DOE-STD-3009-2014 Roll-Out Part IV

Session IV – Hazard Controls Selection IV-1 DOE-STD-3009-2014 Roll-Out DOE-STD-3009-2014 Roll-out AU Session IV Overview  DOE-STD-3009-2014, Section 3 provides detailed criteria and guidance for performing Hazard Analysis, Accident Analysis, and Hazard Control Selection  Clarifies requirements, adding “shalls” to CN3 guidance • See handout “DOE-STD-3009-2014 Requirements Table” • Red font on slides highlight requirements if not already obvious II-2 DOE-STD-3009-2014 Roll-out AU Session IV Overview (Cont.)  Session IV Hazard Control Topics: • Hazard Controls Selection (3.3) • Safety Class • Safety Significant • Other Hazard Controls • Criticality Controls • Hazard Controls Design (3.4) • Beyond DBAs/EBAs (3.5) • Planned Operational Safety Improvements (3.6)  Summary IV-3 DOE-STD-3009-2014 Roll-out AU Hazard Controls Major Changes  Establishes requirement for new facilities to meet the EG with safety-class controls  Clarifies use of hierarchy of controls  Clarifies defense-in-depth concept  Existing facilities over the EG Evaluation  Clarifies requirements for SS Controls for co-located worker safety and chemical protection of the public  Provides criteria to evaluate adequacy of safety SSCs IV-4 3.3/3.4 DOE-STD-3009-2014 Roll-out AU Hazard Controls Key Requirements  Section 3.3 Hazard Controls • Section 3.3.1 Safety Class • Section 3.3.2 Safety Significant • Section 3.3.3 Other Hazard Controls • Section 3.3.4 Criticality Safety Controls  Section 3.4 Design of Hazard Controls IV-5 3.3/3.4 DOE-STD-3009-2014 Roll-out AU Hazard Controls General  Where a SC or SS control is needed, all preventive and mitigative controls associated with the sequence of failures for a given scenario are candidates for consideration.  Controls are selected using a judgment-based process considering a hierarchy of controls (e.g., passive over active, engineered features over ACs or SACs, and preventive over mitigative controls)  When the hierarchy of controls is not used for situations requiring SC/SS controls (e.g., a SAC is selected over an available SSC), DSA shall provide a technical basis that supports the controls selected.  Included as part of the Section 3.2.3 mitigated analysis  Section A.8 clarifies hierarchy of controls; after minimization. IV-6 3.3 DOE-STD-3009-2014 Roll-out AU Hazard Controls General (Cont.)  Identification of hazard controls shall incorporate a defense-in-depth approach that builds layers of defense against rad. or haz. material release so that no one layer is completely relied upon. • Appendix, Section A.9 discusses an overall approach to defense-in-depth • Section 3.3.2 discusses a particular use of defense-in-depth as it applies to SS controls. • The DSA shall describe the facility’s approach to defense-in-depth for protection of workers and the public from the release of radioactive or other hazardous material. IV-7 3.3 DOE-STD-3009-2014 Roll-out AU Hazard Controls General (Cont.)  In some cases, safety-SSCs rely upon supporting SSCs to perform their intended safety function • For new facilities, Attachment 3 of DOE O 420.1C requires that support SSCs be designated as SC or SS SSCs if their failures prevent safety-SSCs/SACs from performing their safety functions. • For existing facilities, support SSCs shall be designated at the same classification (SC or SS) as the safety controls they support,

or else compensatory measures shall be established to assure that the supported safety-SSC can perform its safety function  SSCs whose failure would result in losing the ability to complete an action required by a SAC shall be identified and designed as SC or SS IV-8 3.3 DOE-STD-3009-2014 Roll-out AU Hazard Controls Hierarchy of Controls  Section A.8 clarifies hierarchy of controls; after minimizing hazards: (1) SSCs that are preventive and passive (2) SSCs that are preventive and active (3) SSCs that are mitigative and passive (4) SSCs that are mitigative and active (5) Administrative controls that are preventive (6) Administrative controls that are mitigative Note: Active Confinement preferred over Passive Confinement per DOE O 420.1C. IV-9 3.3 DOE-STD-3009-2014 Roll-out AU Hazard Controls Safety Class Controls  If the unmitigated release consequence for a DBA/EBA exceeds the EG, SC controls shall be applied to prevent the accident or mitigate the consequences to below the EG.  If unmitigated off-site doses between 5 rem and 25 rem are calculated (i.e., challenging the EG), SC controls should be considered, • and the rationale should be described for decisions on whether or not to classify controls as SC.  