DOE-STD-1189-2016,_DOE_Standard_Integration_of_Safety_Into_the_Design_Process.pdf

DOE-STD-1189-2016

December 2016

Superseding

DOE-STD-1189-2008

DOE STANDARD

INTEGRATION OF SAFETY INTO THE

DESIGN PROCESS

U.S. Department of Energy Washington, DC 20585

DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited.

NOT MEASUREMENT

SENSITIVE

ii

FOREWORD

1. This Department of Energy (DOE) Standard has been approved to be used by DOE, including the National Nuclear Security Administration, and their contractors.

2. Beneficial comments (recommendations, additions, and deletions), as well as any pertinent data that may be of use in improving this document, should be emailed to nuclearsafety@hq.doe.gov or sent to:

Office of Nuclear Safety (AU-30) Office of Environment, Health, Safety and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874

3. This Standard provides requirements and guidance for the integration of safety into the design process for DOE’s Hazard Category (HC) 1, 2, and 3 nuclear facilities as defined in 10 Code of Federal Regulations (CFR) Part 830, Nuclear Safety Management. This Standard applies to the design and construction of (a) new DOE HC 1, 2, and 3 nuclear facilities, (b) major modifications to DOE HC 1, 2, and 3 nuclear facilities and (c) other modifications to DOE HC 1, 2, and 3 nuclear facilities that are managed under the requirements of DOE O 413.3B, Program and Project Management for the Acquisition of Capital Assets. DOE technical standards become mandatory for DOE contractors only when the standards or invoking DOE directives are included as a contract requirement.

4. This Standard is a significant revision of and successor document to DOE-STD-1189-2008, Integration of Safety into the Design Process. This Standard updates requirements to reflect experience and lessons learned.

