DOE-STD-3009-2014 Roll-Out Part II

Session II – Hazard Analysis II-1 DOE-STD-3009-2014 Roll-Out DOE-STD-3009-2014 Roll-out AU Session II Overview  DOE-STD-3009-2014, Section 3 provides detailed criteria and guidance for performing Hazard Analysis, Accident Analysis, and Hazard Control Selection  Clarifies requirements, adding “shalls” to CN3 guidance • See handout “DOE-STD-3009-2014 Requirements Table” • Red font on slides highlight requirements if not already obvious  Session II Hazard Analysis Topics: • Hazard Identification • Hazard Evaluation II-2 DOE-STD-3009-2014 Roll-out AU Hazard Analysis Major Changes  No significant change in philosophy  “Hazard Analysis” is: • Hazard Identification, • Hazard Categorization, and • Hazard Evaluation.  Clarifies methods for unmitigated and mitigated hazard evaluations and control selection  Includes Co-located Worker receptor @ 100 m  Clarifies treatment of standard industrial hazards  Includes screening & evaluation of chemical hazards Note: STD-3009-2014 Section number in upper right box. II-3 3.1 DOE-STD-3009-2014 Roll-out AU Hazard Analysis Key Requirements  No significant changes, other than addition of clear “shall” statements • Systematic Identification & Evaluation of Hazards • Nuclear and Nonnuclear Hazards • Complete Spectrum of Events (“hazard scenarios”) • Largely Qualitative • Hazard Analysis Forms Basis for Entire Safety Analysis II-4 3.1 DOE-STD-3009-2014 Roll-out AU Hazard Identification Major Changes  Clarifies Exclusion of Standard Industrial Hazards (SIH) and Chemical Screening • Appendix, Section A.1 clarifies SIH screening • Appendix, Section A.2 clarifies chemical screening  Document Basis for Exclusions • Examples: 10 C.F.R. 851.23, Safety & Health Standards; other codes  Use bounding inventories (radiological and hazardous materials) • May use SACs to establish inventory limits  DSA Section [3.3.2.1] hazard ID summary tables or text Note: use of brackets [ ] refers to DOE-STD-3009-2014, Section 4 II-5 3.1.1 DOE-STD-3009-2014 Roll-out AU Appendix, Section A.1 Standard Industrial Hazards  Standard Industrial Hazards (SIHs) are hazards that are routinely encountered in general industry and construction. • SIHs are addressed by 10 C.F.R. 851, Worker Safety and Health Program (issued 2006). • 10 C.F.R. 851 requires identification and assessment of worker hazards and compliance with safety and health standards that provide specific safe practices and controls. II-6 3.1.1 DOE-STD-3009-2014 Roll-out AU Appendix, Section A.1 SIH Screening  SIH included in DSA Hazard Evaluation if: • Initiate radiological or hazardous material (hazmat) accident • Worsen consequences of radiological or hazmat accident • Result from chemical or radiological hazards (e.g., shrapnel from explosion due to radiolysis in tank) • Prevent Safety SSCs from providing its safety function  Unique Hazards not Excluded as SIH • Unique to DOE applications or operations • Larger quantities than typically used in general industry • Affect entire work area or impact safe operations of facility (prevent implementing SAC) II-7 3.1.1 DOE-STD-3009-2014 Roll-out AU Appendix, Section A.2 Chemical Screening  DSA not intended to deal extensively with chemicals that can be safely handled by Hazardous Material Protection Program  Example chemical screening: • No known or suspected toxic properties (listed by OSHA or EPA, has PAC-2 or PAC-3 value established)

