STANDARDIZATION OF DOCUMENTED SAFETY ANALYSIS REQUIREMENTS ACROSS PROGRAM SECRETARIAL OFFICES

Transcription

1 STANDARDIZATION OF DOCUMENTED SAFETY ANALYSIS REQUIREMENTS ACROSS PROGRAM SECRETARIAL OFFICES June 2004

2 STANDARDIZATION OF DOCUMENTED SAFETY ANALYSIS REQUIREMENTS ACROSS PROGRAM SECRETARIAL OFFICES Carl Smith Corporate ES&H and QA Manager BNFL Inc. Denver Colorado June 2004

3 Table of Contents 1.0 Introduction EM Memoranda Guidance Memoranda DSA Review and Approval Suggestions... 5 Appendix A... A-1 Appendix B... B-1

4 1.0 Introduction On June 25, 2003 the EFCOG SAWG Steering Committee selected 5 objectives designed to improve performance across the DOE complex. Objective 1 is as follows; Objective 1 - Standardization of Documented Safety Analysis Requirements across Program Secretarial Offices Collect and review guidance and directions from Program Secretarial Offices to field organizations concerning preparation of Documented Safety Analyses. The collected information will be summarized in a White Paper that provides suggestions for DSA preparation, review and approval. Program Secretarial Offices (PSO s) were contacted to determine if DSA guidance was provided to DOE field offices. It was determined that only the Office of Environmental Management provided guidance to the field offices. This paper summarizes and highlights the issues associated with guidance provided on DSAs. (PSO in the context of this report includes NNSA.) The DSA guidance to the DOE field offices was driven by the need to accelerate clean up, perform the work more cost effectively and safely and ensure meeting the regulatory required target date of April 2003 for DSA submittal, per 10 CFR 830 Subpart B. 2.0 EM Memoranda Over the period of March 2001 to May 2003 nineteen (19) Office of Environmental Management (EM) memos on the subject of safety basis activities were issued to the EM field offices and other departments. These memos listed in the following table only apply to the Office of Environmental Management work activities. Date Title 05/20/03 Progress in Implementing 10 CFR 830, Subpart B 05/20/03 Environmental Management Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation ** 04/29/03 Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation ** (attachment to 05/20/03 memo above) 01/30/03 Tank Farm Safety Basis Issues ** 12/19/02 Guidance for Onsite Transportation Activities 12/12/02 Supplemental Guidance for Implementing DOE-STD at Environmental Management Nuclear Facilities ** 12/10/02 Recent Issues Related to Nuclear Facility Safety Bases at Environmental Management Nuclear Facilities 11/27/02 Schedule Concerns Related to 10 CFR 830, Subpart B Implementation at EM Environmental Management Facilities 09/17/02 Hazard Categorization of EM Inactive Waste Sites as Less Than Hazard Category 3 1

5 Date ** 08/22/02 Survey on Nuclear Transportation Title 08/02/02 Approval of the Bechtel Jacobs Company LLC (BJC) Procedure for the Unreviewed Safety Question (USQ) Process, BJC-NS-1001, Revision 7 07/03/02 Basic Information on Environmental Management Inactive Waste Sites (IWSs) 06/20/02 Bechtel Jacobs Company LLC Request for Temporary Exemption from 109 CFR Part (c) (2) Requirements for Selected Nuclear Facilities 06/17/02 Guidance Requested from the Office of Environment, Safety and Health for 10 CFR 830, Subpart B Implementation ** 06/13/02 Final Report on the Study of Implementation of 10 CFR 830, Subpart B at Environmental Management Nuclear Facilities 05/28/02 Supplemental Environmental Management Guidance for implementing 10 CFR 830, Subpart B, Safety Basis Requirements ** 04/08/02 10 CFR 830, Subpart B Implementation 01/15/02 Review of the Application of 10 CFR 830, Subpart B, Nuclear Safety Rule 05/03/01 Use of Statistical Methodology (95 Percentile) for Environmental Management Documented Safety Analysis ** 03/27/01 Tools to Assist in the Implementation of 10 CFR 830, Subpart B, Safety Basis Requirements ** Guidance documents The memos and attachments are located at the Office of Environmental Management, Safety Bases website with the following URL; Appendix A provides a tabulated summary of the details in the guidance documents and attachments. Appendix B contains the guidance documents and attachments. The memos in the above table include guidance, requests for information updates and statements on the progress of Safety Basis implementation throughout the complex. Twelve of the 19 memos: Contained requests for DSA Status, Provided congratulations to sites with DSA preparation well underway, Explained that additional transportation guidance is not needed, Approved the Bechtel Jacobs USQD Procedure, Issued Paul Gubanc Report. As such, there is no guidance associated with these 12 memos. Seven of the 19 memos, including attachments, provide DSA implementation guidance. The following summarizes the information contained within three memos which include generic 2

6 guidance to the entire complex and four memos which provide specific guidance to individual sites or contractors. 3.0 Guidance Memoranda (May 20, 2003) Environmental Management Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation This memo notes that there is a perceived weakness in the implementation of important administrative controls. Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation, dated April 29, 2003, is attached to the memo. In summary this guidance notes that: Administrative controls are an integral and important part of the safety basis for EM facilities, particularly for operations such as facility disposition (e.g., deactivation, decontamination, dismantlement), which may have fewer engineered safety features available to adequately control facility hazards. This fact was recognized at a meeting held in March 2003 with representatives from EM sites to discuss effective control selection and implementation practices. The group s collective input is presented and includes general administrative control guidelines and lessons learned that should be considered, as applicable. Section 2 of this guidance document presents practices that are specific to control selection during facility disposition. This is intended to supplement technical guidance on retiring (stepping out of) facility controls, including incorporation of administrative controls as necessary, as presented in DOE-STD , Integration of Environment, Safety and Health into Facility Disposition Activities. Section 3 provides a general discussion on administrative controls that are applicable to all EM operations. Attachments 1-3 provide specific samples of Technical Safety Requirements (TSRs). (January 30, 2003) Tank Farm Safety Basis Issues (Specific to Office of River Protection) This memo notes that concerns remain regarding guidance to support Nuclear Safety Rule implementation and actions required to maintain compliance with safety basis requirements. The memo includes EM Recommended Tank Farm Nuclear Safety Risk Ranking and Control Selection Guidelines which are given as Attachment 2. These are to be used as a quantitative tool to supplement the safe harbor guidance in DOE-STD The guide includes consequence levels and evaluation guidelines for offsite, onsite and facility worker. (December 12, 2002) Supplemental Guidance for Implementing DOE-STD at Environmental Management Nuclear Facilities This supplemental guidance is provided to facilitate effective implementation of the safe harbor methods described in DOE-STD and provisions in 29 CFR (or 29 CFR 3

7 ), Hazardous Waste Operations and Emergency Response (HAZWOPER). The goal in issuing the guidance is to allow for more timely, cost effective and consistent application of DOE-STD across the EM sites. The attachments (2) include the following guidance: Expectations on integration of DOE-STD and HAZWOPER, into facility/activity level safety basis hazard analysis; Applicability of DOE-STD evaluation guidelines for determining the need for safety class structures, systems, and components; Expectations on meeting 10 CFR Technical Safety Requirements (TSRs) and the approach to stepping out of safety controls; A general format and content of a DSA which satisfies 10 CFR 830 Subpart B, DOE- STD /HAZWOPER and DOE-STD Attachment 1 Supplemental guidance for implementation of DOE-STD This EM Supplemental Guidance provides expectations for preparing a DSA that meets this safe harbor. DSAs prepared using this guidance will also satisfy the methods described in DOE-STD (including the currently proposed revision). Attachment 2 - DSA format and content (Applicable to safe harbor methods of DOE-STD /HAZWOPER and DOE STD ). DSAs prepared in accordance with the given format and content guidelines will meet the intent of either DOE-STD /HAZWOPER or DOE- STD safe harbors. (September 17, 2002) Hazard Categorization of EM Inactive Waste Sites This memo notes that contractors responsible for hazard category 1, 2 or 3 nuclear facilities, as noted in the nuclear safety rules of 10 CFR 830 Subpart B, are required to perform work in accordance with the safety basis and the hazard controls to ensure adequate protection of workers, the public and the environment. DOE Nuclear facilities categorized as less than category 3 are not subject to the safety basis requirements. A DOE workshop concluded that most EM inactive waste sites could qualify to be categorized as less than hazard category 3. As a result the memo notes that EM Inactive Waste Sites (IWS) may be categorized as less than hazard category 3 if they meet certain requirements. These requirements are noted in four attachments. (June 17, 2002) Guidance Requested from the Office of Environment, Safety and Health for 10 CFR 830, Subpart B Implementation This memo notes that EM has identified gaps in the DOE guidance meant to support rule implementation. To address the subject, guidance has been issued (no attached EM guidance) to field organizations to support consistent rule implementation. The memo also notes that this form of guidance would be better located in the official DOE guides and standards. 4

