DOE-STD-3009-2014 Requirements Table

DOE-STD-3009-2014 Requirements Table 1-8-2015 - 1 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 1 Forward #4, #7 Throughout this Standard, the word “shall” denotes actions that are required to satisfy this Standard. To use this Standard as an acceptable methodology for meeting 10 C.F.R. Part 830 requirements for preparing DSAs, all applicable “shall” statements need to be met. If a facility, site, or program office chooses to use this DOE-STD-3009 revision for upgrading an existing DSA, then this revision is required by 10 C.F.R. Part 830 to be implemented in its entirety (i.e., all applicable "shall" statements are met) if it is used as the safe harbor. x No No Descriptive (of 10 CFR 830 requirements); not requirements by themselves. While clear and explicit requirements are a significant change in STD-3009, these citations set the stage for requirements to follow. Use of the safe harbor method with exceptions constitutes use of an alternate method, which requires approval in accordance with DOE-STD- 1083. 2 Section 1.3 Throughout this Standard, the word “shall” denotes actions that are required to satisfy this Standard. To use this Standard as an acceptable methodology for meeting 10 C.F.R. Part 830 requirements for preparing DSAs, all applicable “shall” statements need to be met. x No No Descriptive; not requirements. 3 3.1.1 Hazard Identification 1st paragraph The methodology used for hazard identification shall ensure comprehensive identification of the hazards associated with the full scope of facility processes, associated operations, such as handling of fissionable materials and hazardous waste, and work activities covered by the DSA. The methodology shall include characterization of hazardous materials (radiological and non-radiological) and energy sources, in terms of quantity, form, and location. As a minimum, provide a summary table identifying hazards by form, type, location, and total quantity. The attributes of hazards identified in this section are the basis for subsequent hazard evaluation and accident analysis. Include in the basic set of hazards identified radionuclides, hazardous chemicals, flammable and explosive materials used or potentially generated in facility processes, and any mechanical, chemical, or electrical source of energy that may influence accident progression involving such materials. [3.3.2.1] SS (Safety Significant) No 4 3.1.1 Hazard Identification 2nd paragraph Bounding inventory values of radiological or hazardous materials shall be used, consistent with the maximum quantities of material that are stored and used in facility processes. Inventory data may be obtained from flowsheets, vessel sizes, contamination analyses, maximum historical inventories, and similar sources. It is not the intention of the DSA to cover safety as it relates to the common industrial hazards that make up a large portion of basic OSHA regulatory compliance. It is important not to expend DSA resources on those hazards for which national consensus codes and/or standards (e.g., OSHA regulations) already define and regulate appropriate practices without the need for special analysis. … As a minimum, provide a summary SS No See Section 3.2.4.1 for MAR requirements. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 2 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued)

DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments table identifying hazards by form, type, location, and total quantity. The attributes of hazards identified in this section are the basis for subsequent hazard evaluation and accident analysis. Include in the basic set of hazards identified radionuclides, hazardous chemicals, flammable and explosive materials used or potentially generated in facility processes, and any mechanical, chemical, or electrical source of energy that may influence accident progression involving such materials. [3.3.2.1] 5 3.1.1 Hazard Identification 3rd paragraph These hazards are adequately analyzed and controlled in accordance with 10 C.F.R. Part 851, Worker Safety and Health Program, and are analyzed in a DSA only if they can be an accident initiator, a contributor to a significant uncontrolled release of radioactive or other hazardous material (for example, 115-volt wiring as initiator of a fire), or considered a unique worker hazard such as explosive energy. The basis for any identified hazards excluded from further evaluation shall be provided. As part of the identification process, the basis that was used in the hazard screening to remove standard industrial hazards or insignificant hazards from further consideration needs to be presented as well. For these cases, the DSA hazard analysis process interfaces with other programs such as specific topics of OSHA compliance or general industrial safety. These interfaces must be identified. [3.3.1.1] SS No 6 3.1.3.1 General 1st paragraph The hazard evaluation shall provide (a) an assessment of the facility hazards associated with the full scope of planned operations covered by the DSA and (b) the identification of controls that can prevent or mitigate these hazards or hazardous conditions. The hazard evaluation shall analyze normal operations (e.g., startup, facility activities, shutdown, and testing and maintenance configurations) as well as abnormal and accident conditions. In addition to the process-related hazards identified during the hazard identification process, the hazard evaluation shall also address natural phenomena and man-made external events that can affect the facility. The purpose of this information is to present a comprehensive evaluation of potential process related, natural events, and man-made external hazards that can affect the public, workers, and the environment due to single or multiple failures. Consideration will be given to all modes of operation, including startup, shutdown, and abnormal testing or maintenance configurations. As is standard industrial practice, examination of all modes of operation considers the potential for both equipment failure and human error. … The evaluation identifies preventive and mitigative features, including identification of expected operator response to incidents (e.g., accident mitigation actions or evacuation) and provisions for operator protection in the accident environment (see Table 3-1, Action item/Comment column). [3.3]. SS No 7 3.1.3.1 General 2nd paragraph In special situations requiring detailed analysis of one or more specific hazardous conditions of concern, higher-level techniques such as Fault Tree Analysis, Event Tree Analysis, and Human Reliability Analysis should be considered. The rationale supporting the

The graded approach for hazard analysis is a function of selecting techniques for hazard evaluation. The techniques used for hazard evaluation can range from simple checklists or What-If analyses to systematic parameter examinations such as Hazard and Operability SS No Documentation requirement clarified. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 3 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments selected hazard evaluation technique(s) shall be discussed and justified in the DSA. Analyses (HAZOPs). The technique selected need not be more sophisticated or detailed than is necessary to provide a comprehensive examination of the hazards associated with the facility operations. … To achieve the objectives of analysis of accidents, the graded approach ranges from a hazard analysis to a detailed quantitative analysis where formally quantified event trees and/or fault trees form the bases for physical phenomena modeling and engineering analysis. The level of analytical effort employed is primarily a function of magnitude of hazard, but also takes into account system complexity, and the degree to which detailed modeling can be meaningfully supported by system definition. [Chapter 3, Graded Approach] 8 3.1.3.1 General 3rd paragraph As part of the hazard evaluation, an unmitigated hazard scenario shall be evaluated for each initiating event by assuming the absence of preventive and mitigative controls. Initial conditions may be necessary to define the unmitigated evaluation; further guidance is provided in Section A.3 of Appendix A of this Standard. The consequences and the likelihood of the unmitigated hazard scenario shall be estimated (using qualitative and/or semi- quantitative techniques). Hazard scenario consequence estimates shall address potential effects on facility workers, co-located workers, and the public (maximally-exposed offsite individual [MOIs]), consistent with the consequence levels described in Table 1 below. Similarly, hazard scenario likelihood shall be estimated consistent with the classification bins in Table 2 below. Additional considerations for unmitigated consequences and likelihoods are provided in Section 3.2.2 of this Standard. The hazard analysis then moves beyond basic hazard identification to evaluation of the expected consequences and estimation of likelihood of accidents, an activity that in no way connotes the level of effort of a probabilistic or quantitative risk assessment. [Hazard Analysis, p. 11] Figure 3-2 and Tables 3-3 through 3-5 provide examples of hazard evaluation ranking mechanisms. [3.3.2.3.5] Note that the standard already requires that unmitigated consequences be estimated as part of a hazard analysis, though largely in a qualitative manner. [A.3.1] SS Yes New Requirement – Standardized the qualitative likelihood and consequence descriptors and criteria in new Tables 1 and 2. 9 3.1.3.1 General 4th paragraph Risk ranking/binning may be used to support the selection of Design Basis Accidents (DBAs)/Evaluation Basis Accidents (EBAs) and hazard controls (See Appendix A, Section A.4 for information on risk ranking/binning). If risk ranking/binning is used, the consequence and likelihood thresholds in Tables 1 and 2 shall be used.