• NFPA 704 health hazard rating of 0 or 1 • Commonly available and used by general public • Small-scale use quantities similar to intent of 29 C.F.R. 1910.1450 • May exclude fire smoke but not process decomposition products II-8 3.1.1 DOE-STD-3009-2014 Roll-out AU Appendix, Section A.2 Chemical Screening (Cont.)  Extraordinary toxic hazard not excluded  Chemicals included if: • Initiate or contribute to radiological or hazmat accidents, or • Prevent operators to safely manage facility II-9 3.1.1 DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Major Changes  Methodology • Standardizes frequency, consequences, and risk tables • Appendix, Section A.3 clarifies initial conditions • Appendix, Section A.4 clarifies risk ranking  Mitigated Hazard Evaluation • Effectiveness of Controls • Safety Functions  Facility Worker Hazard Evaluation  Inadvertent Criticality Hazard Evaluation  Chemical Hazard Evaluation II-10 3.1.3 DOE-STD-3009-2014 Roll-out AU Hazard Evaluation General  The hazard evaluation shall provide: (a) Assessment of the facility hazards associated with the full scope of planned operations  Normal ops (startup/shutdown, maintenance), abnormal conditions, accident conditions (b) Identification of controls that can prevent or mitigate these hazards or hazardous conditions.  Operational Accidents, Natural Phenomena Hazards (NPH), Man-made External Events  Graded Approach to select Haz. Eval. Technique • Rationale justified II-11 3.1.3 DOE-STD-3009-2014 Roll-out AU  Unmitigated hazard evaluation of “hazard scenarios” • Each initiating event by assuming absence of preventive or mitigative controls • Initial Conditions covered in Section 3.2.2 unmitigated analysis  Estimate Consequences • Qualitative and/or semi-quantitative techniques • Shall address potential effects on Facility Workers (FW), Co- located Workers (CLW), and Public (Maximally-exposed Offsite Individual [MOI])  CLW is new requirement • Shall use Table 1 consequence levels II-12 Hazard Evaluation General (Cont.) 3.1.3 DOE-STD-3009-2014 Roll-out AU  Estimate Likelihoods Qualitatively • Shall use Table 2 likelihood bins  Use of risk binning optional • If risk rankings used, Tables 1 and 2 shall be used • Appendix, Section A.4, Hazard Evaluation and Risk Ranking & Table A-1  Section 3.2.2 provides additional considerations II-13 Hazard Evaluation General (Cont.) 3.1.3 DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Table 1 Consequence Thresholds II-14 3.1.3 Consequence Level Public Co-located Worker Facility Worker High ≥25 rem TED or ≥PAC-2 ≥100 rem TED or ≥PAC-3 Prompt death, serious injury, or significant radiological and chemical exposure Moderate ≥5 rem TED or ≥PAC-1 ≥25 rem TED or ≥PAC-2 No distinguishable threshold Low <5 rem TED or <PAC-1 <25 rem TED or <PAC-2 No distinguishable threshold DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Table 2 Qualitative Likelihood Bins II-15 3.1.3 Description Likelihood Range (/year) Definition Anticipated Likelihood >10-2 Events that may occur several times during the lifetime of the facility (incidents that commonly occur). Unlikely 10-2> likelihood >10-4 Events that are not anticipated to occur during the lifetime of the facility. Natural phenomena of this likelihood class include: Uniform Building Code-level earthquake, 100-year flood, maximum wind gust, etc.

Extremely Unlikely 10-4> likelihood >10-6 Events that will probably not occur during the lifetime of the facility. Beyond Extremely Unlikely Likelihood <10-6 All other accidents. DOE-STD-3009-2014 Roll-out AU  May quantify frequency of occurrence to assign qualitative likelihood • Probabilistic calculations not required to inform likelihood estimates • May use probabilistic risk assessment (PRA) per DOE-STD-1628-2013 to inform qualitative likelihood estimates • Use DOE-STD-3014-2006 for aircraft crash frequencies  Use of <1E-6/yr (BEU) threshold not appropriate for Haz Eval • Should not be used as an absolute cutoff for dismissing physically possible low probability operational accidents such as “red oil” explosions. • Hazard scenarios of operational accidents that are deemed not plausible per the criteria in Section 3.2.1 may be excluded from the hazard evaluation also. II-16 3.1.3 Hazard Evaluation Table 2 (Cont.) DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Table A-1: Risk Ranking Bins II-17 3.1.3 Consequence Level Beyond Extremely Unlikely Below 10-6/yr Extremely Unlikely 10-4 to 10-6/yr Unlikely 10-2 to 10-4/yr Anticipated Above 10-2/yr High Consequence III II I I Moderate Consequence IV III II II Low Consequence IV IV III III DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Facility Worker  FW unmitigated consequences should be based on combination of the following: (1) Magnitude, type, and form of radioactive and hazardous materials involved in a hazard scenario; (2) Type and magnitude of energy sources involved in scenario; (3) Characteristics of hazard scenario such as duration and location where it may occur (e.g., in unmanned areas, such as tank vaults); and, (4) Potential for a hazard to impact workers’ mobility or ability to react to hazardous conditions.  Mobility or ability to react to hazardous conditions should not be used as the sole or primary basis for determining FW impacts II-18 3.1.3 DOE-STD-3009-2014 Roll-out AU  May exclude FW consequences if solely due to SIH • Include serious injury/fatality from SIH if due to the rad. or chemical hazard being evaluated (e.g., explosion, chemical burn)  May use scoping calculations, engineering judgment, historical experience • Not expected to quantify FW rad. / hazmat inhalation consequences II-19 Hazard Evaluation Facility Worker (Cont.) 3.1.3 DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Co-located Worker  Consequence determinations shall be supported by an adequate technical basis • Such as scoping calculations consistent with Section 3.2.4.  Alternately, the quantitative evaluation CLW consequences used to compare to Table 1 thresholds may be performed in the accident analysis and reported in the DSA Section [3.4] II-20 3.1.3 DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Hazard Controls  For each of the unmitigated hazard scenarios, the controls (SSCs, administrative and/or programmatic) that can prevent or mitigate the hazard scenario shall be identified.  A mitigated hazard evaluation shall be performed to determine the effectiveness of safety significant (SS) controls by estimating hazard scenario likelihood with preventive controls and consequences with mitigative controls. • Following the preferred hierarchy described in Section 3.3 II-21 3.1.3 DOE-STD-3009-2014 Roll-out AU  Evaluation of control effectiveness may be accomplished using