mailto:nuclearsafety@hq.doe.gov iii

CONTENTS

1.0 INTRODUCTION

1.1 SCOPE

1.2 APPLICABILITY

1.3 BACKGROUND

1.4 OVERVIEW OF THE STANDARD

2.0 TERMINOLOGY

2.1 ACRONYMS AND ABBREVIATIONS

2.2 SHALL, SHOULD, AND MAY

2.3 DEFINITIONS

3.0 PROJECT MANAGEMENT

3.1 DOE ORDER BASIS

3.2 PROJECT MANAGEMENT PROCESS

3.3 SAFETY DESIGN STRATEGY

3.4 FEDERAL PROJECT DIRECTOR

3.4.1 Management Role

3.4.2 Safety Responsibilities

3.5 FEDERAL INTEGRATED PROJECT TEAM

3.6 CONTRACTOR INTEGRATED PROJECT TEAM

3.7 SAFETY DESIGN INTEGRATION TEAM

3.8 CONFIGURATION MANAGEMENT

3.8.1 Configuration Management Plan

3.8.2 Code of Record

3.8.3 Change Control for the Preliminary Documented Safety Analysis

4.0 INTEGRATION OF SAFETY INTO THE DESIGN

4.1 SAFETY-IN-DESIGN APPROACH

4.1.1 Identification of Design and Safety Requirements

4.1.2 Major Safety Functions

4.1.3 Inherently Safer Design

4.1.4 Hierarchy of Controls

4.1.5 Conservatism

4.1.6 Risk and Opportunity Assessment

4.1.7 Stakeholder Issues

4.1.8 Use of Integrated Safety Management Guiding Principles

4.2 PRE-CONCEPTUAL DESIGN PHASE

4.2.1 Capability Analysis

4.2.2 Mission Need Statement

4.2.3 Expectations of DOE

4.3 CONCEPTUAL DESIGN PHASE

4.3.1 Hazards Analysis at the Conceptual Design Phase

4.3.2 Fire Hazards Analysis

4.3.3 Facility-Level Accident Analysis

iv

4.3.4 Identification of Important Safety Functions and Major Safety SSCs

4.3.5 Conservative Design Margins

4.3.6 Required Documentation

4.3.7 DOE Review of the CSDR

4.4 PRELIMINARY DESIGN PHASE

4.4.1 Hazards and Accident Analyses

4.4.2 SSC Selection and Classification

4.4.3 Fire Hazards Analysis

4.4.4 Technology Readiness Assessment

4.4.5 Preliminary Safety and Design Results

4.4.6 DOE Review of Preliminary Safety and Design Results

4.5 FINAL DESIGN PHASE

4.5.1 90 Percent Design Completion

4.5.2 Procurement Support

4.5.3 Long-Lead Procurement SSCs

4.5.4 Configuration Management Process

4.5.5 PDSA Development

4.5.6 DOE Approval of the PDSA

4.5.7 Inspections, Tests, and Acceptance Criteria

4.6 CONSTRUCTION AND TRANSITION TO OPERATIONS

4.6.1 100 Percent Design Completion

4.6.2 Construction Support and Configuration Controls

4.6.3 Development of DSA and TSRs

4.6.4 Required Documentation

4.6.5 DOE Approval of DSA

4.6.6 Checkout/Acceptance, Testing, and Commissioning

4.6.7 Readiness Reviews

4.6.8 Project Closeout

4.7 RISK MANAGEMENT PLAN

4.7.1 Overview

4.7.2 Identification and Management of Risks

4.8 SAFETY PROGRAM AND OTHER IMPORTANT PROJECT INTERFACES

4.8.1 Safety Management Programs

4.8.2 Other Design Interfaces

4.8.3 List of Potential Interfaces

5.0 INTEGRATION OF SAFETY INTO FACILITY MODIFICATIONS

5.1 OVERVIEW

5.2 MAJOR MODIFICATION DETERMINATION

5.2.1 Criteria for Entering the Major Modification Determination Process

5.2.2 Major Modification Assessment

5.2.3 DOE Concurrence

5.3 GRADED APPROACH

5.4 POTENTIAL FOR DESIGN UPGRADES

5.5 REPURPOSING EXISTING FACILITIES

6.0 REFERENCES

v

APPENDIX A OVERVIEW OF THE SAFETY-IN-DESIGN PROCESS ........................................................................A-1

A.1 PURPOSE ..................................................................................................................................................... A-1 A.2 DOE’S ACQUISITION MANAGEMENT SYSTEM ..................................................................................................... A-1 A.3 PROJECT ORGANIZATION AND INTERNAL COMMUNICATIONS ................................................................................. A-2 A.4 PROJECT PLANNING AND EXECUTION ................................................................................................................ A-3

A.4.1 Pre-Conceptual Design Phase .......................................................................................................... A-5 A.4.2 Conceptual Design Phase ................................................................................................................ A-6 A.4.3 Preliminary and Final Design Phase ................................................................................................ A-7 A.4.4 Construction, Transition, and Closeout ............................................................................................ A-9

APPENDIX B SAFETY DESIGN STRATEGY ......................................................................................................... B-1

B.1 OVERVIEW AND PURPOSE ............................................................................................................................... B-1 B.2 EARLY STAGES OF THE PROJECT ........................................................................................................................ B-1 B.3 FINAL DESIGN AND BEYOND ............................................................................................................................ B-1 B.4 FORMAT AND CONTENT ................................................................................................................................. B-2

APPENDIX C CONCEPTUAL SAFETY DESIGN REPORT ...................................................................................... C-1

C.1 INTRODUCTION ............................................................................................................................................. C-1 C.2 RISK AND OPPORTUNITY ASSESSMENT ............................................................................................................... C-2 C.3 CSDR FORMAT AND CONTENT GUIDE ............................................................................................................... C-6

APPENDIX D PRELIMINARY DOCUMENTED SAFETY ANALYSIS ....................................................................... D-1

D.1 TECHNICAL CONTENT ..................................................................................................................................... D-1 D.2 PDSA FORMAT ............................................................................................................................................ D-2 D.3 DEVELOPMENT OF PDSA ................................................................................................................................ D-2 D.4 GRADED APPROACH TO PDSA DEVELOPMENT .................................................................................................... D-3

APPENDIX E SAFETY PROGRAMS AND OTHER IMPORTANT PROJECT INTERFACES ........................................ E-1

E.1 RADIATION PROTECTION................................................................................................................................. E-1 E.2 FIRE PROTECTION .......................................................................................................................................... E-2 E.3 MAINTENANCE ............................................................................................................................................. E-2 E.4 PROCEDURES, TRAINING, AND QUALIFICATION ................................................................................................... E-2 E.5 CONDUCT OF OPERATIONS .............................................................................................................................. E-3 E.6 QUALITY ASSURANCE ..................................................................................................................................... E-3 E.7 EMERGENCY PREPAREDNESS ........................................................................................................................... E-4 E.8 WASTE MANAGEMENT .................................................................................................................................. E-4 E.9 WORKER SAFETY AND HEALTH PROGRAM .......................................................................................................... E-5 E.10 INFRASTRUCTURE .......................................................................................................................................... E-5 E.11 HUMAN FACTORS ......................................................................................................................................... E-6 E.12 SECURITY ..................................................................................................................................................... E-6 E.13 ENVIRONMENTAL PROTECTION ........................................................................................................................ E-7 E.14 HAZARDOUS MATERIAL .................................................................................................................................. E-8 E.15 EXTERNAL REVIEWS ....................................................................................................................................... E-8 E.16 COGNIZANT SYSTEM ENGINEER PROGRAM ......................................................................................................... E-9 E.17 TRANSPORTATION ....................................................................................................................................... E-10 E.18 CRITICALITY SAFETY ..................................................................................................................................... E-10 vi

APPENDIX F MAJOR MODIFICATION DETERMINATION EXAMPLES ............................................................... F-1

EXAMPLE 1 ................................................................................................................................................................ F-1 EXAMPLE 2 ................................................................................................................................................................ F-3 EXAMPLE 3 ................................................................................................................................................................ F-5 EXAMPLE 4 ................................................................................................................................................................ F-6 EXAMPLE 5 ................................................................................................................................................................ F-8