Figure 3-2 and Tables 3-3 through 3-5 provide examples of hazard evaluation ranking mechanisms. Two examples are provided to indicate there is more than one correct approach. The approach used at any specific facility is based on the detail needed for a given facility and the experience of the analysts. Figure 3-2 is a graphical example of a common three-by-three frequency and consequence ranking matrix. This particular example was used for evaluating airborne SS Yes A new conditional requirement, if risk ranking/binning used. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 4 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments hazardous material releases. The logic behind Figure 3- 2 is elaborated on in Tables 3-3 through 3-5, which provide a description of a four-by-four frequency and consequence-ranking matrix. [3.3.2.3.5] 10 3.1.3.1 General 9th paragraph Consequence determinations used for co-located workers in the hazard evaluation shall be supported by an adequate technical basis such as scoping calculations consistent with Section 3.2.4. Alternately, the quantitative evaluation of co-located worker consequences used to compare to Table 1 thresholds may be performed in the accident analysis and reported in the DSA Section [3.4]. The hazards analysis examines the complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to hazardous materials. [Definition, Hazard Analysis] Note: Old STD-3009 uses the term “onsite workers” once (above) and does not use the term “co-located workers”. SS Yes More emphasis on Co- located workers than in Old- 3009. Note: Many DOE sites have evaluated co-located workers as required by DOE-STD- 1120-2005 and DOE-STD- 5506-2007, and some using DOE-STD-3009-94 CN3. Also required for new factility design per DOE-STD-1189- 2008. 11 3.1.3.1 General 10th paragraph Probabilistic calculations are not required to inform likelihood estimates. However, if probabilistic risk analysis (quantitative risk analysis) results are used to assign qualitative likelihood estimates in Table 2, the process for performing these analyses described by DOE-STD-1628-2013, Development of Probabilistic Risk Assessments for Nuclear Safety Applications, shall be used. The results of such analyses shall not redefine the criteria described in Tables 1 and 2 above. The level of analytical effort employed is primarily a function of magnitude of hazard, but also takes into account system complexity, and the degree to which detailed modeling can be meaningfully supported by system definition. For nonreactor nuclear facilities, these considerations do not support a need for probabilistic/qualitative risk assessment of overall facility operations. This Standard does not present an expectation of or a requirement for probabilistic/ qualitative risk assessment. [Chapter 3, Graded Approach] SS Yes A new conditional requirement, if PRA is used to inform qualitative likelihood estimates for the hazard evaluation. 12 3.1.3.1 General 13th paragraph For each of the unmitigated hazard scenarios, the controls (SSCs, administrative and/or programmatic) that can prevent or mitigate the hazard scenario shall be identified. A mitigated hazard evaluation shall be performed to determine the effectiveness of SS controls (following the preferred hierarchy as described in Section 3.3 of this Standard) by estimating hazard scenario likelihood with preventive controls and consequences with mitigative controls.

Hazard analysis considers the complete spectrum of accidents that may occur … identifies and assesses associated preventive and mitigative features; identifies safety-significant SSCs…. [Chapter 3 Purpose] The evaluation identifies preventive and mitigative features, including identification of expected operator response to incidents (e.g., accident mitigation actions or evacuation) and provisions for operator protection in the accident environment (see Table 3-1, Action item/Comment column). [3.3]. Identify specific administrative controls important to safety that are needed to prevent or mitigate an accident SS Yes. Expanded Requirement – Mitigated Hazard Evaluation (previously could be summarized in DSA Section 3.3.x) DOE-STD-3009-2014 Requirements Table 1-8-2015 - 5 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments scenario as appropriate. In general, SAC designations based on worker safety are limited to those administrative controls that would have been safety- significant had that safety function been provided by a safety-significant SSC. [3.3.2.3.3] Any accidents that have a significant consequence potential to the public or workers, independent of likelihood, must be thoroughly evaluated, including the identification of any appropriate safety SSCs or administrative controls. [Page A-10] 13 3.1.3.1 General 14th paragraph In either case, the analysis should include SS controls for hazard scenarios having high estimated chemical consequences to the public, or high radiological or chemical consequences to workers (i.e., as defined by Table 1). This information, along with safety functions for these controls, shall be included in the hazard evaluation, unless determined as part of the accident analysis (see Section 3.2). Structures, systems, and components which are not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to defense in depth and/or worker safety as determined from safety analyses. [10 CFR 830, Definition of SS SSCs] … Considerations should be based on engineering judgment of possible effects and the potential added value of safety-significant SSC designation. [DOE G 420.1-1] SS Yes New Requirement.- High consequence thresholds established to determine need for SS controls. Not a new requirement to establish SS controls to protect the public and workers from significant radiological or chemical consequences. 14 3.1.3.1 General 15th paragraph Public and worker safety issues are the traditional focus of hazard evaluations. However, the DSA hazard evaluation shall also examine the potential for large-scale environmental contamination and identify preventive and mitigative controls to protect the environment. These controls will typically be the same as those necessary to protect the workers and the public. The criteria for safety control selection presented in Section 3.3 are not based on environmental contamination, unless a significant spill to the environment outside the facility can contribute to radiological exposures as discussed in Section 3.2.4.2. Public and worker safety issues are the traditional focus of hazard evaluations. The DSA hazard evaluation also examines the potential for large-scale environmental contamination. [3.3.2.3]

This subsection summarizes the design and operational features that reduce the potential for large material releases to the environment. Document pathways for uncontrolled release of large amounts of hazardous materials to the environment identified in the hazard evaluation. Estimate potential consequences and preventive and mitigative features associated with specific pathways. … Safety SSC designations are not required for issues solely related to environmental protection. In accordance with 10 CFR 830, TSR designations are not required for such issues either. TSR designation associated with prevention of uncontrolled release of hazardous materials would typically be assigned for defense-in-depth considerations. [3.3.2.3.4] SS No Consistent with prior expectations and 10 CFR 830. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 6 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 15 3.1.3.2 Criticality Hazards 1st paragraph The criticality safety program requirements are derived from the hazard analysis process established in the American National Standards Institute/ American Nuclear Society (ANSI/ANS)-8 series of national standards, which require a documented criticality safety evaluation demonstrating that operations with fissionable material remain subcritical under both normal and credible abnormal conditions (see Appendix A, Section A.5 of this Standard for details). In addition, the DSA hazard evaluation shall include:  Events where consequences (from the criticality itself or subsequent impact to hazardous material) exceed the high radiological consequence thresholds for either the co- located workers or the MOI in Table 1, unless it has been determined that an unmitigated criticality accident is not credible; and  Situations where an active engineered control(s) is required by the Nuclear Criticality Safety (NCS) analysis to ensure subcriticality. The safety items identified in the hazard analysis are examined against those criteria to identify a subset of the most significant controls that prevent uncontrolled release of hazardous materials and nuclear criticality. [Introduction, Defense in Depth] DOE G 423.1-1 provides basic screening criteria to identify defense-in-depth features/items that may require specific TSR coverage. Such features include …active controls that prevent criticality. [3.3.2.3.2] This section analyzes DBAs for each of the major categories to quantify consequences and compare them to the Evaluation Guideline. The major categories are: internally initiated operational accidents (e.g., fires, explosions, spills, criticality); …. [3.4.2] Note: Criticality treated no differently than other DBAs in Old-3009. SS Yes Significant change in the way that criticality safety is addressed in DSA – net effect is that significant details that used to be required by the old 3009 DSA will now reside in the Criticality Safety Program. 16 3.1.3.2 Criticality Hazards 2nd paragraph If the NCS program requires a criticality accident alarm system, then the criticality accident alarm system shall be discussed in the hazard evaluation and carried forward to evaluation in accordance with Section 3.3 of this Standard. The safety items identified in the hazard analysis are examined against those criteria to identify a subset of the most significant controls that prevent uncontrolled release of hazardous materials and nuclear criticality. [Introduction, Defense in Depth]

SS No Criticality accident alarms have historically been designated as safety significant to protect the Facility Worker, and provided coverage with TSR Limiting Condition for Operation and Surveillance Requirements. 17 3.2.1 Design/Evaluation Basis Accident Selection 2nd paragraph EBAs are derived from the spectrum of hazard scenarios developed in the hazard evaluation. Two types of EBAs shall be defined for further analysis: representative and unique. This accident selection activity identifies the process and criteria used to select the unique and representative potential accidents (i.e., DBAs) to be included in accident analysis. Unique accidents are those with sufficiently high-risk estimates that individual examination is needed (e.g., a single fire whose specific parameters result in approaching the Evaluation Guideline, situations of major concern from Figure 3-2). SC (Safety Class) No DOE-STD-3009-2014 Requirements Table 1-8-2015 - 7 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments [3.3.2.3.5] 18 3.2.1 Design/Evaluation Basis Accident Selection 3nd paragraph Representative EBAs bound a number of accidents with a similar control set (e.g., the worst fire, for a number of similar fires). At least one bounding accident from each of the major types determined from the hazard evaluation that have the potential to challenge the EG (fire, explosion, spill, etc.) shall be selected. Representative accidents bound a number of similar accidents of lesser risk (e.g., the worst fire for a number of similar fires, situations of concern in Figure 3-2). Representative accidents are examined to the extent they are not bounded by unique accidents. [3.3.2.3.5] SC No 19 3.2.1 Design/Evaluation Basis Accident Selection 4th paragraph Representative EBAs shall be defined such that:  The control(s) applicable to the EBA are similar and will perform the same function as the controls of the represented hazard scenarios; and  The accident environment associated with the EBA envelopes the environment expected from the represented hazard scenarios. Representative accidents bound a number of similar accidents of lesser risk (e.g., the worst fire for a number of similar fires, situations of concern in Figure 3-2). Representative accidents are examined to the extent they are not bounded by unique accidents. [3.3.2.3.5] SC No 20 3.2.1 Design/Evaluation Basis Accident Selection 7th paragraph Hazard scenarios that have the potential to challenge the EG shall be considered as candidates for DBA/EBA accident analysis except for: (1) operational events that are deemed not plausible as described below; (2) natural phenomena initiators of greater magnitude than those required by DOE O 420.1C (or applicable successor documents); or (3) external man-made accidents with a cutoff likelihood of 10-6/yr, conservatively calculated. An important factor in estimating binning thresholds for public consequences is to tie the thresholds to the Evaluation Guideline so that accidents that could challenge the guideline are correctly identified for formal accident analysis. … In any case, at least one bounding accident from each of the major types determined from the hazard analysis (e.g., fire, explosion, spill, etc.) should be selected unless the bounding consequences are “Low” (See Figure 3-2). Accidents are identified and listed by accident category (i.e., internally and externally initiated) and type (e.g., fire, explosion, spill, etc.). [3.3.2.3.5]