8 (May 28, 2002) Supplemental Environmental Management Guidance for Implementing 10 CFR 830, Subpart B, Safety Basis Requirements Three workshops were held during April, 2002, the focus of which was to facilitate cost effective and safety enhancing implementation of the nuclear safety rule. This memo gives supplemental 10 CFR 830 Subpart B guidance, based on inputs of workshop participants. The guidance was prepared in the areas of exemptions, nuclear facility hazard categorization, and implementation of documented safety analysis (DSA) and technical safety requirements (TSR). The attachments include: 1.0 EM Supplemental Guidance on 10 CFR 830 Exemptions 2.0 EM Supplemental Guidance on Nuclear Facility Hazard Categorization 3.0 EM Supplemental Guidance on DSA/TSR Implementation (May 3, 2001) Use of Statistical Methodology (95 Percentile) for Environmental Management Documented Safety Analysis This memo notes that a specific mathematical methodology to assess risk is not to be used. DNFSB, EH and EM agreed that the use of the 95 percentile methodology for accident dose calculation should not be used. It was considered that the proposed methodology has not been sufficiently developed or reviewed to be accepted as an additional safe harbor for the DSA requirements of 10 CFR 830. Attached to the memo was the justification for the position taken and it also outlines issues and questions that need to be addressed. 4.0 DSA Review and Approval DSA review and approval activities required from two months to several months to complete at several of the DOE sites. This is believed to be due to some new requirements in the Nuclear Safety Rule, uncertainty over changing from a DOE Order to a CFR regulation and other factors. It is believed that the review and approval process could be improved. 5.0 Suggestions The following two suggestions are based on the above summarized guidance memos issued by EM and the DOE and site contractor experience during DSA review and approval: 1. DOE STD should be revised by a team that includes EM and EH with contractor support to incorporate lessons learned from developing DSA s for environmental management projects. (This effort now planned by Tony Eng, EM, began in April 2004.) 2. The DSA review and approval times and more extensive DSA guidance provided by the DOE Field Offices to site contractors could be collected, analyzed and summarized in a White Paper that would provide suggestions for DSA preparation, review and approval. 5

9 Appendix A Date From Title 05/20/03 EM Progress in Implementing 10 CFR 830, Subpart B No Guidance Guidance 05/20/03 EM Environmental Management Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation There is a Perceived weaknesses in the implementation of important administrative controls. Administrative controls are an integral part of the safety basis for EM nuclear facilities, particularly for operations such as facility disposition (e.g., deactivation, decontamination, dismantlement), which may have fewer engineered safety features available to control facility hazards. 04/29/03 EM Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation Guidance on Administrative Controls (attached to above memo) 01/30/03 EM Tank Farm Safety Basis Issues Concerns remain regarding guidance to support Nuclear Safety Rule implementation and actions required to maintain compliance with safety basis requirements. EM Recommended Tank Farm Nuclear Safety Risk Ranking and Control Selection Guidelines. 12/19/02 EM Guidance for Onsite Transportation Activities Additional guidance is not considered necessary. The TSWG met on September 5, 2002, to discuss the survey results and a path forward. The consensus of the survey participants was that no implementation problems were encountered or anticipated and that no additional guidance was necessary. A-1

10 12/12/02 EM Supplemental Guidance for Implementing DOE-STD at Environmental Management Nuclear Facilities The Attached supplemental guidance is provided to facilitate effective implementation of the safe harbor methods described in DOE-STD-1120 and HAZWOPER. The attachments include the following guidance: Expectations on intergration of DOE-STD and HAZWOPER, into facility/activity level safety basis hazard analysis; Applicability of DOE-STD-3009 evaluation guideline for determining the need for safety class structures, systems, and components; Expectations on meeting related to technical safety requirements and approach to stepping out safety controls; and A general format and content of a DSA which satisfies 10 CFR 830 Subpart B, DOE-STD- 1120/HAZWOPER and DOE-STD The goal in issuing this guidance is to allow for more timely, cost effetive and consistent application of DOE-STD-1120 across the EM complex. Attachhment 1: EM Supplemental Guidance provides expecations for preparing a DSA that meets this safe harbor. DSAs prepared using this guidance will also satisfy the methods described in DOE-STD (including the currently proposed revision) DSAs prepared in accordance with the following format and content guidelines will meet the intent of either DOE-STD-1120/HAZWOPER or DOE- STD-3001 safe harbors. A-2

11 12/10/02 EM Recent Issues Related to Nuclear Facility Safety Bases at Environmental Management Nuclear Facilities 11/27/02 EM Schedule Concerns Related to 10 CFR 830, Subpart B Implementation at EM Environmental Management Facilities 09/17/02 EM Hazard Categorization of EM Inactive Waste Sites as Less Than Hazard Category 3 No Guidance however the output may be interesting. In light of the DNFSB's concerns, as well as feedback regarding EM field progress and issues related to the Safety Basis Rule (10 CFR 830, Subpart B) implementation, all sites must provide the information as described below. This is deemed necessary to gain a better understanding of the quality of safety basis documents being generated at EM sites, and the overall ability of Field sites to ensure a technically defensible and accurate DOE review of safety basis documents. 1. DOE Field's direction/guidance to the contractor for generating DSAs/Technical Safety Requirements (TSRs); 2. Contractor's procedure for hazard categorization documents, DSA, TSRs, Unreviwed Safety Questions (USQs) and other safety basis documents; 3. DOE Fields procedure for review and approval of DSAs, TSRs, USQs and other safety basis documents; 4. DOE Field resources involved in the review and approval process (include number of persons and their training/qualification and safety any support contractors involved in reviews); 5. The approval basis documentation (i.e., approval letters, SERs) for Category 2 nuclear facility DSAs/TSR prepared to date for compliance with the Rule; and 6. A summary of actions planned and completed, as well as results related to assessment of the contractor's USQ process. This includes USQ screens, USQ evaluations, PISA process, USQ determination preparer/reviewer qualifications, timeliness, and annual summary reports. No Guidance Inactive waste sites. ( IWS ) Contractors responsible for such facilities are required to perform work in accordance with the safety basis and the hazard controls to ensure adequate protection of workers, the public, and the environment. DOE nuclear facilities categorized as less than category 3 are not subject to the safety basis requirements. Includes Guidance for IWS 08/22/02 EM Survey on Nuclear Transportation No Guidance / Request for information 08/02/02 EM Approval of the Bechtel Jacobs Company LLC (BJC) Procedure for the Unreviewed Safety Question (USQ) Process, BJC-NS-1001, Revision 7 No Guidance. The USQ procedure, Revision 7, the SER, and this approval memorandum are immediately part of the safety bases for EM hazard category 2 and 3 nuclear facilities operated by BJC. A-3

12 07/03/02 EM Basic Information on Environmental Management Inactive Waste Sites (IWSs) 06/20/02 EM Bechtel Jacobs Company LLC Request for Temporary Exemption from 109 CFR Part (c) (2) Requirements for Selected Nuclear Facilities 06/17/02 EM Guidance Requested from the Office of Environment, Safety and Health for 10 CFR 830, Subpart B Implementation 06/13/02 EM Final Report on the Study of Implementation of 10 CFR 830, Subpart B at Environmental Management Nuclear Facilities 05/28/02 EM Supplemental Environmental Management Guidance for implementing 10 CFR 830, Subpart B, Safety Basis Requirements 04/08/02 EM 10 CFR 830, Subpart B Implementation 01/15/02 EM Review of the Application of 10 CFR 830, Subpart B, Nuclear Safety Rule 05/03/01 EM Use of Statistical Methodology (95 Percentile) for Environmental Management Documented Safety Analysis 03/27/01 EM Tools to Assist in the Implementation of 10 CFR 830, Subpart B, Safety Basis Requirements No Guidance / Request for information No Guidance Several gaps in the DOE guidance meant to support consistent rule implementation have been noted. To fill some of these gaps, note attached guidance to our field organizations No Guidance attached Mr. Paul Gubanc conducted a study to identify and pursue methods and ideas to facilitate timely and efficient implementation of 10 CFR 830, Subpart B, Safety Bases Requirements. No report Attached Based on the inputs of the workshop participants, supplemental 10 CFR 830 Subpart B guidance was prepared in the areas of exemptions, nuclear facility hazard categorization, and implementation of documented safety analysis (DSA) and technical safety requirements (TSR). 1.0 EM Supplemental Guidance on 10 CFR 830 Exemptions 2.0 EM Supplemental Guidance on Nuclear Facility Hazard Categorization 3.0 EM Supplemental Guidance on DSA/TSR Implementation No Guidance No Guidance. There is a lack of an accepted interpretation of the 10CFR830, that allows appropriate application of tasks/standards to achieve closure. This has resulted in a situation where each DOE contractor has to develop a tailored or graded approach for each situation, which in turn requires review, modification, and concurrence by the DOE field office. Guidance to not use certain Mathematical Methodologies Notes Attachment - Not Given. A-4