APPENDIX G ANALYSIS OF POTENTIAL DESIGN UPGRADES ........................................................................... G-1

G.1 INTRODUCTION ............................................................................................................................................. G-1 G.2 IDENTIFICATION OF DESIGN CRITERIA CONFLICTS ................................................................................................. G-1 G.3 ANALYSIS OF CONFLICTS ................................................................................................................................. G-1 G.4 REPORT OF ANALYSIS RESULTS ......................................................................................................................... G-2

APPENDIX H INTERFACE BETWEEN SAFETY-IN-DESIGN AND PROJECT MANAGEMENT .................................. H-3

1.0 INTRODUCTION

This Standard (STD) provides requirements and guidance for the integration of safety into the design process for Department of Energy (DOE) Hazard Category (HC) 1, 2, and 3 nuclear facilities as defined in 10 Code of Federal Regulations (CFR) Part 830, Nuclear Safety Management.

1.1 SCOPE

This Standard specifies the requirements and responsibilities for project management, engineering/design, and safety analysis, and their interactions essential for successful integration of safety into design and construction. The Standard also specifies the engineering and design process, as well as key interfaces required for the integration of safety into design.

1.2 APPLICABILITY

This Standard applies to the design and construction of (a) new DOE HC 1, 2, and 3 nuclear facilities, (b) major modifications to DOE HC 1, 2, and 3 nuclear facilities, and (c) other modifications to DOE HC 1, 2, and 3 nuclear facilities that are managed under the requirements of DOE O 413.3B, Program and Project Management for the Acquisition of Capital Assets. The activities and processes in this Standard may be applied to new facilities and to modifications to those facilities not listed above, for example, hazardous non-nuclear facilities.

1.3 BACKGROUND

DOE-STD-1189-2008, Integration of Safety into the Design Process, was developed to fulfill the objectives of project management as stated by the Deputy Secretary of Energy in a December 5, 2005 memorandum, Integrating Safety into Design and Construction, to DOE elements:

I expect safety to be fully integrated into design early in the project. Specifically, by the start of the preliminary design, I expect a hazard analysis of alternatives to be complete and the safety requirements for the design to be established. I expect both the project management and safety directives to lead projects on the right path so that safety issues are identified and addressed adequately early in the project design.

This revision reflects lessons learned and experience since the original issuance of DOE-STD-1189-2008. It also reflects the definition of 90% design completion as set out in Secretary Moniz’s June 8, 2015 memorandum, Project Management Policies and Principles, as reflected in DOE O 413.3B.

1.4 OVERVIEW OF THE STANDARD

Section 2 describes the terminology used in the Standard, including acronyms and abbreviations, requirement and recommendation statements, and definitions.

Section 3 describes the project management processes and responsibilities for ensuring proper implementation of the safety-in-design concept.

Section 4 describes the design process and criteria to ensure that safety is integrated into design.

Section 5 describes the process for determining whether a facility modification is a “major modification” and the application of the graded approach for major modifications.

Section 6 provides key references.

Appendices are provided on the following topics: (A) Overview of the Safety-in-Design process,

(B) Safety Design Strategy, (C) Conceptual Safety Design Report, (D) Preliminary Documented Safety Analysis, (E) Safety Programs and Other Important Project Interfaces, (F) Major Modification Determination Examples, (G) Analysis of Potential Design Upgrades, and (H) Interface Between Safety-in-Design and Project Management.

2.0 TERMINOLOGY

2.1 ACRONYMS AND ABBREVIATIONS

ALARA As Low As Reasonably Achievable CD Critical Decision CDR Conceptual Design Report CFR Code of Federal Regulations CIPT Contractor Integrated Project Team CM Configuration Management COR Code of Record CSDR Conceptual Safety Design Report CSE Cognizant System Engineer DBA Design Basis Accident DOE Department of Energy DSA Documented Safety Analysis FHA Fire Hazards Analysis FPD Federal Project Director G Guide GFE Government Furnished Equipment HC Hazard Category HDBK Handbook IPT (Federal) Integrated Project Team NEPA National Environmental Policy Act NPH Natural Phenomena Hazards O Order PDSA Preliminary Documented Safety Analysis QA Quality Assurance QAP Quality Assurance Program R&OA Risk and Opportunity Assessment RMP Risk Management Plan SAC Specific Administrative Control SDIT Safety Design Integration Team SDS Safety Design Strategy SER Safety Evaluation Report SME Subject Matter Expert SMP Safety Management Program SSCs Structures, Systems, and Components STD Standard TRL Technology Readiness Level TSR Technical Safety Requirement

2.2 SHALL, SHOULD, AND MAY

The word “shall” denotes a requirement; the word “should” denotes a recommendation; and the word “may” denotes permission, neither a requirement nor a recommendation.