The categories of DBAs examined are: · Operational accidents (caused by initiators internal to the facility). · Natural events (e.g., earthquakes, tornadoes). · Man-made external events (caused by man- made initiators external to the facility). [3.4] SC No Note: The plausibility concept is a significant new concept added in DOE-STD-3009- 2014 to clarify when non- realistic scenarios may be excluded. 21 3.2.1 Design/Evaluation Basis Accident Use of a lower binning likelihood threshold such as 10-6/yr (i.e., beyond extremely unlikely) for screening operational events from selection as DBA/EBAs for For operational accidents, a derivative DBA is defined based on the physical possibility of phenomena as defined in the hazard analysis. Use of a lower binning SC Yes. A new conditional requirement, if PRA is used. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 8 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments Selection 10th paragraph the accident analysis, is not appropriate. However, in those situations when it is too costly to implement or impractical to identify SC controls in accordance with the requirements of this Standard, a quantitative analysis that is completed in accordance with DOE- STD-1628-2013, including the development of a PRA plan (approved by DOE), may be used to support decisions regarding the need for SC or SS controls for operational events. In such cases, PRA results shall include an integrated assessment of accident probability and consequences of the accident event to establish the event’s risk significance. When PRA results are used, key assumptions and initial conditions shall be identified and protected (see Section 3.2.2 of this Standard). threshold such as 10-6/yr is generally appropriate, but should not be used as an absolute cutoff for dismissing physically credible low probability operational accidents (e.g., red oil explosions) without any evaluation of preventive and mitigative features in hazard analysis. This distinction is made to prevent “pencil sharpening” at the expense of objective evaluation of hazards. Examples of a candidate derivative DBA would be an ion exchange column or a red oil explosion at a facility where the phenomena is physically possible and documentation is not available substantiating ventilation and building confinement systems were specifically designed for such an occurrence. For natural event accidents, derivative DBAs are defined by a frequency of initiator based on DOE 420.1, “Facility Safety”, and its associated implementation standards. For external man- made accidents, derivative DBAs are assumed if the event can occur with a frequency >10-6/yr as conservatively estimated, or >10-7/yr as realistically estimated. Use of a frequency cutoff for external events represents a unique case for external events only, based on established Nuclear Regulatory Commission (NRC) precedents. [Introduction, Hazard Analysis, page 13-14] There is no predetermined frequency cutoff value, such as 1 E-6 per year, for excluding low frequency operational accidents (i.e., internally initiated). In fact, for operational accidents there is no explicit need for a frequency component to the unmitigated release calculations, since the determination of need is solely driven by the bounding consequence potential. Per the body of this Standard, natural events are defined in terms of the frequency of the initiating event, while external events (i.e., externally initiated man-made events) are defined with a cutoff frequency of 10-6 per year, conservatively calculated, or 10-7 per year, realistically calculated. [A.1]

22 3.2.2 Unmitigated Analysis 1st paragraph Both the hazard evaluation and the accident analysis require an unmitigated analysis of the consequences and likelihood of accidents (note: the term “accident” as used in this subsection also includes “hazard scenarios”). An unmitigated consequence analysis shall be performed for plausible accident scenarios, This subsection compares the unmitigated receptor dose for the accident sequence to the Evaluation Guideline. [3.4.2.X.4] Dose calculations for comparison against the EG are based on the concept of an unmitigated release to SC, SS No DOE-STD-3009-2014 Requirements Table 1-8-2015 - 9 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments NPH events, and external events. determine whether the potential level of hazard in the specific facility warrants SC SSC designation (see Section A.3.1 for details). [A.2] Note that the standard already requires that unmitigated consequences be estimated as part of a hazard analysis, though largely in a qualitative manner. [A.3.1] 23 3.2.2 Unmitigated Analysis 2nd paragraph The initial conditions and assumptions for the analysis shall be documented and evaluated to determine if controls are needed to maintain the validity of the evaluation. If the presence of an assumed passive SSC prevents significant consequences, it shall be classified as either SS or SC. The unmitigated release should characterize both the energies driving the release, and the release fractions in accordance with the physical realities of the accident phenomena at a given facility or process. As a result, there may be assumptions that are necessary to make in order to define a meaningful scenario, but which also impact the magnitude of the resultant consequences. In order to clearly capture these assumptions, and their resulting potential impact on safety SSC designation and/or Technical Safety Requirements (TSR) protection, the unmitigated calculation should … [A.3.1] However, it is important to note that such defining assumptions may warrant some level of safety SSC designation to assure that the assumptions remain valid in the future. [A.3.1] SC, SS No Clarified intent of existing discussion to protect initial conditions and assumptions. 24 3.2.2 Unmitigated Analysis 3rd paragraph The unmitigated source term should characterize both the release fractions and the energies driving the release in accordance with the physical realities of the accident phenomena at a given facility, activity, or operation. As a result, some additional assumptions may be necessary in order to define a meaningful accident scenario, and such assumptions may also affect the magnitude of the resultant consequences. An assumption that an SSC exists does not automatically require SC or SS designation. However, assumptions shall be protected at a level commensurate with their importance. The unmitigated release should characterize both the energies driving the release, and the release fractions in accordance with the physical realities of the accident phenomena at a given facility or process. As a result, there may be assumptions that are necessary to make in order to define a meaningful scenario, but which also impact the magnitude of the resultant consequences. In order to clearly capture these assumptions, and their resulting potential impact on safety SSC designation and/or Technical Safety Requirements (TSR) protection, the unmitigated calculation should … [A.3.1]

However, it is important to note that such defining assumptions may warrant some level of safety SSC designation to assure that the assumptions remain valid in the future. [A.3.1] SC, SS No Clarified intent of existing discussion to protect initial conditions and assumptions. 25 3.2.2 Unmitigated The following assumptions may be appropriate to establish a physically meaningful accident scenario: In order to clearly capture these assumptions, and their resulting potential impact on safety SSC designation SC, SS No Additional clarification provided. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 10 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments Analysis 4th and 6th paragraph  Passive safety controls not affected by the accident scenario are deemed available. This assumption is valid for facility-wide, secondary, and common cause events that are directly caused by natural events, such as earthquake- induced fires and explosions. For example, in the case of a process vessel rupture, it should be assumed that other vessels shown not to be affected by the accident are not ruptured or otherwise unavailable; and  Passive safety controls affected by the accident scenario are deemed available based on an assessment that they will survive accident conditions. For example, in the case of a container drop in which the impact of the drop is shown not to challenge container integrity, it should be assumed that the contents of the container are not released. Similarly, if the facility has permanently-installed resilient flooring that prevents an undesired consequence of such a drop, an assessment of the drop against an unyielding surface is not meaningful. The following conditions shall not be assumed to be available for unmitigated analysis of plausible accident scenarios defined in Section 3.2.1:  Active safety controls, such as ventilation filtration systems in the case of a spill or fire suppression in the case of a fire;  Passive safety controls that produce a leakpath reduction in source term, such as building filtration;  Operator intervention actions that may abort the progression of the event; that is, assume the event occurs with no operator intervention; and  ACs or safety management programs in the unmitigated analysis. For example, combustible controls may not be used as an initial condition to show that a full facility fire is not plausible. Material at risk (MAR) values, and other process physical attributes such as and/or Technical Safety Requirements (TSR) protection, the unmitigated calculation should: (1) Take no credit for active safety features – such as ventilation filtration systems in the case of a spill. (2) Take credit for passive safety features that are assessed to survive accident conditions where that capability is necessary in order to define a physically meaningful scenario. For example, in the case of a container drop where the impact of the drop does not challenge container integrity, it should not be assumed that the contents have dropped in an uncontained manner. Similarly, if the presence of permanently installed resilient flooring prevents an undesired consequence given a drop, an assessment of the drop against some other non-resilient surface is not meaningful. However, it is important to note that such defining assumptions may warrant some level of safety SSC designation to assure that the assumptions remain valid in the future. In the above examples, the container and the flooring may warrant designation as SS or SC design features.