Appendix, Section A.10 provides additional background on the EG. IV-10 3.3.1 DOE-STD-3009-2014 Roll-out AU  Not every control evaluated as a candidate for SC classification will necessarily be designated as SC.  Process of designating one or more controls as SC is judgment-based and depends on multiple factors, such as: • Hierarchy of available controls, • Control’s effectiveness as determined per Section 3.2.3, and • Relative reliability of selected controls.  If the available preventive controls do not eliminate the hazard or terminate the accident scenario, then iterative process of mitigative control selection is performed until mitigated dose below EG. IV-11 3.3.1 Hazard Controls Safety Class Controls (Cont.) DOE-STD-3009-2014 Roll-out AU Hazard Controls Existing Facilities Over the EG  Where no viable control strategy exists in an existing facility to prevent or mitigate the consequence of one or more accident scenarios from exceeding the EG, the following information shall be provided in the DSA, or an attachment: (1) Identification of accidents that cannot be mitigated or prevented. (2) Discussion of credited controls, reliability/adequacy, and analysis of the expected likelihood and mitigated offsite consequences. (3) Discussion of available controls that could reduce the likelihood and/or consequences, including: their potential failure modes, potential impact on accident mitigation, any relevant cost/benefit results, reasons why they are not selected as credited controls to reduce the consequences to below the EG. IV-12 3.3.1 DOE-STD-3009-2014 Roll-out AU (4) Discussion of any planned operational or safety improvements to further reduce the likelihood and/or mitigate consequences, including:  potential facility modifications,  reductions in MAR, and/or  additional compensatory measures, and associated schedules. (5) Qualitative or semi-quantitative comparison of the facility risk from the identified scenarios and cumulative facility risk estimates with the quantitative safety objectives provided in DOE Policy 420.1. IV-13 3.3.1 Hazard Controls Over the EG (Cont.) DOE-STD-3009-2014 Roll-out AU  Level of detail for the analysis may be implemented

on a graded approach that considers the remaining operating life of the facility and the extent of deviation from the EG. • Example: If < 5 yrs, a detailed analysis using mean values and making comparisons to the DOE Policy 420.1 safety goals is not necessary,  But a discussion of available controls considered and planned safety improvements and associated schedules is expected.  Once this condition is identified in the DSA, the information shall be updated in each subsequent annual update until the condition is prevented or mitigated below the EG. IV-14 3.3.1 Hazard Controls Over the EG (Cont.) DOE-STD-3009-2014 Roll-out AU Hazard Controls Safety Significant Controls  SS control designation shall be made on the basis of the control’s contribution to: (1) defense-in-depth (2) protection of the public from release of hazardous chemicals (3) protection of co-located workers from hazardous chemicals and radioactive materials (4) protection of in-facility workers from fatality, serious injury, or significant radiological or chemical exposure.  Similar to the SC control selection, the process of designating one or more controls as SS is judgment- based and iterative. IV-15 3.3.2 DOE-STD-3009-2014 Roll-out AU SS Hazard Controls Defense-in-Depth Controls  Controls that provide a major contribution to defense-in-depth shall be designated as SS.  Established based on the following considerations: (1) Common to multiple hazard/accident scenarios with moderate or high unmitigated consequences. (2) Common to several SS SSCs (reliability perspective). (3) Further significantly reduces the consequences of a hazard/accident scenario already assigned an SC or SS control. (4) Further significantly reduces the likelihood of a hazard/accident scenario already assigned an SC or SS control. (5) Appreciably reduces the risk of significant energetic events that potentially threaten multiple safety systems. (6) Reliability of a single control is not as high as desired … increase reliability by providing multiple layers of protection. IV-16 3.3.2 DOE-STD-3009-2014 Roll-out AU  Chemical releases shall be based on a peak 15 minute TWA air concentration, measured at the receptor location, that exceeds Protective Action Criteria (PAC)-2 (AEGL-2, ERPG-2, and/or TEEL-2). • Note: TEEL table includes many more chemicals than the industrial safety standards covered in AEGL-2 and ERPG-2. • Analysis is not expected for a chemical on the TEEL list when it is apparent that due to releasability or dispersibility considerations, there would be limited, if any, concern for downwind release and exposure. IV-17 3.3.2 SS Hazard Controls Chemical Protection of the Public DOE-STD-3009-2014 Roll-out AU SS Hazard Controls Co-Located Worker Safety  Conservatively calculated unmitigated dose of 100 rem TED to a receptor located at 100 meters from the point of release shall be used as the threshold for designation of SS controls.  