09 1.00E–03 In114m 4.95E+01 2.49E+01 2.16E+04 5.84E+05 1.37E+04 3.70E+05 1.00E–03 In115 1.61E+17 4.31E+15 1.14E+03 3.08E+04 1.00E–03 In115m 1.87E–01 2.70E+01 6.14E+06 1.66E+08 1.00E–03 In116m 2.50E–05 5.18E–04 8.73E+05 2.36E+07 1.00E–03 In117 3.06E–02 2.28E+00 3.11E+06 8.41E+07 1.00E–03 In117m 8.08E–02 1.28E+01 6.59E+06 1.78E+08 1.00E–03 Sn113 1.15E+02 3.16E+02 1.19E+05 3.22E+06 1.18E+05 3.19E+06 1.00E–03 Sn117m 1.36E+01 9.93E+01 3.05E+05 8.24E+06 1.00E–03 Sn119m 2.93E+02 1.42E+03 1.99E+05 5.38E+06 1.00E–03 Sn121 1.13E+00 6.29E+01 2.25E+06 6.08E+07 1.00E–03 Sn121m 2.01E+04 5.91E+04 1.19E+05 3.22E+06 1.00E–03 Sn123 1.29E+02 1.15E+02 3.52E+04 9.51E+05 3.52E+04 9.51E+05 1.00E–03 Sn123m 2.79E–02 2.12E+01 3.02E+07 8.16E+08 1.00E–03 Sn125 9.63E+00 1.84E+01 7.47E+04 2.02E+06 1.00E–03 Sn126 3.65E+07 1.34E+07 1.43E+04 3.86E+05 1.22E+04 3.30E+05 1.00E–03 Sn127 8.83E–02 8.99E+00 3.92E+06 1.06E+08 1.00E–03 Sn128 4.10E–02 8.12E+00 7.55E+06 2.04E+08 1.00E–03 Sb117 1.17E–01 3.08E+01 1.10E+07 2.97E+08 1.00E–03 Sb120b 5.76E+00 4.27E+01 3.02E+05 8.16E+06 1.00E–03 Sb122 2.70E+00 1.45E+01 2.16E+05 5.84E+06 1.00E–03 Sb124 6.02E+01 7.38E+01 4.83E+04 1.31E+06 4.81E+04 1.30E+06 1.00E–03 Sb125 1.01E+03 2.73E+03 1.06E+05 2.86E+06 1.00E–03 Sb126 1.24E+01 3.00E+01 9.37E+04 2.53E+06 9.25E+04 2.50E+06 1.00E–03 Sb126m 1.27E–04 4.61E–03 1.40E+06 3.78E+07 1.00E–03 Sb127 3.84E+00 1.85E+01 1.85E+05 5.00E+06 1.00E–03 Sb128 3.79E–01 6.57E+00 6.61E+05 1.79E+07 1.00E–03 Sb128m 7.01E–03 1.62E+01 8.81E+07 2.38E+09 1.00E–03 Sb129 1.83E–01 4.10E+00 8.47E+05 2.29E+07 1.00E–03 Sb130 2.67E–02 1.21E+01 1.71E+07 4.62E+08 1.00E–03 Sb131 1.60E–02 3.77E+00 8.81E+06 2.38E+08 1.00E–03 Te121 1.68E+01 2.37E+01 5.69E+04 1.54E+06 1.00E–02 Te121m 1.54E+02 3.33E+01 8.74E+03 2.36E+05 1.00E–02 Te123 4.75E+15 2.75E+15 2.30E+04 6.22E+05 1.00E–02 Te123m 1.20E+02 3.33E+01 1.11E+04 3.00E+05 1.00E–02 Te125m 5.80E+01 2.34E+01 1.58E+04 4.27E+05 1.00E–02 Te127 3.92E–01 3.69E+00 3.62E+05 9.78E+06 1.00E–02 Te127m 1.09E+02 1.58E+01 5.56E+03 1.50E+05 5.55E+03 1.50E+05 1.00E–02 156 DOE-STD-6003-96

Te129 4.83E–02 1.47E+00 1.15E+06 3.11E+07 1.00E–02 Te129m 3.36E+01 4.69E+00 5.28E+03 1.43E+05 5.18E+03 1.40E+05 1.00E–02 Te131 1.74E–02 7.88E–02 1.69E+05 4.57E+06 1.00E–02 Te131m 1.35E+00 6.20E–01 1.71E+04 4.62E+05 1.00E–02 Te132 3.26E+00 1.19E+00 1.36E+04 3.68E+05 1.00E–02 Te133 8.61E–03 4.76E–02 2.03E+05 5.49E+06 1.00E–02 Te133m 3.85E–02 7.73E–02 7.38E+04 1.99E+06 1.00E–02 Te134 2.92E–02 1.70E–01 2.12E+05 5.73E+06 1.00E–02 I122 2.50E–03 2.98E–04 4.78E+03 1.29E+05 5.00E–01 I123 5.50E–01 8.55E–02 6.17E+03 1.67E+05 5.00E–01 I124 4.18E+00 1.15E–02 1.08E+02 2.92E+03 5.00E–01 I125 6.01E+01 1.36E–01 8.81E+01 2.38E+03 8.88E+01 2.40E+03 5.00E–01 I126 1.30E+01 1.64E–02 4.89E+01 1.32E+03 5.00E–01 I128 1.74E–02 1.22E–02 2.68E+04 7.24E+05 5.00E–01 I129 5.73E+09 1.78E+06 1.17E+01 3.16E+02 5.00E–01 I130 5.15E–01 8.31E–03 6.06E+02 1.64E+04 5.00E–01 I131 8.04E+00 1.42E–02 6.57E+01 1.78E+03 6.66E+01 1.80E+03 5.00E–01 I132 9.50E–02 3.88E–03 1.51E+03 4.08E+04 5.00E–01 I133 8.67E–01 8.79E–03 3.72E+02 1.01E+04 5.00E–01 I134 3.65E–02 1.57E–03 1.56E+03 4.22E+04 5.00E–01 I135 2.74E–01 8.64E–03 1.14E+03 3.08E+04 5.00E–01 I136 9.65E–04 4.51E–05 1.68E+03 4.54E+04 5.00E–01 Xe122 8.38E–01 8.10E–01 3.87E+04 1.05E+06 1.00E+00 Xe123 8.33E–02 7.69E–03 3.67E+03 9.92E+04 1.00E+00 Xe125 7.13E–01 1.70E–01 9.32E+03 2.52E+05 1.00E+00 Xe127 3.64E+01 8.36E+00 8.83E+03 2.39E+05 1.00E+00 Xe129m 8.89E+00 2.38E+01 1.01E+05 2.73E+06 1.00E+00 Xe131m 1.19E+01 8.75E+01 2.74E+05 7.41E+06 1.00E+00 Xe133 5.24E+00 9.56E+00 6.70E+04 1.81E+06 6.66E+04 1.80E+06 1.00E+00 Xe133m 2.19E+00 4.70E+00 7.88E+04 2.13E+06 1.00E+00 Xe135 3.79E–01 9.77E–02 9.32E+03 2.52E+05 1.00E+00 Xe135m 1.06E–02 1.60E–03 5.45E+03 1.47E+05 1.00E+00 Xe137 2.65E–03 9.11E–04 1.22E+04 3.30E+05 1.00E+00 Xe138 9.79E–03 5.17E–04 1.87E+03 5.05E+04 1.00E+00 Cs126 1.14E–03 6.07E–03 2.07E+05 5.59E+06 1.00E–02 Cs129 1.34E+00 1.39E+01 3.95E+05 1.07E+07 1.00E–02 Cs131 9.69E+00 1.68E+02 6.48E+05 1.75E+07 1.00E–02 Cs132 6.48E+00 1.21E+01 6.93E+04 1.87E+06 1.00E–02 Cs134 7.54E+02 4.58E+01 2.22E+03 6.00E+04 2.22E+03 6.00E+04 1.00E–02 Cs134m 1.21E–01 7.76E+00 2.33E+06 6.30E+07 1.00E–02 Cs135 8.40E+08 5.45E+08 2.35E+04 6.35E+05 1.00E–02 Cs135m 3.68E–02 4.14E+00 4.07E+06 1.10E+08 1.00E–02 Cs136 1.32E+01 4.55E+00 1.24E+04 3.35E+05 1.00E–02 Cs137 1.10E+03 1.02E+03 3.30E+03 8.92E+04 3.29E+03 8.89E+04 1.00E–02 Cs138 2.24E–02 5.39E–02 8.53E+04 2.31E+06 1.00E–02 Cs139 6.46E–03 1.29E–01 7.02E+05 1.90E+07 1.00E–02 157 DOE-STD-6003-96

Ba131 1.17E+01 3.78E+02 1.21E+06 3.27E+07 1.00E–03 Ba133 3.84E+03 1.57E+04 1.50E+05 4.05E+06 1.48E+05 4.00E+06 1.00E–03 Ba133m 1.62E+00 7.97E+01 1.81E+06 4.89E+07 1.00E–03 Ba135m 1.20E+00 7.56E+01 2.29E+06 6.19E+07 1.00E–03 Ba137m 1.77E–03 1.90E–01 3.82E+06 1.03E+08 1.00E–03 Ba139 5.82E–02 9.93E+00 6.00E+06 1.62E+08 1.00E–03 Ba140 1.28E+01 1.05E+02 2.87E+05 7.76E+06 2.89E+05 7.81E+06 1.00E–03 Ba141 1.27E–02 7.91E–01 2.16E+06 5.84E+07 1.00E–03 Ba142 7.43E–03 4.99E–01 2.31E+06 6.24E+07 1.00E–03 La137 2.19E+07 3.42E+07 5.56E+04 1.50E+06 1.00E–03 La138 3.83E+13 3.09E+12 2.86E+03 7.73E+04 1.00E–03 La140 1.68E+00 9.22E+00 1.92E+05 5.19E+06 1.00E–03 La141 1.63E–01 1.06E+01 2.25E+06 6.08E+07 1.00E–03 La142 6.42E–02 1.25E+00 6.71E+05 1.81E+07 1.00E–03 La143 9.79E–03 5.51E+00 1.92E+07 5.19E+08 1.00E–03 Ce139 1.38E+02 5.47E+02 1.40E+05 3.78E+06 1.00E–03 Ce141 3.25E+01 1.16E+02 1.24E+05 3.35E+06 1.22E+05 3.30E+06 1.00E–03 Ce143 1.38E+00 1.28E+01 3.19E+05 8.62E+06 1.00E–03 Ce144 2.85E+02 2.53E+01 3.02E+03 8.16E+04 3.03E+03 8.19E+04 1.00E–03 Pr142 7.97E–01 8.98E+00 3.88E+05 1.05E+07 1.00E–03 Pr143 1.36E+01 5.75E+01 1.45E+05 3.92E+06 1.00E–03 Pr144 1.20E–02 6.43E+00 1.82E+07 4.92E+08 1.00E–03 Pr144m 5.00E–03 6.56E+01 4.45E+08 1.20E+10 1.00E–03 Pr145 2.49E–01 1.22E+01 1.65E+06 4.46E+07 1.00E–03 Pr147 9.31E–03 1.10E+01 3.92E+07 1.06E+09 1.00E–03 Nd141 1.04E–01 3.86E+02 1.29E+08 3.49E+09 1.00E–03 Nd147 1.10E+01 5.58E+01 1.69E+05 4.57E+06 1.00E–03 Nd149 7.17E–02 6.21E+00 2.84E+06 7.68E+07 1.00E–03 Nd151 8.61E–03 1.08E+01 4.07E+07 1.10E+09 1.00E–03 Pm143 2.65E+02 1.13E+03 1.46E+05 3.95E+06 1.00E–03 Pm144 3.60E+02 2.69E+02 2.53E+04 6.84E+05 1.00E–03 Pm145 6.46E+03 7.51E+03 3.91E+04 1.06E+06 4.07E+04 1.10E+06 1.00E–03 Pm146 2.02E+03 5.79E+02 9.58E+03 2.59E+05 1.00E–03 Pm147 9.58E+02 8.96E+02 3.11E+04 8.41E+05 3.11E+04 8.41E+05 1.00E–03 Pm148 5.37E+00 1.68E+01 1.03E+05 2.78E+06 1.00E–03 Pm148m 4.13E+01 7.82E+01 6.25E+04 1.69E+06 1.00E–03 Pm149 2.21E+00 2.54E+01 3.77E+05 1.02E+07 1.00E–03 Pm150 1.12E–01 1.25E+01 3.65E+06 9.86E+07 1.00E–03 Pm151 1.18E+00 2.21E+01 6.04E+05 1.63E+07 1.00E–03 Sm146 3.76E+10 1.52E+07 1.36E+01 3.68E+02 1.00E–03 Sm147 3.87E+13 1.73E+10 1.49E+01 4.03E+02 1.00E–03 Sm151 3.29E+04 3.70E+04 3.65E+04 9.86E+05 3.66E+04 9.89E+05 1.00E–03 Sm153 1.93E+00 3.71E+01 6.14E+05 1.66E+07 1.00E–03 Sm155 1.54E–02 2.16E+01 4.40E+07 1.19E+09 1.00E–03 Sm156 3.92E–01 2.32E+01 1.85E+06 5.00E+07 1.00E–03 Eu150b 1.31E+04 1.58E+03 3.92E+03 1.06E+05 1.00E–03 158 DOE-STD-6003-96