13 Appendix B Table of Contents Number Date Title B-1 05/20/03 Environmental Management Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation B-2 04/29/03 Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation ** (attachment to 05/20/03 memo above) B-3 01/30/03 Tank Farm Safety Basis Issues B-4 12/12/02 B-5 09/17/02 B-6 06/17/02 B-7 05/28/02 B-8 05/03/01 Supplemental Guidance for Implementing DOE-STD at Environmental Management Nuclear Facilities Hazard Categorization of EM Inactive Waste Sites as Less Than Hazard Category 3 Guidance Requested from the Office of Environment, Safety and Health for 10 CFR 830, Subpart B Implementation Supplemental Environmental Management Guidance for implementing 10 CFR 830, Subpart B, Safety Basis Requirements Use of Statistical Methodology (95 Percentile) for Environmental Management Documented Safety Analysis - B-1 -

14 B-1 Environmental Management Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation

15

16

17 B-2 Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation (attachment to B-1 memo)

18 GUIDELINES AND LESSONS LEARNED FOR NUCLEAR FACILITY SAFETY CONTROL SELECTION AND IMPLEMENTATION The Office of Environmental Management April 29, 2003

19 EM Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation 1.0 Introduction Administrative controls are an integral and important part of the safety basis for EM facilities, particularly for operations such as facility disposition (e.g., deactivation, decontamination, dismantlement), which may have fewer engineered safety features available to adequately control facility hazards. This fact was recognized at a meeting held in March 2003 with representatives from EM sites to discuss effective control selection and implementation practices. The group s collective input is presented in this document and includes general administrative control guidelines and lessons learned that should be considered, as applicable, for EM facilities and activities. Section 2 of this document presents practices that are specific to control selection during facility disposition (e.g., deactivation, decontamination, dismantlement). This is intended to supplement technical guidance on retiring facility controls, including incorporation of administrative controls as necessary, that is presented in DOE-STD , Integration of Environment, Safety and Health into Facility Disposition Activities. Section 3 provides general discussion on administrative controls that are applicable to all EM operations. Attachments 1-3 provide specific samples of TSRs 2.0 Guidelines for Control Selection During Facility Disposition Worker hazards and risks during facility disposition activities can be high because of the potential for unknown hazards and high levels of physical worker activity. The nature of disposition is such that engineered safety features may not be available or comprehensive in controlling many of the worker hazards encountered during disposition. In some cases, a particular facility system may physically interfere with further disposition activities and require removal before hazardous materials can be fully removed. Administrative controls are therefore considered an important component of the safety basis strategy for facility disposition activities. Heavy reliance on administrative controls during facility disposition In the case where structures, systems or components (SSCs) are either unavailable or unreliable because of aging or degradation, facility safety and operations personnel must weigh the potential safety benefit of installing or upgrading SSCs, along with the costs associated with these actions, against imposing additional administrative controls. Consideration should be given to (1) the duration of a facility disposition activity (e.g., it may be acceptable to conduct short duration tasks using a fire watch rather than upgrading an unreliable sprinkler system); (2) the capability of the SSC to prevent or mitigate a hazard (e.g., would the SSC have a dramatic effect on reducing worker or public risk); (3) the costs associated with the SSC (e.g., how costly is it to install, upgrade, operate, maintain, and later remove); and (4) how reliable and effective are administrative controls as an alternative. When administrative controls are used in lieu of SSCs or serve as an important defense in depth control, it is important to explain this rationale in the DSA (e.g. TSR derivation information typically provided in Chapter 5 of a DSA). 1

20 EM Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation Certain administrative controls may take on prominence during facility disposition, because of the nature of the work. For example, disposition tasks may involve hot work to dismantle equipment or flammable solvents for decontaminating equipment. An increase in the generation of combustible wastes may also be involved. Additional fire hazards may need to be compensated through additional administrative controls such as more rigorous combustible controls or increased fire response capabilities. Another example is the increased risk of worker exposure during intrusive radiological/hazardous material removal, which may necessitate additional radiation protection and industrial hygiene programs such as personal protective equipment, site controls, or increased air monitoring. During facility disposition activities, the work control process is particularly important. Generally, disposition is a dynamic activity that consists of multiple project tasks, many of which must be evaluated for impacts on the facility safety basis. Work control activities such as tasklevel planning and analysis must be integrated with the Unreviewed Safety Question (USQ) process to ensure facility disposition tasks are conducted within the safety envelope analyzed by the DSA. The process for linking work control and the USQ process (e.g., screening of disposition tasks) should be clearly described in the DSA. Programmatic controls for facility disposition projects should be described in the DSA and TSR consistent with expectations in 10 CFR 830 and DOE G Guidelines provided in Section 3.2 of this document can be used to determine the level of specificity needed within administrative controls. Stepping Out of Facility Disposition Safety Controls The practice of retiring or stepping out of facility controls during a facility disposition project is recognized in DOE-STD-1120 and was briefly discussed in the EM-1 supplemental guidance prepared in December Facility safety controls should only be retired at the point in time when their function is no longer required. Criteria are provided in DOE-STD , Section 3.3.2, for making this determination. A DOE pre-approved process for stepping out of controls allows the contractor to retire a control without formally revising the DSA and TSR and re-submitting to DOE for approval. This requires the use of pre-negotiated step-out criteria that are reviewed and approved by DOE during the initial DSA/TSR review process. Once the criteria are satisfied, the contractor is required to notify DOE that the control is being retired. This practice is encouraged at EM sites during facility disposition activities provided that established points being proposed for stepping out of a control are supported by the hazard analysis and are clearly reflected in the TSR. When using this approach, the TSR should (1) use explicit TSR definitions that define terms and conditions used in retiring controls; (2) incorporate step-out conditions into LCO applicability statements; (3) provide administrative controls that describe the process for stepping out of a control, as well as further safety measures if necessary once a control is retired (e.g., increased fire watch or lower combustible limits); and (4) provide TSR Bases that support the established points for stepping out of controls. 2

21 EM Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation The following is an example that demonstrates an applicability statement for stepping out of a fire sprinkler system LCO: Sprinkler system requirements may be discontinued in an AFFECTED AREA when the area is determined to be OPERATIONALLY CLEAN. In this example, OPERATIONALLY CLEAN was explicitly defined within a TSR definition and an administrative control was provided on the process for meeting the specific requirements and facility conditions for OPERATIONALLY CLEAN. Selected pages from this TSR are provided in Attachment 1 to provide further illustration. 3.0 General Guidelines for Improving Effectiveness and Implementation of Administrative Controls 3.1 Derivation of Specific Administrative Controls Within the DSA DOE-STD-3009 directs that a DSA provide information (i.e., Chapter 5) to support the derivation of hazard controls provided in the Technical Safety Requirements document. This includes the basis from which to derive TSR administrative controls for specific control features or specific programs necessary to perform institutional safety functions. The TSR derivation is particularly important when administrative controls are relied on as a primary control or considered important to safety. The rationale for assigning TSR administrative controls needs to be clearly stated. The level of specificity needed within the TSR administrative control (i.e., general program description vs. specific actions or limits) should also be explained. 3.2 Specificity of Administrative Controls The specificity of administrative controls within the DSA/TSR can vary depending on the severity of hazards and the administrative control s overall contribution in controlling the hazard (i.e., primary or supplemental control). Administrative controls may also be needed to protect important initial conditions assumed in the hazard analysis (e.g., assumption on availability of combustibles). Table 1 provides guidelines for determining the appropriate level of specificity needed for TSR administrative controls. 3