2.3 DEFINITIONS

Code of Record (COR): The COR is a set of design and operational requirements, including Federal and state laws, in effect at the time a facility or item of equipment is designed and accepted by DOE. The COR is (i) initiated during the conceptual design phase, placed under configuration control to ensure it is updated to include more detailed design requirements as they are developed during preliminary design, (ii) controlled during final design and construction with a process for reviewing and evaluating new and revised requirements to determine their impact on project safety, cost, and schedule before a decision is taken to revise the COR, and (iii) maintained and controlled through facility decommissioning. The COR may be defined in contracts, Standards, or Requirements Identification Documents (or their equivalent), or project-specific documents.

Configuration Management: A disciplined process that involves both management and technical direction to establish and maintain alignment of project documentation, design requirements, and the physical configuration of the nuclear facility.

Design Organization: The organization with the responsibility and authority for the design of a capital asset being acquired or major modification to an existing asset (typically, the contractor or contractor team holding the design contract). The design organization may obtain help and support from other organizations, but retains overall responsibility and authority for the design.

In some cases, DOE may be the design organization.

Documented Safety Analysis: A documented analysis of the extent to which a nuclear facility can be operated safely with respect to workers, the public, and the environment, including a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety. [10 C.F.R. § 830.3]

Graded Approach: The process of ensuring that the level of analysis, documentation, and actions used to comply with a requirement in this Standard is commensurate with:

• The relative importance to safety, safeguards, and security;

• The magnitude of any hazards involved;

• The life cycle stage of a facility;

• The programmatic mission of a facility;

• The particular characteristics of a facility;

• The relative importance of radiological and non-radiological hazards; and

• Any other relevant factor. [10 C.F.R. § 830.3]

Major Modifications: Modifications that “substantially change the existing safety basis for the facility.” [10 C.F.R. § 830.3]

Safety Structures, Systems, and Components: Both safety class structures, systems, and components and safety significant structures, systems, and components. [10 C.F.R. § 830.3]

Systems Engineering: A proven, disciplined approach that supports management in clearly defining the mission or problem; managing system functions and requirements; identifying and managing risk; establishing bases for informed decision-making; and verifying products and services meet customer needs. [DOE G 413.3-1]

Technical Safety Requirements (TSRs): The limits, controls, and related actions that establish the specific parameters and requisite actions for the safe operation of a nuclear facility and include, as appropriate for the work and the hazards identified in the documented safety analysis for the facility: Safety limits, operating limits, surveillance requirements, administrative and management controls, use and application provisions, and design features, as well as a bases appendix. [10 C.F.R. § 830.3]

3.0 PROJECT MANAGEMENT

This section sets forth the project management processes and responsibilities for ensuring proper implementation of the safety-in-design concept required by DOE directives. This section identifies DOE directives that provide project management requirements, and identifies requirements for the Safety Design Strategy (SDS), a project management document that provides a roadmap for integration of safety into design. This section also provides roles and responsibilities of project organizations, and top-level requirements for configuration management. Appendix A, “Overview of the Safety-in-Design Process,” further describes the process established in this section.

3.1 DOE ORDER BASIS

The DOE Orders forming the basis for this Standard are: DOE O 420.1C, Chg.1, Facility Safety, and DOE O 413.3B. This Standard provides (a) requirements in addition to those in the cited Orders, and (b) guidance and acceptable methods for meeting Order requirements.

3.2 PROJECT MANAGEMENT PROCESS

DOE’s program and project management system, described in DOE O 413.3B, establishes a required management process for the acquisition of capital assets. Integration of safety into design in all phases of a project is a critical element of this process. Line managers are responsible for successfully developing, executing, and managing projects within the approved performance baseline. Appendix B of DOE O 413.3B describes specific project management responsibilities for all levels of DOE line management.

Project management for projects with a total project cost below the DOE O 413.3B threshold are managed consistent with DOE O 430.1B, Chg. 2, Real Property Asset Management. For such projects, the requirements in this Standard should be graded based on the scope and complexity of the project.

3.3 SAFETY DESIGN STRATEGY

An SDS shall be developed for all projects within the scope of this Standard. For DOE O 413.3B projects, the Order requires that the contractor organization develop an SDS for DOE approval at the conceptual design stage of the project. The SDS for these projects should be developed on a graded approach that considers the degree of interface with nuclear safety SSCs.

The Order states the following in regard to the purpose of the SDS:

The SDS provides preliminary information on the scope of anticipated significant hazards and the general strategy for addressing those hazards. The SDS is updated throughout subsequent project phases and should contain enough detail to guide design on overarching design criteria, establish major safety structures, systems, and components, and identify significant project risks associated with the proposed facility relative to safety.

The SDS reflects and is guided by safety expectations for the project as communicated by the responsible DOE Program Office. The SDS shall address the following aspects of safety integration:

• The guiding philosophies or assumptions to be used to develop the design, including significant inputs and assumptions, potential impacts of new technology, and project constraints as they might affect safety design decisions.

• The safety-in-design and safety goal considerations for the project, including such matters as hazardous materials associated with the facility, preliminary hazard categorization, commitment to DOE O 420.1C, Chg. 1 (design criteria, functional requirements, and design basis); and high-cost design attributes and approaches affecting project risk (such as use of new and non-standard methods).