Eu152 4.92E+03 7.34E+02 4.79E+03 1.29E+05 4.81E+03 1.30E+05 1.00E–03 Eu152m 6.67E–02 2.42E+00 1.17E+06 3.16E+07 1.00E–03 Eu154 3.14E+03 4.01E+02 4.06E+03 1.10E+05 4.07E+03 1.10E+05 1.00E–03 Eu155 1.72E+03 1.48E+03 2.71E+04 7.32E+05 2.70E+04 7.30E+05 1.00E–03 Eu156 1.52E+01 4.40E+01 9.06E+04 2.45E+06 0.00E+00 1.00E–03 Eu157 6.30E–01 2.14E+01 1.06E+06 2.86E+07 1.00E–03 Eu158 3.19E–02 1.30E+01 1.26E+07 3.41E+08 1.00E–03 Gd148 2.74E+04 1.04E+01 1.26E+01 3.41E+02 1.00E–03 Gd152 4.02E+16 2.17E+13 1.73E+01 4.68E+02 1.00E–03 Gd153 2.42E+02 9.48E+02 1.25E+05 3.38E+06 5.18E+04 1.40E+06 1.00E–03 Gd159 7.75E–01 2.94E+01 1.17E+06 3.16E+07 1.00E–03 Tb157 4.02E+04 1.52E+05 1.17E+05 3.16E+06 1.00E–03 Tb158 6.57E+04 8.99E+03 4.23E+03 1.14E+05 1.00E–03 Tb160 7.23E+01 1.11E+02 4.70E+04 1.27E+06 4.81E+04 1.30E+06 1.00E–03 Tb161 6.91E+00 7.77E+01 3.41E+05 9.22E+06 0.00E+00 1.00E–03 Dy157 3.38E–01 5.00E+01 4.61E+06 1.25E+08 0.00E+00 1.00E–03 Dy159 1.44E+02 2.37E+03 5.03E+05 1.36E+07 0.00E+00 1.00E–03 Dy165 9.71E–02 2.86E+01 8.73E+06 2.36E+08 0.00E+00 1.00E–03 Dy166 3.40E+00 1.77E+01 1.53E+05 4.14E+06 0.00E+00 1.00E–03 Ho164 2.01E–02 8.94E+01 1.32E+08 3.57E+09 0.00E+00 1.00E–03 Ho164m 2.64E–02 5.51E+01 6.22E+07 1.68E+09 0.00E+00 1.00E–03 Ho166 1.12E+00 1.43E+01 3.76E+05 1.02E+07 0.00E+00 1.00E–03 Ho166m 4.38E+05 2.18E+04 1.47E+03 3.97E+04 1.48E+03 4.00E+04 1.00E–03 Er169 9.40E+00 1.72E+02 5.29E+05 1.43E+07 1.00E–03 Er171 3.13E–01 1.74E+01 1.59E+06 4.30E+07 1.00E–03 Tm170 1.29E+02 2.06E+02 4.60E+04 1.24E+06 4.44E+04 1.20E+06 1.00E–03 Tm171 7.01E+02 3.02E+03 1.23E+05 3.32E+06 1.00E–03 Yb169 3.20E+01 1.64E+02 1.48E+05 4.00E+06 1.00E–03 Yb175 4.19E+00 1.05E+02 6.97E+05 1.88E+07 1.00E–03 Lu174 1.21E+03 1.42E+03 3.30E+04 8.92E+05 1.00E–03 Lu174m 1.42E+02 2.33E+02 4.60E+04 1.24E+06 1.00E–03 Lu176 1.31E+13 7.95E+11 1.68E+03 4.54E+04 1.00E–03 Lu176m 1.53E–01 2.65E+01 4.81E+06 1.30E+08 1.00E–03 Lu177 6.68E+00 1.11E+02 4.56E+05 1.23E+07 1.00E–03 Lu177m 1.61E+02 9.86E+01 1.69E+04 4.57E+05 1.00E–03 Lu178 1.98E–02 1.73E+01 2.40E+07 6.49E+08 1.00E–03 Lu178m 1.60E–02 2.13E+01 3.65E+07 9.86E+08 1.00E–03 Hf175 7.00E+01 5.89E+02 2.35E+05 6.35E+06 1.00E–03 Hf177m 3.57E–02 2.36E+01 1.82E+07 4.92E+08 1.00E–03 Hf178m 1.13E+04 7.79E+02 1.89E+03 5.11E+04 1.00E–03 Hf179m 2.51E+01 1.17E+02 1.27E+05 3.43E+06 1.00E–03 Hf181 4.24E+01 1.48E+02 9.40E+04 2.54E+06 8.14E+04 2.20E+06 1.00E–03 Hf182 3.29E+09 1.82E+08 1.49E+03 4.03E+04 1.00E–03 Hf183 4.46E–02 1.94E+01 1.16E+07 3.14E+08 1.00E–03 Ta179 6.57E+02 4.39E+03 1.82E+05 4.92E+06 1.00E–03 Ta180m 3.38E–01 1.55E+02 1.24E+07 3.35E+08 1.00E–03 159 DOE-STD-6003-96

Ta182 1.14E+02 1.20E+02 2.81E+04 7.59E+05 1.00E–03 Ta182m 1.10E–02 3.60E+01 8.81E+07 2.38E+09 1.00E–03 Ta183 5.10E+00 4.21E+01 2.20E+05 5.95E+06 1.00E–03 Ta184 3.63E–01 1.31E+01 9.61E+05 2.60E+07 1.00E–03 Ta185 3.40E–02 1.82E+01 1.41E+07 3.81E+08 1.00E–03 Ta186 7.29E–03 1.28E+01 4.60E+07 1.24E+09 1.00E–03 W179 2.64E–02 3.41E+02 3.52E+08 9.51E+09 1.00E–03 W181 1.21E+02 2.88E+04 6.42E+06 1.74E+08 1.00E–03 W185 7.51E+01 4.01E+03 1.41E+06 3.81E+07 1.00E–03 W187 9.96E–01 5.38E+01 1.41E+06 3.81E+07 1.00E–03 W188 6.94E+01 6.89E+02 2.58E+05 6.97E+06 1.00E–03 Re182a 5.29E–01 6.32E+01 3.20E+06 8.65E+07 1.00E–03 Re182b 2.67E+00 3.38E+01 3.40E+05 9.19E+06 1.00E–03 Re184 3.80E+01 3.77E+02 2.63E+05 7.11E+06 1.00E–03 Re184m 1.65E+02 5.40E+02 8.68E+04 2.35E+06 1.00E–03 Re186 3.78E+00 5.05E+01 3.51E+05 9.49E+06 1.00E–03 Re186m 7.30E+07 8.91E+07 3.20E+04 8.65E+05 1.00E–03 Re187 1.59E+13 1.31E+16 2.16E+07 5.84E+08 1.00E–03 Re188 7.08E–01 1.58E+01 5.79E+05 1.56E+07 1.00E–03 Re188m 1.29E–02 1.42E+01 2.86E+07 7.73E+08 1.00E–03 Re189 1.01E+00 3.77E+01 9.61E+05 2.60E+07 1.00E–03 Os185 9.36E+01 5.74E+02 1.62E+05 4.38E+06 1.00E–03 Os189m 2.42E–01 3.41E+02 3.65E+07 9.86E+08 1.00E–03 Os190m 6.88E–03 3.91E–01 1.46E+06 3.95E+07 1.00E–03 Os191 1.54E+01 1.71E+02 2.83E+05 7.65E+06 1.00E–03 Os191m 5.46E–01 8.01E+01 3.75E+06 1.01E+08 1.00E–03 Os193 1.27E+00 2.75E+01 5.48E+05 1.48E+07 1.00E–03 Os194 2.19E+03 1.37E+02 1.58E+03 4.27E+04 1.00E–03 Ir190 1.18E+01 8.02E+01 1.75E+05 4.73E+06 1.00E–03 Ir190m 5.00E–02 7.90E+01 4.06E+07 1.10E+09 1.00E–03 Ir190 N 1.33E–01 2.91E+02 5.60E+07 1.51E+09 1.00E–03 Ir192 7.38E+01 1.31E+02 4.52E+04 1.22E+06 4.44E+04 1.20E+06 1.00E–03 Ir192m 8.76E+04 1.10E+04 3.20E+03 8.65E+04 1.00E–03 Ir194 7.98E–01 1.22E+01 3.86E+05 1.04E+07 1.00E–03 Ir194m 1.71E+02 1.43E+02 2.11E+04 5.70E+05 1.00E–03 Pt191 2.90E+00 1.65E+02 1.45E+06 3.92E+07 1.00E–03 Pt193 1.83E+04 3.63E+06 5.03E+06 1.36E+08 1.00E–03 Pt193m 4.33E+00 2.17E+02 1.27E+06 3.43E+07 1.00E–03 Pt195m 4.02E+00 1.38E+02 8.60E+05 2.32E+07 1.00E–03 Pt197 7.63E–01 6.13E+01 1.99E+06 5.38E+07 1.00E–03 Pt197m 6.56E–02 1.81E+01 6.83E+06 1.85E+08 1.00E–03 Au194 1.65E+00 4.28E+01 6.55E+05 1.77E+07 1.00E–03 Au195 1.83E+02 6.42E+02 8.78E+04 2.37E+06 1.00E–03 Au195m 3.53E–04 1.67E–01 1.19E+07 3.22E+08 1.00E–03 Au198 2.70E+00 5.83E+01 5.33E+05 1.44E+07 3.44E+05 9.30E+06 1.00E–03 Au198m 2.30E+00 2.01E+01 2.16E+05 5.84E+06 1.00E–03 160 DOE-STD-6003-96

Au199 3.14E+00 8.78E+01 6.86E+05 1.85E+07 1.00E–03 Hg194 1.90E+05 1.90E+04 2.52E+03 6.81E+04 1.00E–02 Hg197 2.67E+00 1.84E+01 1.71E+05 4.62E+06 1.00E–02 Hg197m 9.92E–01 4.06E+00 1.02E+05 2.76E+06 1.00E–02 Hg199m 2.96E–02 4.55E+00 3.78E+06 1.02E+08 1.00E–02 Hg203 4.66E+01 4.45E+01 2.30E+04 6.22E+05 1.59E+04 4.30E+05 1.00E–02 Tl200 1.09E+00 4.40E+01 9.89E+05 2.67E+07 1.00E–03 Tl201 3.04E+00 4.92E+02 3.93E+06 1.06E+08 1.00E–03 Tl202 1.22E+01 4.50E+02 8.89E+05 2.40E+07 1.00E–03 Tl204 1.38E+03 2.65E+04 4.60E+05 1.24E+07 1.00E–03 Tl206 2.92E–03 1.55E+01 1.26E+08 3.41E+09 1.00E–03 Tl207 3.31E–03 1.45E+02 1.03E+09 2.78E+10 1.00E–03 Tl208 2.12E–03 5.34E–02 5.92E+05 1.60E+07 1.00E–03 Tl209 1.53E–03 6.93E–02 1.06E+06 2.86E+07 1.00E–03 Tl210 9.03E–04 3.08E–02 7.93E+05 2.14E+07 1.00E–03 Pb202 1.92E+07 8.46E+06 1.07E+04 2.89E+05 1.00E–03 Pb203 2.17E+00 1.45E+02 1.61E+06 4.35E+07 1.00E–03 Pb205 5.55E+09 6.65E+10 2.86E+05 7.73E+06 1.00E–03 Pb209 1.36E–01 6.81E+01 1.17E+07 3.16E+08 1.00E–03 Pb210 8.14E+03 2.85E+01 8.13E+01 2.20E+03 8.14E+01 2.20E+03 1.00E–03 Pb211 2.51E–02 1.43E–01 1.32E+05 3.57E+06 1.00E–03 Pb212 4.43E–01 1.27E–01 6.60E+03 1.78E+05 1.00E–03 Pb214 1.86E–02 1.27E–01 1.55E+05 4.19E+06 1.00E–03 Bi206 6.24E+00 3.74E+01 1.42E+05 3.84E+06 1.00E–03 Bi207 1.18E+04 3.58E+04 7.18E+04 1.94E+06 7.03E+04 1.90E+06 1.00E–03 Bi210 5.01E+00 1.20E+00 5.56E+03 1.50E+05 5.55E+03 1.50E+05 1.00E–03 Bi210m 1.10E+09 6.64E+06 1.41E+02 3.81E+03 1.00E–03 Bi211 1.48E–03 3.16E+00 4.94E+07 1.34E+09 1.00E–03 Bi212 4.21E–02 1.13E–01 6.19E+04 1.67E+06 1.00E–03 Bi213 3.17E–02 1.04E–01 7.52E+04 2.03E+06 1.00E–03 Bi214 1.38E–02 9.80E–02 1.62E+05 4.38E+06 1.00E–03 Po210 1.38E+02 7.77E–02 1.31E+01 3.54E+02 1.30E+01 3.51E+02 1.00E–02 Po211 5.97E–06 9.25E–03 3.59E+07 9.70E+08 1.00E–02 Po213 4.86E–11 1.55E–05 7.33E+09 1.98E+11 1.00E–02 Po214 1.90E–09 2.23E–04 2.69E+09 7.27E+10 1.00E–02 Po215 2.06E–08 1.42E–03 1.57E+09 4.24E+10 1.00E–02 Po216 1.69E–06 1.16E+00 1.55E+10 4.19E+11 1.00E–02 At211 3.01E–01 2.05E–01 1.58E+04 4.27E+05 1.00E–03 At217 3.74E–07 1.61E–01 9.71E+09 2.62E+11 1.00E–03 Rn218 4.05E–07 5.47E–05 3.03E+06 8.19E+07 1.00E+00 Rn219 4.58E–05 8.35E–05 4.06E+04 1.10E+06 1.00E+00 Rn220 6.44E–04 1.28E–01 4.43E+06 1.20E+08 1.00E+00 Rn222 3.82E+00 1.04E+03 5.98E+06 1.62E+08 5.92E+06 1.60E+08 1.00E+00 Fr221 3.33E–03 1.13E+01 7.52E+07 2.03E+09 1.00E–03 Fr223 1.51E–02 3.52E+01 5.09E+07 1.38E+09 1.00E–03 Ra222 4.40E–04 5.07E+00 2.53E+08 6.84E+09 1.00E–03 161 DOE-STD-6003-96