22 EM Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation Table 1. Specificity of Administrative Controls AC Description When To Apply AC Level of Importance Example Specificity of Administrative Controls General More Specific Very Specific Defined SMP Activities Defined Limits and and/or Operational commitments Parameters General Commitment to Implement a Safety Management Program Engineered Safety Features are available and used to control the hazard ACs contribute to safety by ensuring programmatic elements are available A combustible control program shall be established for the facility Engineered Safety Feature(s) are available, but are not completely effective in controlling a hazard Important to safety; needed to protect an initial condition in the hazard analysis or selected from the hazard/accident analysis to supplement other mitigative/preventive features The fire protection program shall ensure that combustible wastes are removed daily during TRU waste packaging activities Severity of Hazards Engineered Safety Features are unavailable or not cost beneficial (i.e., short duration D&D) and only ACs are used to control the hazard Primary or contributing control selected from the hazard/accident analysis as a major mitigative/preventive feature(s) Combustible wastes shall be maintained below 100 pounds in the facility Administrative controls should ensure that safety management programs emphasize key elements that are relied on for controlling hazards. As the severity of hazards increases and the availability or reliability of engineered safety features decreases, it is important to emphasize specific attributes such as administrative limits and specific actions that will be controlled through the TSR. Additionally, where safety management programs are relied on for controlling significant hazards, the defense in depth considerations built into these programs should be discussed (e.g., management of uncertainties, redundant samples or independent readings, assurances that calculations needed within administrative controls are independently verified). An administrative control that has very specific limits may lend itself to a TSR Limiting Condition for Operation (LCO). An example LCO is provided in Attachment 2 for a TRU waste storage facility that has no active engineered safety features available and is in close proximity to the site boundary. Conversely, Attachment 3 demonstrates the use of inventory limits in a facility where active safety SSCs are available and the site boundary is not in close proximity the general public (i.e., less reliance on the administrative control. 4

23 EM Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation The use of an LCO itself does not necessarily improve safety, but it may be helpful in defining discrete limits or features, as well as specific operator actions and surveillances needed to protect a specific condition. This approach may be appropriate where (1) a particular administrative feature or limit is well defined, (2) clear corrective actions are available, (3) conditions can be easily surveilled, (4) the administrative control provides for significant safety to workers or public and (5) the administrative control addresses an element of a program rather than a discrete SSC. For example, it may be important to place a limit on the number of open waste containers permitted at any one time during waste packaging operations, given that an SSC is unavailable to mitigate the accidents involving hazardous and combustible contents. This type of administrative control could be subject to specific action statements and verified through periodic surveillances. An LCO format is not well suited to general programmatic controls since they lack sufficient specificity to define meaningful operator actions. Administrative controls defined at this level (see general and more specific in the matrix) are intended for general conditions or programmatic commitments that protect the validity of hazard analysis, but not selected as specific limits or conditions. This type of control makes an LCO type of format difficult to prepare. Implementation of the programmatic control is typically verified through assessment and performance monitoring (trend analysis). 3.3 Implementation and Maintenance of Administrative Controls Hazard controls contained in a DSA and TSR must be flowed down and implemented through contractor procedures. Prior to implementation of DOE approved TSR administrative controls, contractors should first take appropriate actions to ensure a control s availability and readiness. These actions may include programmatic assessments, development or modification of facility procedures, and training of facility personnel. Contractors should also ensure the continued reliability of administrative controls through periodic assessment of the control s effectiveness, re-training and continued qualification of facility personnel, and adherence to a change control process for affected implementing procedures and safety basis documents. 3.4 Importance of Good Procedure Writing The quality of a contractor s technical procedures can have a significant impact on the effectiveness of administrative controls. Poorly written procedures can be confusing to facility personnel and have a detrimental effect on safety. DOE-STD , Writer s Guide for Technical Procedures, describes a number of good practices for developing operations and maintenance procedures. Procedure writers supporting EM sites should follow this standard or other similar industry standard. A sampling of the important actions that should be performed by procedure writers include: Become familiar with the facilities and activities being addressed by procedures. Perform facility walkdowns and observe facility activities, or simulations of activities where practical; Involve operations and maintenance personnel in procedure development 5

24 EM Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation Give appropriate consideration to the technical, administrative and regulatory requirements that apply to the procedure; Ensure that the procedure clearly articulates the required action steps (prerequisite, performance steps, and post-performance activities) and their appropriate sequencing. 3.5 Improved Oversight of Administrative Control Implementation Consistent with EM supplemental guidance issued in May 2002, DOE safety basis reviewers are expected to verify the flowdown and implementation of TSR controls (including administrative controls). This should involve a review of the completeness of planned implementation actions in a timely fashion so that DSA/TSR implementation can be accomplished within a 90-day time frame after the DSA/TSR approval. DOE reviewers are expected to verify contractor implementation actions. Verification may be in the form of a readiness evaluation where required by DOE 425.1C and DOE-STD Otherwise, verification reviews can be accomplished through less formal means such as review of contractor implementation mechanisms, facility walkdowns and review of facility procedures. Oversight of administrative control implementation should continue throughout the performance of facility activities. DOE facility representatives are expected to function in a primary role for monitoring TSR control implementation. In certain cases, TSR violations may occur due to failures of administrative controls (i.e., important controls with specific operational parameters or limits, or systematic breakdowns in programmatic controls). 3.6 Training on Procedures Facility personnel should be trained on operations, maintenance and facility safety procedures that are relevant to their job duties. Since TSR administrative controls are flowed into these procedures, personnel should be made aware of specific safety programs or other administrative controls that must be followed or that could be impacted by their actions. Training should also address what actions are necessary when non-compliances with TSR administrative controls are discovered. 3.7 Control Selection Process Supporting DSA/TSR Preparation DOE-STD encourages interaction between the preparation and review processes to facilitate a streamlined safety basis review. In particular, EM sites should exercise this practice at the point during DSA preparation when hazard controls are being selected. This affords both DOE and the contractor an opportunity to discuss the suite of available hazard controls and ensure a balance is maintained between cost and risk reduction. These interactions should include a discussion of the overall dependence on administrative controls, the rationale for their selection, and the manner in which they will be addressed in the DSA and TSR. The DOE safety basis review team (or individual), as well as the DOE Facility Representative and DOE program or project manager should participate in the control selection process, along with the contractor s safety analyst, facility management, and operations personnel. This provides a good cross 6

25 EM Guidelines and Lessons Learned for Nuclear Facility Safety Control Selection and Implementation section of personnel with varying perspectives on the necessity, reliability and practicality of controls being considered. 3.8 Updates to Safety Basis Documents to reflect Administrative Control changes 10 CFR requires that a DSA be updated to keep it current and reflective of changes in the facility. Changes related to administrative controls are subject to the USQ and change control processes in a similar fashion as applied to systems, structures and components. Likewise, DOE must approve changes to a TSR when they are related to administrative controls. 3.9 TSR Treatment of Equipment Covered by Safety Management Programs Certain types of equipment are calibrated, tested, operated and maintained as an integral part of a safety management program. Examples include radiation protection equipment such as radiation air monitors and radiation detection devices, as well as emergency management facilities and equipment such as enunciation devices. It is not necessary to functionally classify such equipment as an SSC if a particular safety management program governs the design and operability of this equipment and assures that it will perform its intended safety function. 7

26 Attachment 1 Sample TSR on For Stepping out of Controls

27 3.2 LIMITING CONDITIONS FOR OPERATION: Fire Sprinkler Systems LCO: Building XX and XY shall have OPERABLE automatic sprinklers in the following areas: a. XX Confinement b. XY Confinement c. Room 2000 d. Rooms 2001/2001 e. Room 2002A f. Room 2003 g. Room 2004 Note: The Confinement areas are defined in Chapter 2 (Figures 2-2 through 2-5). Applicability: The requirement covers Operations and Decommissioning activities and is applicable at all times except as allowed in the exception statement. This requirement does not apply to areas that do not have sprinklers (e.g., CSV, canyons, and electrical rooms). The requirement for OPERABLE sprinklers in areas outside confinement (i.e., Rooms 2000, 2002A and 2003) is applicable when radiological material is present. Sprinkler system requirements may be discontinued in an AFFECTED AREA when the area is determined to be OPERATIONALLY CLEAN. Exception: Planned activities outside the Operations Zone that permanently render individual sprinklers or sections of a sprinkler system inoperable may be handled in accordance with AC c. Note: Sprinklers in the basement Decontamination Room and Janitor s Closet are supplied by Riser XX-A, which is not covered by surveillances in LCO 3.2. These Rooms shall be controlled in accordance with AC c. Attachment 1-2