• The approach to developing the overall safety basis for the project, including the types of analyses to be conducted, documents to be developed through the project cycle, transition from preliminary design to final design (including identification of any hold points on design activities until DOE review of preliminary design results is complete), and any tailoring approaches selected.

• Key safety decisions for major processes and systems including risk and opportunity management approaches.

• Key safety documents to be used during the design development phase, to support design development activities and to document the Preliminary Safety and Design Results.

• The Quality Assurance Program (QAP) and implementation strategy.

• The Configuration Management (CM) program and implementation strategy.

• For Major Modifications, the interface with the existing facility’s safety basis and operations.

• The potential need for a Design Upgrade Analysis (see Appendix G).

• Any tailoring or graded approaches used for the requirements of this Standard.

• Facility-level commitments and requirements developed by the various design disciplines such as structural and electrical.

For modifications to DOE HC 1, 2, and 3 nuclear facilities that are not major modifications but are managed under DOE O 413.3B, the SDS should document the type and scope of the hazard/accident analysis, describe the supporting safety documentation and Documented Safety Analysis (DSA) amendment or revision to be prepared, and should explain the process to develop and review and approve these documents. For such modifications, a Conceptual Safety Design Report (CSDR) and a Preliminary Documented Safety Analysis (PDSA) may not be necessary. No SDS is required for modifications that do not require any new or revised hazard controls and do not require a new or revised hazard analysis/accident analysis.

The SDS should be provided to DOE for review and approval prior to submission of other safety documentation required at the conceptual design stage. This is particularly important for large, complex projects.

In developing an SDS, it is a good practice to review lessons learned from previous projects. See Appendix B of this Standard for further guidance on the SDS.

3.4 FEDERAL PROJECT DIRECTOR

3.4.1 Management Role

Appendix B of DOE O 413.3B assigns the central project management role to the Federal Project Director (FPD): “The FPD is accountable to the Project Management Executive, Program Secretarial Officer or delegated authority, as appropriate, for the successful execution of the project.”

The FPD is given these management responsibilities:

• Prepare and maintain the (Federal) Integrated Project Team (IPT) charter and operating guidance and ensure that the IPT is properly staffed;

• Define and oversee the roles and responsibilities of each IPT member;

• Lead the IPT and provide broad project guidance;

• Delegate appropriate decision-making authority to the IPT members; and

• Approve the IPT charter for non-major system projects.

The FPD (or assigned project manager for projects not covered by DOE O 413.3B) provides leadership and sets the expectation of effective coordination between the safety and design organizations. Frequent and frank discussions among technical professionals working on the design and safety analysis are essential for implementation of the safety-in-design integration process. Other senior project managers should monitor interactions between the safety and design organizations.

Some projects (such as projects not covered by DOE O 413.3B) may not identify an FPD. In such cases, the responsibilities assigned to the FPD by this Standard should be carried out by the responsible approving authority.

3.4.2 Safety Responsibilities

DOE O 413.3B assigns to the FPD the task of ensuring “that safety is fully integrated into design and construction for Hazard Category 1, 2, and 3 nuclear facilities.” The Order also requires that the FPD “ensure that design, construction, environmental, sustainability, safety, security, health and quality efforts performed comply with the contract, public law, regulations, and Executive Orders.”

The FPD is also responsible for implementation of a systems engineering approach to the design development process. Systems engineering encompasses engineering, design, construction, testing, operation, and maintenance aspects of design development. Its use will ensure that safety issues and resolutions are well thought out for effective integration into the design details.

DOE G 413.3-1, Managing Design and Construction Using Systems Engineering for Use with DOE O 413.3A, provides additional information on the systems engineering approach.

The FPD approves or concurs in the following safety-in-design documents:

• SDS,

• Risk & Opportunity Assessment (R&OA),

• Safety review letter on the CSDR, and

• Safety Evaluation Report (SER) on the PDSA.

3.5 FEDERAL INTEGRATED PROJECT TEAM

The IPT, including subject matter experts (SMEs) from both DOE and the contractor design organization, is initially established by the appropriate Program Manager or Head of Field Organization. DOE O 413.3B and DOE G 413.3-18A, Integrated Project Team: Guide for Formation and Implementation, elaborate on the roles, responsibilities, and necessary technical expertise of an IPT. Specifically with respect to integration of safety into design, the IPT performs the following tasks:

• Maintain close coordination with the Contractor Integrated Project Team (CIPT) for timely resolution of safety-in-design issues;

• Identify, define, and manage to completion the project’s environmental, safety, health, security, risk, and QA requirements;

• Support resolution of review findings and issues related to safety and design (including those identified by the Defense Nuclear Facilities Safety Board (DNFSB));1 and

• Ensure safety is effectively integrated into design and construction in a timely manner.

For projects not covered by DOE O 413.3B, the FPD or assigned project manager should establish an IPT with a size and composition based on the complexity of the project. The IPT should include a DOE nuclear safety professional, when merited by the scope and complexity of the project. The IPT shall interface and coordinate with the CIPT (see Section 3.6) and with the Safety Design Integration Team (SDIT) (see Section. 3.7), to ensure that integration of safety into project design is accomplished in a timely and effective manner.