Ra223 1.14E+01 7.36E–02 1.41E+02 3.81E+03 1.41E+02 3.81E+03 1.00E–03 Ra224 3.62E+00 6.05E–02 3.65E+02 9.86E+03 3.66E+02 9.89E+03 1.00E–03 Ra225 1.48E+01 9.61E–02 1.41E+02 3.81E+03 1.41E+02 3.81E+03 1.00E–03 Ra226 5.84E+05 3.62E+03 1.34E+02 3.62E+03 1.00E–03 Ra228 2.10E+03 2.47E+01 2.52E+02 6.81E+03 1.00E–03 Ac225 1.00E+01 6.09E–02 1.32E+02 3.57E+03 1.07E+02 2.89E+03 1.00E–03 Ac227 7.95E+03 3.25E–01 8.81E–01 2.38E+01 1.59E–01 4.30E+00 1.00E–03 Ac228 2.55E–01 1.14E–01 9.57E+03 2.59E+05 1.00E–03 Th226 2.15E–02 3.00E–02 3.02E+04 8.16E+05 1.00E–03 Th227 1.87E+01 5.75E–02 6.61E+01 1.79E+03 1.00E–03 Th228 6.98E+02 1.11E–01 3.41E+00 9.22E+01 3.40E+00 9.19E+01 1.00E–03 Th229 2.68E+06 7.81E+01 6.22E–01 1.68E+01 1.00E–03 Th230 2.81E+07 5.38E+03 4.07E+00 1.10E+02 3.29E+00 8.89E+01 1.00E–03 Th231 1.06E+00 6.86E+01 1.36E+06 3.68E+07 1.00E–03 Th232 5.13E+12 2.34E+08 9.61E–01 2.60E+01 6.66E–01 1.80E+01 1.00E–03 Th234 2.41E+01 3.70E+01 3.20E+04 8.65E+05 1.00E–03 Pa230 1.74E+01 5.77E–01 7.05E+02 1.91E+04 1.00E–03 Pa231 1.20E+07 6.95E+02 1.23E+00 3.32E+01 1.00E–03 Pa232 1.31E+00 9.67E–01 1.55E+04 4.19E+05 1.00E–03 Pa233 2.70E+01 1.57E+02 1.22E+05 3.30E+06 1.00E–03 Pa234 2.79E–01 8.54E+00 6.38E+05 1.72E+07 1.00E–03 Pa234m 8.13E–04 7.64E+00 1.96E+08 5.30E+09 1.00E–03 U230 2.08E+01 5.18E–02 5.29E+01 1.43E+03 1.00E–03 U231 4.20E+00 1.86E+02 9.35E+05 2.53E+07 1.00E–03 U232 2.52E+04 1.88E+00 1.58E+00 4.27E+01 1.00E–03 U233 5.81E+07 2.25E+04 8.13E+00 2.20E+02 8.14E+00 2.20E+02 1.00E–03 U234 8.94E+07 3.48E+04 8.13E+00 2.20E+02 8.14E+00 2.20E+02 1.00E–03 U235 2.57E+11 1.09E+08 8.81E+00 2.38E+02 8.88E+00 2.40E+02 1.00E–03 U236 8.55E+09 3.64E+06 8.81E+00 2.38E+02 1.00E–03 U237 6.75E+00 1.03E+02 3.15E+05 8.51E+06 1.00E–03 U238 1.63E+12 7.01E+08 8.81E+00 2.38E+02 8.88E+00 2.40E+02 1.00E–03 U239 1.64E–02 1.57E+01 1.96E+07 5.30E+08 1.00E–03 U240 5.88E–01 1.45E+01 5.03E+05 1.36E+07 1.00E–03 Np235 3.96E+02 5.30E+03 2.78E+05 7.51E+06 1.00E–03 Np236a 4.20E+07 2.17E+04 1.07E+01 2.89E+02 1.00E–03 Np236b 9.38E–01 6.74E–01 1.49E+04 4.03E+05 1.00E–03 Np237 7.81E+08 8.18E+04 2.16E+00 5.84E+01 2.15E+00 5.81E+01 1.00E–03 Np238 2.12E+00 3.49E+00 3.38E+04 9.14E+05 3.37E+04 9.11E+05 1.00E–03 Np239 2.36E+00 5.35E+01 4.65E+05 1.26E+07 1.00E–03 Np240 4.30E–02 3.72E+00 1.76E+06 4.76E+07 1.00E–03 Np240m 5.01E–03 1.71E+00 6.94E+06 1.88E+08 1.00E–03 Pu236 1.04E+03 4.09E–01 8.13E+00 2.20E+02 1.00E–03 Pu237 4.53E+01 1.43E+03 6.52E+05 1.76E+07 1.00E–03 Pu238 3.20E+04 5.50E+00 3.52E+00 9.51E+01 2.29E+00 6.19E+01 1.00E–03 Pu239 8.81E+06 1.38E+03 3.20E+00 8.65E+01 2.07E+00 5.59E+01 1.00E–03 Pu240 2.40E+06 3.77E+02 3.20E+00 8.65E+01 1.00E–03 162 DOE-STD-6003-96

Pu241 5.24E+03 4.79E+01 1.85E+02 5.00E+03 1.07E+02 2.89E+03 1.00E–03 Pu242 1.36E+08 2.30E+04 3.41E+00 9.22E+01 1.00E–03 Pu243 2.07E–01 7.22E+01 7.03E+06 1.90E+08 1.00E–03 Pu244 2.95E+10 5.02E+06 3.41E+00 9.22E+01 1.00E–03 Pu245 4.38E–01 1.67E+01 7.59E+05 2.05E+07 1.00E–03 Pu246 1.09E+01 1.33E+04 2.44E+07 6.59E+08 1.00E–03 Am241 1.58E+05 1.58E+01 2.03E+00 5.49E+01 2.04E+00 5.51E+01 1.00E–03 Am242 6.68E–01 5.73E–01 1.73E+04 4.68E+05 1.00E–03 Am242m 5.15E+04 5.29E+00 2.07E+00 5.59E+01 2.07E+00 5.59E+01 1.00E–03 Am243 2.69E+06 2.72E+02 2.03E+00 5.49E+01 2.04E+00 5.51E+01 1.00E–03 Am244 4.21E–01 1.28E+00 6.08E+04 1.64E+06 1.00E–03 Am245 8.54E–02 5.65E+01 1.32E+07 3.57E+08 1.00E–03 Am246 2.71E–02 2.83E+00 2.07E+06 5.59E+07 1.00E–03 Cm242 1.63E+02 5.02E–01 6.22E+01 1.68E+03 6.29E+01 1.70E+03 1.00E–03 Cm243 1.06E+04 1.59E+00 3.02E+00 8.16E+01 1.00E–03 Cm244 6.64E+03 1.30E+00 3.92E+00 1.06E+02 1.00E–03 Cm245 3.10E+06 3.05E+02 1.96E+00 5.30E+01 1.96E+00 5.30E+01 1.00E–03 Cm246 1.73E+06 1.70E+02 1.96E+00 5.30E+01 1.00E–03 Cm247 5.69E+09 6.21E+05 2.16E+00 5.84E+01 1.00E–03 Cm248 1.24E+08 3.51E+03 5.56E–01 1.50E+01 1.00E–03 Cm249 4.46E–02 1.05E+01 4.62E+06 1.25E+08 1.00E–03 Cm250 3.54E+06 Unknown Unknown Unknown 1.00E–03 Bk249 3.20E+02 1.33E+01 8.13E+02 2.20E+04 1.00E–03 Bk250 1.34E–01 9.93E–01 1.44E+05 3.89E+06 1.00E–03 Cf248 3.34E+02 4.16E–01 2.46E+01 6.65E+02 1.00E–03 Cf249 1.28E+05 1.92E+01 2.94E+00 7.95E+01 1.00E–03 Cf250 4.77E+03 1.36E+00 5.56E+00 1.50E+02 1.00E–03 Cf251 3.28E+05 4.81E+01 2.86E+00 7.73E+01 1.00E–03 Cf252 9.65E+02 4.05E–01 8.13E+00 2.20E+02 1.11E+01 3.00E+02 1.00E–03 Cf253 1.78E+01 3.25E–01 3.52E+02 9.51E+03 1.00E–03 Cf254 6.05E+01 1.19E–02 3.78E+00 1.02E+02 1.00E–03 Es253 2.05E+01 3.40E–01 3.20E+02 8.65E+03 1.00E–03 Es254 2.76E+02 4.21E–01 2.94E+01 7.95E+02 1.00E–03 Es254m 1.64E+00 1.91E–01 2.25E+03 6.08E+04 1.00E–03 Fm254 1.35E–01 1.51E–01 2.16E+04 5.84E+05 1.00E–03 Fm255 8.36E–01 2.01E–01 4.60E+03 1.24E+05 1.00E–03 163 DOE-STD-6003-96 Intentionally Left Blank 164 DOE-STD-6003-96 APPENDIX B IDENTIFICATION OF POTENTIAL HAZARDS, ENERGY SOURCES, AND GENERIC ACCIDENTS FOR FUSION FACILITIES B.1 Introduction This appendix presents a discussion of the potential hazards, energy sources, and generic accident scenarios associated with fusion facilities. A bibliography of the large amount of similar work that has been done in the worldwide fusion safety community in the past is included at the end of the document. Because of the generic nature of this list, a particular hazard, energy source, or accident scenario may or may not be relevant to every fusion system. The existence of a hazard and its magnitude are dictated by the specifics of a facility design including its mission, function, materials, size, and power level. The intent of the listing is to provide a starting point to implement the requirements in the main text related to hazard identifi- cation and development of event trees or accident scenarios for the specific fusion facility. A secondary but equally important use of this listing is to ensure that hazards that are not an inte- gral part of a specific system but that can have an interfacing effect are also identified. B.2 Hazards The hazards associated with fusion consist of radiological, chemical, and industrial hazards. In addition, fusion has a number of energy sources that must be managed effectively to prevent accidents that would result in release of chemical and radiological hazards. The hazards are discussed below.

