DOE G 151.1-1 V3-3, Categorization and Classifications of Operational Emergencies

DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-1 3. CATEGORIZATION AND CLASSIFICATION OF OPERATIONAL EMERGENCIES 3.1 Introduction To allow the rapid dissemination of information about an Operational Emergency so that proper actions to respond to the emergency can be initiated at all levels of DOE, a system of categorization and classification has been established. An Operational Emergency is categorized according to the following types: • Health and Safety Operational Emergency • Environmental Operational Emergency • Security and Safeguards Operational Emergency • Offsite DOE Transportation Operational Emergency • Hazardous Materials Operational Emergency. If the emergency is a Hazardous Materials Operational Emergency, it is then classified according to the following options: • Alert • Site Area Emergency • General Emergency In addition to the ensuring rapid communications, the primary focus of the classification process for the hazardous materials events is the initiation of preplanned local responses and the protection of the local site and offsite populations. The process of categorizing events as Operational Emergencies and of classifying hazardous material events was created to ensure rapid recognition of emergency conditions and timely response. The emergency categorization/classification system represents a set of pre-approved decisions, agreed to by senior management and state and local officials, that allows onsite supervisory personnel to make rapid decisions affecting personnel, facilities, and resources in response to an emergency. The authority to initiate emergency communications and commit resources often rests with upper management. During the onset of an emergency, adherence to the normal management approval processes may delay the initiation of response actions and mobilization of resources. For the system to be effective, the responsibility and authority for initial event categorization and classification (for hazardous materials events) should be vested in on-duty supervisory personnel who are close to the problem and who are familiar with the facility. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-2 On August 27, 1997, the Secretary of Energy issued a directive on “Timely Notification of Emergencies and Significant Events," which emphasizes the importance of prompt recognition of significant events and the timely notification of these events to all relevant parties. Two new elements were included in the directive: 1) notification of state, local, and tribal officials and the Headquarters Operations Center even if the applicability of standing guidance is in question for a specific event; and, 2) implementation of a new threshold of reporting for non-emergency significant events. Hazardous Materials Program. Operational Emergencies involving the release of hazardous materials on or from DOE sites or facilities are differentiated according to their severity for the purpose of rapidly implementing groups of response activities and notifications that are commensurate with the degree of hazard presented by the event. Emergency Action Levels (EALs) are criteria used to classify such hazardous material emergencies.

This chapter describes the basic principles of event categorization and classification of Operational Emergencies, the relative severity of events which fall into each hazardous materials emergency class, and the transition from normal operations to event categorization and classification. Use of the DOE M 232.1 Occurrence Reporting criteria in the Operational Emergency recognition and decision-making process, or as an alerting/prompting tool, is discussed. The use of protective action criteria for radiological and non-radiological releases to establish hazardous materials emergency classes is also discussed. Guidance is provided for developing criteria, known as EALs, used to detect and recognize hazardous material events and assign them to specific emergency classes. Appendix B provides examples for the implementation of event classification. Base Program. Each DOE site/facility is required to produce a Hazards Survey to identify the generic emergency events and conditions to be addressed by the DOE Comprehensive Emergency Management System. This survey can be used to further define those events and conditions which should be categorized as Operational Emergencies, according to the Order. Base Program sites/facilities are required to identify these Operational Emergencies and develop criteria for categorizing them quickly. This process of categorizing Operational Emergencies and developing criteria is addressed in this chapter, Section 3.2. The two Appendices provide additional guidance for the Base Program site/facility in terms of developing the criteria and integrating the criteria with normal operating procedures. 3.2 Recognition and Categorization of Operational Emergencies CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-3 Operational Emergencies are unplanned, significant events or conditions that require time- urgent response from outside the immediate affected site or facility. Operational Emergencies may involve degradation of personnel health and safety, the environment, security and safeguards, or the release or loss of control of hazardous materials. The Order gives a number of examples of events and conditions that are to be categorized as Operational Emergencies. Although it is not intended that facilities/sites develop detailed and quantitative categorization criteria for each type of Operational Emergency described in the Order, some planning and preparation will be needed to ensure that events meeting the Order descriptions are promptly recognized and categorized. For some types of Operational Emergencies, facilities and sites may choose to develop facility/site-specific criteria, based upon the results of their Hazards Survey and Hazards Assessment, to aid decision making. Others may use the information presented in this section to interpret observed conditions directly against the Order descriptions. In either case, responsible personnel should be trained to recognize events or conditions that require rapid assessment and categorization decisions. A variety of techniques may be used to integrate this recognition/decision process with existing operations, management, emergency response, and reporting activities (e.g., existing occurrence reporting and hazardous materials recognition/classification procedures). The following sections describe how the examples of Operational Emergency events or conditions given in the Order should be used to develop facility and site procedures to support recognition and categorization of events.

3.2.1 Health and Safety Events or conditions that represent, cause, or have the potential to cause serious health and safety impacts to workers or members of the public are Operational Emergencies. (1) Discovery of radioactive or other hazardous material contamination from past DOE operations that is causing or may reasonably be expected to cause uncontrolled personnel exposures exceeding protective action criteria. Discussion. This example applies to the discovery of contamination that poses a serious near-term threat to people. An Operational Emergency of this type has two defining characteristics. First, without prompt and effective action, it is likely that people will continue to be exposed to the contamination. Second, the acute dose or exposure to individuals who come in contact with the contamination will be about the same as that for which protective actions are usually planned when dealing with environmental release of hazardous materials. The example applies to CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-4 any newly discovered onsite or offsite contamination area for which access control was not immediately established, or where personnel may continue to gain access without DOE/contractor knowledge while the magnitude and extent of the contamination is being characterized. Minimum severity thresholds for this condition may have one of several bases, as follows: ! For radioactive material in general, a multiple of the Unusual Occurrence criterion for offsite radioactive contamination may be used. ! For gamma emitters, dose conversion factors can be used to determine the contamination level that would result in a dose of 1 rem effective dose equivalent (EDE) to a person exposed to the contaminated area for a short period of time (for example, a week or less). ! For radionuclides that pose an inhalation hazard, inhalation dose factors and an assumed average resuspension factor can be used to estimate the surface contamination level that corresponds to a 1 rem dose commitment total effective dose equivalent (TEDE) for a short period (i.e., a week or less) of exposure to the contaminated area. ! For nonradioactive hazardous materials, an assumed average resuspension factor can be used to estimate the surface contamination level that corresponds to an ERPG-1 (or equivalent) concentration in the air above the contaminated area. Methods. Using bases such as those cited above, facilities that store or process significant quantities of hazardous materials (or have done so in the past) may select a “contamination” criterion on which they will declare an Operational Emergency. Facilities that have potential for contamination with several hazardous materials may develop simple conversion factors, formulae, or tables to permit rapid evaluation of measured contamination values against protective action criteria. Any discovery of high levels of contamination will typically result in technical assessments and internal notifications preliminary to initiation of the Occurrence Report required by DOE M 232.1-1, under either Group 1 (Facility Condition - radioactive contamination) or Group 2 (Environmental - hazardous material contamination). Therefore, internal procedures and training related to radiation protection and industrial hygiene (e.g., directions for handling of unusual survey results) and occurrence reporting can be used to alert safety/health and occurrence reporting personnel to the requirement for an Operational Emergency declaration and expedited notifications, if contamination exceeds certain levels that are well above the unusual occurrence values.

CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-5 (2) An offsite hazardous material event not associated with DOE operations that is observed to have or is predicted to have an impact on a DOE site such that protective actions are required for onsite DOE workers. Discussion. This example applies to any release of hazardous material from external sources that requires onsite personnel to evacuate or take shelter. Such releases may originate from fixed facilities or transportation activities outside the site boundaries; from non-DOE transportation accidents on roads, railroads, or rivers that traverse the site; or from private industrial activity being conducted on the DOE site. However, if hazardous materials from the offsite event could lead to loss of control over onsite DOE hazardous materials, then the event should be classified on the basis of the potential onsite release. (See Section 3.3.) The need for onsite protective actions may be based on measurements or consequence projections by site personnel or on a recommendation from the on- scene Incident Commander, offsite emergency management authorities, or the responsible carrier. Any significant concentration of DOE and/or contractor personnel should be considered “onsite” for purposes of this example, even if they occupy a leased offsite building or facility. Such offsite buildings should be considered if the occupants have principle site operations and management responsibilities. Offsite subcontractor offices, hotels/motels, company recreational areas, and conference facilities need not be included. Methods. Because hazardous material releases may originate from any transportation artery and many industrial facilities, this condition applies to every site and facility occupied by DOE or prime contractor staff. Local area, site, and building emergency procedures, and associated building emergency warden training, may be used to help ensure recognition of this situation as an Operational Emergency requiring prompt reporting. Although DOE M 232.1-1 does not explicitly identify offsite hazardous materials events impacting DOE sites/workers as reportable occurrences, local occurrence reporting procedures, guidelines, and training of occurrence reporting personnel can be used to help ensure recognition. Because events involving onsite releases of hazardous material are classified in accordance with Section 3.4 of this guidance, emergency classification (EAL) procedures, which are likely to be consulted for any hazardous material event with impact on people, can be used to identify this condition as an Operational Emergency not requiring classification. (3) An occurrence that causes or can reasonably be expected to cause significant structural damage to DOE facilities, with confirmed or suspected personnel injury or death or substantial degradation of health and safety. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-6 Discussion. This example applies to events such as earthquakes, tornadoes, fires, explosions, and vehicle accidents that cause significant structural damage to DOE or contractor facilities, such that death or injury to personnel might reasonably be expected. Damage to the structure does not need to be total or exceed any particular cost threshold, nor does death or injury need to be confirmed. The threat to personnel safety in conjunction with structural damage is the key to this example. Accordingly, a fire that completely destroys a building that is abandoned (or is otherwise believed not to be occupied) is not an Operational Emergency, whereas the collapse of the roof of a normally occupied building during working hours is an Operational Emergency, even if no death or injury of the occupants is initially evident.

Methods. Any facility that is routinely occupied by personnel could be subject to such events. Because initial response to an event of this nature is likely to be carried out by local fire and rescue organizations, building emergency/fire plans, management notification lists, and incident command training can be used effectively to ensure recognition. Local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 1 (Facility condition - facility evacuation) or Group 3 (Personnel safety - injuries) may also be used to prompt a review of the site-specific criteria for categorizing a building evacuation as an Operational Emergency. (4) Any facility evacuation in response to an actual occurrence that requires time- urgent response by specialist personnel, such as hazardous material responders or mutual aid groups not normally assigned to the affected facility. Discussion. This example applies to any normally occupied DOE or contractor facility. The event or condition that requires evacuation and time-urgent response by specialist personnel may be a fire, hazardous material spill, or safeguards/security incident. An event that requires response only by specialist personnel assigned to the affected facility, such as the building security staff, is not an Operational Emergency. Neither is a precautionary evacuation and response by specialist personnel that does not involve any significant threat to health, safety, or security, such as a hazardous materials team investigating a report of an unusual odor or firefighters responding to a reported smell of smoke without any other indication of fire. However, if the responding specialist personnel find a condition, such as a fire or hazardous material spill, that will require more than an hour or so of corrective action or cleanup before the facility can be reoccupied, the condition should be categorized as an Operational Emergency. If release of significant quantities of hazardous material to the environment occurs or is threatened, such CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-7 events are Operational Emergencies requiring classification as described in Section 3.3. Methods. Because response from outside the facility may be by fire/rescue, HAZMAT, security, or other specialist personnel, the procedures for those responses can be used to help ensure that the condition is recognized and categorized as an Operational Emergency. Local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 1 (Facility condition - facility evacuation) or Group 3 (Personnel safety - injuries) may also be used to prompt review of the site-specific criteria for categorizing a “facility evacuation” Operational Emergency. (5) An unplanned nuclear criticality resulting in actual or potential facility damage. Discussion. Any unplanned nuclear criticality is an Operational Emergency because it represents major failures of safety systems and practices and has the potential to cause facility damage and release of radioactive material. Criticality events that result in release of significant quantities of radioactive material to the environment are Operational Emergencies requiring classification as described in Section 3.3.