The IPT is responsible for reviewing the following safety-in-design documents:

• R&OA,

• CSDR,

• PDSA, and

• SER on the PDSA, DSA, and Technical Safety Requirement (TSRs).

1 For details regarding the DNFSB interface, see DOE M 140.1-1B, Interface with the Defense Nuclear Facilities

Safety Board, 2001.

3.6 CONTRACTOR INTEGRATED PROJECT TEAM

The contractor managing the project shall establish a CIPT to accomplish the responsibilities described below. Normally, the contractor’s Project Manager serves as the team leader and the contractor’s Safety Lead serves as a team member. CIPT members should represent the competencies relevant to the project, including systems engineering. This range of expertise permits the CIPT to provide an important forum for discussion and resolution of design, safety, and project issues. If separate safety and/or design engineering organizations are supporting the contractor, a representative of these organizations should be included on the CIPT. For a large, complex project, the CIPT is functionally parallel to the IPT. The FPD and contractors maintain close coordination using the IPT and CIPT as communication tools.

The CIPT (a) ensures safety is effectively integrated into design and construction in a timely manner, (b) monitors performance of safety and design tasks and completion of safety and design deliverables to ensure that they are integrated and in sync, and (c) takes action, including informing the IPT, if safety and design task integration presents risks to successful completion of the project.

The CIPT also maintains close coordination with the SDIT (see next section), which is intimately involved with the safety analysis, design, construction, and operational planning details. The SDIT is the ultimate source of project information related to safety-in-design activities. The CIPT’s assigned responsibilities parallel those of the IPT. The CIPT assists the IPT in resolving design issues.

3.7 SAFETY DESIGN INTEGRATION TEAM

An SDIT shall be established for all projects that fall under this Standard, unless the DOE-approved SDS provides an alternate approach.

The SDIT shall be a part of the organization responsible for the design (typically, the contractor organization). The principal tasks of the SDIT are to (a) support the IPT/CIPT to ensure the integration of safety into the design process, including development of the SDS, (b) identify and analyze the hazards in the facility,2 (c) ensure that the selected controls are adequate to perform the safety function, (d) ensure that the requirements of project interfaces (e.g., security needs) are addressed, and (e) ensure that selected controls are consistent with control selection hierarchy and represent cost effective solutions to safety challenges. (See DOE O 420.1C and DOE-STD- 3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, for further guidance). The SDIT should be established and commence operations no later the commencement of conceptual design. Because an SDS should be developed in the earliest stages of the project cycle, the SDIT should develop a working draft as its first task.

2 In the case of a major modification, the SDIT examines hazards within the scope of the modification project.

The SDIT is responsible for preparing the following safety-in-design documents, as directed by the CIPT:

• R&OA,

• CSDR,

• PDSA, and

• DSA and TSRs (assisted by operations personnel).

The SDIT should use R&OAs as a communication and decision-making tool for highlighting safety-in-design assumptions, risks, and decisions (see Appendix C for further details). The SDIT shall communicate and coordinate with the IPT (or applicable federal authority) and the CIPT to ensure that integration of safety into the project design is accomplished in a timely and effective manner.

The SDIT should consist of (a) a core technical team and (b) additional SMEs who may be called upon to accomplish specific tasks. The overall team composition depends on complexity of the design being developed. The core team should consist of safety personnel (contractor safety lead), engineering and design personnel responsible for the process or facility, operations and maintenance personnel, and the management of the design organization.

In rare cases, which meet one of the following criteria, the SDIT duties may be performed by the CIPT, or by another approach, as described in the approved SDS.

• The project is small such that the IPT and the CIPT can coordinate effectively all safety-in-design related issues, leaving no uncertainties in communication protocols;

• Hazards are well-defined and hazards mitigation strategies are well-defined and have been proven effective; or

• Design solutions, including those to meet safety-in-design requirements, are well-defined and have been proven effective.

In these situations, use of a separate, stand-alone SDIT is still strongly recommended to provide adequate focus on and integration of important technical tasks.

3.8 CONFIGURATION MANAGEMENT

3.8.1 Configuration Management Plan

DOE’s approach to this subject is set forth in DOE-STD-1073-2016, Configuration Management, which is endorsed by DOE O 413.3B and DOE O 430.1B, Chg. 2. This Standard provides a disciplined CM process to establish consistency among safety and design requirements, control the physical configuration of a nuclear facility,3 and manage

3 This includes controlling configuration during a major modification.

documentation.

The design organization shall prepare and implement a CM plan as an integrated process for all activities that affect safety-in-design integration as the project moves from inception to operation. The CM plan identifies how different levels of CM are phased in as design requirements are established and construction activities are completed and turned over. The CM plan shall (a) specify the process so that the design basis and design requirements are made consistent with the safety analysis process, (b) specify the process for maintaining configuration management of safety basis documents, and (c) describe the basis for any graded approach, if used. The CM plan should be initiated early in the conceptual design process and approved prior to start of preliminary design activities.