B.2.1 Radiological Hazards The dominant radiological hazards are tritium, which is the fuel in the deuterium-tritium (D-T) fusion reaction, and activation products that are produced as a result of neutron interac- tion with materials and fluids surrounding the plasma. Hazards from direct exposure to fusion neutrons will normally be mitigated by design features and administrative controls. Tritium inventories are a strong function of the fusion facility design. Tokamak Fusion Test Reactor (TFTR) is limited to contain less than 5 g of tritium, whereas the inventory of tritium in the International Thermonuclear Experimental Reactor (ITER) is expected to be between 1 and 10 kg. Tritium can be found in plasma-facing components (PFCs) in the fuel process system, the vacuum pumps and fuel injectors, in the blanket and associated processing system, and in storage. Tritium is also present in neutral beam injectors and associated cryopanels. The tritium inventory in each of these systems must be assessed to determine the associated hazard. The dispersion and oxidation characteristics in an off-normal event will influence the degree or severity of the hazard for tritium that may be released. For machines such as ITER that will experience a high neutron fluence, activation prod- ucts will constitute the largest source of radioactivity. For ITER, an inventory of 1020 Bq (3 × 109 Ci) is estimated for the stainless steel shield and vacuum vessel during the later phases of operation. The inventory in the structure and the potential hazard to the public are directly 165 DOE-STD-6003-96 related to the structural material. The use of low activation materials for fusion structural compo- nents can influence the potential hazard. The majority of these activation products (~98 to 99%) will be bound in solid metal structures such as the first wall, blanket, and divertor and would only be mobilized during off-normal conditions. Mechanisms for mobilization include partial vaporiza- tion during a plasma disruption, oxidation-driven volatilization due to chemical reactions of the structure with air and/or steam, and magnet coil electrical arcing. Smaller inventories of activation products include the following: a. corrosion products that will be circulating in coolant streams from actively cooled structures like the blanket and divertor, b. “tokamak dust” produced by erosion of material from the surfaces facing the plasma due to interaction with high-energy neutrals and ions from the plasma, and c. activated air inside the building as a result of neutron leakage and streaming. These activation product inventories are operational, maintenance, and accident concerns. The hazard associated with activation products is a function of the structural, PFC, and coolant materials that are used in the design, the power level of the machine, and the expected neutron fluence. B.2.2 Chemical Hazards Many fusion devices may use materials that are chemical hazards. For example, beryl- lium is the current plasma facing material of choice for ITER. It is toxic, and special precautions need to be taken to work with it, as demonstrated at the Joint European Torus (JET), a large tokamak in the United Kingdom. Vanadium, a potential low-activation structural material, is chemically hazardous when in the oxide form. Because of the production of metallic dust in the tokamak, the hazard of PFC materials that are not normally considered toxic in solid form needs to be examined.

B.2.3 Industrial Hazards Industrial hazards associated with fusion include asphyxiant gases, radio frequency (RF) fields, high voltage, magnetic fields, and heavy lifts. Many of the fusion machines will use super- conducting magnets and/or cryopumps that are cooled with liquid nitrogen and helium. Acci- dental release of these gases would displace oxygen and could be an occupational hazard (e.g., suffocation). Some fusion machines will use RF heating as a means to supply power to the plasma to obtain ignition. Some may use neutral beam injectors. Both have high-voltage hazards. The magnets used to confine the plasma can cause high external magnetic fields. The RF fields and magnetic fields are hazards that needs to be managed at the facility during opera- tion. None of these hazards are unique to fusion per se but are included for completeness. 166 DOE-STD-6003-96 Standards exist in other industries for dealing with these hazards to provide adequate protection for workers. B.3 Energy Sources In fusion a number of distributed energy sources could potentially induce accidents that can result in release of radioactivity or toxic materials. The amount of energy, the time scales for its release, and the potential consequences are a function of the specific fusion design. The var- ious energy sources are discussed below. B.3.1 Plasma Energy The fusion plasma generally contains very little stored energy (e.g., on the order of 1 GJ for ITER). However, because the fusion reaction is a reaction that takes place in the plasma, a complex control system may be needed to provide for control of the plasma during the reaction. This is known as plasma burn control. The control system contains a fueling system, a magnetic confinement and plasma position control system, a current drive system, an auxiliary heating system, an impurity control system, and a vacuum system. Failure in any of these systems would result in extinguishing the plasma, which may be accompanied by a plasma disruption. The plasma can disrupt very quickly and the energy contained in the plasma can be imparted to the plasma-facing materials very quickly (~ms), which can cause significant PFC armor tile abla- tion and/or melting. In addition, the plasma current will rapidly quench (time scale is ~ms to 1 s) and produce magnetically induced forces in the structures that must be accounted for in the design. B.3.2 Magnetic Energy The energy stored in the superconducting magnets of a fusion device can be very large. For ITER, the magnets will contain on the order of 100 GJ that can be released on the order of seconds to minutes as the result of arcing, shorts, or a quench with magnet discharge (loss of cryogen). Fusion designs must contain provisions for control and potential dissipation of this stored energy source without causing propagating faults in other systems. The most important aspect of magnet design from a safety viewpoint is to ensure that the magnet structural integrity and geometry are maintained for credible accident conditions so that magnet structural failure cannot result in the release of radioactive or toxic materials. B.3.3 Decay Heat The activation products produced during operation of a fusion device will generate decay heat. The level of decay heat may be on the order of 2 to 3% of the steady state operating power but is a function of the structural materials used and the accumulated neutron fluence. For smaller fusion devices, decay heat may not be a significant energy source because of the low power level and fluence expected. For ITER, operating at 1500 MW, the decay heat would be about 30 to 40 MW. Removal of this energy is needed during normal operation between pulses, during maintenance and bakeout, and during decommissioning to prevent overheating

167 DOE-STD-6003-96 of structures and volatilization of activation products. Because the decay heat is distributed throughout the entire structure, the overall power density is relatively low. B.3.4 Chemical Energy Large quantities of chemical energy can potentially be liberated by reaction of certain fusion materials with air or water under off-normal or accident conditions. Potential fusion materials include the following: PFCs—W, Be, C, Cu, Nb Structural Materials—stainless steel, ferritic steel, vanadium alloys Coolants—water, Li, LiPb, NaK, Na, Ga, He Most of the reactions between the PFCs and structural materials with water are exother- mic (some are endothermic). Alkali liquid metals (Li, NaK, and Na) produce exothermic reac- tions with air, water, and concrete. In the event of an assumed in-vessel reaction, the heat gen- erated by the reaction can cause the surrounding structures to heat up and volatilize activation products. Steam reactions can generate flammable or explosive concentrations of hydrogen. The magnitude of the chemical energy problem is a strong function of the materials that are used in the machine, the amount of material available for interaction, and the ability of the design to prevent the chemical interaction and to mitigate the consequences should it occur. In addition to these chemical hazards, the production of explosive levels of ozone from external radiation in cryogenic systems such as the cryostat needs to be considered. B.3.5 Coolant Internal Energy Pressurized coolants will be used in some of the components of fusion machines. Water is a common coolant for PFCs. Liquid nitrogen and liquid helium are used in cryopumps and the cryoplant. Liquid helium is also used to cool the superconducting magnets. The energy released during a sudden loss of coolant for all of these coolants needs to be considered in the design because of the high pressures that could be developed as a result of the spill. The case of an in- vessel loss of coolant water is a particular concern because the blowdown of water will produce steam that could react with the hot PFCs and generate hydrogen, as discussed previously. Many design options are available to deal with the pressurization potential of these coolants including having expansion volumes available to collect the gas and making the component (e.g., cryostat, vacuum vessel, and building) robust enough to handle the peak coolant pressure during the event. B.4 Potential Generic Accident Scenarios Past conceptual design studies on fusion power plants and recent safety analyses per- formed for current machines have identified a number of generic accident scenarios that need to be considered in determining the potential for the energy sources mentioned earlier to mobilize the radioactive and/or toxic materials available in a fusion machine. This section contains a brief 168 DOE-STD-6003-96 description of each class of accident that can be used as a starting point for a detailed machine- specific hazard analysis. B.4.1 Loss-of-Coolant Event Loss-of-coolant events (LCEs) refer to the actively cooled components that remove the fusion power (e.g., blanket, shield, vacuum vessel, or divertor cooling systems). The serious- ness of the event depends on the coolant being used in the design (e.g., water, liquid metal, and helium) and details of the design (e.g., segmentation of cooling loops, material, and length of piping).

Two types of LCEs have generally been considered in fusion conceptual design studies: in-vessel LCE and ex-vessel LCE. The in-vessel LCE would spill coolant into the torus that could cause pressurization and potential chemical reaction with hot PFC surfaces. The magni- tude of the pressurization is a function of the spill size, the coolant being used, the surface tem- perature of the PFC, the internal energy of the coolant, and for water the presence of condensa- tion surfaces. The introduction of coolant into the plasma chamber would result in a plasma disruption and terminate the plasma. Ex-vessel LCEs generally tend to be larger in terms of coolant loss than in-vessel LCEs because of the size of the ex-vessel piping that transports coolant to the heat removal systems (e.g., steam generator and heat exchanger). Rapid detection of ex-vessel LCE may be required so that the plasma shutdown system can terminate the plasma before damage would occur to the divertor and first wall. The time scale for such detection and shutdown is a strong function of the heat loads on the PFCs and could be on the order of seconds. B.4.2 Loss-of-Flow Event Both in-vessel and ex-vessel loss-of-flow events (LFEs) have been considered in past conceptual design studies for fusion machines. The consequences of such events are a strong function of the coolant material, the heat loads on the divertor and first wall, and the design of the heat transport systems. LFEs can lead to an in-vessel LCE because of the possibility of tube burnout if plasma shutdown is not accomplished quickly (in seconds). Ex-vessel LFEs tend to be dominated by loss of off-site power, which results in pump coastdown. Loss of pumping power would need to trigger the plasma shutdown system to pre- vent propagation of the LFE into an in-vessel LCE. For an in-vessel LFE, the concern is tube plugging or coolant channel blockage. Because of the small tubing in most in-vessel compo- nents, an in-vessel LFE would result in burn-through of the tube or channel wall and a small in- vessel LCE. The subsequent injection of coolant into the plasma chamber would terminate the plasma probably due to a plasma disruption. The system would then have to be cooled down and the failed tube or channel isolated and plugged to recover from the event. 169 DOE-STD-6003-96 B.4.3 Loss-of-Vacuum Event A loss-of-vacuum event (LVE) occurs when the vacuum inside the plasma chamber is lost. An LVE can occur as a result of a failure of a diagnostic window, port, or other seal due to either incipient flaws, wearout, radiation, embrittlement, or overpressurization of the plasma chamber due to an in-vessel LCE. The LVE can then provide a pathway for release of tokamak dust and any tritium gas from the vacuum vessel. The ingressed air can also react with hot PFC surfaces and generate additional chemical energy that could volatilize radioactivity from the PFC surface. The ultimate impact of such releases is a function of both in-vessel and ex-vessel features of the design. B.4.4 Plasma Transients

The two classes of plasma transients that are potentially important to safety are transient overpower events and plasma disruptions. A fusion overpower event can occur in an ignited plasma when a balance is not maintained between fusion generation and loss. The result is an increase in plasma temperature (and thereby thermal energy) until either a power balance is reestablished or a beta limit is exceeded. Exceeding a beta limit would trigger a disruption and shutdown the plasma. Plasma disruptions cover a range of transient events in which confine- ment of the plasma is lost and the plasma energy is transferred to the surrounding structure very quickly. The rapid energy transfer can cause armor tile ablation and/or melting. In addition, the plasma current will rapidly quench (time scale is 1 ms to 1 s) and generate magnetically induced forces in the structures that must be accounted for in the design. There are numerous initiators for plasma disruptions including thermal plasma excursions, impurities injected into the plasma, loss of plasma position control, and vertical displacement events. Many of these disruptions are considered to be anticipated operational occurrences and hence would need to be covered by the design. In addition, certain plasma disruptions will generate high-energy electrons, termed “runaway” electrons. These electrons can damage PFCs and be an initiator for a common mode failure of blanket and divertor cooling systems. B.4.5 Magnet Transients The major concern about magnet transients is the potential for propagating faults to other components of the fusion machine. The magnet faults of concern from an accident propagation viewpoint are off-normal forces that would produce large coil displacements, break off magnet pieces, and pull in ferrous missiles from other areas or arcs that could produce melting and volatilization in other components. In ITER, these events could have the potential to damage the vacuum vessel, ducts and piping from the vacuum vessel, and the cryostat and could potentially result in radioactivity release. Off-normal forces could arise from shorts in coils, faults in the dis- charge system, or power supply faults. Arcs between coils, arcs to ground, and arcs at open leads could lead to melting and/or volatilization. Arcs could arise from insulation faults, gas ingress, overvoltage, or other causes. 170 DOE-STD-6003-96 B.4.6 Loss of Cryogen Loss of cryogen (either helium or nitrogen) is a potential safety concern because the pressure that can be developed as a result of the leak can threaten radioactivity confinement barriers in the fusion machine, and the cryogen can displace oxygen and present a suffocation potential for personnel. For superconducting magnets, quenching of a superconductor without electrical discharge could lead to leakage or even local bursting of the superconductor and sub- sequent release of helium. Faults in the cryoplant can lead to flashing of liquid nitrogen. The amount of cryogen that can be released is a function of the design details of the cryoplant and of the superconducting magnets (if used). B.4.7 Tritium Plant Events The tritium processing and fueling/pumping systems contain inventories of tritium that can be released in the event of an accident that could breach the tritium confinement barrier system. Generally, tritium system design standards call for double or triple containment for components or systems that contain tritium that would tend to reduce the frequency of large releases. In addition, the potential for hydrogen explosions must be considered. Dispersion and oxidation characteristics will influence the severity of the hazard.