Methods. Only facilities dealing with fissionable materials in quantities approaching a minimum critical mass need to consider this potential condition. Local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 1 (Facility condition - nuclear criticality safety and loss of control of radioactive material), Group 2 (Environmental - radionuclide releases) and Group 4 (Personnel radiation protection - radiation exposure) can be used to help ensure timely recognition and categorization of criticality events. Because most inadvertent criticalities will be classified as Alert or higher due to actual or potential radioactive releases, emergency classification (EAL) procedures and emergency response procedures should identify the specific conditions under which a criticality is to be categorized as an Operational Emergency not requiring classification. (6) Any non-transportation-related mass casualty event. Discussion. This example applies to events that result in numbers of deaths or injuries that significantly exceed the Unusual Occurrence threshold for occupational illness/injuries. The term “mass casualty” is defined by a number and severity of casualties that exceeds the readily available treatment capability. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-8 Indicators of this level of casualties include the need to exercise triage at the event scene, request ambulances and medical personnel from offsite, or dispatch victims to multiple medical facilities to ensure adequate and timely treatment. Methods. Emergency planners for facilities and sites may elect to establish a local definition for “mass casualty” based on such factors as available emergency medical resources and distance to treatment centers. (See Volume IV, Chapter 3, for a discussion of the characteristics of a mass casualty event that can be used to formulate such a definition.) Emergency medical responder and incident command training and procedures can use that definition to ensure timely recognition and categorization of an Operational Emergency. Since any event that has the potential to be a “mass casualty” will almost certainly be recognized as a potentially reportable occurrence, local occurrence reporting guidelines and training materials for occurrence reporting personnel related to Group 3 (Personnel safety - occupational injury/illness) can be annotated with the local definition for “mass casualty.” 3.2.2 Environment Events or conditions that represent, cause, or have the potential to cause serious detrimental effects on the environment are Operational Emergencies. (1) Any actual or potential release of hazardous material or regulated pollutant to the environment, in a quantity greater than five times the Reportable Quantity (RQ) specified for such material in 40 CFR 302, that could result in significant offsite consequences such as major wildlife kills, wetland degradation, aquifer contamination, or the need to secure downstream water supply intakes.

Discussion. The specified release of hazardous material or regulated pollutant to the environment is an Operational Emergency if it results in actual or potential offsite consequences of the type and magnitude specified in the example. Although the Order refers to “offsite consequences,” many DOE sites contain sensitive and valued “onsite” environments. Examples include wetlands, streams, rivers, endangered species of wildlife, lakes, and aquifers. Such sensitive areas should be considered if contamination would generate response and interest equivalent to similar contamination of offsite areas. To facilitate recognition and categorization, sites and facilities should identify hazardous material storage and potential release locations, including locations on transportation routes, that could produce impacts such as those described in the example. This will allow releases to be categorized on the basis of the material, quantity, and release location rather than on field/in situ measurements of the impact, which may require days or weeks CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-9 to quantify. Specific material release scenarios that, in addition to causing environmental degradation, have the potential to cause acute airborne exposure hazards to people are Operational Emergencies requiring classification as discussed in Section 3.3. Methods. This condition applies to facilities/sites for which the Hazards Survey has identified quantities of hazardous materials or regulated pollutants that could cause significant damage to the environment. Plans, procedures, and training related to environmental spill response and reporting can be used to ensure recognition of the need to categorize specific releases as Operational Emergencies. Local occurrence reporting guidelines and training of hazardous waste management and occurrence reporting personnel related to Group 2 (Environmental - Release of hazardous substances/regulated pollutants/oil) can also be used to prompt a review of the site-specific criteria for categorizing such releases as an Operational Emergency. (2) Any release of greater than 1,000 gallons (24 barrels) of oil to inland waters; greater than 10,000 gallons (238 barrels) of oil to coastal waters; or a quantity of oil that could result in significant offsite consequences (e.g., need to relocate people, major wildlife kills, wetland degradation, aquifer contamination, need to secure downstream water supply intakes, etc.) [Oil as defined by the Clean Water Act (33 U.S.C. 1321) means any kind of oil and includes petroleum.]. Discussion. Any release of oil exceeding the stated quantities or any smaller release that produces or is likely to produce offsite consequences of the type and magnitude specified is to be categorized as an Operational Emergency. To facilitate categorization, sites and facilities should identify oil storage and potential release locations, including locations on transportation routes, that could produce impacts such as those described in the example. Methods. This condition applies to facilities/sites for which the Hazards Survey has identified the potential for release of more than 1000 gallons to inland waters, 10,000 gallons to coastal waters, or any release that could result in significant offsite consequences. Plans, procedures, and training related to environmental spill response and reporting can be used to ensure recognition of the need to categorize specific releases as Operational Emergencies. Local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 2 (Environmental - Release of hazardous substances/regulated pollutants/oil) can also be used to prompt a review of the site-specific criteria for categorizing oil/petroleum releases as Operational Emergencies.

CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-10 3.2.3 Security and Safeguards Events or conditions that represent, cause, or have the potential to cause degradation of security or safeguards conditions with actual or potential direct harm to people or the environment are Operational Emergencies. (1) Actual unplanned detonation of an explosive device or a credible threatened detonation resulting from the location of a confirmed or suspicious explosive device. Discussion. Detonation or discovery of an explosive device at any DOE or contractor facility should be categorized as an Operational Emergency. However, in some cases, the location of the explosive device and its size may need to be considered. For example, a common firecracker or rifle cartridge should not be considered an “explosive device” unless the conditions under which it is found or exploded suggest deliberate placement and destructive intent. Discovery or credible threat of any explosive device in a location where it clearly threatens DOE property or site personnel is an Operational Emergency. Placement or detonation of a device that causes or threatens a release of hazardous material with the potential for acute airborne exposure hazards to people is an Operational Emergency requiring classification as discussed in Section 3.3. Methods. All DOE and prime contractor facilities and sites are subject to this type of malevolent act. Security plans and security response procedures may be used to identify the criteria for declaration of an Operational Emergency in terms of the security/safeguards status or response level triggered by an event meeting these descriptions. Local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 5 (Safeguards and Security - Criminal Acts) can be used to prompt a review of the site-specific criteria for categorizing explosive device events as Operational Emergencies. (2) An actual terrorist attack or sabotage event involving a DOE site/facility or operation. Discussion. An armed assault involving a DOE site, facility, or operation might be directed at an individual DOE or contractor employee, at gaining access to valuable property or classified material, or at causing damage to the DOE property. Therefore, the term “terrorist attack” should be interpreted broadly; any armed assault that takes place at a DOE or contractor facility should be categorized as an Operational Emergency because the motivation for and objectives of the assault are not likely to be known until long after the fact. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-11 Exceptions to this generalization might include violent confrontations between individuals or simple acts of vandalism that take place incidentally on the DOE or contractor premises. Any confirmed attempt to sabotage facilities or equipment should be categorized as an Operational Emergency, even if it initially appears to be unsuccessful, because of uncertainty concerning other undiscovered, but related, potentially destructive acts. If these destructive acts impact the control over, or result in the release of significant quantities of hazardous materials, they are Operational Emergencies requiring classification as discussed in Section 3.3.

Methods. All DOE and prime contractor facilities and sites are subject to this type of malevolent act. Security plans and security response procedures may be used to identify the criteria for declaration of an Operational Emergency in terms of the security/safeguards status or response level triggered by an event meeting these descriptions. Local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 5 (Safeguards and Security - Criminal Acts) can be used to prompt a review of site-specific criteria for categorizing such terrorist/sabotage events as Operational Emergencies. (3) Kidnaping or the taking of hostage(s) involving a DOE site/facility or operation. Discussion. Kidnaping of a DOE site employee or family member or the taking of hostages may be undertaken to extort money, materials, or concessions from the DOE or its contractor. The DOE, its contractors, and their employees may come under great pressure to meet a perpetrator's demands, some of which might have safety, health, or environmental implications. Such occurrences should not be categorized as Operational Emergencies if the kidnaping or hostage-taking occurs off the DOE site and the motivation for the crime is not believed to involve DOE interests (e.g., an estranged spouse “kidnaping” his/her children from the DOE/contractor residence). Methods. All DOE and prime contractor facilities and sites are subject to this type of malevolent act. Security plans and security response procedures may be used to identify the criteria for declaration of an Operational Emergency in terms of the security/safeguards status or response level triggered by an event meeting these descriptions. Local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 5 (Safeguards and Security - Criminal Acts) can also be used to prompt a review of the site-specific criteria for categorizing these types of kidnaping/hostage events as Operational Emergencies. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-12 (4) Actual theft or loss of a Category I or II quantity of Special Nuclear Materials or other hazardous material that, if released, could endanger workers, the public, or the environment. Discussion. Category I or II quantities of Special Nuclear Material might be dispersed or fashioned into a crude nuclear explosive device to terrorize the population or extort concessions from the U.S. government. Other radioactive and nonradioactive hazardous materials could also be used in a similar manner for terror or extortion. Loss of such materials should be categorized as an Operational Emergency if the material is known or suspected to have been stolen or diverted. Actual or threatened release of the stolen/diverted hazardous material on DOE property with the potential for acute airborne exposure hazards to people is an Operational Emergency requiring classifications as discussed in Section 3.3. Hazardous materials vary widely in their attractiveness as targets of theft or diversion because of differences in toxicity, dispersibility, and ease of handling or transport. DOE facilities and sites should identify materials and quantities that might be attractive targets for terror or extortion, and loss or theft of those materials should be categorized as Operational Emergencies. Loss of other materials of similar toxicity may not warrant such a categorization for various reasons (e.g., it is commonly used in industry and science and is widely available from other sources; it is difficult to handle or disperse effectively; it degrades rapidly in the environment).

Methods. This condition applies only to facilities/sites for which the Hazards Survey has identified Category I or II quantities of Special Nuclear Materials or other hazardous materials that are judged to be a threat to personnel if stolen and released. Procedures and personnel training related to nuclear material control and accountability (MC&A) may be used to ensure recognition of the need to categorize certain Special Nuclear Materials theft/loss situations as Operational Emergencies. Local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 5 (Safeguards and Security - Material Control and Accountability and Criminal Acts) can be used to prompt a review of the site-specific criteria for categorizing these loss/theft events as Operational Emergencies. (5) Damage or destruction of a site or facility by natural or malevolent means sufficient to expose classified information to unauthorized disclosure. Discussion. Even if no personnel are injured or threatened, physical damage to or destruction of a DOE facility should be categorized as an Operational Emergency CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-13 if it causes or is likely to cause classified information to be exposed to unauthorized disclosure. Methods. This condition applies only to facilities that the Hazards Survey has identified as containing classified matter. It may mean that classified material is strewn about outside the facility where it would be accessible to unauthorized personnel, or that damage to a structure permits unauthorized viewing (e.g., overhead surveillance) of classified objects or activities. Building emergency plans, fire response procedures, security response procedures, and training of building managers and classified material custodians can be used to help ensure recognition of this Operational Emergency possibility. It is difficult to conceive of a condition meeting this description that would not also trigger the occurrence reporting process. Therefore, local occurrence reporting guidelines and training of occurrence reporting personnel related to Group 1 (Facility condition - fires/explosions), Group 3 (Personnel safety - occupational illness/injuries), Group 5 (Safeguards and security - Unaccounted-for Classified matter or compromised information) can serve as aids to recognition that this condition is an Operational Emergency. 3.2.4 Offsite DOE Transportation Activities Events or conditions that represent an actual or potential release of radiological or non- radiological hazardous materials from a DOE shipment outside a DOE site are Operational Emergencies. (1) The radiation dose from any release of radioactive material or the concentration in air from any release of other hazardous material is expected to require establishment of an initial protective action zone. (“Initial protective action zone” is defined in DOT RSPA 1996 North American Emergency Response Guidebook (NAERG96) as amended or updated.) Discussion. The emergency potential associated with offsite DOE transportation activities involving radioactive and other hazardous materials should be analyzed in accordance with Volume IX, Transportation Emergency Management System. Initial response to an accident involving an offsite shipment will most likely come from a local police or fire department. These responders will most likely use NAERG96 to determine what protective actions should be implemented at the scene. While the language used in the various guides in the NAERG differs slightly, it is clear that, if there are indications that a hazardous material or radiological shipment is leaking, responders will establish a zone surrounding the accident where protective actions, such as evacuation, are implemented. Once

CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-14 DOE becomes aware that such a zone, or such protective actions have been implemented by the responsible local responders, the event would be classified as an Operational Emergency. Methods. The responsibility for recognizing, categorizing, and reporting Operational Emergencies associated with offsite transportation activities rests with the DOE entity that has direct operational control of the shipment (usually the shipper). The transportation plans, procedures, and personnel training for specific types of materials may incorporate information and criteria needed to ensure recognition of conditions that require an Operational Emergency declaration. (2) Failures in safety systems threaten the integrity of a nuclear weapon, component, or test device. Discussion. This example applies to systems that prevent unauthorized access to nuclear weapons, components, or test devices during transport, and also to the systems that prevent or minimize the likelihood of damage to or detonation of the weapon, component, or device. Significant failures of either type should be categorized as Operational Emergencies if they require the deployment of technical support to assist transportation personnel in restoring the shipment to the required envelope of safety and/or security conditions. Methods. For transportation events involving nuclear weapons, devices, or components, the Operational Emergency declaration may be keyed to the initiation of response procedures or reporting conditions that are unique to nuclear explosive safety events. As an example, events categorized using DOD terminology as a “Bent Spear” or “Broken Arrow” would both be Operational Emergencies if they occur offsite. Some Broken Arrow events would clearly be classified as Alert or higher if occurring on a DOE site, depending on the potential for release of radioactive material to the atmosphere. (3) Damage to a nuclear explosive, nuclear explosive-like assembly, or Category I/II quantity of Special Nuclear Materials as a result of a transportation accident. Discussion. Offsite transportation accidents that cause actual or likely damage to devices or materials specified in this example should be categorized as Operational Emergencies. Observable indications of possible damage to the weapon, device, or material (such as fire or breach of shipping container) should be determined. If these indications are observed, the condition should be categorized as an Operational Emergency. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-15 Methods. For transportation events involving nuclear weapons, devices, or components, the Operational Emergency declaration may be keyed to the initiation of response procedures or reporting conditions that are unique to nuclear explosive safety events. 3.2.5 Release of Hazardous Materials Events or conditions that involve the actual or potential release of significant quantities of hazardous (radioactive or nonradioactive) materials to the environment are Operational Emergencies that require classification. The following characteristics distinguish hazardous material Operational Emergencies. ! The hazardous material is, or is likely to be, released to the environment (i.e., outside of a structure or enclosure). ! The material immediately threatens those who are in close proximity and has the potential for dispersal beyond the immediate vicinity in quantities or concentrations that threaten the health and safety of onsite personnel or the public.