28 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITIONS FOR OPERATION: Fire Sprinkler Systems ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. Riser XX-A or XY-A is INOPERABLE. B. A section of sprinklers or an entire Riser is INOPERABLE. A.1 Isolate water supply to INOPERABLE Riser, cross-connect to an OPERABLE Riser, and verify static pressure in OPERABLE Riser is 70 psig. OR A.2 Go to Condition B B.1 Discontinue Hot Work in the AFFECTED AREA (except if required to restore sprinkler system). AND B.2 Inside Operations Zone: SUSPEND OPERATIONS in the AFFECTED AREA. AND B.3 Establish a Fire Watch in the AFFECTED AREA in accordance with Fire Protection Engineering guidance. AND B.4 Restore sprinklers 4 hours 4 hours IMMEDIATELY 4 hours 4 hours 30 days Attachment 1-3

29 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITIONS FOR OPERATION: Fire Sprinkler Systems (continued) ACTIONS: C. A section of sprinklers or an entire Riser is INOPERABLE. AND The facility is notified that Fire Department staffing is inadequate to respond to a fire. D. Individual sprinklers or sections of sprinklers outside the Operations Zone are temporarily INOPERABLE due to planned activities (Planned Out of Tolerance). C.1 Discontinue Hot Work in the AFFECTED AREA (except if required to restore sprinkler system). AND C.2 SUSPEND OPERATIONS in the AFFECTED AREAS. AND C.3 Establish a Fire Watch in the AFFECTED AREA in accordance with Fire Protection Engineering guidance. AND C.4 Restore sprinklers D.1 Remove combustible materials from AFFECTED AREA as directed by Fire Protection Engineering. AND D.2 Implement additional precautions specified by Fire Protection Engineering. AND D.3 Restore sprinklers. IMMEDIATELY 4 hours 4 hours 30 days Before entering Condition D Before entering Condition D 30 days Note: Sprinklers operability problems may also impact operability of the Plenum Deluge Systems. Attachment 1-4

30 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 4.2 SURVEILLANCE REQUIREMENTS: Fire Sprinkler Systems SURVEILLANCE REQUIREMENTS SR Ensure that normal water supply pressure is being maintained. Acceptance Criteria: Verify that the static pressure for the risers listed below is greater than or equal to 70 psig: XX Riser B XX Riser C XX Riser D XY Riser A SR Verify that the water supply is available to the sprinklers. Acceptance Criteria: Verify that the post indicating valves (PIVs) and control valves associated with XX Systems B, C, and D, and XY System A are locked in the proper position. SR Verify that a flow alarm is received at the Fire Dispatch Center if a sprinkler opens. SR Acceptance Criteria: Flow test the inspector s test connection and verify alarm transmittal to Fire Dispatch Center for XX Systems B, C, D, and XY System A. Verify that there has not been a change in the condition of the water supply (e.g., blocked or degraded valves or lines). Acceptance Criteria: Flow test the main drain and verify that residual water pressure is greater than or equal to the minimum value listed below: XX Riser B 61 psi XX Riser C 63 psi XX Riser D 63 psi XY Riser A 65 psi FREQUENCY Monthly Monthly Quarterly Annually Attachment 1-5

31 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 4.2 SURVEILLANCE REQUIREMENTS: Fire Sprinkler Systems SR Perform a floor-level visual inspection of the observable portions of sprinkler systems supported by each riser. Acceptance Criteria: Inspect sprinklers for proper orientation, obstructions, deterioration (e.g., corrosion, paint, foreign material), and physical damage. The impact of deficiencies on operability shall be determined by Fire Protection Engineering and Nuclear Safety. Annually Attachment 1-6

32 5.0 Administrative Controls 5.3 Combustible Material and Hot Work Controls.. c. Permanent Sprinkler System Deficiency Controls Controls to manage permanent Sprinkler deficiencies shall include: 1. Sprinkler System deficiencies or impairments shall be concurred with by Fire Protection Engineering and tracked in accordance with AC The area affected by each Sprinkler System deficiency or impairment (area where combustible materials must be controlled in order to not challenge the Sprinkler System) shall be identified (e.g., paint or mark floor or wall). 3. Combustible material shall not be stored or staged in areas affected by Sprinkler System deficiencies. Applicability: These controls apply in: Building XXX Confinement Areas; and Waste staging/storage areas outside Confinement (i.e., Rooms 1234/1235, 3456, and Dock XY). These controls may be discontinued in an area when the area is OPERATIONALLY CLEAN. Inspect areas with permanent Sprinkler deficiencies or impairments weekly to ensure that the areas affected by permanent Sprinkler deficiencies are clearly identified. There are no combustible materials in the areas affected by Sprinkler deficiencies. 5.5 Operationally Clean This section contains requirements for making OPERATIONALLY CLEAN determinations and for periodically verifying that the areas remain OPERATIONALLY CLEAN Operationally Clean Requirements 1. DOE shall be notified at least 7 calendar days prior to declaring an area OPERATIONALLY CLEAN and discontinuing TSR requirements. This may be accomplished by providing documented notification to the DOE Facility Representative. 2. An area may be declared OPERATIONALLY CLEAN when the following conditions are met: a. Contaminated process equipment and components (e.g., tanks, piping, gloveboxes, B-boxes, hoods, contaminated ductwork, contaminated portions of Attachment 1-7

33 5.0 Administrative Controls filter plenums, and contaminated HEPA filters) have been dismantled, packaged as waste, and removed from the AFFECTED AREA. Exception: The following components may remain: 1) Contaminated components that must be removed as part of structural decontamination. 2) Components that meet Surface Contaminated Object (SCO) waste requirements. 3) Contaminated utilities or support systems that are required for worker safety or to provide service to other areas. b. No containerized radioactive waste is stored or staged in the AFFECTED AREA. Exception: 1) Waste generated after an area is declared OPERATIONALLY CLEAN may be stored or staged in the area where it was generated. 3. A weekly surveillance shall be performed on OPERATIONALLY CLEAN areas to ensure the following conditions are maintained: a. There are no contaminated process components (e.g., tanks, piping, gloveboxes, B-boxes, hoods, contaminated ductwork, contaminated portions of filter plenums, and contaminated HEPA filters) in the area, except for the items specified when the area was declared OPERATIONALLY CLEAN. b. Only waste containers generated in an OPERATIONALLY CLEAN area are staged/stored in the OPERATIONALLY CLEAN area. NOTE: This surveillance may be discontinued in an area once final surveys are complete and access is controlled (e.g., doors are locked). 5.6 Configuration Management This section contains requirements for tracking and managing configuration changes as equipment, systems, and structures are shut down, dismantled, and removed from the facility Configuration Management Requirements 1. Operations Documentation. Documentation needed for Configuration Control Authorities to manage the facility (e.g., authorize work, identify safety equipment status, define Affected Areas) shall be maintained current in accordance with MAN- 066-COOP, Section 6.6. Configuration management information shall include: a. Safety and Support System Operating Status b. LCO/AC Surveillance Status c. System Configuration Information System configuration information shall identify the systems, structures, Attachment 1-8

34 5.0 Administrative Controls components, and support systems providing safety functions. The systems to be tracked shall include: HVAC Systems Sprinkler Systems Plenum Deluge Systems Criticality Accident Alarm Systems Electrical Power System LS/DW System d. Facility Condition Information Facility condition information should include information needed to effectively manage the facility and update surveillances. Examples include: Permanent Sprinkler System Deficiencies Permanent Periphery Confinement Barrier Deficiencies Permanent Inadequate CAAS Annunciation Areas Operationally Clean Areas 2. Surveillance Procedures. Procedures used to verify TSR Surveillance Requirements shall be updated to match the current facility configuration prior to performing the surveillance. Surveillance procedures shall be formally revised or updated as determined by facility management. 3. Equipment Maintenance and Removal. A program shall exist to test, survey, and maintain systems and functions/components listed below. In addition, DOE shall be notified at least 7 calendar days prior to shutting down or removing systems or functions/components listed below. This may be accomplished by providing documented notification to the DOE Facility Representative. Systems Turbine Generator System Uninterruptible Power Supply System UPS-XXE Fire Reporting System (Simplex) Attic Leak Detection System System Functions/Components Confinement Pressure Differential HVAC System 1 and 3 Standby or Redundant Exhaust Fans HVAC System 1 and 2 Return Fan Interlocks HVAC System 1 Supply Fan Interlock Data Acquisition Control System (DACS) Attachment 1-9