B.4.8 Auxiliary System Accidents Fusion machines may use a number of auxiliary systems associated with plasma heating, current drive, machine bakeout, and fueling. In general, accidents with these systems may include toxic materials and gram-quantities of tritium that may reside on individual components. B.4.8.1 Neutral Beams Neutral beam injectors may be used as a means of providing heating to the plasma during startup and operation. Operation of the beam without a plasma or misalignment in the chamber can lead to ablation and/or melting of material from the surface where the beam lands and potential release of radioactivity. Circuitry control interlocks and protective armor in the torus are usually employed to preclude this scenario from being credible. B.4.8.2 RF Heating Some fusion designs call for the use of RF heating to assist in startup and operation. Safety concerns related to the high power levels are adequately addressed in traditional electrical safety standards. B.4.8.3 Fuel System Pellet injectors are one method of fueling the core of the plasma. These injectors drive solid pellets (T, D, Li, etc.) into the plasma at high velocity (several km/s). The kinetic energy imparted by the injector can be large enough to warrant preventive safety measures, such as backstops. 171 DOE-STD-6003-96 B.4.8.4 Vacuum Pumps Fusion devices employ large vacuum pumps. Turbomolecular pumps generally have high-speed rotors that pose mechanical safety concerns. Vacuum reservoirs can be dangerous unless guarded to prevent personnel from being drawn against a leak location. Cryopumps have the additional concern of large gas inventories that may expand when the pumps are allowed to come to ambient temperature, causing pressurization and possible tritium contamination problems. B.4.8.5 Wall Conditioning and Bakeout Systems Wall conditioning of in-vessel components is performed by a variety of techniques (e.g., glow discharge cleaning, bakeout, and diborane deposition) to remove impurities from surfaces. In addition, external systems containing tritium may undergo bakeout and/or cleaning to reduce tritium inventories in the material. Accidents under these conditions need to be considered in addition to accidents during operation. B.4.8.6 Energy Storage Because of their pulsed operation, some fusion systems may use energy storage devices (e.g., alternating rotor and flywheel) in the power plant; the failure of these devices could pose a hazard not usually found in other power-conversion systems. B.4.9 Maintenance Events Activation of structures by fusion neutrons will require much of the maintenance of facili- ties such as ITER to be done remotely. While this may reduce direct exposure of personnel to radiation, the probability of accidentally breaking something is significantly increased. There will be hazards of fluid conduit rupture, activated dust dispersion, and similar kinds of events asso- ciated with remote maintenance. Also, for items removed to hot cells for maintenance or other activities, normal hazards associated with hot-cell facilities should be considered. 172 DOE-STD-0028-96 APPENDIX C REFERENCES AND SUPPLEMENTAL GUIDANCE CHAPTER 2 REFERENCES ACGIH “Threshold Limit Values for Chemical Substances and Physical Agents and Biological Exposure Indices,” published by the American Conference of Governmental Industrial Hygienists (ACGIH) 6500 Glenway Ave. Bldg. D-7, Cincinnati, Ohio 45211-4438, latest revi- sion. See also “Documentation of the Threshold Limit Values and Biological Exposure Indices,” published by ACGIH, latest revision.

AEC 1968 “Meteorology and Atomic Energy, 1968,” D. H. Slade, Editor, U.S. Atomic Energy Commission, Division of Technical Information, Oak Ridge, TN, July 1968. Alpen 1978 Alpen, E. L., “Magnetic Field Exposure Guidelines,” Chap. 3 in Proceedings of the Biomagnetics Effects Workshop, LBL-7452, Lawrence Berkeley Laboratory (April 6–7, 1978). Alpen 1979 Alpen, E. L., Letter to K. B. Baker (July 23, 1979). Brynda 1986 Brynda, W. J., et al., Non-reactor Nuclear Facilities: Standards and Criteria Guide, DOE/TIC-11603, BNL-51444, Rev. 1 (September 1986). 10 CFR 20 Code of Federal Regulations, “Standards for Protection Against Radiation,” Title 10, Part 20, “Radiation Dose Limits for Individual Members of the Public,” Subpart D, Washington, D.C., Nuclear Regulatory Commission (May 21, 1991). 10 CFR 61 Code of Federal Regulations, “Licensing Requirements for Land Disposal of Radioactive Waste,” Title 10, Part 61, Washington, D.C., Nuclear Regulatory Commission (December 27, 1982, amended August 15, 1991). 10 CFR 835 Code of Federal Regulations, “Occupational Radiation Protection,” Title 10, Part 835, “Accidents and Emergencies,” Subpart N; “Occupational exposure limits for general employees,” Sect. 835,202; “Facility design and modifications,” Sect. 835.1002; and “Emergency Exposure Situations,” Sect. 835.1302, Washington, D.C., U.S. Department of Energy. 29 CFR 1910 Code of Federal Regulations, “Occupational Safety and Health Standards,” Title 29, Part 1910.1000, “Air Contaminants,” 173 DOE-STD-0028-96 Washington, D.C., Occupational Safety and Health Administration (January 19, 1989, amendments through July 1, 1992). 40 CFR 61 Code of Federal Regulations, “National Emission Standards for Hazardous Air Pollutants,” Title 40, Part 61, Washington, D.C., Environmental Protection Agency (December 15, 1989). Chanin 1990 Chanin, D. I., et al., MELCOR Accident Consequence Code System (MACCS), Report NUREG/CR-4691 (SAND-86-1562) (1990). Craig 1993 Craig, D. K., et al., “Toxic Chemical Hazard Classification and Risk Acceptance Guidelines for Use in DOE Facilities,” Workshop of the Safety Analysis Working Group of the Energy Facility Contractors Operating Group, Denver, Colorado (June 16–18, 1993). DHHS 1993 Toxicological Profile for Beryllium, U.S. Department of Health and Human Services, Public Health Service, Agency for Toxic Sub- stances and Disease Registry (April 1993). DOE 1994 “Radiation Control Manual,” Chap. 2, Part 1, “Administrative Control Levels and Dose Limits,” DOE/EH-0256T, U.S. Department of Energy, Washington, D.C., 1994. DOE 1996 United States Department of Energy Standard, “Safety of Magnetic Fusion Facilities: Requirements,” DOE-STD-6002-96, 1995. EPA 1991 “Manual of Protective Action Guides and Protective Actions for Nuclear Incidents,” PB92-164763, U.S. Environmental Protection Agency, Washington, D.C. (October 1991). FDA 1982 Department of Health and Human Services, Food and Drug Adminis- tration, “Accidental Radioactive Contamination of Human Food and Animal Feeds; Recommendations for State and Local Agencies,” Federal Register Vol. 47, No. 205 (October 22, 1982), pp. 47073 ff. Finkel 1983 Hamilton and Hardy’s Industrial Toxicology, Fourth Edition, revised by A. J. Finkel, John Wright PSG Inc., Boston (1983). 51 FR 30028 Nuclear Regulatory Commission, “Safety Goals for the Operations of Nuclear Power Plants; Policy Statement; Republication,” Federal Register Vol. 51, No. 162 (August 21, 1986), pp. 30028–30033.

ICRP 1977 International Commission on Radiological Protection, Recommenda- tions of the International Commission on Radiological Protection, ICRP Publication 26, Pergamon Press, New York (1977). 174 DOE-STD-0028-96 ICRP 1979 International Commission on Radiological Protection Publication 30 Part 1, “Limits for Intakes of Radionuclides by Workers,” Annals of the ICRP, Vol. 2, No. 3/4, Pergamon Press, Elmsford, New York (1979). ICRP 1979a International Commission on Radiological Protection Publication 30 Supplement to Part 1, “Limits for Intakes of Radionuclides by Workers,” Annals of the ICRP, Vol. 3, No. 14, Pergamon Press, Elmsford, New York (1979). ICRP 1980 International Commission on Radiological Protection Publication 30 Part 2, “Statement and Recommendations of the 1980 Brighton Meeting of the ICRP,” Annals of the ICRP, Vol. 4, No. 3/4, Pergamon Press, Elmsford, New York (1980). ICRP 1980a International Commission on Radiological Protection Publication 30 Supplement to Part 2, “Limits for Intakes of Radionuclides by Workers,” Annals of the ICRP, Vol. 5, No. 16, Pergamon Press, Elmsford, New York (1980). ICRP 1981 International Commission on Radiological Protection Publication 30 Part 3, “Limits for Intakes of Radionuclides by Workers,” Annals of the ICRP, Vol. 6, No. 2/3, Pergamon Press, Elmsford, New York (1981). ICRP 1991 International Commission on Radiological Protection, Recommenda- tions of the International Commission on Radiological Protection, ICRP Publication 60, Pergamon Press, New York (1991). Miller 1987 Miller, G., “Exposure Guidelines for Magnetic Fields,” American Industrial Hygiene Association Journal, 49, 12 (December 1987) pp. 957–968. MPH 1977 “Maximum Permissible Levels of Exposure to Static Magnetic Fields at Work with Magnetic Installations and Magnetic Materials,” Docu- ment No. 1742-77, Ministry of Public Health, Moscow (1977) (in Russian). MPH 1985 “Maximum Permissible Levels of Magnetic Fields with the Frequency of 50 Hz,” Document No. 3206-85, Ministry of Public Health, Moscow (1985). Napier 1988 Napier et al., “GENII—The Hanford Environmental Radiation Dosimetry Software System,” PNL-6584, Vols. 1–3, Pacific North- west Laboratory, Richland, Washington (1988). 175 DOE-STD-0028-96 NCRP 1987 National Council on Radiation Protection and Measurements, Recommendations on Limits for Exposure to Ionizing Radiation, NCRP Report No. 91, National Council on Radiation Protection and Measurements, Bethesda, Maryland (1987). NCRP 1993 National Council on Radiation Protection and Measurements, Limitations of Exposure to Ionizing Radiation, NCRP Report IV.116 National Council on Radiation Protection and Measurements, Bethesda, Maryland (1993). NIOSH 1994 NIOSH Pocket Guide to Chemical Hazards, DHHS (NIOSH) Publica- tion 94-116, National Institute of Occupational Safety and Health, Cincinnati, Ohio (1994). NOAA 1989 Start, G. E., et al., “Atmospheric Diffusion for Airflows in the Vicinity of the James Forrestal Campus, Princeton University,” U.S. Depart- ment of Commerce National Oceanic and Atmospheric Administra- tion, Idaho Falls, Idaho (May 1989). Parks 1992 Parks, B. S., User’s Guide for CAP-88-PC, Version 1.0, 402-B0-92- 001, U.S. Environmental Protection Agency, Office of Radiation Programs, Las Vegas Facility, Las Vegas, Nevada (March 1992). Wenzel 1993 Wenzel, D. R., “The Radiological Safety Analysis Computer Program (RSAC-5) User’s Manual,” WINCO-1123, Westinghouse Idaho Nuclear Company, Idaho Falls, Idaho (October 1993).

CHAPTER 3 REFERENCES DOE 1993a U.S. Department of Energy, Federal Environmental Standards of Potential Importance to Operations and Activities at U.S. Department of Energy Sites, DOE/RL/01830-H15, June 1993, Draft. DOE 1993b U.S. Department of Energy, Recommendations for the Preparation of Environmental Assessments and Environmental Impact Statements, Office of NEPA Oversight, May 1993. CHAPTER 4 REFERENCES DOE-STD-1073-93 Guide for Operational Configuration Management Programs, Includ- ing the Adjunct Programs of Design Reconstitution and Material Condition and Aging Management. DOE-ER-STD-6001-92 Implementation Guide for Quality Assurance Programs for Basic and Applied Research. 176 http://www.doe.gov/html/techstds/standard/std1073/std1073.pdf DOE-STD-0028-96 SG 830.120 Safety Guide for Quality Assurance. SG 830.310 Guidelines for the Conduct of Operations at DOE Facilities. DOE-STD-1030-92 Guide to Good Practices for Lockout and Tagout. DOE-STD-1031-92 Guide to Good Practices for Communications. DOE-STD-1032-92 Guide to Good Practices for Operations Organization and Administration. DOE-STD-1033-92 Guide to Good Practices for Operations and Administration Updates through Required Reading. DOE-STD-1034-92 Guide to Good Practices for Timely Orders to Operators. DOE-STD-1035-92 Guide to Good Practices for Logkeeping. DOE-STD-1036-92 Guide to Good Practices for Independent Verification. DOE-STD-1037-93 Guide to Good Practices for Operations Aspects of Unique Processes. DOE-STD-1038-93 Guide to Good Practices for Operations Turnover. DOE-STD-1039-93 Guide to Good Practices for Control of Equipment and System Status. DOE-STD-1040-93 Guide to Good Practices for Control of On-shift Training. DOE-STD-1041-93 Guide to Good Practices for Shift Routines and Operating Practices. DOE-STD-1042-93 Guide to Good Practices for Control Area Activities. DOE-STD-1043-93 Guide to Good Practices for Operator Aid Postings. DOE-STD-1044-93 Guide to Good Practices for Equipment and Pipe Labeling. DOE-STD-1045-93 Guide to Good Practices for Notification and Investigation of Abnormal Events. ANS 15.16 Emergency Planning for Research Reactors. NFPA 1561 Standard on Fire Department Incident Management System. 177 http://www.doe.gov/html/techstds/standard/std1030/std1030.pdf http://www.doe.gov/html/techstds/standard/std1031/std1031.pdf http://www.doe.gov/html/techstds/standard/std1032/std1032.pdf http://www.doe.gov/html/techstds/standard/std1033/std1033.pdf http://www.doe.gov/html/techstds/standard/std1034/std1034.pdf http://www.doe.gov/html/techstds/standard/std1035/std1035.pdf http://www.doe.gov/html/techstds/standard/std1036/std1036.pdf http://www.doe.gov/html/techstds/standard/std1037/std1037.pdf http://www.doe.gov/html/techstds/standard/std1038/std1038.pdf http://www.doe.gov/html/techstds/standard/std1039/std1039.pdf http://www.doe.gov/html/techstds/standard/std1040/std1040.pdf http://www.doe.gov/html/techstds/standard/std1041/std1041.pdf http://www.doe.gov/html/techstds/standard/std1042/std1042.pdf http://www.doe.gov/html/techstds/standard/std1043/std1043.pdf http://www.doe.gov/html/techstds/standard/std1044/std1044.pdf http://www.doe.gov/html/techstds/standard/std1045/std1045.pdf DOE-STD-0028-96 DOE-STD-1050-93 Planning, Scheduling, and Coordination of Maintenance at DOE Nuclear Facilities. DOE-STD-1051-93 Maintenance Organization and Administration at DOE Nuclear Facilities. DOE-STD-1052-93 Types of Maintenance Activities at DOE Nuclear Facilities.