! The material has a rate of transport and dispersion in the environment that requires time-urgent response to implement protective actions. Essentially all hazardous material Operational Emergencies involve airborne releases because the air pathway represents the most time-urgent situation, requiring rapid, coordinated emergency response on the part of the facility, collocated facilities, and surrounding jurisdictions to protect workers, the public, and the environment. Hazardous material Operational Emergencies are to be classified as either Alert, Site Area Emergency, or General Emergency based on the projected or measured hazardous material impact. Classified emergencies are a subset of the Operational Emergency category. Therefore, when an event is classified, it is (by definition) also categorized as an Operational Emergency at the same time. The categorization that is implicit in the classification of a hazardous material emergency does not require any notifications or actions beyond those otherwise specified for classified emergencies. Guidance on the classification of hazardous material Operational Emergencies is presented in Section 3.3. 3.3 Classification of Hazardous Material Operational Emergencies Event classification is the process of assessing hazardous materials Operational Emergencies to determine if they fall into one of the three emergency classes. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-16 Classification provides further definition to this subset of Operational Emergencies beyond the categorization of “Operational Emergency.” 3.3.1 Principles of Event Classification During the development of an event classification system, the following basic principles governing the purpose, expected results, and event classification methods should be taken into consideration. The purpose of a standard event classification system is to: ! initiate a set of pre-planned response actions appropriate to all events of a given class or severity (e.g., notification, mobilization of resources, and protective actions); ! activate necessary analytical and decision-making capabilities to make sound determinations of the need for other action; and ! enhance the likelihood that mitigative action will be taken to prevent conditions from becoming more severe. Accurate event classification is key to achieving a graded response. A graded response is the mobilization of personnel and resources in proportion to the severity of events or conditions. An underlying purpose of event classification is to minimize the severity of an event by quickly bringing technical resources to bear on the problem. The implementation of the event classification process should provide for the following. ! Prompt notification of minor events to prevent escalation to more serious consequences. ! Mobilization of resources to better manage the event or arrest degradation of safety. ! Sufficient lead time to activate facilities and prepare for protective actions. ! Protection of the public and employees at some distance from the event site in case of a release of hazardous material. ! Prompt and accurate flow of information. Event classification methods should have the following characteristics. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-17 ! Timely: Methods should provide for early recognition and response. ! Reliable: Event classification should be based upon dependable event indicators, which are, whenever possible, directly related to the severity of the event.

! Internally consistent: Different events of a similar severity should result in the same classification. Different indicators of the same event should be recognizable as such and result in the same classification. ! Anticipatory: Event indicators upon which classification decisions are made should include consideration of the response level necessary to address the potential/future consequences of the event(s) in progress, rather than just the severity of the event at the time it is recognized. ! Redundant: Repetition of event indicators in procedures, checklists, control panels, etc., will increase the probability that an event will be recognized and the event classification process initiated. ! Complete: All events and associated observable indicators identified in the facility/site Hazards Assessment should be incorporated in the event classification system. ! Conservative: Conditions lacking detailed or quantitative indicators should be classified on the assumption that the condition has either challenged or failed the engineered barriers until confirmed safe by more direct methods. ! Usable: Event classification methods should be designed using sound human engineering principles (e.g., express EALs in units consistent with instrumentation and everyday use, use familiar form and format, place all necessary information and references in one location, use color coding or other pointers). ! Integrated: Methods are integrated with normal operations; EALs and entry points into the event classification procedure should be integrated with normal and off-normal operations procedures, indicators (i.e., control panels or instrument read-out stations), checklists, safety precautions, and other operational practices. 3.3.2 Event Classification and Protective Action Criteria For emergency events/conditions involving the actual or potential release of hazardous materials, each emergency class is defined in terms of the health impact or risk to the general public or site/facility workers. If the impact or risk approaches or exceeds some CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-18 predetermined level, then steps to protect the public and workers should be taken. These predetermined levels, expressed in terms of doses, exposures, or concentrations, are termed “protective action criteria.” The Order states that the specific Protective Action Criteria (PAC) to be used in emergency planning are the Environmental Protection Agency (EPA) Protective Action Guides (PAGs) and the American Industrial Hygiene Association (AIHA) Emergency Response Planning Guidelines (ERPGs). These protective action criteria are discussed in detail in Appendix B of Volume II. The threshold between emergency classes can be defined in terms of the actual or potential consequences from a release of hazardous material resulting in a dose or exposure that exceeds a (PAC) at the predetermined receptor location (e.g., 30 meters, facility boundary, and site boundary).

At the Alert level, emergency event consequences exceeding the PAC could be expected outside the facility at or beyond 30 meters from the point of release, but not beyond the facility boundary. Alternatively, the Alert may be defined in terms of exceeding a site- specific criterion corresponding to a small fraction of the PAC at or beyond the facility boundary. At the Site Area Emergency level consequences exceeding the PAC would exist onsite at or beyond the facility boundary but not offsite or in site areas where the general public has unescorted access. A General Emergency exists when consequences exceed the protective action criteria at or beyond the site boundary or in site areas where the general public has unescorted access. The discussion above is not intended to imply that wind-direction- dependent classification criteria (EALs) be developed, except for EALs that are stated in terms of consequences calculated or projected using the actual meteorological conditions existing at the time. These “Projection” EALs are not typically used for initial classification. For purposes of this guidance, unescorted access correlates to the site boundary definition contained within Volume II, which states: If the general public can gain unescorted access to areas of the DOE site, such as public highways or visitor centers, those areas should be considered as offsite for purposes of emergency class definition, unless it is assured that those areas can be evacuated and access control established within about one (1) hour of any emergency declaration. The results of the Hazards Assessment are used to identify specific event indicators (i.e., alarms, monitor readings, sample results, observed conditions) that correspond to actual or potential emergency event/condition consequences that equal or exceed a PAC at the receptor of interest. These indicators become the facility EALs. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-19 3.3.3 Emergency Classes and Severity Level The severity of each of the three Operational Emergency classes and the general area of impact intended is summarized in Table 3.1. Table 3.1. Summary of Emergency Classes. Emergency Class Facility Weapons/Devices/Components Alert Substantial actual/potential Substantial actual/potential degradation of level of safety. degradation of level of safety. No Hazardous material releases not immediate threat to workers or expected to exceed PAC levels at general public. facility boundary. Site Area Actual/potential major failures of Actual/potential system failures Emergency functions needed for protection of that threaten the integrity of the workers and public. device. May adversely impact Hazardous material releases health and safety of workers in expected to exceed PAC levels immediate vicinity, but not the beyond facility boundary, but not general public. offsite. General Actual/imminent catastrophic Actual/likely catastrophic failures Emergency reduction of safety systems with of safety or secondary systems potential or actual loss of threatening the integrity of the hazardous material. device. May adversely impact Hazardous material releases health and safety of both workers expected to exceed PAC levels and public. offsite. 3.3.4 Integration of Event Classification with Normal Operations

At any given time, many different indicators and symptoms may be monitored or observed to determine if facility conditions are normal or off-normal. The monitoring of these indicators and the recognition of the significance of abnormalities to the state of the facility is generally a routine function of the operations staff. Transition to emergency operations depends on the detection and recognition of specific emergency event/condition indicators/symptoms. This process should be viewed as a natural extension to the routine functions employed to monitor and determine facility status. The methods employed to implement the detection and recognition of emergency events/conditions and to make the transition to emergency response should be integrated CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-20 with routine Operational Emergency practices to the extent possible. A more detailed discussion of how to implement this integration is presented in Appendix A. 3.4 Development of Emergency Action Levels 3.4.1 Role of Facility Hazards Assessment The Hazards Assessment prepared and maintained for a facility constitutes the technical basis for that facility's hazardous material emergency management system. The Hazards Assessment identifies and characterizes the hazards associated with a facility, determines the events and conditions that could lead to releases, and quantifies the potential onsite and offsite consequences of each postulated accident or emergency event/condition. The two steps within the Hazards Assessment process that provide the foundation on which to develop EALs and the corresponding event classifications are the development of accident and emergency event scenarios and the determination of the consequences. Among the supporting material to be developed for each identified accident or emergency event scenario are the corresponding initiating conditions, accident mechanisms, equipment or system failures, event indicators, and contributing events. This information is used to identify the specific observable methods of detection and recognition for each accident or emergency event scenario. These could include an instrument reading, an equipment status indicator, a measurable offsite/onsite parameter, a discrete observable event, results of analyses, or another observed phenomenon. To the maximum extent possible, the indications selected for use should be directly observable, unambiguous, and objective. The Hazard Assessment results provide a quantitative estimate of the consequences of each release at specific locations in terms of radiation dose or peak concentration of toxic chemicals. Another result of interest for EAL development is the maximum distance at which a PAC could be exceeded for each release. This information determines the emergency class associated with the release. For detection and recognition methods that correlate directly with actual or potential consequences, it is possible to calculate specific values or conditions that correspond to each emergency class. Examples of indications for which specific values or conditions may be calculated are alarms, instrument readings, sample analysis results, and system or equipment status indicators (e.g., valve open vs. valve not open, system operable vs. system not operable). Specific values or conditions for instrument readings, sample analysis results, equipment status, etc., can be calculated that indicate when a PAC has been reached at a receptor of interest (e.g., facility or site boundary). These specific values or conditions become the EALs for determining the correct emergency class. For

CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-21 example, if a scenario could result in a release of radioactive material through the facility's stack that exceeds the criterion for a General Emergency, and one of the means of detection is the installed stack monitor, then instrument readings marking the onset of Alert, Site Area Emergency, and General Emergency should be calculated and identified as EAL values. Similar values should also be calculated and identified for any other identified detection methods. In some situations, accident/emergency event indicators or symptoms may not be detectable by quantitative methods, or they may be indirectly recognized. If a readily recognizable (observable) event (i.e., tank failure) has the potential for causing a release of hazardous material, and an actual release would be difficult or impossible to confirm (i.e., no quantitative detection method), then the recognition or observation of the event becomes the EAL, and the event classification is based upon the maximum consequences determined in the Hazards Assessment. For example, in many cases involving the actual or potential release of non-radioactive hazardous material from outdoor storage areas, there may be little or no installed instrumentation to quantify a release. As a result, EALs for this situation are often stated in terms of the observable indicators or conditions, and the resulting event classification is based on the consequence resulting from the release of the maximum quantity of material known to be present. The correlation of Hazard Assessment information and data leading to the creation of specific EALs is briefly discussed in Volume II, Sections 3.5 and 3.6. A matrix or tabular approach provides an excellent method for establishing the data relationships necessary for creation of specific EAL values. This process is a natural continuation of the Hazards Assessment process and should be undertaken in conjunction with that effort using the same tools, resources, and personnel. 3.4.2 Symptom-Based and Event-Based EALs EALs may be stated in terms of either specific symptoms of safety degradation or the occurrence of a broadly defined event or condition. Symptom-based EALs provide for detection and recognition of actual or threatened safety degradation using one or more specific facts or observations. Existence of a “symptom” alone is defined as sufficient basis for declaring an emergency. It is not necessary to understand the cause or sequence of events that produced the symptom. In general, symptom-based EALs are most applicable to well-instrumented and more complex process facilities. “Symptoms” that are defined as EALs should indicate failure of (or challenge to) the barriers, which are the systems or controls that maintain hazardous materials in a safe condition. Symptoms that describe the status of the migration (or CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-22 release) path of the Material at Risk (MAR) from source to the outside environment are particularly useful as EALs. Using symptomatic EALs, the correct emergency class can be determined simply by comparing the observed condition (alarm state, instrument reading, equipment status, etc.,) to the EALs in the event classification procedure. No additional interpretation or investigation of the underlying cause or sequence of events is required.