35 5.0 Administrative Controls Sprinklers Waterflow Alarms / Fire Reporting System (Simplex) (i.e., Fire Department notification) Plenum Deluge (for Plenums in LCO 3.3) Heat Detectors / Deluge Control Panels / Fire Reporting System (Simplex) (i.e., automatic actuation and Fire Department notification) Criticality Accident Alarm System Criticality Alarm Display Panel Batteries LS/DW Batteries Remote Alarms / Plant Alarm System 4. Safety Equipment Replacement. DOE shall be notified a least 7 calendar days prior to replacing existing equipment performing safety functions or essential support equipment listed in LCO Bases with temporary equipment. This may be accomplished by providing documented notification to the DOE Facility Representative. Attachment 1-10

36 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES BACKGROUND System Overview: As shown in Figure 2.6, water for the sprinkler systems in Buildings XX and XY are supplied by the domestic cold water (DCW) mains. The DCW mains are looped throughout the plant site so that water may be provided from two different directions. Lead-in lines from the DCW main supply water to each of the sprinkler system risers. Figures 2-7 through 2-10 identify the area (or equipment) supplied by each riser. When a fire occurs, heat rising from the fire causes individual sprinklers to open as they are heated to their design temperature. The water impinges on the sprinkler deflector to produce a uniform spray pattern. The sprinklers provide fire control (i.e., reduce the heat release rate of a fire and hold the fire to the area of its origin) by discharging water directly on the burning material. Impact of Decommissioning: As part of decommissioning, all of the sprinkler systems must ultimately be shut down, dismantled, and packaged as waste. System configurations will change during the project. Therefore, the controls were written to allow some flexibility to perform decommissioning activities.

37 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES (continued) APPLICATION TO System Classification: SAFETY ANALYSIS The accident analyses credits sprinkler systems with reducing the frequency of large and major fires. The reduction in frequency is relied upon to reduce the Risk Class of these fires for co-located workers and the public. The unmitigated consequences to the public for all sub-scenarios that credit sprinklers are below 5 rem. Some scenarios also selected sprinklers as DEFENSE IN DEPTH. The hazard analysis (Chapter 5) also concludes that sprinklers are a Safety- Significant System required to protect immediate workers. Based on the discussion above, sprinkler systems are considered a SAFETY- SIGNIFICANT SSC. Applicable Accident Scenarios: See Chapter 7 for a listing of the scenarios that rely on sprinklers. Safety Function: Sprinklers reduce the frequency of large and major fires by controlling or limiting the size of fires. Discharging water directly on burning material reduces the heat release rate of a fire and limits growth. Operating sprinklers also pre-wet adjacent combustibles, which reduces fire spread and holds the fire to the area of origin. Sprinklers also indirectly help protect the HEPA filters in the event of a fire by controlling and cooling the temperature of room air being drawn into ductwork and entering a filter plenum. Discharging water directly on the burning material reduces the heat release rate of the fire, and the spray cooling ability of sprinklers further reduces the temperature of the air. Sprinklers are also effective for worker safety. NFPA 101 (Reference 5) recognizes sprinklers in numerous ways for life safety. For example, sprinklers cool the smoke and make it possible for a person to remain in the area much longer than they could without sprinklers, which extends evacuation time and allows longer exit distances. Attachment 1-12

38 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES (continued) LCO 3.2 LCO Overview: LCO 3.2 ensures that OPERABLE automatic sprinklers protect the areas listed under the LCO. Applicable Areas: The areas requiring coverage (listed in LCO 3.2) were determined by reviewing applicable fire scenarios. In addition, areas where waste containers are staged outside confinement were included to provide an additional layer of defense. The areas requiring coverage in LCO 3.2 are served by the XX Risers B, C, and D and XY Riser A. Operability: Several basic functions or requirements must be met for a sprinkler system to be considered OPERABLE. These requirements are listed as SURVEILLANCE REQUIREMENTS in SR 4.2. Therefore, a sprinkler system is considered OPERABLE when it meets the requirements listed in SR 4.2. Support Systems: The following systems support the sprinkler systems and are required to meet LCO 3.2 or assumptions in the accident analysis: Domestic Cold Water System Fire Reporting System (Simplex) These systems will be maintained in accordance with contractor procedures until the LCO is discontinued. Non-Essential Systems: The following systems also support the sprinkler systems but are not required to meet LCO 3.2 or assumptions in the accident analysis: None Attachment 1-13

39 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES (continued) APPLICABILITY Overview: LCO 3.2 is applicable at all times until the discontinuation criteria in the applicability statement are met, except as allowed in the exception statement. Since the applicability statement hands off to the exception statement, the facility does not need to declare an Out-of-Tolerance with respect to LCO 3.2 when following the exception statement. The CONDITIONS and REQUIRED ACTIONS provide options for addressing unplanned deficiencies and impairments. The REQUIRED ACTIONS shall also be entered prior to performing activities that result in a Planned OUT-OF-TOLERANCE. Discontinuation: Ultimately, the sprinkler systems must be shut down and removed. Therefore, the applicability statement also contains criteria for when the sprinkler requirements can be discontinued. The sprinkler system requirements may be discontinued in an AFFECTED AREA when the AFFECTED AREA is determined to be OPERATIONALLY CLEAN. The determination of OPERATIONALLY CLEAN shall be performed in accordance with AC 5.5. Accidents that Support Discontinuation: Scenarios DD-FIRE-A1, DD-FIRE-B4, DD-FIRE-C3, DD-SPILL-P1, DD-SPILL-Q3, DD-EXP-P6, DD-EXP-T1 evaluate the risk associated with OPERATIONALLY CLEAN areas. These scenarios do not rely on sprinklers and support discontinuing LCO 3.2 when an area is OPERATIONALLY CLEAN. Attachment 1-14

40 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES (continued) EXCEPTION The Exception may only be used outside the Operations Zone. Decommissioning XX and XY requires activities that permanently remove sprinklers from service (e.g., cutting, capping, and removing lines that obstruct ductwork removal, permanently removing ceiling tiles). Operable sprinklers are preferred and use of this exception should be minimized. The exception provides an authorized method for safely handling these activities. Sprinkler impairments and coverage problems existing at the time of implementation (historical impairments) can also be handled using the exception. The exception hands off to an administrative program in AC c that minimizes fire hazards in areas with inoperable sprinklers. Since the LCO hands off to Administrative Control, deviations from the Administrative Controls are handled as AC NON-COMPLIANCES. The facility can follow the Administrative Controls for the remaining life of the facility. Work control documents (e.g., IWCP) are appropriate for invoking AC c for a planned activity. NOTE The Note simply acknowledges that sprinklers in the basement Decontamination Room and Janitor s Closet are supplied by Riser XX-A, which is not covered by surveillances in LCO 3.2. A lower rigor for sprinklers in these rooms is reasonable due to their small size, the lack of radiological material, and separation from areas with hazardous material. These rooms have sprinklers and Riser XX-A will still be tested as part of the Fire Protection Program. However, to comply with the LCO, these rooms will be considered deficient and will be controlled in accordance with AC c. Attachment 1-15

41 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES (continued) ACTIONS Risers XX-B and XX-C can be cross connected by manually opening valve A.1 and A.2 C-43, which is located in the attic. This allows both XX-B and XX-C sprinklers to be supplied from one riser. When a riser impairment exists, the water supply to the impaired Riser should be isolated first to preclude any impairment of other Riser. After the INOPERABLE Riser is isolated, the cross-connect valve should be opened, and then acceptable pressure in the riser should be verified to confirm successful cross-connection. For a Planned Out-of-Tolerance, cross-connecting first is preferred to minimize impacts. The 4-hour COMPLETION TIME allows adequate time to complete the cross-connect and isolation given that the cross-connect valve is located in a radiological area. Entering the area requires donning of personnel protective clothing, RCT coverage, and transit time, and manipulation of both valves requires Integrated Safety Services or Fire Department response. This COMPLETION TIME is reasonable due to the low initiation frequency of fire. In the event a cross-connection is not possible (e.g., the other Riser is also ACTIONS B.1 to B.4 inoperable) or not desired, the facility must implement other options. Condition B is intended for unplanned Out-of-Tolerances and is entered if the deficiencies are identified that keep sprinklers from performing their credited function. The deficiencies may be identified during surveillances, general tours, by personnel working in the area. The impact of deficiencies on the credited function of the sprinklers shall be determined by Fire Protection Engineering and Nuclear Safety. The credited function is to reduce the frequency of large and major fires by reducing the heat release rate of the fire and holding it to the area of origin, which depends on an adequate water density and spray pattern. The impact of deficiencies may be documented in surveillance data sheets (e.g., note in comments) or in a separate document (e.g., Engineering Operability Evaluation) if more evaluation is required. (continued) Attachment 1-16