DOE-STD-1053-93 Control of Maintenance Activities at DOE Nuclear Facilities. DOE-STD-1054-93 Control and Calibration of Measuring and Test Equipment at DOE Nuclear Facilities. DOE-STD-1055-93 Maintenance Management Involvement at DOE Nuclear Facilities. DOE-STD-1059-93 Practices for Maintenance Supervisor Selection and Development. DOE-STD-1064-94 Guideline to Good Practices for Seasonal Facility Preservation at DOE Nuclear Facilities. DOE-STD-1065-94 Guideline to Good Practices for Post Maintenance Testing at DOE Nuclear Facilities. DOE-STD-1067-94 Guidelines to Good Practices for Maintenance Facilities, Equipment, and Tools at DOE Nuclear Facilities. DOE-STD-1069-94 Guideline to Good Practices for Maintenance Tools and Equipment Control at DOE Nuclear Facilities. 10 CFR 830 Nuclear Safety Management. SG 830.330 Guidelines for the Selection, Training, Qualification and Certification of Personnel at DOE Nuclear Facilities. 29 CFR 1910 OSHA Regulations. 29 CFR 1926 OSHA Construction Regulations. DOE-HDBK-1074-95 DOE Handbook—Alternative Systematic Approaches to Training. DOE-STD-0101T-91 Training Accreditation Program Manual [TAP-1]. DOE-STD-0102T-91 Performance Based Training Manual [TAP-2]. DOE-STD-0103T-91 Training Program Support Manual [TAP-3]. 178 http://www.doe.gov/html/techstds/standard/std1051/std1051.pdf http://www.doe.gov/html/techstds/standard/std1054/std1054.pdf http://www.doe.gov/html/techstds/standard/std1055/std1055.pdf http://www.doe.gov/html/techstds/standard/std1059/std1059.pdf http://www.doe.gov/html/techstds/standard/std1067/std1067.pdf http://www.doe.gov/html/techstds/standard/hdbk1074/hdbk1074.pdf DOE-STD-0028-96 DOE-NE-STD-1001-91 DOE Guideline—Guide to Good Practices for Training and Qualifi- cation of Instructors. DOE-NE-STD-1001-91 DOE Guideline—Guide to Good Practices for Training and Quali- fication of Instructors. DOE-NE-STD-1002-91 DOE Guideline—Guide to Good Practices for Training and Quali- fication of Chemical Operators. DOE-NE-STD-1003-91 DOE Guideline—Guide to Good Practices for Training and Quali- fication of Maintenance Personnel. DOE-STD-1005-92 DOE Guideline—Guide to Good Practices for Developing Learning Objectives. DOE-STD-1006-92 DOE Guideline—Guide to Good Practices Evaluation Instrument Examples. DOE-STD-1007-92 DOE Guideline—Guide to Good Practices for Teamwork Training and Diagnostic Skills Development. DOE-STD-1008-92 DOE Guideline—Guide to Good Practices for Training of Technical Staff and Managers. DOE-STD-1009-92 DOE Guideline—Guide to Good Practices for the Development of Test Items. DOE-STD-1010-92 DOE Guideline—Guide to Good Practices for Incorporating Operat- ing Experiences. DOE-STD-1011-92 DOE Guideline—Guide to Good Practices for the Design, Develop- ment, and Implementation of Examinations. DOE-STD-1012-92 DOE Guideline—Guide to Good Practices for On-The-Job Training. DOE-STD-1029-92 DOE Standard—Writer’s Guide for Technical Procedures. DOE-STD-1056-93 DOE Standard—Guide to Good Practices for Line and Training Manager Activities Related to Training. DOE-STD-1057-93 Guide to Good Practices for the Selection, Training and Qualification of Shift Technical Advisors. DOE-STD-1058-93 Guide to Good Practices for Developing and Conducting Case Studies. 179

http://www.doe.gov/html/techstds/standard/std1005/std1005.pdf http://www.doe.gov/html/techstds/standard/std1006/std1006.pdf http://www.doe.gov/html/techstds/standard/std1007/std1007.pdf http://www.doe.gov/html/techstds/standard/std1008/std1008.pdf http://www.doe.gov/html/techstds/standard/std1009/std1009.pdf http://www.doe.gov/html/techstds/standard/std1010/std1010.pdf http://www.doe.gov/html/techstds/standard/std1011/std1011.pdf http://www.doe.gov/html/techstds/standard/std1012/std1012.pdf http://www.doe.gov/html/techstds/standard/std1056/std1056.pdf http://www.doe.gov/html/techstds/standard/std1057/std1057.pdf http://www.doe.gov/html/techstds/standard/std1058/std1058.pdf DOE-STD-0028-96 DOE-STD-1059-93 Guide to Good Practices for Maintenance Supervisor Selection and Development. DOE-STD-1060-93 Guide to Good Practices for Continuing Training. DOE-STD-1061-93 Guide to Good Practices for the Selection, Training, and Qualifica- tion of Shift Supervisors. DOE/EH-0256T Rev. 1 DOE Radiological Control Manual. DOE/EH-0353P Occupational Safety and Health Technical Reference Manual. TRADE Document Job Task Analysis—Guide to Good Practices: Volumes I & II. TTR89-009 TRADE Document The Occasional Trainer’s Handbook, 1992. TTR92-010 CHAPTER 5 REFERENCES 10 CFR 830.120 Code of Federal Regulations, “Nuclear Safety Management,” Title 10, Part 830, Subpart 120, “Quality Assurance Requirements,” May 5, 1994. 40 CFR 1502.22 Code of Federal Regulations, “Environmental Impact Statement,” Title 40, Part 1502, Subpart 22, “Incomplete or Unavailable Information,” Nov. 29, 1978. DOE 1986 United States Department of Energy Order, “Safety Analysis and Review System,” DOE 5481.1B, September 23, 1986. DOE 1991 United States Department of Energy Order, “Unreviewed Safety Questions,” DOE Order 5480.21, December 24, 1991. DOE 1992a United States Department of Energy Order, “Technical Safety Requirements,” DOE 5480.22, February 25, 1992. DOE 1992b United States Department of Energy Order, “Nuclear Safety Analysis Reports,” DOE 5480.23, April 30, 1992. DOE 1992c United States Department of Energy Order, “Planning and Preparedness for Operational Emergencies,” DOE 5500.3, Feb. 27, 1992. DOE 1992d United States Department of Energy Standard, “Hazard Categoriza- tion and Accident Analysis Techniques for Compliance with DOE 180 http://www.doe.gov/html/techstds/standard/std1059/std1059.pdf http://www.doe.gov/html/techstds/standard/std1060/std1060.pdf http://www.doe.gov/html/techstds/standard/std1061/std1061.pdf DOE-STD-0028-96 Order 5480.23, Nuclear Safety Analysis Reports,” DOE-STD-1027- 92, December 1992. DOE 1993 United States Department of Energy Standard, “Planning and Conduct of Operational Readiness Reviews,” DOE-STD-3006-93, November 1993. DOE 1994 United States Department of Energy Standard, “Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports,” DOE-STD-3009-94, July 15, 1994. DOE 1995a United States Department of Energy Order, “Facility Safety,” DOE Order 420.1, October 13, 1995. DOE 1995b United States Department of Energy Order, “Startup and Restart of Nuclear Facilities,” DOE 425.1, October 26, 1995. Elder 1986 Elder, J. C. et al., “A Guide to Radiological Considerations for Siting and Design of DOE Nonreactor Nuclear Facilities,” LA-10294-MS, January 1976. EPA 1991 Environmental Protection Agency Manual, “Manual of Protective Action Guides and Protective Actions for Nuclear Incidents,” EPA 400-R-92-001, PB92-164763, October 1991.

NRC 1974 United States Nuclear Regulatory Commission, “Assumption used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Boiling Water Reactors,” Regulatory Guide 1.3, June 1974, Rev 2. NRC 1978 Planning Basis for the Development of State and Local Government Radiological Emergency Response Plans in Support of Light Water Nuclear Power Plants, NUREG-0396, EPA 520/1-78-016, December 1978. NRC 1983 United States Nuclear Regulatory Commission, “Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants,” Regulatory Guide 1.145, February 1983, Reissue Rev. 1. CHAPTER 6 REFERENCES ACI 1989 ACI 318, “Building Code Requirements for Reinforced Concrete,” 1989. 181 DOE-STD-0028-96 AISC 1986a AISC, “Manual of Steel Construction and Specification for the Design, Fabrication and Erection of Structural Steel for Buildings,” 9th Ed., 1986. AISC 1986b AISC-LRFD, “Load and Resistance Factor Design Specification for Structural Steel Buildings,” 1st Ed., 1986. ANS 1985 Design Guide, Manipulators, Auxiliary Tools, and Handling Devices, ANS 11.9, Feb. 1985. ANSI 1984 ANSI/AISC N690, “Nuclear Facilities Steel Safety Related Structures Design, Fabrication and Erection,” 1984. ANSI 1993a ANSI/ASME Standard B31.3, “Chemical Plant and Petroleum Refinery Piping” (1993). ANSI 1993b ANSI/ASCE, “Minimum Design Loads for Buildings and Other Structures,” 7-93, ASCE. ASCE 1980 “Structural Analysis and Design of Nuclear Plant Facilities,” ASCE, Manual No. 58, 1980. ASHRAE 1988 ASHRAE, “Design Guide for Department of Energy Nuclear Facilities,” ISBN 1-883413-03-6. ASHRAE 1991 ASHRAE Handbook of HVAC Application, 1991, Chap. 24, “HVAC for Nuclear Facilities.” ASME 1989a ASME N509, “Nuclear Power Plant Air-Cleaning Units and Components,” 1989. ASME 1989b ASME N510, “Testing of Nuclear Air Treatment Systems,” 1989. ASME 1992 ASME Boiler and Pressure Vessel Code, 1992 Ed. with 1993 Addenda. ASME 1993 ASME AG-1, “Code on Nuclear Air and Gas Treatment,” 1993. Brereton 1989 Brereton, S. J., “Explosion Hazard in Liquid Nitrogen-Cooled Fusion Systems,” Fusion Technology, 15, pp. 833–837 (1989). 10 CFR 20 Code of Federal Regulations, “Standards for Protection Against Radiation,” Title 10, Part 20, “Radiation Dose Limits for Individual Members of the Public,” Subpart D, Washington, D.C., Nuclear Regulatory Commission (May 21, 1991). 182 DOE-STD-0028-96 10 CFR 835 Code of Federal Regulations, “Occupational Radiation Protection,” Title 10, Part 835, “Accidents and Emergencies,” Subpart N; “Occupational exposure limits for general employees,” Section 835,202; “Facility design and modifications,” Section 835.1002; and “Emergency Situations,” Section 835.1302, Washington, D.C., U.S. Department of Energy. 29 CFR 1910 Code of Federal Regulations, “Occupational Safety and Health Standards,” Title 29, Part 1910.1000, “Air Contaminants,” Washington, D.C., Occupational Safety and Health Administration (January 19, 1989, amendments through July 1, 1992). 10 CFR 20 Code of Federal Regulations, “Standards for Protection Against Radiation,” Title 10, Part 20, “Radiation Dose Limits for Individual Members of the Public,” Subpart D, Washington, D.C., Nuclear Regulatory Commission (May 21, 1991). DOE 1984 United States Department of Energy Order, “Environmental Protec- tion, Safety and Health Protection Standards,” DOE 5480.4 (1984). DOE 1989 United States Department of Energy Order, “General Design Criteria,” DOE 6430.1A (1989).