Event-based EALs are stated in terms of specific events or conditions with potential safety significance. The user must interpret all available information and decide if the situation constitutes an event-based EAL. For event-based EALs, the level of severity (emergency class) is based on the degree to which the event is expected to degrade the safety of hazardous materials. Safety degradation may result from impacts on control systems, confinement barriers, or the ability of personnel to manage the situation. Where there is a choice, symptom-based EALs are preferred because they are more easily correlated to criteria, and are generally more quantitative. For process facilities where safety-significant systems are monitored with instruments and alarms, a large fraction of the EALs may be symptomatic. Simple facility EAL sets will typically contain more event-based EALs. Mostly symptomatic EAL sets should be supplemented with event- based EALs for the major events analyzed. Event-based EALs can often be restated in more quantitative or objective terms. However, some initiating conditions such as security events do not lend themselves to preparation of symptomatic EALs. Security event EALs must be event-based in order to ensure their “anticipatory” nature. Table 3.2 illustrates the difference between event-based EAL statements and symptom-based EAL statements for the same condition. Table 3.3 illustrates symptom-based EALs for increasing severity levels for the same category of symptoms. Table 3.4 illustrates event-based EALs for increasing severity levels of the same initiating condition. 3.4.3 Barrier Approach to EAL Development The barrier analysis technique recommended in Volume II, Section 3.5 examines the potential for release of hazardous material in terms of the failure or degree of challenge to the barriers between the MAR and the environment. In addition to identifying the basic information on which specific EALs are based, this technique provides a method for approaching the development of an integrated EAL scheme based upon the degree of safety degradation. The physical and administrative controls associated with safe facility operation can be viewed as barriers, and the facility-specific EAL system can be designed to ascertain the status of these barriers and, therefore, the degree of safety degradation. The specific EALs developed to indicate degree of barrier challenge or failure may be CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-23 either symptom-based or event-based in nature, but usually tend more toward symptom- based statements. If the physical indications (e.g., instruments) and administrative controls indicative of barrier status and challenge can be concisely stated, without needing to describe each initiating event, the overall complexity and size of the EAL scheme can be minimized. More information and examples on the application of this approach to EAL development is presented in Appendix B. Table 3.2. Examples of Event-Based and Symptom-Based EAL Statements for the Same Condition. Initiating Symptom-Based Condition Event-Based EAL Statement EAL Statement Fire Fire in the chemical make-up room of the Potential loss of chemical make-up room ABC facility that is not extinguished by automatic fire suppression systems. integrity as indicated by: chemical make-up room temperature greater than 300E F for >5 minutes as indicated on FP-T-007

OR negative pressure in chemical make-up room of less than 0.25 in. H O as2 indicated on DP-CMR-96. Radiological Fire, explosion, or cooling water system ABC stack alpha monitor PA-SM-691 release rupture reported in the 243-X HEPA filter reading > 3E+3 FCi/sec or charcoal banks OR ABC particulate gamma monitor PG-SM- 96 reading > 5E+4 FCi/sec Natural Observed wind/tornado damage to ABC ABC building integrity loss as indicated phenomena facility creating the potential for a by: radiological release any ABC Facility fenceline FL-ARM- 2001 system monitor reading >1 mrem/hr, OR HVAC system not maintaining > 0.2" w.g. negative pressure in Ventilation Zone A Note: Values in the EALs above are only examples; site/facility-specific values will depend on hazardous materials characteristics, site/facility layout, and instrumentation available. Example: For this fictitious facility/site, the 300EF temperature reading for >5 minutes might be based on the fire dampers being rated for 350EF for 10 minutes. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-24 Table 3.3. Example Symptom-Based EALs for Different Severity Levels of the Same Initiating Condition. Initiating Condition Example EALs For: Alert Site Area Emergency General Emergency Nitric acid tank Tank NA-15 level Tank NA-15 level Tank NA-15 level release decreasing at > 1.0 ft/min decreasing at > 2.5 ft/min decreasing at > 5.0 ft/min (with no transfer operation (with no transfer operation (with no transfer operation in progress and pump in progress and pump in progress and pump discharge valve N.V.-3 discharge valve N.V.-3 discharge valve N.V.-3 indicating shut) indicating shut) indicating shut) Radiological Stack Monitor I-40 (Fci/cc) Stack Monitor I-40 (Fci/cc) Stack Monitor I-40 release (see X SF-50 (CFM) X (4.27 E- X SF-50 (CFM) X (4.27 E- (Fci/cc) X SF-50 (CFM) X formula) 4) reading > 2E0 Ci/sec 4) reading > 1E+1 Ci/sec (4.27 E-4) reading > 3E+1 OR OR Ci/sec Any combination of two Any combination of two ARMs or portable survey fenceline ARMs or Any combination of two instrument readings >500 perimeter portable survey portable survey instrument mrem/hr in the area outside instrument readings of readings outside the the ABC Facility, but >1000 mrem/hr security fence of >1500 within the security fence mrem/hr OR OR Any combination of two portable survey instrument readings at the site boundary of >500 mrem/hr Waste tank 3 hottest RTDs > 90EF 3 hottest RTDs > 90EF No analyzed chemical failure by AND AND reaction and tank failure internal result in General reaction Emergency any 2 pressures > + 1 in any 2 pressures > 1.0 PSIG H O in past hour2 AND “A” OR “B” rupture disk failure alarm Note: Values in the EALs above are only examples; site/facility-specific values will depend on hazardous materials characteristics, site/facility layout, and instrumentation available. Example: For this fictitious facility/site, the stack monitor readings would be those computed, using 95% meteorology, to exceed the 1 rem TEDE value at the respective receptor points. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-25 Table 3.4. Example Event-Based EALs for Different Severity Levels of the Same Initiating Condition. Initiating Condition Example EALs For: Alert Site Area Emergency General Emergency

Nitric acid Rupture of 2-in. transfer Rupture of 5-in. transfer With present use of 80% railroad tank line during Xfr operation line during Xfr operation nitric acid and limit of one car release OR OR RR tank car at the facility, within facility there is NO RR tank car boundary rupture scenario resulting other minor breach other major breach AND visible acid plume length or personnel distress at >2 RR Visible acid plume length tank car lengths or personnel distress at >4 AND EITHER RR car lengths OR plume crossing facility security fenceline in a General Emergency Process line A Loss of AC power to Loss of AC power to Loss of AC power to loss of power SWGR A-19 for >20 SWGR A-19 for >1 hour SWGR A-19 for >2 hours (only minutes AND AND applicable in mode A operation) any 2 local or panel A- indication that process line RTD-10 temperatures A is auto-catalytic by ANY exceed 500EF of following indications: • panel A-RTD-10 temperatures >1000EF OR • visible smoke outside room A OR • Shift Manager judgment Natural Tornado observed on site Tornado observed to touch Tornado-driven objects phenomena and approaching facility as down within facility breach filter Bldg F-202 impact confirmed by either: boundary as confirmed by walls as indicated by Tornado visual report OR visual report observed damage to wind speed > 80 mph on met. tower M-16 or M-19 wind speed > 80 mph on either: either: OR building walls or exterior met. tower M-20 or AM-1 panels OR HVAC system unable to maintain > 0.2" w.g. negative pressure in F-202 CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-26 Note: Values in the EALs above are only examples; site/facility-specific values will depend on hazardous materials characteristics, site/facility layout, and instrumentation available. Example: The 500 and 1000EF readings would be based on analyses showing the approach to and confirmed auto-catalytic conditions. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-27 3.4.4 Non-Facility-Specific (Sitewide) EALs Most events will be classified on the basis of facility- or activity-specific symptoms or event indicators; however, some initiating conditions are a result of factors external to the facility. Some of these may not be identified through the Hazards Assessment. The following are examples of conditions that do not originate in a specific facility and are likely to be classified only by a sitewide authority. ! Incidents affecting multiple operating areas or facilities. ! Heightened readiness required to deal with range of possible challenges to security or safety at hazardous materials facilities. (Note: Some prior security and safeguards events which were classified at Alert or higher may now become Operational Emergencies not requiring classification.) ! Classification based upon impacts that are measured or calculated by a sitewide response organization. ! Transportation accidents involving facility-generated hazardous materials that occur onsite, but away from the facility. The following are examples of initiating conditions indicative of the events listed above. ! Earthquakes, tornado, range fire, blizzard/ice storm, and flooding. ! Train, plane, or land vehicle accidents involving either the onsite movement of or impact to hazardous materials. (Note: Personnel casualties caused by transportation accidents not involving hazardous materials are covered under the Occurrence Reporting System.)

! Release of hazardous material at an adjacent facility when such releases impact the capability of other site facilities to maintain control of hazardous materials. ! Security and safeguards events potentially affecting one or more site hazardous materials facilities. Personnel responsible for developing EALs should be cognizant of initiating events that are either non-facility-specific (sitewide) or applicable to multiple facilities and should ensure that EALs for such events are included in facility and site-wide classification procedures. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-28 3.4.5 Discretionary EALs To compensate for possible incompleteness in the EAL set or unforeseen conditions, such as multiple events or loss of essential instrumentation during an accident, there must be a criterion by which personnel responsible for event classification (i.e., Emergency Director or Shift Supervisor) can declare the level of emergency that most closely corresponds to the apparent conditions, regardless of whether it can be determined that a specific EAL has been exceeded. This criterion is necessary to ensure that a decision can be made rapidly by the person with the best understanding of the facility and the conditions that exist at the time. Therefore, each facility and sitewide EAL system should also contain a judgment-based EAL statement to cover situations not specifically covered in the EALs (e.g., loss of all/most indications when an event is in progress). These EALs, sometimes referred to as “discretionary,” “general prudential,” or “judgment” EALs, are typically stated as “Shift Manager or Duty Officer Judgment” or “Emergency Director/Manager Judgment.” These “judgment” EALs are applicable to all three severity classes. The individual responsible for classification (e.g., emergency director) compares his/her subjective evaluation of the degree of safety degradation or facility status against the fundamental definitions of emergency classes given in Table 3.1 and makes the emergency declaration. 3.4.6 Equipment Availability When matching initiating events to facility equipment and instrumentation that provide a means of detecting the event, it should be recognized that under some accident conditions the equipment may be non-operational (e.g., loss of power) or be outside its operating limits (e.g., out of range). To cover this situation, the EAL scheme should include redundant means of detection, such as visible observations by facility staff, and more remote readings (e.g., exterior to process areas or facility walls) from portable survey instruments. 3.4.7 Facility Operational Modes The conditions that exist during different operational modes (e.g., operating versus shutdown) must be taken into consideration when developing facility-specific EALs. During one mode of operation, an instrument reading of a specific value provides a clear indication of an accident condition; in another mode, it may not. Or, an instrument used to detect an accident indicator during normal operations may not be available during stand-by mode. For example, during routine operations in a facility, a reading exceeding 10 mrem/hr on a specific area radiation monitor may be a clear indication of an Alert level event; however, during maintenance with shielding removed, exceeding this value on the CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-29

same monitor may be normal. Avoid setting an EAL that can be exceeded when no emergency exists. Operating mode applicability can be included in either groups of EALs or within individual EALs. 3.4.8 Method of EAL Presentation Once all of the facility-specific EALs have been developed, they must be organized into an implementation procedure usable by personnel responsible for event classification. The resulting procedure should be clear, concise, and designed using good human factors principles. The technical bases for the EALs should be maintained in a separate document suitable for training and reference (e.g., the facility Hazards Assessment Document or a summarized resource manual). The following factors should be considered in determining the method of presentation. ! The intended user. The initial event classification will usually be performed by a person closely associated with the facility, such as a shift manager/supervisor, senior operator, or duty officer. Therefore, the facility's event classification procedure should be presented in a form familiar to operations personnel. Once the Emergency Response Organization (ERO) has been activated, follow-up event classifications are typically performed by a higher level of management. Decisions will be based on input from the facility as well as other elements of the ERO, such as a consequence assessment team in the Emergency Operations Center (EOC.) ! Conditions under which the procedure is to be used. Because this procedure must be read, understood, and acted upon under emergency conditions, it is highly likely that the user will be under high stress. This is particularly true for the initial event classification, when the user is involved in directing the response. The procedure should be designed to reduce the possibility of stress-related errors. ! Assistance available to the user. The initial user of the procedure will likely have the least amount of help in interpreting the EALs. Therefore, all the information necessary to make a decision has to be contained in the procedure and be easily recognized and interpreted. The relieving Emergency Manager responsible for event classification has many more resources immediately available, including the facility personnel, to assist in the decision-making process than does the initial classification authority, the on-site supervisor. 3.4.9 Event Termination Criteria To complete the event classification process, some criteria must be developed to determine when an event class can be terminated. It is neither practical nor recommended CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-30 that EALs be used in reverse to downgrade the event class. Neither is it necessary to develop termination criteria for every accident/emergency event scenario analyzed in the Hazards Assessment. Rather, general criteria should be established that will allow ERO personnel to declare emergency response terminated and enter into an accident/emergency event recovery phase. “Termination and Recovery” are covered in detail in Volume IV, Chapter 6. “Reentry” criteria and guidance are covered in Volume IV, Chapter 2. 3.4.10 Testing EALs for Completeness