(3) Take no credit for passive safety features producing a leakpath reduction in source term, such as building filtration. (4) Assume the availability of passive safety features that are not affected by the accident scenario. For example, in the case of a process vessel rupture, it should be assumed that other vessels not affected by the accident are not ruptured or otherwise unavailable. [A.3.1] DOE-STD-3009-2014 Requirements Table 1-8-2015 - 11 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments waste acceptance criteria on radiological or fissile concentrations that establish inventory limits, are considered an exception to not crediting ACs for the unmitigated analysis, because they are considered initial conditions if addressed by a SAC (see Appendix A, Section A.3). MAR limits are a special case and have historically been allowed for the unmitigated analysis since it defines the initial conditions for the hazard evaluation and accident analysis. Examples include limiting the inventory in a HC-3 facility or limiting to low-level waste criteria based on the Waste Acceptance Criteria that prohibits TRU wastes or higher fissile concentrations. Other ACs, such as combustible controls, that are elevated to a SAC as an initial condition for the unmitigated analysis would circumvent the control selection process considering the hierarchy of preferences, and place greater reliance on administrative controls over available engineered controls. 26 3.2.3 Mitigated Analysis 1st paragraph A mitigated analysis shall be performed to determine the effectiveness of SS and SC controls to protect co- located workers and the public. This analysis should be the same as the unmitigated analysis except that accident (note: the term “accident” as used in this subsection also includes “hazard scenarios”) likelihood is estimated with preventive controls available, and consequences are estimated with mitigative controls available. Final dose estimations representing the anticipated behavior of the facility under accident conditions should be based on the mitigated design basis accidents (DBAs), wherein full or partial functionality of SC SSCs is assumed. [A.2] SC, SS No. Clarified Requirement – Mitigated Hazard Evaluation (previously could be summarized in DSA Section 3.3.x) 27 3.2.3 Mitigated Analysis 2nd paragraph Where preventive controls are credited as SS or SC, the DSA shall evaluate the effectiveness of the controls to either eliminate the hazard or terminate the accident and prevent a release of radioactive or other hazardous materials. If hazard elimination or accident termination cannot be accomplished, the effectiveness of the credited controls is evaluated in terms of the overall reduction in the likelihood of the accident. Once a set of SC SSCs has been identified, accident consequences can be estimated in a DBA calculation, which represents the accident scenario progression where SC SSCs successfully perform their intended safety function. … For each scenario in the DSA, sufficient documentation of both the unmitigated and mitigated accident scenarios (DBAs) should be made such that the thought process of determining the SC SSCs is well understood. In all cases, the level of protection provided by the identified SC SSCs should be evident. [A.3.1] SC, SS Yes New Requirement – relative to effectiveness of SS controls only

No new requirement relative to effectiveness of SC controls. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 12 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 28 3.2.3 Mitigated Analysis 3rd paragraph A mitigated consequence analysis is required if the credited preventive controls do not eliminate the hazard or terminate the accident. This analysis shall demonstrate how SC mitigative SSCs and/or SACs reduce consequences below the EG and how SC (if identified) and SS mitigative SSCs and/or SACs reduce co-located worker consequences below 100 rem. Once a set of SC SSCs has been identified, accident consequences can be estimated in a DBA calculation, which represents the accident scenario progression where SC SSCs successfully perform their intended safety function. … For each scenario in the DSA, sufficient documentation of both the unmitigated and mitigated accident scenarios (DBAs) should be made such that the thought process of determining the SC SSCs is well understood. In all cases, the level of protection provided by the identified SC SSCs should be evident. [A.3.1] SC, SS Yes New Requirement – Clarified requirement to provide controls to protect public to below the EG and co-located workers to below 100 rem at 100 m. 29 3.2.4 Consequence Calculation 2nd paragraph Calculations shall be made based on technically- justified input parameters and underlying assumptions such that the overall consequence calculation is conservative. Conservatism is assured by the selection of bounding accident scenarios, the use of a conservative analysis methodology, and the selection of source term and input parameters that are consistent with that methodology. General discussion is provided for source term calculation and dose estimation, as well as prescriptive guidance for the latter. The intent is that calculations be based on reasonably conservative estimates of the various input parameters. [A.3] SC, SS No 30 3.2.4.1 Material at Risk 1st paragraph The MAR is the bounding quantity of radioactive material that is available to be acted upon by a given physical stress from a postulated accident. The MAR may be the total inventory in a facility or a portion of this inventory in one location or operation, depending on the event. MAR values used in hazard and accident analysis shall be consistent with the values noted in hazard identification/evaluation, and shall be bounding with respect to each accident being evaluated. While DOE-STD-1027-92 excludes material in Department of Transportation Type B containers from consideration for the purposes of hazard categorization, the existence of such material shall be acknowledged in the DSA and the material excluded from the source term for a particular accident scenario only if the containers can be shown to perform their safety functions under accident conditions. The MAR values used in hazard and accident analysis must be consistent with the values noted in hazard identification as described in section 3.3.2.1 of this standard, and should represent documented maxima for a given process or activity. [A.3.2] SC No DOE-STD-3009-2014 Requirements Table 1-8-2015 - 13 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 31 3.2.4.1 Damage Ratio 1st paragraph

The DR is the fraction of material that is actually affected by the accident-generating conditions. DOE- HDBK-3010 notes that some degree of ambiguity can result from overlapping definitions of MAR and DR. A given DSA should use one consistent definition throughout. A DR of 1.0 shall be used unless there is an applicable standard or technical basis for a different value. DAMAGE RATIO (DR). The DR is that fraction of material actually impacted by the accident generating conditions. DOE-HDBK-3010 notes that some degree of ambiguity can result from overlapping definitions of MAR and DR in various applications. One consistent definition should be used throughout a given DSA. [A.3.2] SC Yes Expanded requirement on DR or provide technical basis. 32 3.2.4.1 Airborne Release Fraction and Respirable Fraction 1st paragraph The ARF is the coefficient used to estimate the amount of a radioactive material that can be suspended in air and made available for airborne transport under a specific set of induced physical stresses. The RF is the fraction of airborne radionuclide particles that can be transported through air and inhaled into the human respiratory system. The RF is commonly assumed to include particles of 10-μm Aerodynamic Equivalent Diameter and less. Bounding estimates, and in many cases median estimates, for radionuclide ARFs and RFs for a wide variety of MAR and release phenomena are presented in DOE-HDBK-3010. The bounding estimates shall be used unless a different value is provided in an applicable standard or is otherwise technically justified. In cases where direct shine may contribute significantly to dose, that contribution should be evaluated without the use of the RF, and without the use of the ARF if due to a spill release resulting in exposure to a pool. ARFs and RFs are selected based on physical conditions and stresses anticipated during accidents. DOE-HDBK-3010 defines bounding ARFs and RF mechanisms and airborne release rates based on physical context. AIRBORNE RELEASE FRACTIONS (ARFs) AND RESPIRABLE FRACTIONS (RFs). Bounding estimates for radionuclide ARFs and RFs for a wide variety of MAR and release phenomena are systematically presented in DOE-HDBK-3010. In those cases where there may be significant direct shine contribution to dose, that contribution should be evaluated without the use of the respirable fraction. [A.3.2] SC No Clarified requirement on ARF and RF. 33 3.2.4.1 Leakpath Factor 1st paragraph The LPF is the fraction of material that passes through some confinement deposition or filtration mechanism. Several leakpaths may be associated with a specific accident, such as the fraction passing from a glovebox, the fraction passing from a room, or the fraction passing through a leaking door. The LPF used in the common five-factor formula is the total fraction of respirable airborne material released during the accident that escapes from the building to the environment. For purposes of the unmitigated LEAKPATH FACTOR (LPF). The LPF is the fraction of material passing through some confinement deposition or filtration mechanism. Several LPFs may be associated with a specific accident, e.g., fraction passing from a glovebox, fraction passing from a room, fraction passing through filtration vis-à-vis door leakage. For the purposes of the unmitigated release calculation, the LPF should be set to unity. [A.3.2] SC No Clarified requirement on LPF. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 14 -