3.8.2 Code of Record

The Code of Record (COR) and its supporting documents should be organized in a manner that supports accessibility, traceability, and maintainability. The COR is initiated during the conceptual design phase and is placed under configuration management to ensure it is updated to include more detailed design requirements, or changes to requirements, as they are identified during preliminary and final design. The COR is controlled during final design and construction with a process for reviewing and evaluating new and revised requirements to determine their impact on project safety, cost and schedule before a decision is taken to revise the COR. A database tool is often useful in organizing COR information and its specific applicability to project structure, system, or components (SSCs).

3.8.3 Change Control for the Preliminary Documented Safety Analysis

After the PDSA is issued, not every change in the design baseline will necessitate a PDSA revision. The following criteria should be applied to design baseline changes when determining whether a PDSA revision is necessary.

• The change alters a safety function for a safety structure, system, and component identified in the current PDSA.

• The change alters either the functional classification or the design standard for a safety SSC previously specified in the PDSA configuration baseline.

• The change requires implementation of new or different safety SSCs or specific administrative controls (SACs), or safety management program (SMP) key elements.

• The change significantly alters the process design or its safety basis.

• The change significantly alters the likelihood or consequences of an SSC malfunction.

4.0 INTEGRATION OF SAFETY INTO THE DESIGN

This section sets forth the design process and criteria to ensure that safety SSCs, SACs, and SMPs are integrated into the design in an effective and efficient way. As the design progresses and hazard analyses are performed, the design organization determines appropriate safety features. Failure to incorporate safety features early in the design can result in prohibitively expensive changes and delays later in the design process. A systematic design development process is executed in project phases, using a graded approach:

• Pre-Conceptual – develop the Mission Need Statement based on gap analysis.

• Conceptual – evaluate alternatives for satisfying the Mission Need Statement to identify the preferred alternative for preliminary design.

• Preliminary – initiate the process of converting concepts to a design appropriate for procurement or construction.

• Final – complete the design effort and produce approved design documentation necessary to permit procurement, construction, testing, checkout and turnover to proceed.

For capital asset projects, a tie to the Critical Decisions (CDs) in DOE O 413.3B shall be established in the Project Execution Plan.4

Section 4.1 specifies the safety-in-design approach and requirements that need to be used in the design development phases, as described in Sections 4.2 through 4.6 below.

4.1 SAFETY-IN-DESIGN APPROACH

The following safety-in-design approach is used to ensure that safety concepts are well thought out from the pre-conceptual to final design phases of the project and fully integrated into the design at the appropriate time.

4.1.1 Identification of Design and Safety Requirements

DOE O 420.1C, Chg. 1, provides nuclear design criteria and requirements for facility safety and hazards analyses, defense in depth, and safety-in-design integration. Safety SSCs shall be designed and constructed using applicable industry codes and standards and other DOE directives identified in accordance with Attachment 3 to DOE O 420.1C, Chg. 1. For security and safeguards design requirements, the DOE O 470 series is used. The identified requirements are actively managed and safety is integrated into the design using a systems engineering approach. The identified requirements provide a foundation for the COR.

4 See DOE G 413.3-15, Department of Energy Guide for Project Execution Plans.

4.1.2 Major Safety Functions

During design development, the design organization shall identify the safety SSCs and their safety functions as determined by the hazards and accident analyses. Safety function descriptions state the objective of the SSCs in a given accident scenario to prevent or mitigate the consequences of the scenario. Any supporting systems and requirements related to accomplishing safety functions shall also be identified. The safety design basis should explain how supporting systems, adjacent systems, or connecting systems might affect a safety SSC when its function is demanded. These functions are later developed into performance criteria for each SSC.

4.1.3 Inherently Safer Design

The design process shall evaluate and consider inherently safer design concepts that can lead to the removal or reduction of hazards before controls need to be developed. Specifically, this design philosophy entails consideration of the following:

• Minimize: Reducing the amount of hazardous material present at any one time (for example, by using smaller batches).

• Substitute: Replacing one material with another of less hazard (for example, cleaning with water and detergent rather than a flammable solvent).

• Moderate: Reducing the strength of an effect (for example, having a cold liquid instead of a gas at high pressure) or using material in a dilute rather than concentrated form.

• Simplify: Eliminating problems by design rather than adding additional equipment or features to deal with them. Use complex procedures only when necessary.5

Inherently safer design concepts can allow facilities to be designed minimizing the need for complex layers of controls that can add project risk and increase operational complexity.

4.1.4 Hierarchy of Controls

After hazardous material minimization/elimination and application of inherently safer design concepts where practical, a control strategy shall be (a) selected to prevent or mitigate releases of hazardous materials and to provide defense in depth, and (b) based on the following order of preference:6

5 For the origin and meaning of this preference structure, see for example Bollinger, R.E., et al., Inherently Safer Chemical Processes: A Life Cycle Approach, D.A. Crowl, Ed., American Institute of Chemical Engineers, New York, NY (1996), and Khan, Faisal and Amyotte, Paul, “How to Make Inherent Safety Practice a Reality,” Canadian Journal of Chemical Engineering, 81: 2-16 (Feb. 2003).