The proposed facility EALs should be tested against a range of initiating conditions and accident/emergency event scenarios to determine if the indicated emergency class is appropriate. If necessary, EALs should be modified or additional EALs developed to ensure that the full range of possible emergency conditions can be classified in a timely manner. It is also prudent to test the EALs, through a verification and validation program, with the personnel who will be declaring the event (Emergency Director, Shift Supervisor, etc.,) to ensure the wording and referenced instrumentation is written/referenced in a way to allow correct interpretation. To compensate for possible incompleteness in the EAL set or unforeseen conditions, such as multiple events or loss of essential instrumentation during an accident, there must be a criterion by which personnel responsible for event classification (i.e., Emergency Director or Shift Supervisor) can declare the level of emergency that most closely corresponds to the apparent conditions, regardless of whether it can be determined that a specific EAL has been exceeded. This criterion is necessary to ensure that a decision can be made rapidly by the person with the best understanding of the facility and the conditions that exist at the time. Documentation of this effort should be retained in accordance with site quality assurance requirements. 3.5 Bibliography DOE O 151.1Chg 2. Comprehensive Emergency Management System. August 21, 1996. DOE O 232.1A. Occurrence Reporting and Processing of Operations Information. July 21, 1997. DOE M 232.1-1A. Occurrence Reporting and Processing of Operations Information. July 21, 1997. DOE 5400.5. Radiation Protection of the Public and the Environment. February 8, 1990. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-31 33 United States Code 1321. Clean Water Act. Title 10 CFR 835. Occupational Radiation Protection. Title 40 CFR 302. Designation, Reportable Quantities, and Notification. Manual of Protective Action Guides and Protective Actions for Nuclear Incidents. EPA-400-R-92-001. Environmental Protection Agency. May 1992. The DOT 1996 North American Emergency Response Guidebook (NAERG96). DOT RSPA P 5800.7. Department of Transportation Research and Special Programs Administration. 1996. Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants, NUREG-0654/FEMA-REP-1, Rev. 1. Nuclear Regulatory Commission and Federal Emergency Management Agency. November, 1980. Methodology for Development of Emergency Action Levels. NUMARC NESP-007, Rev. 1. The Nuclear Management and Resource Council, Inc. February 1991. The AIHA 1996 Emergency Response Planning Guidelines and Workplace Environmental Exposure Level Guides Handbook. American Industrial Hygiene Association. 1996. Acronyms AIHA American Industrial Hygiene Association EAL Emergency Action Levels EDE Effective Dose Equivalent EOC Emergency Operations Center EPA Environmental Protection Agency ERO Emergency Response Organization ERPG Emergency Response Planning Guidelines MAR Material at Risk NAERG96 North American Emergency Response Guidebook PAC Protective Action Criteria PAG Protective Action Guide RQ Reportable Quantity TEDE Total Effective Dose Equivalent CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-A-1 APPENDIX A INTEGRATION OF EVENT CATEGORIZATION AND

CLASSIFICATION WITH NORMAL OPERATIONS A.1 Introduction Even the best designed set of event recognition procedures will not function properly if the detection, recognition, and communication chain necessary to alert those responsible for event categorization and classification fails. In this context, categorization refers to determining if an event is an Operational Emergency as defined in the Order. These events may require classification (i.e., as an Alert, Site Area Emergency, or General Emergency) if they involve a potential or actual release of radiological or non-radiological hazardous materials. A major problem encountered when designing an event recognition system is how to ensure that events/conditions are compared to categorization and classification criteria in a timely and efficient manner. In general, if the severity of a condition or event is beyond that covered by DOE M 232.1-1, then there should be some way of detecting it, a means to ensure that its significance is recognized, and a mechanism for communicating the information to those responsible for event categorization and classification. The elements required to ensure the proper sequence of actions leading to event categorization and classification include the following. ! Means of detecting symptoms/indications. ! Recognition of significance of indications. ! Proper response to recognition (i.e., communication with categorization and classification authority). Within the site/facility operating structure, many varied detection methods exist. The recognition of the significance of that which is detected depends on training, the existence of “attention-getting” devices, and procedural links. Transmittal of information to the person with the authority to perform event categorization and classification depends on the establishment of clear, well-understood reporting relationships. Most DOE sites/facilities had existing occurrence notification, environmental spill reporting, and hazardous materials emergency classification systems in place when the Order was issued. The Order included new requirements to categorize certain events as Operational Emergencies not requiring classification and to report the events within a specified time period. Most sites will find it convenient to add the new event CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-A-2 categorization criteria and reporting instructions to one or more of the existing systems. For example, the implementing procedures for occurrence reporting could be modified to indicate the events that should be categorized as Operational Emergencies not requiring classification. The procedure would be modified to specify the accelerated notification requirements for these events. With this alternative, the existing Emergency Action Level (EAL) procedures could continue to be used for event classification. A second alternative is to expand the existing event classification procedures to include the categorization criteria for Operational Emergencies not requiring classification.

The following discussion will examine how the symptom, detection, recognition, and communication chain could be implemented through integration with normal operational activities and procedures. Categorization will usually be based on general criteria and judgment of the need to notify people up the chain. Classification should be less subjective and based on pre-established EAL criteria. A rigorous integration of event recognition procedures into existing facility procedures is not necessary and could lead to difficulty in maintaining the facility procedures. However, keeping the recognition procedures totally separate and relying solely on memory and training during periods of high stress is equally insufficient. Visual cues and other indicators are sometimes employed in facility procedures to alert users to consult the event recognition procedures. For the purpose of this discussion, the likely methods of detection and means for accomplishing categorization of events/conditions or classification, if necessary, have been grouped into five general areas. ! Complex hazardous material facilities. ! Industrial facilities. ! Office buildings. ! Site emergency response organizations. ! Natural phenomena. Listed below are some accident/emergency event symptoms/indicators, potential methods of detection, and methods for incorporating the recognition of event classification into normal operations. The groupings and listings used in this discussion are not intended to be all inclusive but are used only for illustrative purposes. A.2 Complex Hazardous Material Facilities This grouping is applicable to facilities containing more complex processes, such as reactors and waste vitrification facilities. Potential symptoms or indications that could identify the onset of an accident condition include abnormal indications for temperatures, CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-A-3 pressures, fluid levels, flow rates, power loss, radiation levels, and fire detection. Detection methods include the following. ! Installed instrumentation/hardware. ! Routine or off-normal sampling results. ! Operator observation during log taking and other inspection/walkdown routines. ! Employee observation during normal work activities. Methods for implementing the categorization and classification transitions include the following. ! Facility Operating Procedures. Facilities with complex processes have a system of procedures that may include individual equipment procedures, integrated plant procedures, normal operating procedures, system compliance procedures, alarm response procedures, off-normal operating procedures, and emergency procedures. The facility may also be governed by Technical Safety Requirements (TSRs) or Technical Specifications. These procedures and documents can be annotated, where appropriate, to refer the user directly to an event categorization or classification procedure. There are many methods that use accepted human engineering principles for annotating text to call the users attention to a particular piece of important information. Some of these include the use of flags, margin notes, color coding, or other special symbols, such as stars or triangles. Regardless of the method used to catch the user's attention, the entry should be specific as to the condition for triggering the comparison with the event categorization and classification procedure(s) and the section of the categorization or classification procedure that applies.

! Inspection/Walkdown Observations. The formality of these activities varies from one facility to another. These activities may be governed by procedure, standing orders, checklists, log sheets, or verbal instructions. Using the results of the facility's Hazards Assessment, it can be determined which accident symptoms/indicators these activities could be expected to detect. The procedures, checklists, log sheets, and other instructions can be annotated as discussed above to assist the user in recognizing when an accident indicator has been encountered. The annotation should contain specific instructions on whom to notify and how to notify them (e.g., job position or title and phone number). A specific reference to the procedure and section could also be included. Personnel performing inspections/walkthroughs form a human interface with the system or process. Judgment and interpretation are required to initiate the recognition, communication, and event categorization and classification chain. As a result, training is a key element in ensuring that this chain functions properly. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-A-4 ! Standing Orders/Instructions to personnel. This is general guidance provided to personnel, often job-specific, encouraging awareness of certain conditions, symptoms, and indicators for making notifications of such to specific personnel and/or responding with prescribed actions. A standing order should contain guidance on how to recognize and interpret symptoms and indicators as well as instructions on who to contact and how to contact them in the event that they are observed. The person identified should be directly responsible for comparing the symptom/indicator to event categorization and classification criteria or be provided with additional guidance and instructions to ensure that the information is promptly communicated to someone who is authorized to perform these tasks. Once again, recognition and communication are highly dependent upon human judgment and interpretation; therefore, training plays a key role. Facilities in this grouping are generally comprised of relatively complex systems required to have a variety of detection systems and alarm features. Usually, the operation of these facilities is highly formalized and controlled by detailed procedures. A system of inspections and walkdowns should augment the detection process. Personnel working in these facilities should be highly trained, which improves the probability that symptoms/indicators will be recognized and a prompt response initiated. The path from detection to the personnel responsible for event recognition is often short and direct, which is necessary because these are often high-hazard facilities with a small response window for protective actions. A.3 Industrial Facilities This grouping covers activities such as shops, transportation, laboratories, burial grounds, tank farms, storage tanks, transfer lines, etc. Hazardous materials may be involved with some of these activities. Methods for detecting an emergency include the following. ! Management observation during inspections/walkdowns. ! Alarms and monitors. ! Sampling or measurements. ! Employee or public report. Methods for implementing the recognition/categorization and classification transition include the following.

! Procedures and reporting relationships. There are fewer and less formal procedures within this grouping than the previous group. The procedures that do exist can be annotated, where appropriate, to refer to emergency categorization and classification procedures. Because fewer procedures exist, the associated CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-A-5 reporting structure is less formalized and complete. The normal reporting relationship between the point of detection/recognition and the position responsible for performing event categorization and classification is often less direct than it was in the previous grouping. For example, the reporting chain might include supervisor, operations manager, and building/area emergency director. Therefore, in addition to the considerations mentioned above for annotating procedures, it is important to shorten the normal reporting chain to bring the information to the attention of the authority responsible for event categorization and classification as rapidly as possible. ! Procedural response to alarms and monitor readings. Within this grouping, less instrumentation exists for the detection of event symptoms/indicators. Examples of the types of instrumentation that may exist include radiation monitors [i.e., Continuous Air Monitors (CAMs), Area Radiation Monitors (ARMs), transfer line monitors, environmental surveillance monitors, etc.,] and non-radiological hazardous materials monitors (e.g., oxygen level indicators, chlorine monitors, explosive level indicators, fire detectors, tank level indicators/alarms, transfer line leak detectors). As discussed above, these response procedures can be annotated to facilitate the recognition to event classification chain. ! Response to sampling and measurement results. Sampling and monitoring activities are usually governed by procedures and the results recorded on checklists, log sheets, or another form of permanent record. Any of these are candidates for notations to alert the user that they have encountered the symptoms/indicators of a potential Operational Emergency. The methods for implementing this form of user aid have been discussed above. Within this grouping, the detection/recognition/categorization and classification chain is less reliant on installed instrumentation and more on human judgment and interpretation. Therefore, training is once again an important element. The individual at the point of detection is further removed from the event classification authority. A strong training program and periodic safety meetings coupled with good procedural and reporting interfaces are necessary to ensure the completion of the detection/recognition/categorization and classification transition. A.4 Office Buildings Large office buildings may have a building management organization for utilities, a building security force, volunteer building evacuation wardens, and a building emergency plan. Smaller office buildings will likely have none of these building-specific organizations CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-A-6 and plans. They may, however, be covered by a sitewide plan and emergency organization. Contractors may also have company policy manuals that address emergency notifications and response. At office buildings, emergency detection will almost always depend on employee or public report and installed fire detection systems. The applicability of the Order to contractor and subcontractor employees in offsite buildings should be determined on an individual basis by contracting officers.

Methods for detecting the symptoms/indicators of an emergency at an office building include the following. ! Fire alarm systems. ! Security and building management force observations. ! Employee observations or public report. Methods for implementing the recognition/categorization and classification transition include the following. ! Security force and building management organization procedures and standing orders. The procedures that do exist can be annotated where appropriate to refer to emergency categorization and classification procedures or to notify a designated person in the occupant organization who is trained to make the categorization and notification determination. ! Building emergency plans. Large multi-story office buildings will have an emergency plan that identifies evacuation routes and provisions for the evacuation of handicapped persons. As previously mentioned, references and notations can be included to link these plans to the categorization authority and procedures. ! Security force, employee, or public recognition of an emergency. Office building occupants should be trained to respond to fire alarms and other potential emergencies at their work location, but most of them will have little if any knowledge of event categorization and reporting requirements. The assignment of a building warden can provide the link to categorization and notification. Large DOE sites typically have an Emergency Duty Officer (EDO) who is notified of all emergencies on the site. The EDO can categorize the emergencies for buildings that do not have an established emergency organization. Contractors typically make arrangements to be notified by security and fire departments for off-hours emergencies that affect their buildings. The public generally receives no formal training, but is often provided with phone numbers and points of contact should any conditions which may impact security or health and safety be observed. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-A-7 A.5 Emergency Response Organizations EROs may include security forces, fire departments, emergency medical providers, 911 centers, and fire dispatch centers. These organizations are often the first to know of an emergency since employees are trained to call them immediately to obtain aid. Notification is usually by telephone or installed security and fire alarms. Their first priority is the dispatch of the needed aid. These organizations can then either provide the emergency categorization and classification or initiate a notification call tree to the categorization and classification authority. This authority is typically a Site Emergency Duty Officer, Facility/Building Emergency Director, centralized occurrence notification center, or On-Call Manager. Methods for detecting the symptoms/indicators of an emergency include: ! security alarm systems; ! fire alarm system; and ! employee observations or public report. Methods for implementing the recognition/categorization and classification transition include the following.