# 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments release calculation, the LPF shall be set to unity. For mitigated analysis, analytical tools used in calculating the LPF shall be appropriate to the physical conditions being modeled, including the use of input parameters, such that the overall LPF would be conservative. 34 3.2.4.2 Atmospheric Dispersion 2nd paragraph One of the following options, as described in this subsection, shall be used to evaluate atmospheric dispersion and the resulting χ/Q:  Option 1: Follow a process based on NRC Regulatory Guide 1.145, Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants;  Option 2: Use a DOE-approved toolbox code and apply the conservative parameters as discussed below; or  Option 3: Use site-specific methods and parameters as defined in a site/facility specific DOE-approved modeling protocol. The relevant factors for dose estimation are receptor location, meteorological dispersion, and dose conversion values. Specific guidance for each is provided below. [A.3.3] Accidents with unique dispersion characteristics, such as explosions, may be modeled using phenomenon- specific codes more accurately representing the release conditions. Discussion should be provided justifying the appropriateness of the model to the specific situation. [A.3.3] SC Yes New Approach with 3 options; Requirements clarified. 35 3.2.4.2 Meteorological Data 1st paragraph For the calculation of offsite doses, five years of representative, recent meteorological data shall be used as input to the dispersion model. If five years of data are not available, justification for using a smaller data set shall be provided in the DSA. NRC Regulatory Guide 1.23 describes acceptable means of generating the meteorological data upon which dispersion is based. [A.3.3] Documentation of methodology should include the following: … Methods used to estimate dose and exposure profiles including assumptions on variables such as meteorological conditions, time dependent characteristics, activity, and release rates or duration for radioactive or other hazardous materials that could be released to the environment. [3.4.1] SC, SS Yes Requirement clarified to use 5 years of data, or justify why not. 36 3.2.4.2 Receptor Location 1st paragraph For the purposes of comparison to the EG, the comparison point shall be the location of a hypothetical Maximally-Exposed Offsite Individual (MOI). This MOI is typically located either at the shortest distance to the DOE site boundary (directionally independent), or at the site boundary location with the highest directionally-dependent dose based on a ground level release. DOSE CALCULATION LOCATION. For the purposes of comparison to the EG, the comparison point is take[n] to be the location of a theoretical MOI standing at the site boundary. This location can also be beyond the DOE site boundary if a buoyant or elevated plume is not at ground level at the DOE site boundary. In such cases, the calculation location is taken at the point of maximum exposure, typically where the plume reaches the ground level. [A.3.3] SC No DOE-STD-3009-2014 Requirements Table 1-8-2015 - 15 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant

Change ? Comments 37 3.2.4.2 Determination of the Offsite x/Q 1st paragraph The parameter χ/Q represents the dilution of the radioactive plume via dispersion and deposition as it travels from the facility during an accident. Appropriate χ/Q values at the MOI shall be determined using a method consistent with application of Reg Guide 1.145, using either the directionally independent or directionally dependent method. For directionally independent assessments, this calculation represents the 95th percentile, as described in Reg Guide 1.145, Section C.3, Regulatory Position 3, Determination of 5 Percent Overall Site χ/Q Value. For directionally-dependent calculations this calculation represents the 99.5th percentile, as described in Reg Guide 1.145, Section C.2, Regulatory Position 2, Determination of the Maximum Sector Values. While the three options allow for alternative methods to calculate the χ/Q values, all three options shall evaluate the dose at the MOI using either a 95th percentile for a directionally independent method or a 99.5th percentile for a directionally dependent method ATMOSPHERIC DISPERSION. The 95th percentile of the distribution of doses to the MOI, accounting for variations in distance to the site boundary as a function of direction, is the comparison point for assessment against the EG. The method used should be consistent with the statistical treatment of calculated X/Q values described in regulatory position 3 of NRC Regulatory Guide 1.145 for the evaluation of consequences along the exclusion area boundary. The determination of distance to the site boundary should be made in accordance with the procedure outline in position 1.2 of Regulatory Guide 1.145. NRC Regulatory Guide 1.23 describes acceptable means of generating the meteorological data upon which dispersion is based. [A.3.3] SC Yes A new conditional requirement, if a 99.5 percentile of directionally dependent distribution is used. Not a new requirement to use the 95th percentile for directionally dependent distribution. 38 3.2.4.2 Determination of the Offsite x/Q 5th paragraph For codes that do not contain fixed values or calculate the parameters internally, the following parameters shall be used for ensuring conservative calculation of offsite doses in accordance with Option 2:  Non-buoyant, ground level, point source release;  Plume centerline concentrations for calculation of dose consequences;  Rural dispersion coefficients;  A deposition velocity of 0.1 cm/sec for unfiltered release of particles (1-10 m Aerodynamic Equivalent Diameter), 0.01 cm/sec for filtered particles, or 0 cm/sec for tritium/noble gases;  A surface roughness of 3 cm;  A minimum wind speed of 1 m/s;  Plume meander may be used, consistent with the accident release duration and the appropriate code guidance; and  Building wake factors should not be credited in the plume dispersion, outside of those already incorporated into plume meander. Documentation of methodology should include the following: … Methods used to estimate dose and exposure profiles including assumptions on variables such as meteorological conditions, time dependent characteristics, activity, and release rates or duration for radioactive or other hazardous materials that could be released to the environment. [3.4.1] SC, SS Yes A new conditional requirement, if Option 2 is selected (not applicable to Options 1 and 3). DOE-STD-3009-2014 Requirements Table 1-8-2015 - 16 - # 3009-2014 Section

DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 39 3.2.4.2 Determination of the Offsite x/Q 6th paragraph When Option 3 is used, the modeling protocol shall address the appropriateness of the model to the site- specific situation, show that the overall result (i.e., radiological dose consequence) is conservative, and be submitted to the DOE Safety Basis Approval Authority for approval prior to use. For new facilities and for the major modifications to existing facilities that are designed in accordance with DOE-STD-1189, the modeling protocol may be included as part of a Safety Design Strategy or other DOE-approved safety design basis document. Documentation of methodology should include the following: … Methods used to estimate dose and exposure profiles including assumptions on variables such as meteorological conditions, time dependent characteristics, activity, and release rates or duration for radioactive or other hazardous materials that could be released to the environment. [3.4.1] SC Yes A new conditional requirement, if Option 3 is selected (not applicable to Options 1 and 2). 40 3.2.4.2 Determination of the Onsite x/Q 1st paragraph A χ/Q value of 3.5 x 10-3 sec/m3 shall be used for ground-level release evaluation at the 100 meter receptor location, unless an alternate onsite χ/Q value is justified. This value may not be appropriate for certain unique situations such as operations not conducted within a physical structure. When an alternate value is used, the DSA shall provide a technical basis supporting the need for the alternate value and the value selected. Accidents with unique dispersion characteristics, such as explosions, may be modeled using phenomenon- specific codes more accurately representing the release conditions. Discussion should be provided justifying the appropriateness of the model to the specific situation. [A.3.3] SS Yes New Requirement - Analysis of worker safety at 100 meters was not addressed in old 3009. 3.5 x 10-3 sec/m3 adopted from DOE-STD-1189-2008 and justified by technical paper (soon to be issued). 41 3.2.4.2 Dose Coefficients and Breathing Rate 1st paragraph Dose coefficients consistent with International Commission on Radiological Protection Publication 68, Dose Coefficients for Intakes of Radionuclides by Workers, and Publication 72, Age-dependent Doses to Members of the Public from Intake of Radionuclides, for adults shall be used. SC No Clarification to use new international and national RP guidance. ICRP-68 and ICRP-72 replace the ICRP-26 and ICRP-30 related guidance. Consistent with other DOE RP requirements in 10 CFR Part 835, DOE O 458.1, and DOE-STD-1196. Not significantly different. 42 3.2.4.3 Chemical Dispersion Analysis and Consequences 1st paragraph If neither a radiological dispersion analysis nor a DOE “Toolbox code” is used for the chemical dispersion analysis, a modeling protocol shall address the appropriateness of the model to the site-specific situation (including source term characterization), show that the overall result (i.e., chemical consequence) is conservative, and be submitted to the appropriate DOE Safety Basis Approval Authority for approval prior to use. N/A. SS Yes. New Requirement - Chemical modeling not addressed in old 3009. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 17 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006)