42 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES (continued) ACTIONS ACTION B.1 B.1 to B.4 Initiators for fire scenarios include sparks or heat from operations, (continued) maintenance, and decommissioning activities that ignite combustible material. Sparks and heat are produced primarily from Hot Work (e.g., welding, plasma arc, grinding) and electrical shorts. The possibility of electrical shorts or overheating associated with operating electrical equipment (e.g., fans, lights, size reduction tent airmovers, CAAMS, CAAS, extension cords, sawzalls, nibblers) poses a small amount of risk. However, the risk of fire associated with operating electrical equipment is much smaller than the risk associated with Hot Work. Therefore, REQUIRED ACTION B.1 requires the facility to discontinue Hot Work in LCO 3.2 areas with INOPERABLE sprinklers, which effectively lowers the frequency of fire initiators. Suspending additional activities would not significantly affect the amount of electrical equipment operating in the facility or further reduce the likelihood of a fire. The immediate COMPLETION TIME requires the facility to define the AFFECTED AREAS and suspend Hot Work as soon as practicable. ACTION B.2 ACTION B.2 requires the facility to SUSPEND OPERATIONS in area of the Operations Zone with inoperable sprinklers. This effectively lowers initiating event frequencies by minimizing ignition sources and placing nuclear materials in a safe configuration. The AFFECTED AREA for this condition is the area where the sprinklers are inoperable. The 4-hour COMPLETION TIME was selected as reasonable to define the AFFECTED AREA and SUSPEND OPERATIONS. ACTION B.3 LCO 3.2 cannot be met if the facility has sprinkler deficiencies or if an entire sprinkler system is not OPERABLE. Therefore, the facility shall establish a Fire Watch in the AFFECTED AREAS. The function of the Fire Watch is to identify conditions that may lead to a fire, detect fires, and initiate emergency response. The 4-hour COMPLETION TIME was selected as reasonable to define the AFFECTED AREA and assign appropriate personnel to Fire Watch duty. Fire Watches must be established in accordance with FPE guidance and approved procedures (e.g., PRO-V60-HSP-34.06). Attachment 1-17

43 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES (continued) ACTIONS B.1 to B.4 (continued) ACTIONS C.1 to C.4 ACTION B.4 This action requires the sprinklers to be restored within 30 days. This limits the duration of Out of Tolerance. It also lowers the likelihood of a fire in an area where sprinklers are INOPERABLE by limiting the length of time that sprinklers may be INOPERABLE. The Site SAR governs minimum Fire Department staffing and notification. Although Fire Department response is not directly credited in the accident analysis, this action provides a layer of defense in the event of a fire. If there are INOPERABLE sprinklers in areas covered by LCO 3.2 and the facility is notified that Fire Department staffing is inadequate to respond to a fire, the facility shall implement the following REQUIRED ACTIONS. ACTION C.1 requires the facility to discontinue Hot Work in areas with INOPERABLE sprinklers, which effectively lowers the frequency of fire initiators. The IMMEDIATE COMPLETION TIME requires the facility to define the AFFECTED AREAS and suspend Hot Work as soon as practicable ACTION C.2 requires the facility to SUSPEND OPERATIONS in areas with inoperable sprinklers. This lowers initiating event frequencies further by minimizing ignition sources and placing nuclear materials in a safe configuration. The AFFECTED AREA for this condition is the area where the sprinklers are inoperable. The 4-hour COMPLETION TIME was selected as reasonable to define the AFFECTED AREA and take steps necessary to safely SUSPEND OPERATIONS. ACTION C.3 requires the facility to establish a Fire Watch in the AFFECTED AREAS. The function of the Fire Watch is to identify conditions that may lead to a fire, detect fires, and initiate emergency response. The 4-hour COMPLETION TIME was selected as reasonable to define the AFFECTED AREA and assign appropriate personnel to Fire Watch duty. Fire Watches must be established in accordance with FPE guidance and approved procedures (e.g., PRO-V60-HSP-34.06). ACTION C.4 requires the sprinklers to be restored within 30 days. Although the Fire Department staffing will most likely be restored before 30 days, this action limits the possible duration of this condition. It also lowers the likelihood of a fire while this condition exists by limiting the length of time that sprinklers may be INOPERABLE. Attachment 1-18

44 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.2 LIMITING CONDITION FOR OPERATION: Fire Sprinkler Systems BASES (continued) ACTIONS Condition D applies to Planned Out-of-Tolerances. Decommissioning D.1 to D.3 XX and XY requires performing activities that temporarily render sprinklers inoperable (e.g., removing ceiling tiles, blocking sprinkler spray pattern) or require a sprinkler system to be temporarily isolated (e.g., sprinkler system maintenance or repair, isolating a sprinkler section to cut and cap a line that does not have isolation valves). CONDITION D provides an approved method for safely performing these activities as a Planned Out of Tolerance. ACTION D.1: The requirement to remove combustible materials as directed by Fire Protection Engineering effectively lowers initiating event frequencies and consequences by removing materials that can ignite or propagate a fire. ACTION D.2: Implementing additional precautions specified by Fire Protection Engineering (e.g., Fire Watches, heat collector curtains around ceiling tile openings) reduces the likelihood, or mitigates the consequences, of a fire. These actions are specific to the conditions surrounding the activity and are in addition to controls already in the Fire Protection SMP. When ceiling tiles are removed for short duration access, attending personnel can provide the equivalent of a continuous Fire Watch. In conjunction with removing combustible materials, the additional precautions specified by Fire Protection Engineering reduces the likelihood and consequences of a fire in the AFFECTED AREA as much as reasonable. REQUIRED ACTIONS D.1 and D.2 must be implemented prior to initiating the activity because CONDITION D is considered a Planned Out of Tolerance. REQUIRED ACTIONS D.1 and D.2 lend themselves to implementation through work control documents (e.g., IWCP). ACTION D.3 requires the sprinklers to be restored within 30 days. This limits the duration of Planned Out of Tolerances. It also lowers the likelihood of a fire in an area where planned work activities temporarily renders sprinklers inoperable by limiting the length of time that sprinklers may be inoperable. Attachment 1-19

45 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 4.2 SURVEILLANCE REQUIREMENTS: Fire Sprinkler Systems BASES (continued) SR NFPA 25 (Reference 6) requires that the static pressure in wet-pipe sprinkler systems be verified once per month to ensure that normal water supply pressure is maintained. SR verifies that the static pressure for each of the credited risers is greater than or equal to the value listed in the criteria. FPE established minimum static pressure requirements for each riser by subtracting a confidence limit and gauge uncertainty from previous surveillance results. Although the values are intended to be a threshold that may indicate a problem rather than an absolute minimum pressure, they are used as OPERABILITY criteria for LCO 3.2. SR SR SR NFPA 25 requires that the alignment of locked control valves be verified once per month to ensure that water is available to fire suppression systems. SR verifies that the PIVs and control valves for sprinkler systems are locked or sealed in their normally open or closed positions. NFPA 25 requires that water flow alarms be tested quarterly by opening the inspector s test connection. Inspector s test connections allow a flow rate equivalent to one sprinkler. Opening the test valve verifies that water can flow through the system and it tests the operation of the alarms from the alarm valve to the Fire Dispatch Center. NFPA 25 requires that a main drain flow test be conducted annually to determine if there has been a change in the condition of the water supply piping and control valves. This test compares static and residual pressures to previous tests and verifies that water supply conditions have not changed significantly. SR verifies that the residual pressure for each of the credited risers is greater than or equal to a value listed in the criteria. FPE established minimum residual pressure requirements for each riser by subtracting a confidence limit and gauge uncertainty from previous surveillance results. Although the values are intended to be a threshold that may indicate a problem rather than an absolute minimum pressure, they are used as OPERABILITY criteria for LCO 3.2. Attachment 1-20

46 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 4.2 SURVEILLANCE REQUIREMENTS: Fire Sprinkler Systems BASES (continued) SR NFPA 25 requires that sprinklers and piping be visually inspected annually. The inspection is conducted from the floor level and sprinklers that are not observable, installed in concealed spaces, or installed in areas that are inaccessible for safety considerations do not need to be inspected. Sprinklers shall be visually inspected from the floor level for proper orientation, obstructions, deterioration (e.g., corrosion, foreign materials, paint), and physical damage (e.g., damaged pipe hangers, bent deflectors). The impact of deficiencies on the credited function of the sprinklers shall be determined by Fire Protection Engineering and Nuclear Safety. The credited function is to reduce the frequency of large and major fires by reducing the heat release rate of the fire and holding it to the area of origin, which depends on an adequate water density and spray pattern. The impact of deficiencies may be documented in surveillance data sheets (e.g., note in comments) or in a separate document (e.g., Engineering Operability Evaluation) if more evaluation is required. Attachment 1-21