! Procedures and standing orders. Procedures, standing orders, and training can identify specific conditions that require declaration of an Operational Emergency and/or notification of the categorization and classification authority. It is important that the security, fire, and emergency preparedness plans establish the structure for close coordination between the organizations. The working-level implementation is carried out within the procedures, standing orders, checklists, and training. Links between the security and fire response systems and the emergency response system must exist to ensure that the potential health and safety aspects of an emergency are recognized and that the information is communicated to the emergency response event categorization/classification authority. Establishing specific measurable criteria as trigger points for notifying the event categorization/classification authority is not always straightforward. Annotations and references in procedures and standing orders may require more than simple margin notes, and the success of the transition will depend heavily on training. ! Operating, off-normal, and emergency procedures. These may contain specific instructions for operations during a security incident. As previously mentioned, references and notations can be included. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-A-8 ! Security personnel are well-trained to recognize a security threat. Fire department personnel are well-trained to fight fires. They are less prepared to recognize when an event also has health and safety implications. Employees receive limited training on how to recognize a reportable emergency condition and respond according to general standing orders. Training on the recognition of health, safety, and operational implications stemming from emergency events is important for emergency response personnel and general employees. The public generally receives no formal training but is often provided with phone numbers and points of contact should any conditions that may impact security or health and safety be observed. ! Procedural reporting relationships. Within the EROs, the reporting relationships governing the response are proceduralized and understood. But the reporting relationship between emergency response groups and the ERO is often poorly defined and understood. Reporting relationships for general employees are less distinct and understood. Emergency response groups (security and fire) maintain a highly structured response system implemented by well-trained personnel whose responsibilities are well-defined within their emergency response plan. However, their event classification criteria may not be integrated with facility event classification criteria. Site emergency plans and security and fire plans should be coordinated to ensure strong, well-understood links in both directions. Procedures, standing orders, and training should contain information and aids to assist fire and security personnel in coordinating with other elements of the ERO. A.6 Natural Phenomena This group covers those emergency conditions that occur as a result of natural phenomena. Symptoms/indications that could identify an actual or potential threat include observed tornado, high winds, high/low water levels, range or forest fire, earthquake, and lightening. Methods for detecting the symptoms/indicators of events caused by natural phenomena include the following. ! Meteorological instrumentation. ! Weather forecasts. ! Water level sensors. ! Seismic monitors. ! Employee/public observation. ! News media report (e.g., report of range fire, tornado sighting, weakening of

earthen dam upstream of site; may not classify based upon report but might initiate investigation that would result in detection). CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-A-9 Methods for implementing the recognition/classification transition include the following. ! Comparison of observed or measured conditions to limits/specifications. Often personnel at the point of detection are not directly related to the operational organization of a particular facility and do not have the experience or training to recognize when their observations indicate that an operational limit is being approached or exceeded. Field measurements are not always taken in the same units specified in the TSRs or event classification criteria thus adding to the difficulty in recognizing their significance (e.g., seismic monitors read out in the Richter scale and the criteria is in units of acceleration). Therefore, log sheets or other methods used to record observations should be annotated, and training should include instructions to aid personnel in recognizing and reporting of events needing comparison to the event classification criteria. ! Procedural response and reporting relationships. Procedures used for taking measurements that are indicators of natural phenomena should be annotated where appropriate (e.g., meteorological station procedures, water control procedures, etc.). Because the personnel at the point of detection are often separate from the facility operations organization, the path for reporting information may be long and informal. Detection of natural phenomena affecting facility safety may be performed by diverse, unrelated groups who are often far removed from the facility operations organization and the event categorization and classification authority. Few formalized procedures or other aids exist to facilitate the recognition/reporting/categorization/classification process. To make the transition work properly, it is important to establish trigger points that direct personnel to bring abnormal conditions to the attention of the event categorization and classification authority. Acronyms ARM Area Radiation Monitors CAM Continuous Air Monitors EAL Emergency Action Level EDO Emergency Duty Officer TSR Technical Safety Requirements CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-A-10 This page intentionally left blank. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-1 APPENDIX B METHODS AND EXAMPLES FOR IMPLEMENTATION OF EVENT CATEGORIZATION AND CLASSIFICATION B.1 Introduction This appendix presents suggestions for placement of Operational Emergency categorization criteria within existing site/facility Occurrence Reporting and Classification procedures. Sections B.3 and B.4 discuss the application of the barrier approach to EAL development and provide examples of EAL organization and format by presenting EALs developed for the hypothetical facility Hazards Assessment presented in Volume II, Appendix D. B.2 Operational Emergency Categorization Procedure Integration Section 3.2 of this chapter included a general discussion of the means by which the recognition and categorization of Operational Emergencies could be assured. This section provides methods and examples for integrating recognition and categorization with existing programs and procedures for operations, safety, security, emergency response, and occurrence reporting.

It is not intended that facilities/sites develop detailed and quantitative categorization criteria for each type of Operational Emergency described in the Order. If, however, upon examining the Operational Emergency potential and likely response, site/facility officials determine that additional measures are needed to ensure prompt recognition and categorization, these methods and examples may prove useful. The following sections provide examples of how Operational Emergency recognition criteria and alerting or prompting questions may be inserted within several types of existing site/facility procedures. For sites/facilities that have existing, consolidated occurrence reporting and classification procedures, the new Operational Emergency categorization criteria should be summarized in a companion procedure or appendix to these existing procedures. B.2.1 Health and Safety 1. Order Example: Discovery of radioactive or other hazardous material contamination from past DOE operations that is causing or may reasonably be expected to cause uncontrolled personnel exposures exceeding protective action criteria. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-2 Possible Implementation Method: ! Include referral to local Operational Emergency criteria in Site-Specific Radiological Control Manual and internal procedures for reporting radiological problems and abnormal survey findings. ! Include criteria in Site Occurrence Reporting guidelines, such as: Radioactive contamination in an uncontrolled area in excess of 500 times the surface contamination levels specified in Appendix D, 10 CFR 835 is to be reported as an Operational Emergency in accordance with DOE O 151.1, Chapter VIII. 2. Order Example: An offsite hazardous material event not associated with DOE operations that is observed to have or is predicted to have an impact on a DOE site such that protective actions are required for onsite DOE workers. Possible Implementation Method: ! Provide standing instructions to the single point of contact for emergency communications (site 911 operator, Security Watch Commander, or equivalent) to the effect that: Any advisory or warning that an offsite hazardous materials release is in progress or imminent and that onsite persons may be affected is an Operational Emergency. ! Insert a statement in the facility/site emergency classification procedure, Hazardous Materials Events section, such as: Any hazardous material release from offsite that requires evacuation or sheltering of onsite personnel is to be reported as an Operational Emergency in accordance with DOE O 151.1, Chapter VIII. 3. Order Example: An occurrence that causes or can reasonably be expected to cause significant structural damage to DOE facilities, with confirmed or suspected personnel injury or death or substantial degradation of health and safety. Possible Implementation Method: ! Include provision in site fire/rescue procedures and building pre-fire plans such as: Any fire or rescue response to building may require prompt notification of DOE Headquarters and offsite authorities. Immediately notify (emergency duty officer) of call-out to this facility. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-3 4. Order Example: Any facility evacuation in response to an actual occurrence that requires time-urgent response by specialist personnel, such as hazardous material responders or mutual aid groups not normally assigned to the affected facility.

Possible Implementation Method: ! Include provision in site fire/rescue, hazardous materials (HAZMAT) team or security augmentation procedures and building pre-fire plans such as: Any fire, HAZMAT or security response to building may require prompt notification of DOE Headquarters and offsite authorities. Immediately notify (emergency duty officer) of call-out to this facility. 5. Order Example: An unplanned nuclear criticality resulting in actual or potential facility damage. Possible Implementation Method: ! Include specific criteria in site/facility emergency classification (EAL) procedure to allow distinction between a criticality that requires classification and one that does not, such as: Valid criticality alarm or other indication of criticality in cell with effluent high range monitor or facility ARMs reading less than (value indicating dose outside facility walls exceeding site-specific Alert criterion) is to be reported as an Operational Emergency in accordance with DOE O 151.1, Chapter VIII. 6. Order Example: Any non-transportation-related mass casualty event. Possible Implementation Method: ! Provide training and a checklist item for Incident Commanders to require them to make the judgment call on whether they are dealing with a “mass casualty,” such as: Onsite illness/injury events requiring activation of mutual aid from both (offsite medical centers/ambulance services) to transport casualties is an Operational Emergency. Have Dispatcher immediately advise (emergency duty officer) of situation. B.2.2 Environment 1. Order Example: Any actual or potential release of hazardous material or regulated pollutant to the environment, in a quantity greater than five times the CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-4 Reportable Quantity (RQ) specified for such material in 40 CFR 302, that could result in significant offsite consequences such as major wildlife kills, wetland degradation, aquifer contamination, or the need to secure downstream water supply intakes. Possible Implementation Method: ! Provide training and a checklist item in spill response plan/procedures to direct the team leader to initiate notifications under certain conditions, such as: The following conditions have been identified as potential Operational Emergencies requiring prompt notification of DOE Headquarters and offsite authorities. Immediately advise (emergency duty officer) of the situation. – Breach of tank with contents reaching the drainage canal. – Overflow or breach of the retention dam. 2. Order Example: Any release of greater than 1000 gallons (24 barrels) of oil to inland waters; greater than 10,000 gallons (238 barrels) of oil to coastal waters; or a quantity of oil that could result in significant off-site consequences (e.g., need to relocate people, major wildlife kills, wet-land degradation, aquifer contamination, need to secure downstream water supply intakes, etc.). [Oil as defined by the Clean Water Act (33 U.S.C. 1321) means any kind of oil and includes petroleum.] Possible Implementation Method: Same as example 1 above. B.2.3 Security and Safeguards 1. Order Example: Actual unplanned detonation of an explosive device or a credible threatened detonation resulting from the location of a confirmed or suspicious explosive device. Possible Implementation Method:

! Link the Operational Emergency declaration to the security response level that corresponds and include notifications in the security force procedures and checklists for that level response, such as: Security Alert II -- Any CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-5 unplanned detonation of an explosive device or a credible threatened detonation may be an Operational Emergency requiring prompt notification of DOE Headquarters and offsite authorities. Immediately advise (emergency duty officer) of the situation. 2. Order Example: An actual terrorist attack or sabotage event involving a DOE site/facility or operation. Possible Implementation Method: Same as example 1 above. 3. Order Example: Kidnaping or the taking of hostage(s) involving a DOE site/facility or operation. Possible Implementation Method: Same as example 1 above. 4. Order Example: Actual theft or loss of a Category I or II quantity of Special Nuclear Materials or other hazardous material that, if released, could endanger workers, the public, or the environment. Possible Implementation Method: ! Provide training and a response checklist item for both Security and Materials Control and Accountability (MC&A) staff to ensure recognition of this item, such as: Loss or diversion of any Category I or II quantity of Special Nuclear Material is an Operational Emergency requiring prompt notification of DOE Headquarters and offsite authorities. Immediately advise (emergency duty officer) of the situation. 5. Order Example: Damage or destruction of a site or facility by natural or malevolent means sufficient to expose classified information to unauthorized disclosure. Possible Implementation Method: ! Include provision in site fire/rescue procedures and building pre-fire plans such as: Major fire or structural damage to a building may be an Operational Emergency requiring prompt notification of DOE CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-6 Headquarters and offsite authorities. Immediately notify (emergency duty officer) of call-out to this facility. B.2.4 Offsite DOE Transportation Activities 1. Order Example: The radiation dose from any release of radioactive material or the concentration in air from any release of other hazardous material is expected to require establishment of an initial protective action zone. (“Initial protective action zone” is defined in DOT 1996 North American Emergency Response Guidebook - NAERG96, as amended or updated.) Possible Implementation Method: ! Provide drivers, dispatchers, and responsible program personnel with criteria for determining emergency status of shipments. For radioactive shipments, such criteria and direction might be: Any actual breach of the package, including involvement of the trailer in fire is to be considered an Operational Emergency. Immediately notify (emergency duty officer) . 2. Order Example: Failures in safety systems threaten the integrity of a nuclear weapon, component, or test device. Possible Implementation Method: ! Provide drivers, dispatchers, escorts, and responsible program personnel with criteria for determining emergency status of shipments. Such criteria and direction might be incorporated within Transportation Safeguards Division procedures for reporting and responding to abnormal conditions that meet the “Broken Arrow” or “Bent Spear” description.