6 See DOE-STD-3009-2014 and DOE G 420.1-1A for additional details on implementation.

• SSCs are preferred over administrative controls.

• Passive SSCs are preferred over active SSCs.

• Preventive controls are preferred over mitigative controls.

• Controls closest to the hazard may provide protection to the largest population of potential receptors, including workers and the public.

• Controls that are effective for multiple hazards can be resource-effective.

4.1.5 Conservatism

When a safety-in-design strategy is uncertain and/or immature at an early stage of design, design margins and assumptions shall be conservative. Use of conservative assumptions, however, should be tempered by weighing risks and opportunities, because some assumptions cannot be relaxed at a later date without significant impact on cost and schedule. In cases where extra conservatism is added because the design is immature, this conservatism should be documented so that it can be reevaluated later as the design matures. The degree of conservatism can be relaxed and the provisional set of SSCs may be refined when justified by evolving design information.

4.1.6 Risk and Opportunity Assessment

The safety-in-design integration process shall incorporate use of a Risk and Opportunity Assessment (R&OA) tool for tracking and assessing the risks/opportunities associated with safety and design features affecting project cost, schedule and contingencies.7

4.1.7 Stakeholder Issues

Specific issues that have been raised by outside stakeholders, such as local, state, and public interest groups, should be addressed at the appropriate stage of the project. The R&OA may be used for this purpose.

4.1.8 Use of Integrated Safety Management Guiding Principles

To ensure effective and efficient integration of safety into the design, a systematic approach requiring implementation of the core functions should be implemented in the design process.

Important guiding principles involved in this process and addressed in this Standard are (a) identification of safety standards and requirements and (b) development of hazard controls tailored to the work to be performed. The process includes documentation and timely review of safety design evolution to ensure feedback and improvement.

7 See DOE G 413.3-7A, Risk Management Guide, for additional guidance.

4.2 PRE-CONCEPTUAL DESIGN PHASE

During the pre-conceptual design development phase for DOE O 413.3B projects, the DOE Program Office identifies and analyzes any shortfall in its current capabilities when viewed in light of its strategic mission. This analysis forms the basis of the Mission Need Statement, the vehicle for formally establishing a project to address the capability deficiency. The mission need determines the overall scope and objectives of the project.

4.2.1 Capability Analysis

The capability analysis provides the basis for the Mission Need Statement. It determines whether a new facility or a modification to an existing facility would best satisfy the mission need. The Program Office is responsible for performing the capability analysis and may direct contractor tasks, including performing the following activities to support this analysis:

• Identification of material inputs and outputs, together with the process technology options, to permit a credible initial assessment of the hazards posed by each proposed process;8

• Preparation of a qualitative assessment of the physical and programmatic risks associated with various available alternatives (i.e., new facility, modification, or no change); and

• Preliminary determination of safety functions for major systems and hazard controls, based on a qualitative hazard analyses.

4.2.2 Mission Need Statement

Based on the results of the capability analysis, the Program Office drafts the Mission Need Statement. The Statement should:

• Describe safety-in-design information affecting the mission need, commensurate with information available at the pre-conceptual phase;

• Identify capability gaps and translate them into functional requirements that cannot be met through other than material means;

• Describe the general parameters of the solution;

• Explain the benefits of the solution; and

• State why the solution is critical to the overall accomplishment of DOE’s mission.

4.2.3 Expectations of DOE

DOE will provide expectations for execution of safety-in-design efforts. DOE O 413.3B requires that the SDS developed in the conceptual design phase be based on those DOE expectations.

8 Generally, a simple process model that shows the material inputs and outputs will satisfy this purpose.

4.3 CONCEPTUAL DESIGN PHASE

During the conceptual design phase, alternatives for satisfying the mission need are evaluated in detail to identify the preferred alternative for preliminary design. The scope of the alternatives analysis should be comprehensive enough to ensure that the selected alternative is best suited for safety-in-design integration, technology readiness, type of facility, site location, security, constructability, and operability. The alternatives analysis shall consider inherently safer design concepts.

The design organization shall identify the functional and performance requirements of major safety systems in a timely manner to ensure that safety becomes an integral part of the design.

DOE-HDBK-1132-99, Design Considerations, provides safety-in-design considerations for major systems such as:

• Confinement systems,

• Fire protection systems,

• Facility layout and design,

• Process equipment and piping systems,

• Mechanical systems,

• Electrical, instrumentation, and control systems, and

• Handling of special nuclear material.

4.3.1 Hazards Analysis at the Conceptual Design Phase

A qualitative evaluation of the potential facility hazards shall be performed for the available alternatives to assist in identifying a preferred option (and possibly a back-up alternative). A more detailed facility-level hazards analysis shall be performed for the preferred alternative.

This hazards analysis (a) describes the initial major hazards and other risk areas that could affect project cost and schedule and (b) identifies significant hazard scenarios and the initial suite of facility design basis accidents (DBAs).