Safety Class.? 1 Significant Change ? Comments 43 3.2.4.3 Chemical Dispersion Analysis and Consequences 3rd paragraph A χ/Q value of 3.5 x 10-3 sec/m3 may be used for ground-level release evaluation for chemical releases at the 100 meter receptor location, unless an alternate onsite χ/Q value is justified. The use of an alternate onsite χ/Q value may be considered for unique situations such as operations not conducted within a physical structure, or unusual release and dispersion characteristics. When an alternate value is used, the DSA shall provide a technical basis supporting the need for the alternate value and the value selected. Additional guidance on hazard and accident may be gained from the following references: · Guidelines for Hazard Evaluation Procedures, American Institute of Chemical Engineers, 1992. · “Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports” DOE-STD-1027. · “Recommended Values and Technical Bases for Airborne Release Fractions (ARFs), Airborne Release Rates (ARRs), and Respirable Fractions (RFs) at DOE Non-Reactor Nuclear Facilities” DOE Handbook (HDBK)-3010. · Nuclear Fuel Cycle Facility Accident Analysts Handbook, Nuclear Regulatory Commission NUREG- 1320. · “A Strategy for Occupational Exposure Assessment,” American Industrial Hygienists Association, 1991. · “Application of Hazard Evaluation Techniques to the Degree of Potentially Hazardous Industrial Chemical Processes,” National Institute of Occupational Safety and Health No. 88-79897, March 1992. · 29 CFR 1910.119, “Process Safety Management of High Hazardous Chemicals.” [3] SS Yes New Requirement - Chemical modeling not addressed in old 3009. 44 3.3 Hazard Controls 2nd paragraph When the hierarchy of controls is not used for situations requiring SC/SS controls (e.g., a SAC is selected over an available SSC), the DSA shall provide a technical basis that supports the controls selected. [from Appendix] Following efforts to minimize hazardous materials, this control selection strategy translates into the following hierarchy of controls, listed from most preferred to least preferred: (1) SSCs that are preventive and passive; (2) SSCs that are preventive and active; (3) SSCs that are mitigative and passive; (4) SSCs that are mitigative and active; (5) ACs that are preventive ; and (6) ACs that are mitigative. Some considerations in the prioritization of facility safety issues include: - Hazardous material inventory should be minimized at all times. - Safety SSCs are preferred over administrative controls. - Passive SSCs are preferred over active SSCs. - Preventive controls are preferred over mitigative controls. - Controls closest to the hazard may provide protection to both workers and the public. - Facility safety SSCs are preferred over personal protective equipment. - Controls that are effective for multiple hazards can be resource effective. [A.4] SC, SS No Expectation for hierarchy of controls was clarified and formalized. New requirement added to document technical basis if hierarchy of controls is not followed. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 18 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 45 3.3 Hazard Controls 3rd paragraph

The identification of hazard controls shall incorporate a defense-in-depth approach that builds layers of defense against release of radioactive or other hazardous materials so that no one layer by itself, no matter how effective, is completely relied upon. The overall approach to defense-in-depth is further discussed in Appendix A, Section A.9, and typically includes multiple independent layers of defense, including accident prevention, accident management, and accident mitigation layers. Section 3.3.2 below discusses a particular use of defense-in-depth as it applies to SS controls. The DSA shall describe the facility’s approach to defense-in-depth for protection of workers and the public from the release of radioactive or other hazardous material. Defense in depth as an approach to facility safety has extensive precedent in nuclear safety philosophy. It builds in layers of defense against release of hazardous materials so that no one layer by itself, no matter how good, is completely relied upon. To compensate for potential human and mechanical failures, defense in depth is based on several layers of protection with successive barriers to prevent the release of hazardous material to the environment. [Purpose, page 7] Structures, systems, or components that are major contributors to defense in depth are designated as safety-significant SSCs. [Purpose, page 7] As a minimum, all aspects of defense in depth identified must be covered within the relevant safety management programs (e.g., maintenance, quality assurance) committed to in the DSA. [Purpose, page 9] SS No Significant Clarification 46 3.3 Hazard Controls 4th paragraph In some cases, safety SSCs rely upon supporting SSCs to perform their intended safety function. For new facilities, Attachment 3 of DOE O 420.1C requires that support SSCs be designed as SC or SS SSCs if their failures prevent safety-SSCs or SACs from performing their safety functions. For existing facilities, support SSCs shall be designated at the same classification (SC or SS) as the safety controls they support, or else compensatory measures shall be established to assure that the supported safety- SSC can perform its safety function when called upon. Expected products of this chapter, as applicable based on the graded approach, include: … · Identification of support systems safety SSCs depend upon to carry out safety functions. [4, Purpose] This subsection identifies requirements that are specifically needed to fulfill safety functions. Such functional requirements are specified for both the safety class SSC and any needed support safety-class SSCs. [4.3.x.3] This subsection identifies requirements that are specifically needed to fulfill safety functions. Such functional requirements are specified for both the safety significant SSC and any needed support safety- significant SSCs. [4.4.x.3] SC, SS No Clarification of existing requirements. Support SSCs addressed in O 420.1C 47 3.3 Hazard Controls 5th paragraph SSCs whose failure would result in losing the ability to complete an action required by a SAC shall be identified. These SSCs shall be designated as SC or SS based on the SAC safety function or justification provided if not so designated. Expected products of this chapter, as applicable based on the graded approach, include: · Descriptions of safety SSCs and SACs including safety functions. · Identification of support systems safety SSCs depend upon to carry out safety functions. [4, Purpose]

SC, SS No Clarification provided. Support SSCs for SACs. Guidance is also in DOE- STD-1186-2004. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 19 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 48 3.3.1 Safety Class Controls 1st paragraph If the unmitigated release consequence for a DBA/EBA exceeds the EG, SC controls shall be applied to prevent the accident or mitigate the consequences to below the EG. If unmitigated off- site doses between 5 rem and 25 rem are calculated (i.e., challenging the EG), SC controls should be considered, and the rationale should be described for decisions on whether or not to classify controls as SC. Comparison of the unmitigated consequences for a limited subset of potential accidents to the EG is performed to determine if the need for designation of SC SSCs exists. If the EG value is approached by the unmitigated consequences of a release scenario, a need for SC SSC designation is indicated. … If the need for SC designation is determined, all preventive and mitigative features associated with the sequence of failures that result in a given release scenario, as well as any features whose functionality is assumed as part of the scenario definition itself are candidates for SC SSC designation. [A.2] The value of 25 rem TEDE is not to be used as a ‘hard’ pass/fail level. Unmitigated releases should be compared against the EG to determine whether they challenge the EG, rather than exceed it. [A.2] Thus, the unmitigated release calculation is a critical step in the DBA formulation process that estimates the potential magnitude of the radiological release. The result of the calculation is compared to the EG to (1) determine if any SC SSC is required and (2) provide insight for selecting the appropriate SC SSC(s) for each DBA scenario. [A.3.1] SC No Clarification provided – see also requirements (#49) if controls can not keep doses below the EG. A firm new requirement is provided for new facilities to establish controls to get below the EG. No impact of this requirement on existing facilities. 49 3.3.1 Existing Facilities with Mitigated Offsite Consequence Estimates over the EG 1st paragraph In circumstances where no viable control strategy exists in an existing facility to prevent or mitigate the consequence of one or more of the accident scenarios from exceeding the EG, the following information shall be provided in the DSA, or an attachment to the DSA:  Identification of the accidents that cannot be mitigated or prevented, including the likelihood of the event(s) and the mitigated consequences associated with the event(s), based on calculations following the methodology described in this Standard.  A discussion of the credited controls, including their reliability and adequacy, and an analysis of the expected likelihood and mitigated offsite consequence estimates of the associated accident(s). The analysis should include a discussion of the significant contributors to If the Evaluation Guideline is exceeded, provide a summary assessment of the significance of the exceedance and administrative and/or engineered controls whose implementation would prevent or mitigate the accident sequence. Detailed cost-benefit analyses to evaluate potential changes are beyond the scope of the DSA. [3.4.2.X.4] SC Yes A new conditional requirement, if mitigated offsite dose estimates exceed the EG.

DOE-STD-3009-2014 Requirements Table 1-8-2015 - 20 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments uncertainties in both the likelihood and consequence evaluations. The analysis should compare the risk (i.e., likelihood and consequences) based on calculations performed per Section 3.2 of this Standard to the risk calculated using mean or best estimate values for source-term and dispersion input parameters (with supporting technical basis).  A discussion of the available controls that could reduce the likelihood and/or consequences of the associated accident(s), including their potential failure modes, their potential impact on accident mitigation, any relevant cost/benefit results, and the reasons why they are not selected as credited controls to reduce the consequences to below the EG.  A discussion of any planned operational or safety improvements, including potential facility modifications, reductions in MAR, and/or additional compensatory measures, and associated schedules, to further reduce the likelihood and/or mitigate consequences of an accident. Note: Where DOE has accepted a path forward, the path forward may be used to support this discussion.  A qualitative or semi-quantitative comparison of the facility risk from the identified scenarios and total facility risk (i.e., cumulative risk estimate for facility accidents) with the quantitative safety objectives provided in DOE Policy 420.1. Discuss the level of risk and the basis why this risk is acceptable, taking into account an evaluation of available alternatives, the benefits to the public of the alternatives, and the costs to the public of the alternatives. 50 3.3.1 Existing Facilities with Mitigated Offsite Consequence Estimates over the EG 3rd paragraph Once this condition (i.e., mitigated offsite consequence estimates over the EG) is identified in the DSA, the associated DSA content required above (including planned safety improvements and associated schedules) shall be updated in each subsequent annual update until the condition is prevented or mitigated below the EG, and may be removed from the DSA once resolved. N/A SC Yes A conditional requirement, if mitigated offsite dose estimates exceed the EG. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 21 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 51 3.3.2 Safety Significant Controls 1st paragraph SS control designation shall be made on the basis of the control’s contribution to: (1) defense-in-depth; (2) protection of the public from release of hazardous chemicals; (3) protection of co-located workers from hazardous chemicals and radioactive materials; and, (4) protection of in-facility workers from fatality, serious injury, or significant radiological or chemical exposure. Structures, systems, and components which are not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to defense in depth and/or worker safety as determined from safety analyses. [10 CFR 830] … ]Definition, SS SSCs] Any accidents that have a significant consequence potential to the public or workers, independent of likelihood, must be thoroughly evaluated, including the identification of any appropriate safety SSCs or administrative controls. [Page A-10]