3. Order Example: Damage to a nuclear explosive, nuclear explosive-like assembly, or Category I/II quantity of Special Nuclear Materials as a result of a transportation accident. Possible Implementation Method: Same as example 2 above. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-7 B.3 Determining Emergency Class Using Barrier State as a Measure of Safety Degradation This section will describe a method for using the condition or state of protective “barriers” as a quantitative measure of facility or process safety degradation for purposes of determining hazardous materials facility event class. The method can be adapted to a broad range of facilities and processes and used to develop an internally consistent EAL scheme for each major hazard at a DOE site. The Order requires that hazardous materials Operational Emergencies involving or affecting DOE facilities be placed in one of three classes by degree of severity. The assigned emergency class should reflect the actual or potential consequences of the situation. The Order emergency class definitions are stated in terms of “safety degradation” and “actual or potential failure of safety functions,” as well as in units of consequence (dose, exposure, or concentration). In developing EALs, each facility must determine the observable conditions that equate to various levels of “safety degradation.” The standard set of Example Initiating Conditions provided by the NRC (In NUREG-0654 and in Industry Standard NUMARC/NESP-007) defines the levels of degradation for commercial nuclear reactors in terms that are specific to large light-water-cooled power reactors. This method has worked well for the commercial nuclear industry because the facilities are quite homogeneous (i.e., virtually every site has the same basic design features and similar organizational structure). To provide technically consistent and coherent example initiating conditions for each type of emergency at all the possible types of DOE hazardous materials facilities would be a formidable task. Lacking standard sets of example initiating conditions, facilities can develop coherent systems to drive graded, anticipatory responses to threats, challenges, and failures. This is done by viewing physical and administrative controls as the barriers that maintain hazardous material in a safe condition and constructing the EAL scheme around the status of those barriers. EAL schemes developed in this manner may be event-based but are typically more symptom-based in nature. The character of the site-specific EAL scheme will be largely dependent on the type and level of sophistication of installed systems that monitor the barrier(s) status. In general, the more complete and quantitative the information provided by monitoring systems, the more symptom-based the EAL scheme can be. Conversely, if monitoring is largely dependent on staff observation of events, the scheme will tend to be more event oriented. B.3.1 Barrier Definition CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-8 The various “layers of protection” afforded facility and site personnel, the general public and the environment by the design and operational controls of each facility can be thought of as barriers. Facility design features that contain hazardous materials or separate them from people or the environment are physical barriers in the traditional sense. This concept of barriers is the one typically applied when analyzing commercial nuclear reactor plants. However, in order to develop a complete EAL scheme, barriers other than those of a physical nature (such as administrative or procedural controls) may have to be considered. Examples of various types of barriers are as follows.

! Physical – containments – glove boxes – binding agents – confinements – hot cells – overpacks – cylinders – process piping – shipping casks – tanks – tunnels/shafts – building HVAC systems ! Configuration – safe geometries – segregated storage – process controls – temperature controls – cryogenic traps – humidity controls – arming circuits – security systems (e.g., cipher locks) ! Administrative – procedural compliance – inventory control – two-man rules – access controls CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-9 – security and safeguards rules – meteorological restrictions – training – knowledge – line management oversight B.3.2 Criteria For Failure and Challenge of Barriers In order to develop EALs based on barrier condition, “barrier failure” and “barrier challenge” must be defined. Failure of a barrier can usually be recognized by the readings or output from plant instruments such as valve position indicators, failed fuel monitors, pressure sensors, or stack effluent monitors. The criteria for declaring that a particular barrier is failed should be stated in terms of specific values on specific instruments (e.g., “Main Stack RMS-19 indicates > 1.5E+8 uCi/sec,” or “Any Valve Position Indicator on panel CI-903 indicates Open”). To achieve an anticipatory and conservative declaration in the case where all indications of a barrier's condition are lost during an upset condition or operating transient, it may be necessary to consider the barrier to be failed until such time as conditions can be verified satisfactory by other means (e.g., visual inspection, portable monitoring equipment, etc.). For example, if following a building isolation signal the control room position indicators for two of the ten installed isolation valves/dampers show neither an open or shut indication, then the associated valves/dampers should be considered to be failed open until such time as they can be verified shut by another method. A barrier should be considered “threatened” or “challenged” if the events in progress may result in a barrier failure. In general, classification should not be delayed by the expectation that mitigating activities in progress are likely to correct the degraded conditions. The EAL statements should take into account the likelihood that corrective actions can and will be taken within the time necessary to prevent barrier failure such that the decision is not left to user. For example, recognition of a fire that could challenge a barrier may be a good basis for classifying the event at a level corresponding to failure of that barrier. The degree of challenge is directly related to the duration of the fire (and thus indicative of the success of mitigation efforts) and can be reflected in an EAL statement such as “Fire in Zone 1 lasting more than 15 minutes,” where the 15 minutes is related to the time that the barrier could remain intact under fire conditions. B.3.3 EALs Based On Barrier Status CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-10 A method of developing facility-specific EALs based on barrier status is outlined in the following steps. 1. Identify, from the facility Hazards Assessment prepared in accordance with the Order (and as further detailed in Volume II), the radiological and hazardous/toxic materials sources of significant operational concern. 2. For each material and source (i.e., storage or process location), determine the

highest possible emergency class from release of that material, as analyzed in the facility Hazards Assessment. 3. Determine the physical, administrative, and configuration barriers between each of the sources and the outside environment. For the purposes of the EAL development process, it is unlikely that more than three barriers (physical and other) can be reasonably credited for any hazard source. For simplicity, no more than three overlying and independent barriers should be considered. Justification for selecting barriers should be provided in an accompanying technical basis document. For example, a building and its HVAC system should not be considered a barrier unless the HVAC filtration system can remove a high enough percentage of the material of interest during the maximum credible release to prevent exceeding any exposure criterion at the facility perimeter while maintaining a negative pressure in the building. NOTE: This method is founded on the assumption that the barriers are approximately equal in their safety significance. If the barriers differ widely in the degree to which they ensure control over the hazardous material, their failures (or challenges) cannot logically be treated as equal safety decrements for purposes of assigning an emergency class. No more than three most significant barriers should be considered. 4. Develop facility-specific EALs for each hazardous material source at the facility using the concepts of barriers “failed” or “challenged” as follows. ! Select the independent barriers (between the source and the environment) for which credit will be taken. ! For each barrier selected, identify the symptoms or observable indications of the barrier being either failed or challenged. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-11 ! If all of the barriers are either failed or challenged, then the symptoms of their challenge or failure, taken collectively, constitute an EAL for declaring the highest emergency class, identified in Step 2 above. For example, in the case of a hazardous material source that is capable of producing a General Emergency and has three barriers preventing its release, the comprehensive EAL set for the General Emergency class would include indications of the following combinations. – Three barriers failed. – Two barriers failed, one barrier challenged. – One barrier failed, two barriers challenged. – Three barriers challenged. ! For the second and third combinations, there may be three permutations each. For example, if A, B, and C designate the individual barriers, the second combination (two barriers failed and one challenged), may be either: – A and B failed, C challenged, or – A and C failed, B challenged, or – B and C failed, A challenged. ! If all except one barrier is failed or challenged, the condition is classified at one level lower than if all are failed or challenged. In the three barrier examples cited above, the class would be Site Area Emergency and the comprehensive EAL set for the Site Area Emergency class would include indications of the following combinations: – two barriers failed, one barrier intact and not challenged; – one barrier failed, one barrier challenged, one barrier intact and not challenged; and – two barriers challenged, one barrier intact and not challenged.

! If all except two barriers are failed or challenged, the condition is classified two levels lower than if all are failed or challenged. For the three barrier example cited above, the class would be Alert and the EALs for the Alert classification would be based on indications of one barrier either failed or challenged and two barriers intact and not challenged. This case requires some special attention, since the purposeful and controlled breaching of a CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-12 barrier (in a multiple barrier facility), such as the temporary opening of a truck lock door or the performance of carefully planned maintenance activities on a barrier, should not be considered a failure or challenge. 5. Events or conditions that represent a reduced margin of safety, but with no predicted barrier failure or challenge in the next few hours, should be treated as an Operational Emergency not requiring classification or under the DOE Occurrence Reporting System (per DOE M 232.1-1), as applicable. B.3.4 Examples of EALs Based On Barrier Failure and Challenge The process described in the previous sections can be applied to hazard sources having less than three barriers and sources for which the highest emergency class is Site Area Emergency or Alert. In the example below, only two barriers exist, a single-wall chemical process tank and the building within which it is located. The building can be sealed against maximum credible pressures. It has been calculated that the maximum credible release, a sudden complete breach of both the tank and the building, should be classified as a Site Area Emergency. If the barriers are considered to be nearly equal in their safety significance, their condition can be used as a measure of the degree of safety degradation, and hence, as the basis for determining emergency class. The EALs for Site Area Emergency should include indications of the following conditions. ! Two (both) barriers failed. ! One barrier failed, one barrier challenged. ! Two barriers challenged. Likewise, the EALs for Alert should include indications of the following conditions. ! One barrier failed, one barrier intact and not challenged. ! One barrier challenged, one barrier intact and not challenged. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-13 Accordingly, Site Area Emergency EALs might read as shown in Table B.1. Table B.1. Example Site Area Emergency EALs. Two Barriers Failed As Indicated By Tank 501A ruptured Any two building sump high alarms OR Tank 501A rapid level decrease OR monitor HF-23 >1000 PPM OR relief 501A-2 open AND Building 602 failed Visual observation OR one or more HVAC dampers not shut OR truck lock air seal failure alarm CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-14 Table B.1. Example Site Area Emergency EALs (continued). One Barrier Failed; One Challenged As Indicated By Tank 501A ruptured Any two building sump high alarms OR Tank 501A rapid level decrease OR monitor HF-23 > 1000 PPM OR relief 501A-2 open AND Building 602 challenged Fire potentially degrading HVAC or door seals OR HVAC air operating system pressure <85 PSIG OR Building 602 pressure >2“ H O2 OR Building 602 failed Visual observation OR one or more HVAC dampers not shut OR truck lock air seal failure alarm AND Tank 501A challenged 501A pressure > 125 PSIG OR 501A temperature > 355E F OR loss of cooling water flow to 501A OR

fire out of control in Building 602 CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-15 Table B.1. Example Site Area Emergency EALs (continued). Two barriers challenged As Indicated By Tank 501A challenged 501A pressure > 125 PSIG OR 501A temperature > 355EF OR loss of cooling water flow to 501A OR fire out of control in Building 602 AND Building 602 challenged Fire potentially degrading HVAC or door seals OR HVAC air operating system pressure <85 PSIG OR Building 602 pressure >2" H O2 The example in Table B.1 represents only a subset of the possible EALs applicable to the hypothetical facility. The EAL development process should attempt to define all of the symptoms of failure or challenge to barriers. To the maximum extent possible, EALs should be stated in terms of specific installed indications, such as individual fire alarm panel temperature and ion detectors identified by zone, or process pressure and temperature indicators identified by panel and instrument number. There are obviously hazards capable of generating an Site Area Emergency or General Emergency to which the barrier approach cannot be applied (e.g., a single-wall tank, in an open area, with little or no remote instrumentation). The EALs for events impacting such a hazard are usually worded to describe events, even though the events are really “single-barrier failures.” It is essential that EALs be grouped and organized in a manner that is consistent with how emergency events and conditions are likely to be recognized and perceived by facility staff and decision makers. The groupings or categories of EALs should allow the intended user to quickly identify the most likely EAL statement for a particular event or condition. The completed EAL set should/will contain some redundancy among the sections, allowing the same event to potentially be recognized by two or more EAL statements (e.g., Barrier Status and Field Monitoring). CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-16 Somewhere between 5 and 20 categories will serve the purposes of most facilities. If more categories are used, the categories will tend to be more explicit and narrowly defined. While it is easier for the user to understand and relate to more explicit individual category titles, the resulting larger number of categories makes it more difficult for a user to scan the entire EAL set and select the applicable statements in a limited time. Example List of EAL Categories The following list of 12 EAL categories covers a wide range of possible events and conditions that could occur at a DOE facility. ! Barrier status. ! Radiological releases. ! Toxic or hazardous chemical releases. ! Fire or explosion. ! Electrical failures (power supply). ! Abnormal process system conditions (leakage, temperature, pressure, reaction rates). ! Loss of control and indication features (automatic trips, indicating systems, safe. shutdown systems). ! External events (man-made events). ! Security and safeguards events. ! Natural phenomena impacts. ! Criticality control. ! Miscellaneous. Table B.2. provides an example of how the first EAL category, Barrier Status, can be expanded, depending on the type of facility and the degree to which barrier status is used to quantify the safety state of the facility and processes. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-17 Table B.2. Example EAL Sub-Categories for Category Number 1.