Chemical releases shall be based on a peak 15 minute TWA air concentration at the receptor location that exceeds PAC-3. IV-18 3.3.2 DOE-STD-3009-2014 Roll-out AU SS Hazard Controls Co-Located Worker Safety (Cont.)  For existing facilities, if no viable control strategy to either prevent or mitigate hazard/accident scenarios from exceeding onsite radiological or chemical consequence thresholds • DSA may determine co-located worker consequences at

receptor distances further than 100 meters (if correlates to locations of adjacent facilities), • Else, DSA shall provide a technical basis for the acceptance of the mitigated analysis results, including reasons why other controls were not credited to reduce consequences below 100 rem (and should address PAC-3 protection level if not met). IV-19 3.3.2 DOE-STD-3009-2014 Roll-out AU  SS controls (SSCs or SACs) shall be selected for cases where a fatality, serious injury, or significant radiological or chemical exposure may occur.  SS controls are not designated solely to address standard industrial hazards (see Appendix A.1).  Safety Management Programs (SMPs) also play an important part of the overall strategy for protecting facility workers (but not credited as SS). • Further discussions are provided in Section A.11 on safety management programs vs. Section A.12 on SACs. IV-20 3.3.2 SS Hazard Controls Facility Worker Safety DOE-STD-3009-2014 Roll-out AU  Examples of conditions that warrant consideration of SS designation include: • High concentrations of radioactive or chemically toxic materials in areas where a facility worker could be present; • Explosions or over-pressurizations within process equipment or confinement/containment structures or vessels,  where serious injury or death to a facility worker may result from the fragmentation of structures or vessels; and • Unique hazards that could result in asphyxiation or significant chemical/thermal burns. IV-21 3.3.2 SS Hazard Controls Facility Worker Safety (Cont.) DOE-STD-3009-2014 Roll-out AU Hazard Controls Other Hazard Controls  Hazard evaluation process may identify preventive or mitigative controls that do not rise to the level of SC or SS but still enhance the safety of the facility • Identified in the hazard evaluation table but not explicitly credited as SC/SS • Maintained in accordance with SMPs and the Unreviewed Safety Question process  Other hazard controls may also include specific controls required by DOE in its Safety Evaluation Report • See DOE-STD-1104-2014 (November 2014) for further guidance IV-22 3.3.3 DOE-STD-3009-2014 Roll-out AU Hazard Controls Criticality Safety Controls  NCS Program ensures that operations remain subcritical under normal and credible abnormal conditions  Controls derived in accordance with the DOE-approved NCS Program • Implemented in accordance with 10 C.F.R. Part 830, Subpart A, Quality Assurance Requirements  Explicit criticality controls required as a result of hazard evaluation criteria established in Section 3.1.3.2 shall be documented in the DSA and classified in accordance with requirements of Sections 3.3.1 and 3.3.2 IV-23 3.3.4 DOE-STD-3009-2014 Roll-out AU Hazard Controls Design of Hazard Controls  For new facilities, DOE has established design requirements for SC and SS controls. • These design requirements include specific criteria for identification and use of industry codes and standards, as well as DOE technical standards such as DOE-STD-1189-2008 and DOE-STD-1020-2012.  As specified in DOE O 420.1C. • A system evaluation supporting the adequacy of safety SSCs and SACs, shall be incorporated into the DSA using guidance provided in Appendix B of this Standard.  As required to be included in the PDSA in accordance with DOE-STD-1189-2008. IV-24 3.4 DOE-STD-3009-2014 Roll-out AU  For existing facilities, an engineering evaluation