SS No Designation of SS SSCs remains broadly consistent. 52 3.3.2 Safety Significant Controls Providing Major Contribution to Defense-in-Depth 1st paragraph Controls that provide a major contribution to defense- in-depth shall be designated as SS. These controls (SSCs and SACs) should be technically defensible, based on candidate controls in the hazard evaluation or accident analysis, and established based on the following:  If a candidate control is common to multiple hazard/accident scenarios with moderate or high unmitigated consequences, its relative contribution to defense-in-depth should be considered for designating the control as an SS SSC or SAC. This consideration should be in the context of all of the hazard/accident scenarios taken together across the spectrum of hazards.  If a support SSC is common to several SS SSCs (but not necessarily required to ensure operability alone of any single SS SSC) then it should be considered, from a reliability perspective, as a candidate for SS classification.  If a candidate control further significantly reduces the consequences of a hazard/accident scenario already assigned an SC or SS control, then this control should be considered for designation as an SS SSC or SAC.  If a candidate control that further significantly reduces the likelihood of a hazard/accident scenario already assigned an SC or SS Structures, systems, and components which are not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to defense in depth …. [10 CFR 830] [Definition, SS SSCs] This section summarizes significant aspects of defense in depth, and identifies associated safety-significant SSCs, SACs and other items needing TSR coverage. … Distinguish safety-significant SSCs from among those structures, systems, and components contributing to defense in depth. To effectively use the graded- approach concept, focus on the most important items of defense in depth whose failure could result in the most adverse uncontrolled releases of hazardous material. [3.3.2.3.2] SS Yes Significant clarification for what is a major contributor to defense in depth to select SS controls. Criteria adopted from DOE-STD-1189-2008, with modifications. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 22 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments control, then this control should be considered for designation as an SS SSC or SAC.  The control appreciably reduces the risk of significant energetic events that potentially threaten multiple safety systems, then this control should be considered for designation as an SS SSC or SAC.  If the reliability of a single control (preventative or mitigative) is not as high as desired, candidate controls designed to increase reliability by providing multiple layers of protection should be considered as SS SSCs or SACs. 53 3.3.2 Safety Significant Controls Providing Protection to the Public from Chemicals 1st paragraph SS designation of controls for protection of the public from chemical releases shall be based on a peak 15 minute time-weighted average air concentration, measured at the receptor location, that exceeds PAC-2 (AEGL-2, ERPG-2, and/or TEEL-2).

Identify structures, systems, and components as safety- significant SSCs where appropriate. As a general rule of thumb, safety-significant SSC designations based on worker safety are limited to those systems, structures, or components whose failure is estimated to result in … significant radiological or chemical exposures to workers (see definition of safety-significant SSCs for further clarification). [3.3.2.3.3 and Definitions, SS SSCs] DSAs specifically examine those hazards inherent in processes and related operations that can result in uncontrolled release of hazardous material (i.e., chemical or radiological) or process-unique energy sources (e.g., high pressure autoclave). [Definitions, hazard] Candidate hazards include … hazardous chemicals as defined by OSHA in 29 CFR 1910.1200 and 29 CFR 1910.1450; any material assigned a reportable quantity value in 40 CFR 302, Table 302.4; threshold planning quantities in 40 CFR 355 Appendix A; threshold planning quantities in 29 CFR 1910.119; level of concern quantities in EPA’s “Technical Guidance for Hazard Analysis—Emergency Planning for Extremely Hazardous Substances”; or materials rated as 3 or 4 in National Fire Protection Association 704 “Identification of the Fire Hazards of Materials.” [Definitions, hazardous materials] The hazard classification mechanism used in DOE-STD- SS Yes New Requirement – for use of PAC-2 values to determine need for SS controls; this was adopted from DOE-STD- 1189-2008. Not a new requirement to establish SS controls to protect the public. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 23 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 1027 does not consider the potential hazardous chemical releases. The results of the hazard analysis will indicate whether a facility contains significant chemical hazard(s) that may necessitate accident analysis. [Chapter 1, graded approach] Since the hazard analysis activity is considered sufficient for Hazard Category 3 facilities, … A possible exception to this case, as previously noted, is a facility with Hazard Category 3 quantities of radionuclides but possessing large amounts of toxic chemicals. Such facilities need to summarize the maximum radiological consequences expected and identify the chemical accidents selected for accident analysis. [3.3.2.3.5] Hazard Category 3 facilities will not have safety-class SSCs and the number of safety-significant SSCs and SACs if any, will be less than that of a Hazard Category 2 facility due to the reduced magnitude of hazards. As noted in Chapter 3, “Hazard and Accident Analyses,” a possible exception to this general guidance pertains to chemical hazards. The hazard classification mechanism used in DOE-STD-1027-92 does not consider potential hazardous chemical releases. It is possible that a Hazard Category 3 facility could need safety-class items for large chemical hazards, although it is not typically expected. [Chapter 4, Purpose] 54 3.3.2 Safety Significant Controls Providing Co-located Worker Safety 1st paragraph For radiation hazards, a conservatively calculated unmitigated dose of 100 rem TED to a receptor located at 100 meters from the point of release shall be used as the threshold for designation of SS controls. The methodology used to determine consequences shall be consistent with that described in Section 3.2. SS designation for protection of co- located workers from chemical releases shall be based on a peak 15 minute time-weighted average air concentration at the receptor location that exceeds PAC-3.

The hazards analysis examines the complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to hazardous materials. [Definition, Hazard Analysis] Old STD-3009 uses the term “onsite workers” once (above) and does not use the term “co-located workers”. Protection of the public is paramount in safety design, but protection of workers is no less important. However, the degree of protection for facility workers achievable by safety SSCs is limited. Major contributions to overall safety assurance to the worker are institutional factors such as conduct of operations, training, and the entirety of safety management programs. [A.4] SS Yes New Requirement – for use of 100 rem or PAC-3 values to determine need for SS control; this was adopted from DOE-STD-1189-2008. Not a new requirement to establish SS controls to protect the workers, including co-located workers. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 24 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 55 3.3.2 Safety Significant Controls Providing Co-located Worker Safety 2nd paragraph … If the mitigated dose still exceeds 100 rem, or adjacent facilities are located at 100 meters or less from the point of release, the DSA shall provide a technical basis for the acceptance of the mitigated analysis results, including the reasons why other controls were not credited to reduce consequences below 100 rem. N/A SS Yes A new conditional requirement, if mitigated co- located worker dose estimates exceed 100 rem at 100 meters. 56 3.3.2 Safety Significant Controls Providing for Facility Worker Safety 1st paragraph Safety management programs provide an important part of the overall strategy for protecting facility workers. However, SS controls (SSCs or SACs) shall be selected for cases where a fatality, serious injury, or significant radiological or chemical exposure to a facility worker may occur. The term “serious injury” refers to an injury requiring medical treatment for immediately life-threatening or permanently disabling injury such as the loss of an eye or limb. SS controls are not designated solely to address standard industrial hazards (see Appendix A.1). Examples of conditions that warrant consideration of SS designation include:  High concentrations of radioactive or chemically toxic materials in areas where a facility worker could be present;  Explosions or over-pressurizations within process equipment or confinement/containment structures or vessels, where serious injury or death to a facility worker may result from the fragmentation of structures or vessels; and  Unique hazards that could result in asphyxiation or significant chemical/thermal burns. Structures, systems, and components which are not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to defense in depth and/or worker safety as determined from safety analyses. [10 CFR 830] … Considerations should be based on engineering judgment of possible effects and the potential added value of safety-significant SSC designation. [DOE G 420.1-1] As a general rule of thumb, safety-significant SSC designations based on worker safety are limited to those systems, structures, or components whose failure is estimated to result in a prompt worker fatality or serious injuries or significant radiological or chemical exposures to workers. [3.3.2.3.3. and Definition, SS SSCs]