Facility Type Possible Barrier-Status EAL Sub-Categories Reactors Fuel cladding, reactor vessel and coolant piping, confinement or containment building Expended fuel Fuel cladding, storage building, and HVAC system Chemical/materials processes Tanks, pipes, traps, hot cells, building and HVAC systems Radwaste Binding/solidifying agent, drums and tanks, buildings, geologic containments Toxic material storage Tanks, cylinders, building, and HVAC system Weapons and fissile material Configuration, arming features, assembly facilities, geologic containment, configuration controls B.4 Hazardous Materials Facility EAL Organization and Format As discussed in Section 3.4 of this chapter, facility-specific EALs must be organized into an implementing procedure that is logical and comprehensive, yet concise and usable. Example Emergency Action Levels For a Hypothetical Facility Appendix D, Volume II, describes a hypothetical DOE facility and presents results of its Hazards Assessment, including the emergency classes most appropriate to the analyzed accidents or emergency events. The results of the accident/event consequence analyses are summarized in Tables 6.1a-d, and examples of the technical basis arguments for possible EALs are summarized in Section 8 of the appendix. Table B.3 represents the culmination of the EAL development effort that began with the facility Hazards Assessment. The “conceptual” EALs that were identified in the Hazards Assessment process have been translated into specific EALs and presented in the form of an emergency classification table for the hypothetical ABC Facility. The table is intended to illustrate the following. ! How specific EALs can be developed from the results of the facility Hazards Assessments. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-18 ! Stating EALs in terms of the most objective observable conditions. ! Use of EAL categories to aid facility staff in identifying and applying the EALs that are most applicable to an observed event or condition. ! One acceptable format and organization for an EAL table. ! The principle of redundancy (i.e., EALs in different categories that lead to classification of an event at the same level, even if it is recognized by different means). ! Integration of the EALs with the reportable occurrence and Operational Emergency (not requiring classification) recognition procedures is left to the individual site. CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-19 Table B.3. Emergency Action Levels for the ABC Facility. EAL As Indicated By Emergency Class 1. Barrier Status 1a. HF cylinder breached in Direct observation of breach General Emergency warehouse or outside 1.b HF cylinder breached in Direct observation of cylinder Alert operating corridor, HVAC breach function maintained AND at least one HVAC exhaust fan running AND operating corridor pressure indicator PI-xxxx reading negative relative to atmospheric pressure 1.c One or more TDI drums Direct observation Site Area Emergency breached in warehouse or outside 1.d TDI drum breached in process Direct observation of TDI drum Site Area Emergency area and HVAC function lost breach AND process area pressure indicator PI- yyyy reading zero or positive relative to atmospheric 1e. TDI drum breached in room Direct observation of TDI drum Alert 101; HVAC function breach maintained AND at least one HVAC exhaust fan running

AND process area pressure indicator PI- zzzz reading negative relative to atmospheric 1.f One or more Pu nitrate bottles Direct observation of bottle breach Site Area Emergency breached with vault (room 109) breached direct observation of vault outside AND wall breached CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-20 Table B.3. Emergency Action Levels for the ABC Facility (continued). EAL As Indicated By Emergency Class 1.g Pu nitrate bottle breached in Direct observation of bottle breach Alert ABC building producing airborne release stack alpha monitor indicating AND >3000 counts per minute 1.h Pu powder can breached Direct observation of powder can Alert outside cell producing airborne breach release AND EITHER operating corridor CAM alarms OR stack alpha monitor indicates >3000 counts per minute 2. Radiological Releases 2a. Stack release rate Stack alpha monitor indicates off- General Emergency scale high >60,000 Bq/sec OR Pu-238 stack grab sample results indicate >1E+4 Bq/m Pu-238 in3 effluent air at normal exhaust flow rate 2b. Stack release rate exceeding Stack alpha monitor indicates Site Area Emergency 20,000 Bq/sec Pu-238 >1.2E+5 counts per minute stack grab sample results indicate OR >3E+3 Bq/m Pu-238 in effluent3 air at normal exhaust flow rate 2c. Stack release rate exceeding Stack alpha monitor indicates Alert 4,000 Bq/sec >3E+4 counts per minute Pu-238 OR stack grab sample results indicate >8E+2 Bq/m in effluent air at3 normal exhaust flow rate CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-21 Table B.3. Emergency Action Levels for the ABC Facility (continued). EAL As Indicated By Emergency Class 2.d Any release of radioactive Sample or measurement of air General Emergency 1 material to atmosphere concentration outside the facility producing actual or predicted taken in accordance with EPIP-38 dose to a person at or beyond any site boundary in excess of prediction of committed dose an applicable EPA PAG using the SUPERRAD model and 2 OR actual dispersion conditions 2.e Any release of radioactive Sample or measurement of air Site Area Emergency material to atmosphere concentration outside the facility producing actual or predicted taken in accordance with EPIP-38 dose to a person at or beyond any facility boundary, but not prediction of committed dose beyond any site boundary, in using the SUPERRAD model and excess of an applicable EPA actual dispersion conditions PAG value OR 2.f Any release of radioactive Sample or measurement of air Alert material to atmosphere concentration outside of the producing actual or predicted facility taken in accordance with dose to a person boundary EPIP-38 >0.1 EPA PAG value at or 3 beyond any facility prediction of committed dose OR using the SUPERRAD model and actual dispersion conditions Note 1: EALs 2.d, 2.e, and 2.f are the generic equivalent to EALs 2.a, 2.b, and 2.c. They allow for event classification based upon field measurement results or based on dispersion calculations (e.g. stack monitor not available, etc.). Note 2: The use of the procedure number in this EAL statement implies that the procedure specifies the use of specific instrumentation for obtaining field samples and/or measurements and that it provides the user with a method for relating the methodology for relating the results to the applicable EPA PAGs.

Note 3: The use of 0.1 EPA PAG for setting the Alert threshold is only intended to illustrate the establishment of a facility-specific Alert threshold (see Section 3.3.2); it is not a recommended generic value. CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-22 Table B.3. Emergency Action Levels for the ABC Facility (continued). EAL As Indicated By Emergency Class 3. Toxic or Hazardous Chemical Releases 3a. Contents of HF cylinder released Direct observation General Emergency in warehouse or outside 3.b HF cylinder contents released in Direct observation release Alert operating corridor, HVAC function maintained at least one HVAC exhaust fan AND running AND operating corridor pressure indicator PI-xxxx reading negative relative to atmospheric pressure 3.c One or more TDI drums spilled Direct observation Site Area Emergency in warehouse or outside 3.d TDI drum spilled in process area Direct observation of TDI spill Site Area Emergency and HVAC function lost AND process area pressure indicator PI- yyyy reading zero or positive relative to atmospheric 3.e TDI drum spilled in room 101, Direct observation of TDI drum Alert HVAC function maintained breach AND at least one HVAC exhaust fan running AND process area pressure indicator PI- zzzz reading negative relative to atmospheric 3.f Any release of hazardous Sample or measurement of air General Emergency 1 chemical to atmosphere that concentration in accordance with produces actual or predicted EPIP-42 peak concentration at or beyond any site boundary in excess of prediction of air concentration using the ERPG-2, or equivalent, the SUPER model and actual value for that chemical. dispersion conditions 2 OR CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-23 Table B.3. Emergency Action Levels for the ABC Facility (continued). EAL As Indicated By Emergency Class 3.g Any release of hazardous Sample or measurement of air Site Area Emergency chemical to atmosphere concentration in accordance with producing actual or predicted EPIP-42 peak concentration at or beyond any facility boundary, prediction of air concentration but not beyond any site using the SUPER model and boundary, in excess of the actual dispersion conditions ERPG-2, or equivalent, value for that chemical OR 3.h Any release of hazardous Sample or measurement of air Alert producing actual or predicted concentration in accordance with peak concentration at or EPIP-42 beyond any facility boundary, but not beyond any site prediction of air concentration boundary, in excess of the using the SUPER model and ERPG-1 , or equivalent, value actual dispersion conditions 3 for that chemical OR Note 1: EALs 3.f, g, and h are the generic equivalents to EALs 3.a, b, c and d. They allow for event classification based upon field measurement results or based upon dispersion calculations. Note 2: The use of the procedure number in this EAL statement implies that the procedure specifies the use of specific instrumentation for obtaining field samples and/or measurements and that it provides the user with a method for relating the methodology for relating the results to the applicable ERPG or equivalent value. Note 3: The use of ERPG-1 for setting the Alert threshold is only intended to illustrate the establishment of a facility-specific Alert threshold (see Section 3.3.2); it is not a recommended generic value. 4. Fire or Explosion

4a. Fire in warehouse not Direct observation of flames or General Emergency extinguished by automatic smoke suppression systems OR fire alarm on zone 4 AND fire not extinguished by automatic suppression systems CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-24 Table B.3. Emergency Action Levels for the ABC Facility (continued). EAL As Indicated By Emergency Class 4b. Fire or explosion in cell B with Direct observation of fire or Site Area Emergency release from cell. explosion in cell B OR cell B fire suppression system alarm initiates on Panel ABC-0123 AND alarm on operating corridor CAM- xxx-01 4c. Fire in room 101 Direct observation of flames or Alert smoke in room 101 OR fire alarm on zone 8 AND fire not extinguished by automatic suppression systems 4d. Fire or explosion in room 101 Direct observation of flames or Alert that breaches building integrity explosion OR fire alarm on zone 8 AND direct observation of penetration of exterior wall within 5 minutes of first alarm or observation 5. Electrical Failures (power supply) 5a. Loss of AC power for more than ABC Vital Equipment Bus voltage Alert 10 minutes less than 450 volts on distribution panel ABC-56-78 for >10 minutes 6. Abnormal Process System Conditions 6a. Collapse of Pu nitrate storage Direct observation of rack collapse Alert rack with breach of bottle(s) and breach of one or more nitrate bottles CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-25 Table B.3. Emergency Action Levels for the ABC Facility (continued). EAL As Indicated By Emergency Class 6b. Over temperature condition in High temperature alarm on Alert process no. 1 polymer reactor process annunciator T-4 TI-1234 indicates >400EC AND EITHER OR combustion product sensor alarm on process annunciator T-6 7. Loss of Control and Indication Features 7a. Stack monitor not operable Stack Monitor Failure alarm on Alert during upset condition building annunciator M-11 OR stack monitor determined by inspection to be out of service AND EITHER any ABC Building CAM in alarm state OR fire alarm: zone 1, 2, 3, 5, 6 or 8 OR any explosion or missile damage to process No. 2 areas 7b. Loss of power to process no.1 Direct observation of control and Alert control and annunciator of annunciator panel loss power panel during production run process no. 1 Control Power OR Failure alarm on Building Annunciator P-009 AND polymer mixing/extrusion run in progress 7c. Cell pressure control lost Alarm on Cell A/B/C diff. Unusual Occurrence causing Pu release to operating pressure annunciator corridor AND alarm on any Cell A/B/C operating corridor CAM CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-26 Table B.3. Emergency Action Levels for the ABC Facility (continued). EAL As Indicated By Emergency Class 8. External Events 8a. Aircraft crash within ABC Direct observation Alert Protected area 8b. Any external impact on the Direct observation Alert ABC building that breaches a building wall or causes fire 8c. Any external event that forces Process no. 1 production run in Alert evacuation of the ABC progress Building during process no. 1 production run ABC Building evacuation ordered AND by Building Emergency Director 9. Security and Safeguards Events 9a. Sabotage of HF cylinder(s) Direct observation General Emergency 9b. Physical control of any part of Direct observation General Emergency ABC Facility lost to armed intruder(s)

9c. Unauthorized person in ABC Unauthorized person observed in Site Area Emergency Facility security controlled area warehouse or ABC Building with evidence of malevolent proper intent. AND EITHER evidence of tampering with any lock, seal or access control device OR evidence of sabotage to any hazardous material storage area or container, safety system or control system 9d. Unauthorized person in any Direct observation Alert part of ABC facility AND intruder resists or avoids attempt by facility staff to identify and apprehend CANCELE D DOE G 151.1-1, Volume III Program Elements (1) 8-21-97 3-B-27 Table B.3. Emergency Action Levels for the ABC Facility (continued). EAL As Indicated By Emergency Class 10. Natural Phenomena Impacts 10a. Earthquake exceeding ABC Site seismic monitoring station Alert Facility design basis is reports ground acceleration in experienced excess of 0.20 g horizontal or 0.12 g vertical has been recorded 10b. Winds exceeding ABC Facility Site meteorological station reports Alert design basis observed wind speed in excess of 110 km/hr at station 4 OR direct observation of winds causing structural damage to ABC Building or warehouse 10c. Flood exceeding facility Site meteorological station Alert design basis predicts river level to exceed 490- ft elevation within 24 hours 10d. Snowfall approaching roof Accumulation of >18 in. of snow Alert design load limits on facility roof 11. Criticality Control ---------------------------------------------------NONE------------------------------------------------ 12. Miscellaneous 12a. Any degradation of safety not Shift Manager judgment Alert; Site Area otherwise directly covered in Emergency; General other specific EALs Emergency Acronyms HAZMAT Hazardous Materials MC&A Materials Control and Accountability RQ Reportable Quantity CANCELE D Program Elements (1) DOE G 151.1-1, Volume III 8-21-97 3-B-28 This page intentionally left blank. CANCELE D