47 Attachment 2 LCO Example for Material At Risk Inventory Control (TRU Waste Storage Facility)

48 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.3 TRU Waste Storage Facility Material At Risk Inventory Control LCO: The quantity of nuclear material in containerized waste at TRU Waste Storage Facility SHALL NOT exceed the following material at risk limits: NOTE All MAR inventory limits are provided in curies equivalent of Pu 239 unless otherwise stated The total quantity of nuclear material present at WASTE STORAGE FACILITY SHALL NOT exceed 2000 Curies. AND 2. No single 55 gallon drum shall be > 150 Curies OR 3. No waste boxes or crates shall > 300 Curies MODE APPLICABILITY: At All Times PROCESS AREA APPLICABILITY: Entire Facility Attachment 2-2

49 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.3 Limiting Condition for Operation: TRU Waste Storage Facility Material At Risk Inventory Control ACTION(s) CONDITION REQUIRED ACTION COMPLETION TIME A. Total inventory of material within drums and waste boxes is exceeded B. Waste container Material at Risk limits are exceeded A.1 Suspend all waste container receipts at WASTE STORAGE FACILITY. AND A.2 Bring WASTE STORAGE FACILITY into compliance with quantity limits. B.1 Suspend all waste container movements within 10 feet of the non-compliant waste container. AND B.2.1 Remove the non-compliant waste container from WASTE STORAGE FACILITY OR B.2.2 Bring the non-compliant waste container into compliance with the material at risk limits. 1 Hour 3 Weeks 1 Hour 3 Weeks 3 Weeks Attachment 2-3

50 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3.3 TRU Waste Storage Material At Risk Inventory Control (continued) SURVEILLANCE REQUIREMENTS: SURVEILLANCE REQUIREMENTS SR Verify that quantities of waste containers do not exceed the total limits for combined drums and waste boxes SR Verify that the gram content of a containerized waste item that is to be received at Waste Storage Facility does not exceed the material at risk limits. FREQUENCY Monthly Before shipment OR At receipt Attachment 2-4

51 3.3. LCO: TRU Waste Storage Material At Risk Inventory Control BASES: BACKGROUND SUMMARY APPLICATION TO SAFETY ANALYSIS LCO 3.3 MODE APPLICABILITY Inventory Control and Material Management provides control for the location, storage configuration, and handling of nuclear material within WASTE STORAGE FACILITY based on the quantity, type, and form. This element protects the assumptions of the accident analysis that limit the amount of MAR available for potential release in the event of an accident. Accidents resulting from a breach of TRU waste containers can result in significant consequences to workers and potentially the public. Specific controls and restrictions are placed on radiological material inventory (containerized waste items and WASTE STORAGE FACILITY) to prevent the introduction of materials into WASTE STORAGE FACILITY that would invalidate the safety basis. The total quantity of containerized waste that can be stored in WASTE STORAGE FACILITY is restricted to 2,000 plutonium-239 equivalent curies. Compliance shall be demonstrated by tracking the total quantity of nuclear material present within all waste boxes and other containers. The LCO set the initial MAR for accident scenarios that involve the entire WASTE STORAGE FACILITY waste inventory (i.e., major fire, seismic). The initial MAR determination for these scenarios is based on projected waste container loading to the Site 95 th UCL + 20% values. Using these values represents a very conservative MAR determination for the entire WASTE STORAGE FACILITY inventory. It is judged that increases in the Site 95 th % UCL plus 20% values during the expected operating life of WASTE STORAGE FACILITY will not invalidate the accident consequences presented in this DSA and an Unreviewed Safety Question Determination would not be necessary. The MAR loadings for the highest estimated single TRU containers were used in the safety analysis for scenarios involving just a few waste containers and are carried forward as requirements. Compliance with these requirements can be demonstrated by utilizing the Waste and Environmental Management System (WEMS) database and process knowledge, scan data, radiological surveys, or other assessment methods indicating that the waste is TRU. Therefore, WEMS must contain a curie value or a waste type designation of TRU prior to acceptance of a container. High americium wastes do not fall in the category of TRU and are not evaluated in this safety analysis. Waste storage is the only activity conducted in the WASTE STORAGE FACILITY. Attachment 2-5

52 3.3. LCO: TRU Waste Storage Material At Risk Inventory Control BASES (Continued) ACTIONS If WASTE STORAGE FACILITY exceeds the total quantity of material A.1 and A.2 permitted, the building shall be brought into compliance to re-establish the assumptions of the WASTE STORAGE FACILITY specific safety analyses. Compliance may be re-established by removing container(s) from WASTE STORAGE FACILITY, re-assay to obtain a more accurate count, or expert review of an existing assay. Bringing WASTE STORAGE FACILITY into compliance within 3 weeks is required. Three weeks is considered adequate time for facility management to identify, communicate with, and coordinate a transfer to an appropriate on-site facility. ACTIONS B.1 through B.2.2 If a waste container in WASTE STORAGE FACILITY contains more that the specified nuclear material at risk limits, all container movement in the vicinity of the non-compliant waste container must be suspended within 1 hour. Based upon the simplicity of the container movement activities in WASTE STORAGE FACILITY, one hour is judged to be adequate to notify all workers in the vicinity to suspend movement activities and to safely secure the handling equipment and waste containers involved. If a waste container in WASTE STORAGE FACILITY contains more than the specified nuclear material limits, the waste container is to be removed from the facility or brought into compliance to re-establish the assumptions of the WASTE STORAGE FACILITY specific safety analyses within 3 weeks. Compliance may be established by re-assay to obtain a more accurate count or expert review of an existing assay. Three weeks is considered adequate time for facility management to identify, communicate with, and coordinate a transfer to an appropriate on-site facility or to reestablish container compliance. SR and An increase in a specific waste container MAR does not have any impact on contiguous waste containers, other than for issues dealing with criticality. Therefore, for all accidents not involving a criticality, high MAR containers do not require container segregation. The Criticality Safety Program is credited for handling any criticality issues related to high MAR containers and their movement. The likelihood of an occurrence of an accident involving identified high MAR waste container(s) is small during the maximum three-week interval for removal. Performance of SR and on a monthly basis assurances WASTE STORAGE FACILITY compliance with material at risk limits. Performance of SR and before shipment OR at receipt assures that WASTE STORAGE FACILITY is operated within the bounds of the safety analysis. A WEMS query may be used to perform SR 3.3.1, and SR Attachment 2-6

53 ATTACHMENT 3 Administrative Control for TRU Waste Processing Facility

54 5.0 Administrative Controls Radioactive Inventory Control This administrative control provides controls to ensure that radioactive inventories, material forms, stacking configurations, and packaging limits assumed in the accident analysis will not be exceeded without additional analyses. Key Elements The administrative control key elements include the following: a. Radioactive inventory limits for TRU Waste facilities SHALL be maintained in accordance with the limits provided in Table b. Inventories, and locations of containers and material SHALL be tracked to support demonstration that the requirements shown above are being maintained. In the event that the facility inadvertently accepts and or stores waste packages that exceed the inventory limits defined in Table 5.6-1, the condition SHALL be corrected within 96 hours of the discovery of exceeding the inventory limit. Table Configuration/Facility Limit (Pu 239 equivalent curies) Single TRU Waste Container 83 Outside Waste Staging Zone 600 Transportation between Burial Ground and 500 Building 215 Building 235 Storage Area 2000 Attachment 3-2

55 B-2 Tank Farm Safety Basis Issues

56

57

58

59

60

61

62

63

64

65 B-3 Supplemental Guidance for Implementing DOE-STD at Environmental Management Nuclear Facilities

66

67

68

69

70

71

72

73

74

75 B-4 Hazard Categorization of EM Inactive Waste Sites as Less Than Hazard Category 3

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105 B-5 Guidance Requested from the Office of Environment, Safety and Health for 10 CFR 830, Subpart B Implementation (No Guidance Attached)

106

107

108 B-7 Supplemental Environmental Management Guidance for implementing 10 CFR 830, Subpart B, Safety Basis Requirements

109

110

111

112

113

114

115