one of the following two options: (1) Perform mitigated analysis and include results for hazard scenarios directly in hazard evaluation tables; or, (2) Perform mitigated analysis and include as a summary evaluation in DSA Section [3.3.2.3].  In either case, include SS controls for hazard scenarios having: • high estimated chemical consequences to the public, or • high radiological or chemical consequences to workers  Control effectiveness, along with safety functions for these controls, shall be included in the hazard evaluation, • unless determined as part of the Section 3.2 accident analysis II-22 Hazard Evaluation Hazard Controls (Cont.) 3.1.3 DOE-STD-3009-2014 Roll-out AU  Additional considerations for mitigated hazard evaluation are provided in: • Section 3.2.3, Mitigated Analysis • Section 3.3, Hazard Control Classification  DSA hazard evaluation shall also examine the potential for large-scale environmental contamination and identify preventive and mitigative controls to protect the environment • Section 3.3 criteria for safety control selection are not based on environmental contamination  unless a significant spill to the environment outside the facility can contribute to radiological exposures as discussed in Sect. 3.2.4.2. II-23 Hazard Evaluation Hazard Controls (Cont.) 3.1.3 DOE-STD-3009-2014 Roll-out AU  Inadvertent criticality accident represents a special case for hazard evaluation  Criticality safety evaluations per ANSI/ANS-8 series  DSA hazard evaluation shall include: • Events where consequences exceed the high rad. thresholds for either the co-located workers or the MOI, and  Unless unmitigated criticality accident is not credible • Situations where an active engineered control(s) is required by the Nuclear Criticality Safety (NCS) analysis to ensure subcriticality II-24 Hazard Evaluation Criticality Hazards 3.1.3.2 DOE-STD-3009-2014 Roll-out AU  If the NCS program requires a criticality accident alarm system, then the criticality accident alarm system shall be discussed in the hazard evaluation and carried forward to evaluation in accordance with Section 3.3.  Chapter 6 of the DSA will provide: • General discussion of criticality control strategies • General discussion of the parameters used for the prevention of inadvertent criticality II-25 Hazard Evaluation Criticality Hazards (Cont.) 3.1.3.2 DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Chemical Hazards  Chemicals not screened (e.g., A.2) need to be considered for their possible impact on: • radiological or other chemical accident initiation or progression, or • potential adverse impact on safety systems  Qualitative evaluation of chemical consequences is generally sufficient for comparison to Table 1  Quantitative analysis should be performed to determine impacts to CLW and MOI (based on guidance in 3.2.4.3) II-26 3.1.3.3 DOE-STD-3009-2014 Roll-out AU  Determination of chemical quantities sufficient to challenge the criteria may be supported by: • Scoping calculations using the methods presented in Section 3.2.4.3, or by • Engineering judgment based on previous safety basis calculations, emergency planning calculations, or consensus standards.  Appendix, Section A.2 provides guidance on chemical exposure calculations • Topic to be addressed in more detail in the DOE Accident Analysis Handbook II-27 Hazard Evaluation Chemical Hazards (Cont.) 3.1.3.3

DOE-STD-3009-2014 Roll-out AU Hazard Evaluation Documentation  Section [3.3.2.3] Provides Expectations of Summaries  Provide Hazard Evaluation tables or data sheets - either as a DSA appendix or supporting document(s). • Note that hazard evaluation data are part of the DSA, whether included directly or by reference.  For each hazard scenario table or data sheets: • Brief scenario summary, unmitigated likelihood and consequences, preventive and mitigative controls • Optional: unmitigated risk binning; mitigated likelihood, consequence, risk binning; and operational safety enhancements II-28 DOE-STD-3009-2014 Roll-out AU  Provide summaries if large number of hazard scenarios by distilling from Hazard Evaluation tables or data sheets  Present mitigated hazard evaluation if not included in DSA Section 3.4, Accident Analysis  Other DSA Sections: • [3.3.2.4] Defense-in-Depth  Appendix, Section A.9 provides background on defense-in-depth philosophy • [3.3.2.5] Facility Worker Safety • [3.3.2.6] Environmental Protection II-29 Hazard Evaluation Documentation (Cont.)