shall be conducted to assess the performance capabilities of safety SSC(s).  Evaluation shall determine the adequacy of the safety SSC(s) and demonstrate that it meets or exceeds performance criteria imposed on the SSC to ensure designated functional requirements are met under postulated accident conditions. • If performance criteria are not met, evaluation shall identify noted deficiencies and any compensatory measures necessary to ensure the safety function of the SSC.  May need safety classification and additional TSR controls IV-25 3.4 Hazard Controls Design of Hazard Controls (Cont.) DOE-STD-3009-2014 Roll-out AU  Engineering evaluation shall address relevant design capabilities of safety SSCs by one of the following methods: • Providing a technical basis that includes an evaluation against the code of record, to the extent known, and augmented as needed with calculations, performance tests, or reliability evidence from operating history or industry databases; • Comparing the safety SSC design attributes to DOE O 420.1C design requirements, and associated codes and standards that are applicable, to demonstrate compliance; or • Demonstrating that the existing SSCs satisfy equivalent design requirements of current design codes and standards. IV-26 3.4 Hazard Controls Design of Hazard Controls (Cont.) DOE-STD-3009-2014 Roll-out AU  Documented in the DSA Subsections [4.3.X.4] and [4.4.X.4].  Other hazard controls (i.e., not SC and SS) identified pursuant to Section 3.3.3 are expected to be designed to the applicable industry code/standard for the given type of non-safety SSC. • No specific evaluation of their adequacy is required to be documented in the DSA. IV-27 3.4 Hazard Controls Design of Hazard Controls (Cont.) DOE-STD-3009-2014 Roll-out AU Beyond DBA Major Changes  Section 830.204 of 10 C.F.R. Part 830 requires consideration of the need for analysis of accidents which may be beyond the design basis of the facility.  Clarifies DBA/EBA vs. BDBA/BEBA • Addresses operational accidents deemed not plausible or BEU  Accidents that are excluded from accident analysis based on applying the criteria in Section 3.2.1 shall be scrutinized to determine whether they should be further evaluated as beyond DBA/EBAs. • NPH • External events IV-28 3.5 DOE-STD-3009-2014 Roll-out AU  Purpose is to provide: (1) perspective of the residual risk associated with the operation of the facility, and (2) additional perspectives for accident mitigation.  Allows use of realistic analyses of consequences  These BDBA/BEBA actions, systems or controls do not need to be designated, designed, and controlled as SC or SS.  DSA Section [3.5] addresses documentation IV-29 3.5 Beyond DBA Key Requirements DOE-STD-3009-2014 Roll-out AU Planned Improvements Key Requirements  Need for additional design or operational safety improvements may be identified.  DSA may include a commitment to implement an improvement that will not be complete for some time. • It is not permissible to rely on incomplete upgrades to meet the requirements of this Standard.  Interim controls may be necessary until such upgrades are completed.  These improvements described in DSA Section [3.6]. IV-30 3.6 DOE-STD-3009-2014 Roll-out AU 3009-2014 Roll-out Summary  The revised Standard 3009: • Clarifies, streamlines, and updates DOE and contractors’ requirements and responsibilities, and

• Updates the requirements to reflect current industry practices.  AU-31 is open to feedback from implementing organizations.  AU-31 is available to provide assistance in understanding the Standard requirements and how to effectively implement them. IV-31 DOE-STD-3009-2014 Roll-out AU 3009-2014 Roll-out Summary (Cont.)  DOE developing Accident Analysis Handbook • Additional information to support the DSA development • Examples of good practices in its implementation  Disclaimers: • The 3009-2014 STD is the product of many people throughout the DOE complex • Bullets on slides have been abbreviated  Need to read DOE-STD-3009-2014 to get full description • DOE AU-31 provides official interpretations  Questions? IV-32 DOE-STD-3009-2014 Roll-out AU For Further Information, Feedback, and FAQs…  Garrett Smith, Director, Nuclear Safety Basis and Facility Design, Office of Nuclear Safety (DOE AU-31) Phone: 301/903-7440; E-mail: garrett.smith@hq.doe.gov  David Compton, Consultant, PEC Phone: 202/586-1034; E-mail: david.compton@hq.doe.gov  Jeff Woody, Consultant, Link Technologies Phone: 865/300-5604; E-mail: wjwoodyjr@gmail.com  Terry Foppe, Consultant, Link Technologies Phone: 303/915-8353; E-mail: terryfoppe@comcast.net IV-33