SS Yes Significant clarifications provided, partly based on DOE-STD-1189-2008 and DOE-STD-5506-2007. 57 3.3.4 Criticality Safety Controls The Criticality Safety Program ensures that operations remain subcritical under normal and credible abnormal conditions. Nuclear Criticality Safety controls derived in accordance with the DOE approved NCS Program are required to be implemented in accordance with 10 C.F.R. Part 830, Subpart A, Quality Assurance Requirements, commensurate with the importance of the safety functions performed. Explicit criticality controls required as a result of hazard evaluation criteria established in Section 3.1.3.2 shall be documented in The safety items identified in the hazard analysis are examined against those criteria to identify a subset of the most significant controls that prevent uncontrolled release of hazardous materials and nuclear criticality. [Introduction, Defense in Depth] DOE G 423.1-1 provides basic screening criteria to identify defense-in-depth features/items that may require specific TSR coverage. Such features include …active controls that prevent criticality. [3.3.2.3.2] SS No DOE-STD-3009-2014 Requirements Table 1-8-2015 - 25 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments the DSA and classified in accordance with requirements of Sections 3.3.1 and 3.3.2. This section analyzes DBAs for each of the major categories to quantify consequences and compare them to the Evaluation Guideline. The major categories are: internally initiated operational accidents (e.g., fires, explosions, spills, criticality); …. [3.4.2] Criticality treated no differently than other DBAs in Old- 3009. 58 3.4 DESIGN OF HAZARD CONTROLS 1st paragraph . . . A system evaluation supporting the adequacy of safety SSCs and SACs, required to be included in the PDSA in accordance with DOE-STD-1189-2008, shall be incorporated into the DSA using guidance provided in Appendix B of this Standard. N/A SC. SS No Documentation requirement applies to new facilities and major mods. only, to incorporate PDSA system evaluation into DSA. Requirement flows from STD- 1189-2008 – not a significant change. 59 3.4 DESIGN OF HAZARD CONTROLS 2nd paragraph For existing facilities, an engineering evaluation shall be conducted to assess the performance capabilities of safety SSCs. The evaluation shall determine the adequacy of the safety SSCs and demonstrate that they meet or exceed performance criteria (i.e., operational responses and capabilities) for the SSCs to ensure designated functional requirements are met under postulated accident conditions such as elevated pressures and temperatures. If performance criteria are not met, the evaluation shall identify noted deficiencies and any compensatory measures necessary to ensure the safety function of the SSCs. These compensatory measures may need to be identified as additional TSR controls, subject to the considerations for safety classification of controls described in Section 3.3. This subsection provides performance criteria imposed on the safety-class SSC so it can meet functional requirement(s) and thereby satisfy its safety function. Performance criteria characterize the specific operational responses and capabilities necessary to meet functional requirements.

Engineering judgment may be used to develop performance criteria for existing safety SSCs (i.e., already designed) where documentation of design and operational responses may not exist. In determining performance criteria for safety-class SSCs, existing criteria traditionally associated with safety-class designation, such as single failure criteria, should be considered in the judgment process. However, for existing SSCs, formal design comparison and compliance with traditional safety-class performance criteria is not required. Evaluate the capabilities of the SSC to meet performance criteria. The evaluation should be as simple as possible, and rely on engineering judgment, calculations, or performance tests as opposed to formal design reconstitution. [4.3.X.4] SS No Clarified expectations. DOE-STD-3009-2014 Requirements Table 1-8-2015 - 26 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments 60 3.4 DESIGN OF HAZARD CONTROLS 3rd paragraph The engineering evaluation shall address the relevant design capabilities of safety SSCs by one of the following methods:  Providing a technical basis that includes an evaluation against the code of record, to the extent known, and augmented as needed with calculations, performance tests, or reliability evidence from operating history or industry databases;  Comparing the safety SSC design attributes to DOE O 420.1C (or applicable successor document) design requirements, and associated codes and standards that are applicable, to demonstrate compliance; or  Demonstrating that the existing SSCs satisfy equivalent design requirements of current design codes and standards. This section lists the design codes, standards, regulations, and DOE Orders that are required for establishing the safety basis of the facility. The intent is to provide only the requirements that are specific for this chapter and pertinent to the safety analysis, and not a comprehensive listing of all industrial standards or codes or criteria. SRIDs may be referenced as appropriate. In determining performance criteria for safety-class SSCs, existing criteria traditionally associated with safety-class designation, such as single failure criteria, should be considered in the judgment process. However, for existing SSCs, formal design comparison and compliance with traditional safety-class performance criteria is not required. Evaluate the capabilities of the SSC to meet performance criteria. The evaluation should be as simple as possible, and rely on engineering judgment, calculations, or performance tests as opposed to formal design reconstitution. [4.3.X.4] SS No Clarified requirement for evaluating design capabilities. 61 3.5 BEYOND DESIGN/ EVALUATION BASIS ACCIDENTS 1st paragraph Section 830.204 of 10 C.F.R. Part 830 requires consideration of the need for analysis of accidents which may be beyond the design basis of the facility. Accidents that are excluded from accident analysis based on application of the criteria in Section 3.2.1 shall be scrutinized to determine whether they should be further evaluated as beyond design basis accidents (BDBAs) or beyond evaluation basis accidents (BEBAs). The Rule requires consideration of the need for analysis of accidents which may be beyond the design basis of the facility to provide a perspective of the residual risk associated with the operation of the facility.

It is expected that beyond DBAs will not be analyzed to the same level of detail as DBAs. The requirement is that an evaluation be performed that simply provides insight into the magnitude of consequences of beyond DBAs (i.e., provide perspective on potential facility vulnerabilities). [3.4.3] No No Clarified requirement – flows directly from Rule requirement. Beyond DBAs – not SC or SS. 62 Section 4 DSA FORMAT AND CONTENT 1st paragraph . . . The DSA shall address applicable DSA sections described below, consistent with the format and content described below. . . . This Standard incorporates and integrates many different approaches regarding DSA format and content. To ensure a consistent application of this Standard among users, the following guiding principles are provided. …  A common DSA format (chapter, title, and organization) for all nonreactor nuclear facilities is desirable but not essential. A table is to be provided by the preparer that indicates where the DSA requirements of 10 CFR 830 are addressed. No No These are documentation requirements – not accident analysis or control selection – generally consistent with previous expectations. There are some significant changes in documentation expectations. For example, STD-3009-2014 does not DOE-STD-3009-2014 Requirements Table 1-8-2015 - 27 - # 3009-2014 Section DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments Content needs to be flexible to allow for different facility types, hazard categories, and other grading factors. While a basic descriptive model of the facility and its equipment must be provided in Chapter 2, “Facility Description,” highly detailed descriptions are reserved for two categories of SSCs comprising the most crucial aspects of facility safety. These two categories are safety-class SSCs and safety-significant SSCs. [Purpose, page 9] Descriptions for each safety-class SSC must be complete enough to indicate suitability of safety analysis inputs and assumptions. [4.3] Descriptions for each safety-significant SSC must be complete enough to allow for verification of the accuracy of the safety analysis inputs and assumptions. [4.4] Descriptions for each SAC must be complete enough to indicate suitability of safety analysis inputs and assumptions (see DOE-STD-1186). [4.5] For SACs, functional requirements may involve unimpeded access to specific rooms or areas, use of certain instrumentation, written procedures or checklists, and special tooling. The description of the functional requirement must fully address all aspects important for ensuring the SAC can be accomplished. [4.5.X.3] To meet the human factors safety requirements of 10 CFR 830, a systematic inquiry of human factors must be presented. [Chapter 13] Design of significant modifications to an existing facility must consider provisions for D&D. [Chapter 16] For facilities whose mission is D&D, which includes deactivation, a DSA that addresses the safety aspects of the decontamination and decommissioning activities must be prepared. [Chapter 16] Assessment of future D&D activities must be based on an evaluation of the type and magnitude of hazards and require a separate chapter for each safety management program. These changes are not rated as significant because they are decreased documentation requirements DOE-STD-3009-2014 Requirements Table 1-8-2015 - 28 - # 3009-2014 Section

DOE-STD-3009-2014 Text (11-12-14 Final Issued) DOE-STD-3009-94 CN3 Text (March 2006) Safety Class.? 1 Significant Change ? Comments the complexity of processes. [16.3] 1 Applicable requirements identified as "Safety Class" are from either the Accident Analysis Section (3.2) or the Hazard Controls Selection Section (3.3). Requirements from Hazard Analysis Section (3.1) are not identified as "Safety Class" because these controls are evaluated for "Safety Significant" designation, which may be upgraded to "Safety Class" if the hazard analysis establishes that an accident analysis is necessary and the accident analysis indicates a need for "Safety Class" controls. Note: Additional "new changes" in the STD-3009 guidance affect DSA development but are not captured in the above table of requirements. Color Codes – Safety Classification Column Safety Class (SC) – The DOE-STD-3009-2014 requirements apply to SC controls. Safety Significant (SS) only – The DOE-STD-3009-2014 requirements apply to SS controls only. No – The DOE-STD-3009-2014 requirements do not apply to either SC or SS controls. Color Codes – Significant Change Column Yes – The DOE-STD-3009-2014 requirements are a significant change. No – The DOE-STD-3009-2014 requirements are not a significant change.