DOE 1990 United States Department of Energy Order, “Radiation Protection for Occupational Workers,” DOE Order 5480.11, June 1990. DOE 1993a United States Department of Energy Order, “Fire Protection,” DOE 5480.7A (1993). DOE 1993b United States Department of Energy Standard, “Natural Phenomena Hazards Performance Categorization Guidelines for Structures, Systems, and Components,” DOE-STD-1021-93 (1993). DOE 1993c United States Department of Energy Standard, “Natural Phenomena Hazards Site Characterization Criteria,” DOE-STD-1022-93 (1993). DOE 1994a United States Department of Energy Standard DOE-STD-3009-94, “Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports” (1994). DOE 1994b United States Department of Energy Standard, “Natural Phenomena Hazards Design and Evaluation Criteria for Department of Energy Facilities,” DOE-STD-1020-94 (1994). DOE 1994c DOE Handbook DOE-HDBK-1079-94, “Primer on Tritium Safe Handling Practices,” 1994. 183 DOE-STD-0028-96 DOE 1995a United States Department of Energy Order, “Facility Safety,” DOE Order 420.1, October 13, 1995. DOE 1995b United States Department of Energy Standard, “Natural Phenomena Hazards Assessment Criteria,” DOE-STD-1023-95 (1995). IAEA 1981 IAEA Technical Reports Series No. 203, “Handling of Tritium-Bearing Wastes,” 1981. IAEA 1991 IAEA Technical Reports Series No. 324, “Safe Handling of Tritium— Review of Data and Experience,” 1991. IEC 1989 IEC 964, “Design for Control Rooms of Nuclear Power Plants,” 1989. IEEE 1974 IEEE 383-1974, “Electrical Cables, Field Splices, and Connections for Nuclear Power Generating Stations,” 1974. IEEE 1980 Institute of Electrical and Electronic Engineers, “Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Equipment,” IEEE Std 308. IEEE 1983 IEEE 323-1983, “Qualifying Class 1E Equipment for Nuclear Power Generating Stations,” 1983. IEEE 1984 IEEE Std 730-1984, “IEEE Standard for Software Quality Assurance Plans” (1984). IEEE 1993 IEEE 338 Std., Standard Criteria for the Periodic Testing of Nuclear Power Generating Station Class 1E Power and Protection Systems (1993). IEEE 1987 IEEE 344-1987, “Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations,” 1987. IEEE 1988 IEEE 379-1988, “Single-Failure Criterion to Nuclear Power Generat- ing Station Safety Systems,” 1988. IEEE 1991 IEEE 603-1991, “Criteria for Safety Systems for Nuclear Power Generating Stations,” 1991. IEEE 1992 IEEE 384-1992, “Independence of Class 1E Equipment and Circuits,” 1992. NASA 1991 Force Reflecting Hand Controller for Manipulator Teleoperation, Section 1.3, Final Technical Report NASA Contract NAS7-1069, 1991. 184 DOE-STD-0028-96 NET 1993 NET Team, “Next European Torus Predesign Report,” Fusion Engineering and Design, 21, pp. 335–338 (1993). NRC 1989 United States Nuclear Regulatory Commission, “A Summary of Hydrogen-Air Detonation Experiments,” NUREG/CR-4961 (1989). Smolik 1991 Smolik, G. R., B. J. Merrill, S. J. Piet, and D. F. Holland, “Evaluation of Graphite/Steam Interactions for ITER Accident Scenarios,” Fusion Technology, 19, pp. 1342–1348 (1991). Smolik 1992 Smolik, G. R., B. J. Merrill, and R. S. Wallace, “Implications of Beryllium: Steam Interactions in Fusion Reactors,” Journal of Nuclear Materials, 191–194, pp. 153–157 (1992). UBC 1991 “Uniform Building Code,” International Conference of Building Officials, Whittier, CA, 1991.

API 620 Design and Construction of Large, Welded, Low-Pressure Storage Tanks, Eighth Edition; Errata—1992. Locator Code E-07-21. API 650 Welded Steel Tanks for Oil Storage, Ninth edition, DoD Adopted. Locator Code E-07-21. IEEE 338 Standard Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems (R 1993). Locator Code R-34-11. ANSI Standards C50.10 Rotating Electrical Machinery—Synchronous Machines—and C50.12–C50.10-90 17 pp. Locator Codes F-02-03, A-51-13, A-47-23, A-47-01, A-47-25. C50.12—Salient-Pole Synchronous Generators and Generator/Motors for Hydraulic Turbine Applications, Requirements for (R 1989). Locator Code A-47-25. NEMA Standard Publication MG-1-93 Motors and Generators. Locator Code A-45-01. IEEE Standard Guide: Test Procedures for Synchronous Machines (R 1991). 115–115-83 Locator Codes A-47-23, A-47-25. 115A-87—Standard Procedures for Obtaining Synchronous Machine Parameters by Standstill Frequency Response Testing (Supplement to ANSI/IEEE Std 115-1983) Locator Codes A-47-23, A-47-25. IEEE Standard 386-85 Standard for Separable Insulated Connector Systems for Power Distribution Systems Above 600 V (R 1991) DoD Adopted. Locator Code A-18-07. 185 DOE-STD-0028-96 ANSI Standards Application Guide for AC High-Voltage Circuit Breakers C37.010 and C37.13.– Rated on a Symmetrical Current Basis (R 1989); Supplement C37.010-79 C37.010D—1984, Supplement C37.010E- 1985. C37.010B-85— Standard for Emergency Load Current-Carrying Capability (Supplement to ANSI/IEEE C37.010-1979, IEEE Application Guide for AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis). C37.013-93—Standard for AC High Voltage Generator Circuit Breakers Rated on a Symmetrical Current. IEEE Standard 485-83 Recommended Practice for Sizing Large Lead Storage Batteries for Generating Stations and Substations. Locator Code A-01-11. NFPA 70-93 National Electrical Code—DoD Adopted. Locator Code A-90-30. 70A-93—Electrical Code for One and Two Family Dwellings. Locator Code A-90-30. 70E-88—Standard for Electrical Safety, Require- ments for Employee Workplaces. Locator Code S-08-10. IEEE Standards 317-83 Standard for Electric Penetration Assemblies in Containment Struc- tures for Nuclear Power Generating Stations (R 1992). Locator Code A-09-27. USNRC Regulatory Electric Penetration Assemblies in Containment Structures Guide 1.63 for Nuclear Power Plants, Rev. 3, Feb. 1987. USNRC Regulatory Physical Independence of Electric Systems—Rev. 2, Guide 1.75 Sept. 1978. IEEE Standard 387 Standard Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations (See also Regulatory Guide 1.9). IEEE Standard 80-86 Guide for Safety in AC Substation Grounding (R 1991). Locator Code A-31-15. IEEE Standard 142-91 Recommended Practice for Grounding of Industrial and Commercial Power Systems (IEEE Green Book) Correction Sheet, May 1993. Locator Code A-09-03. ANSI Standard C62.2-87—Guide for the Application of Gapped Silicon— C-62 series Carbide Surge Arresters for Alternating Current Systems —C62.11- 87—Standard for Metal-oxide Surge Arresters for AC Power circuits. C62.22-91—Guide for the Applications of Metal-Oxide Surge Arresters for Alternating-Current Systems. C62.32-81—Standard Test Specifications for Low-Voltage Air Gap Surge-Protective Devices (excluding Valve and Expulsion Devices) (R 1994). C62.33- 82—Standard Test Specifications for Varistor Surge—Protective Devices (R 1989). C62.41-91—IEEE Recommended Practice on

186 DOE-STD-0028-96 Surge Voltages in Low-Voltage AC Power Circuits. C62.42-92— Guide for the Application of Gas Tube and Air Gap Arrester Low- Voltage (Equal to or Less Than 100 Vrms or 1200 Vdc) Surge- Protective Devices. C62.45-92—Guide on Surge Testing for Equipment Connected to Low-Voltage AC Power Circuits. C62.47- 92—Guide on Electrostatic Discharge (ESD): Characterization of the ESD Environments. C62.61-85—Gas Tube Surge Arresters on Wire Line Telephone Circuits. Locator Code F-33-45. C62.92 PT I-87— Guide for the Application of Neutral Grounding in Electrical Utility Systems Part I—Introduction (Revision of IEEE Std 143-1954). C62.92 PT II-89—Guide for the Application of Neutral Grounding in Electrical Utility Systems Part II—Grounding of Synchronous Generator Systems. C62.92-4-91—Guide for the Applications of Neutral Grounding in Electrical Utility Systems, Part IV—Distribution. C62.92.5-92—Guide for the Application of Neutral Grounding in Electrical Utility Systems, Part V—Transmission Systems and Subtransmission Systems—41 pp. NFPA Standard 780-92 Lightning Protection Code. Locator Code C-51-80. EIA Standard RS-170-57 Monochrome Television Studio Facilities, Electrical Performance Standards (Replaced by SMPTE 170M—1993). NEMA ICS-6 Enclosures for Industrial Control and Systems; Revision 1—March 1989. DoD Adopted. Locator Code A-08-01. ASME NOG-1-89 Rules for Construction of Overhead and Gantry Cranes (Top Running Bridge, Multiple Girder): Special Errata—1990. Locator Code S-05-05. NOG-1A-90—Addenda to NOG-1 Rules for Con- struction of Overhead and Gantry Cranes (Top Running Bridge, Multiple Girder). Locator Code S-05-05. ANSI B30.2-90 Overhead and Gantry Cranes (Top Running Bridge, Single or Multiple Girder. Top Running Trolley Hoist). B30.2A-91—Addenda to B30.2 Overhead and Gantry Cranes (Top Running Bridge, Single or Multiple Girder, Top Running Trolley Hoist). B30.2b-92—Addenda to B30.2 Overhead and Gantry Cranes. B30.2c-93—Addenda to B30.2 Overhead and Gantry Cranes. ANSI B30.10-93 Hooks. NEMA ICS-1-88 General Standards for Industrial Control and Systems; Revision 1— May 1989, Rev. 2—January 1990. DoD Adopted Locator Code F-25-01. ICS 1.1-84—Safety Guidelines for the Application Installa- tion and Maintenance of Solid State Control; Revision 1—October 1987 (R 1988). Locator Code F-25-01. ICS 1.3-86—Preventive Main- 187 DOE-STD-0028-96 tenance of Industrial Control and Systems Equipment (R 1991). Locator Codes A-90-55, F-26-01, F-90-63. NEMA WC-3 Rubber-Insulated Wire and Cable for the Transmission and Dis- tribution of Electrical Energy (R 1986) (ICEA S-19-81); Rev. 1, Jan. 1983, Rev. 2—Dec. 1984, Rev. 3—Aug. 1986, Rev. 4—Jul. 1987, Rev. 5—May 1988, Rev. 6—May 1989. Locator Code A-33-11. ANSI C2 C2-93—National Electrical Safety Code. C2.16-92—Guide for Thermal-Spray Operator Qualification. C2.18-93—Guide for the Protection of Steel with Thermal Sprayed Coatings of Aluminum and Zinc and Their Alloys and Composites. ANSI B30.1 and B30.16 B30.1-92—Jacks. B30.16—Overhead Hoists (Underhung), and B30.16 Includes Interpretations. CHAPTER 7 REFERENCES 10 CFR 40 Code of Federal Regulations, "Domestic Licensing of Source Material," Title 10, Part 40, Washington, D.C., Nuclear Regulatory Commission. 10 CFR 50 Code of Federal Regulations, “Reporting and Recording for Decom- missioning Planning,” Title 10, Part 50, Sect. 75, Washington, D.C., Nuclear Regulatory Commission (June 27, 1988).

10 CFR 60 Code of Federal Regulations, “Disposal of High Level Radioactive Wastes in Geologic Repositories,” Title 10, Part 60, Washington, D.C., Nuclear Regulatory Commission (February 25, 1982, as amended). 10 CFR 61 Code of Federal Regulations, “Licensing Requirements for Land Disposal of Radioactive Waste,” Title 10, Part 61, Washington, D.C., Nuclear Regulatory Commission (December 30, 1982). DOE 1990 United States Department of Energy Order, “Radiation Protection of the Public and the Environment,” DOE 5400.5 (February 8, 1990). DOE 1993 United States Department of Energy Order, “General Design Criteria,” DOE 6430.1A, April 6, 1989, modified October 20, 1993, Sects. 1300, 1326, and 1328. DOE 1994 “Radiation Control Manual,” Chap. 2, Part 1, “Administrative Control Levels and Dose Limits,” DOE/EH-0256T, U.S. Department of Energy, Washington, D.C., 1994. 188 DOE-STD-0028-96 Fetter 1988 Fetter, S., E. T. Cheng, and F. M. Mann, “Long-Term Radioactivity in Fusion Reactors,” Fusion Engineering and Design, Vol. 6, 1988, pp. 123–130. Kennedy 1983 Kennedy, Jr., W. E., and P. A. Peloquin, “Potential Low-level Waste Disposal Limits for Activation Products from Fusion,” PNL-4844 (Richland, WA: Pacific Northwest Laboratory, September 1983); W. E. Kennedy, Jr., and F. M. Mann, “Potential Low-level Disposal Limits for Fusion Radionuclides,” Transactions of the American Nuclear Society, Vol. 45, 51 (1983). Maninger 1985 Maninger, R. C., “Impact of Long-lived Radionuclides on Waste Classification for Fusion,” Transactions of the American Nuclear Society, Vol. 49, 65 (1985); R. C. Maninger, “Qualitative Compari- sons of Fusion Reactor Materials for Waste Handling and Disposal,” Fusion Technology, Vol. 8, 1367 (July 1985); R. C. Maninger and D. Dorn, “Radiation Safety Criteria for Maintenance and Waste Management in the Mirror Advanced Reactor Study,” Fusion Technology, Vol. 6, 616 (November 1984). NRC 1981 U.S. Nuclear Regulatory Commission, “Draft Environmental Impact Statement on 10 CFR Part 61 ‘Licensing Requirements for Land Disposal of Radioactive Waste’,” NUREG-0782 (Washington, D.C.: Nuclear Regulatory Commission, September 1981). NRC 1982 U.S. Nuclear Regulatory Commission, “Final Environmental Impact Statement on 10 CFR Part 61 ‘Licensing Requirements for Land Disposal of Radioactive Waste,” NUREG-0945 (Washington, D.C.: Nuclear Regulatory Commission, November 1982). Ponti 1986 Ponti, C., “Low Activation Elements for Fusion Reactor Materials,” IAEA Technical Committee on Fusion Reactor Safety, Culham, U.K., 3–7 November, 1986. APPENDIX A REFERENCES Abbott 1994 Abbott, M. L., and Wenzel, R., “Dose Calculations for Routine Airborne Releases of ITER Activation D, Products,” ITER/US/93/TE/SA-19, May 1994. DOE 1988a “External Dose-Rate Conversion Factors for Calculation of Dose to the Public,” DOE/EH-0070, July 1988. DOE 1988b “Internal Dose-Rate Conversion Factors for Calculation of Dose to the Public,” DOE/EH-0071, July 1988. DOE 1992 United States Department of Energy Standard, “Hazard Categorization and Accident Analysis Techniques for Compliance 189 DOE-STD-0028-96 with DOE Order 5480.23, Nuclear Safety Analysis Reports,” DOE-STD-1027-92, October 1992. Fetter 1988 Fetter, S., “Internal Dose Conversion Factors for 19 Target Organs and 9 Irradiation Times and External Dose-Rate Conversion Factors for 21 Target Organs for 259 Radionuclides Produced in Potential Fusion Reactor Materials,” EGG-FSP-8036, March 1988.

Fetter 1991 Fetter, S., “Internal Dose Conversion Factors for 19 Target Organs and 9 Irradiation Times and External Dose-Rate Conversion Factors for 21 Target organs for 144 Radionuclides,” EGG-FSP-9875, September 1991. Shleien 1992 Shleien, B., “The Health Physics and Radiological Health Handbook,” Revised Edition, Scinta Inc., Silver Springs, MD, July 1992. 190 DOE-STD-6003-96 CONCLUDING MATERIAL Review Activity: Preparing Activity: DOE Field Offices DOE-ER-54 DP AL EH CH Project Number: EM ID SAFT-0028 ER NV FM OR LM RFO NE RL NS SR SR SF SA Fernald National Laboratories ANL BNL INEL LANL LLNL PNL Sandia Area Offices Amarillo Argonne Brookhaven Dayton Golden Kirtland Los Alamos Rocky Flats Pinellas Princeton ** Including all DOE Technical Standards Managers TABLE OF CONTENTS FOREWORD DEFINITIONS LIST OF ACRONYMS 1. INTRODUCTION 1.1 Purpose 1.2 Background 1.3 Implementation 1.4 Overview 2. RADIATION AND HAZARDOUS MATERIAL 2.1 Dose Definitions 2.2 Public Exposures and Environmental Impacts 2.2.1 Evaluation Guidelines for Exposures to the Public 2.2.2 Additional Guidance 2.2.3 Environment 2.3 Routine Worker Exposure 2.3.1 Radiation 2.3.2 Hazardous Materials 2.3.2.1 Beryllium 2.3.2.2 Vanadium Oxides 2.3.3 Common Industrial Hazards 2.3.4 Magnetic Fields 2.4 Guidance for Meeting Regulatory Limits 2.4.1 Evaluation Guidelines 2.4.2 Exposure 2.4.3 Meteorological Dispersion 2.5 Consequence Thresholds for PAGs and Emergency Response Planning Guidelines 2.5.1 Radiological (No Ingestion) 2.5.2 Radiological (Ingestion) 2.6 Models Used in Relating Exposures to Estimated Consequences 3. ENVIRONMENTAL AND PERMITTING REQUIREMENTS 3.1 Federal Requirements 3.1.1 National Environmental Policy Act and Implementing Guidelines, Regulations, and Orders 3.1.2 Federal Statutes and DOE Orders Relating to Environmental Quality 3.1.2.1 Federal Statutes 3.1.2.2 DOE Orders and Guidance 3.2 Federal and State Consultation, Permits, and Approvals 3.2.1 Federal Permits and Approvals 3.2.2 State and Local Permits and Approvals 3.2.2.1 Air 3.2.2.2 Archaeological Finds 3.2.2.3 Other State Requirements 3.3 Environmental Compliance Procedures and Scheduling 3.3.1 Environmental Documentation Guidelines 3.3.1.1 NEPA Compliance Plan 3.3.1.2 Environmental Compliance Plan 3.3.1.3 OSHA Compliance Plan 3.3.2 Environmental Compliance Scheduling 4. PROGRAM MANAGEMENT FOR SAFETY 4.1 Design and Construction Management 4.2 Operations Management 4.3 Site Restoration Management 4.4 Tools for Program Management Safety 4.4.1 Configuration Management 4.4.1.1 Configuration Management Process Application 4.4.1.2 Change Control 4.4.1.3 Record Keeping and Reporting 4.4.2 Quality Assurance 4.4.2.1 Management 4.4.2.2 Performance 4.4.2.3 Assessment 4.4.3 Verification and Validation 4.4.4 Conduct of Operations 4.4.5 Emergency Preparedness 4.4.5.1 Operational Emergency Event Classes 4.4.5.2 Emergency Plans and Procedures 4.4.5.3 Hazards Assessment 4.4.5.4 Emergency Response Organization 4.4.5.5 Emergency Facilities Equipment and Personnel Preparedness 4.4.6 Maintenance 4.4.6.1 Maintenance Policy, Goals and Objectives, and Procedures 4.4.6.2 Plant Maintenance Organization 4.4.6.3 Types of Maintenance 4.4.6.4 Work Control Process 4.4.7 Training and Qualifications 4.4.7.1 Facility Training Plan 4.4.7.2 Personnel Selection and Staffing 4.4.7.3 Records

4.4.8 Tritium Control, Accountability, and Physical Protection 4.4.8.1 Requirements 4.4.8.2 Nuclear Material Locations at a Fusion Facility 4.4.8.3 Tritium Measurements Method 4.4.8.4 Facility Measurement Recommendations 5. SAFETY ANALYSIS 5.1 Facility Description 5.1.1 General 5.1.2 Safety Structures, Systems, and Components 5.2 Facility Mission/Processes 5.3 Hazards Analysis 5.3.1 Inventory 5.3.2 Classification 5.4 Analysis of Off-Normal Conditions 5.4.1 Event Scenario Identification and Classification 5.4.2 Analysis Approach for the Safety Analysis Report 5.4.3 Emergency Planning Basis Analysis 5.5 Safety Analysis Report Process 5.5.1 Risk Assessment 5.5.2 Safety Analysis Report 5.6 Safety Envelope Configuration Control 5.7 Technical Safety Requirements 5.7.1 Implementation of Technical Safety Requirements 5.7.2 Risk-Based Prioritization in Technical Safety Requirements 5.8 Startup and Restart of Fusion Facilities 5.8.1 Implementation of Startup and Restart Reviews 5.8.2 Risk-Based Prioritization Implications for Startup and Restart Reviews 5.9 Authorization Basis 6. FACILITY DESIGN GUIDANCE 6.1 Introduction and General Guidance 6.1.1 Design Basis 6.1.2 Safety Functions and Structures, Systems, and Components 6.1.3 General Design Guidance 6.1.3.1 Design for Reliability 6.1.3.2 Defense-In-Depth 6.1.3.3 Design Verification 6.1.3.4 Codes and Design Standards 6.1.3.5 Materials 6.1.3.6 Testing and Inspection 6.1.3.7 Remote Maintenance 6.1.3.8 Human Factors 6.1.3.9 Fire Protection 6.1.3.10 Hydrogen Explosions 6.2 Systems Performing Safety Functions 6.2.1 Public Safety Function: Confinement Systems 6.2.1.1 Vacuum Vessel 6.2.1.2 Tritium Systems 6.2.1.3 Cryostat 6.2.1.4 Confinement/Heating, Ventilating, and Air Conditioning (HVAC) Systems 6.2.2 Worker Safety Function: Systems Controlling Operating Hazards 6.2.2.1 ALARA Design Considerations 6.2.2.2 Access Controls and Shielding from Radioactive Hazards 6.2.2.3 Nonradioactive Worker Hazards 6.3 Systems Involved with Potential Safety Concerns 6.3.1 Afterheat Removal Systems 6.3.2 Rapid Plasma Shutdown System 6.3.3 Control of Potential Energy Sources 6.3.3.1 Coolant Energy 6.3.3.2 Chemical Energy 6.3.3.3 Magnetic Energy 6.3.3.4 Plasma Energy 6.3.4 Limiting Airborne and Liquid Releases to the Environment 6.4 Systems That Support Safety Functions 6.4.1 Instrument and Control Systems 6.4.2 Electrical Power Systems 6.4.3 Cooling Systems 6.4.4 Remote-Handling Systems 6.5 Impact of Facility Support and Experimental Systems on Safety Functions 6.5.1 Group 1 Systems 6.5.2 Group 2 Systems 7. SITE RESTORATION 7.1 General 7.2 Decommissioning, Decontamination, and Site Restoration in the Initial Design 7.3 Site Restoration 7.4 Waste Sent to a Low-Level Waste Repository 7.4.1 Requirements for Land Disposal of Radioactive Waste 7.4.1.1 Classification of LLW for Near-Surface Disposal 7.4.1.2 Classes of Waste 7.4.2 Methodology of 10 CFR 61 Extended to Fusion-Specific Isotopes 7.4.3 Chemically Hazardous Materials Sent to a Hazardous Waste Site 7.4.3.1 Clean Air Act 7.4.3.2 Clean Water Act 7.4.3.3 Safe Drinking Water Act 7.4.3.4 Resource Conservation and Recovery Act 7.4.3.5 Comprehensive Environmental Response, Compensation, and Liability Act 7.4.3.6 Superfund Amendment and Reauthorization Act of 1986 7.4.4 Mixed Waste Requirements

7.5 Requirements on Low-Level Waste Repository APPENDIX A CATEGORY 2 THRESHOLD QUANTITIES OF RADIONUCLIDES APPENDIX B IDENTIFICATION OF POTENTIAL HAZARDS, ENERGY SOURCES, AND GENERIC ACCIDENTS FOR FUSION FAC B.1 Introduction B.2 Hazards B.2.1 Radiological Hazards B.2.2 Chemical Hazards B.2.3 Industrial Hazards B.3 Energy Sources B.3.1 Plasma Energy B.3.2 Magnetic Energy B.3.3 Decay Heat B.3.4 Chemical Energy B.3.5 Coolant Internal Energy B.4 Potential Generic Accident Scenarios B.4.1 Loss-of-Coolant Event B.4.2 Loss-of-Flow Event B.4.3 Loss-of-Vacuum Event B.4.4 Plasma Transients B.4.5 Magnet Transients B.4.6 Loss of Cryogen B.4.7 Tritium Plant Events B.4.8 Auxiliary System Accidents B.4.8.1 Neutral Beams B.4.8.2 RF Heating B.4.8.3 Fuel System B.4.8.4 Vacuum Pumps B.4.8.5 Wall Conditioning and Bakeout Systems B.4.8.6 Energy Storage B.4.9 Maintenance Events APPENDIX C REFERENCES AND SUPPLEMENTAL GUIDANCE LIST OF FIGURES LIST OF TABLES