DOE G 420.2-1A, Accelerator Facility Safety Implementation Guide for DOE O 420.2C, Safety of Accelerator Facilities

DOE G 420.2-1A 8-1-2014 Accelerator Facility Safety Implementation Guide for DOE O 420.2C, SAFETY OF ACCELERATOR FACILITIES [This Guide describes suggested nonmandatory approaches for meeting requirements. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with the parent Policy, Order, Notice, or Manual.] US Department of Energy Office of Science NOT MEASUREMENT SENSITIVE DOE O 420.2-1A i 8-1-2014 Table of Contents 1 Introduction ....................................................................................................................... 1 1.1 Purpose .................................................................................................................................... 1 1.2 Scope ....................................................................................................................................... 1 1.3 Exemptions .............................................................................................................................. 2 1.4 Equivalency Process ................................................................................................................ 3 1.5 Graded Approach to Implementation ...................................................................................... 4 1.6 Tailoring Process for Implementation ..................................................................................... 4 1.7 ASO DOE and Contractor Requirements ................................................................................ 5 2 Accelerator Facility Preoperational Activities ............................................................... 8 2.1 Hazard Analysis Development for New Projects .................................................................... 8 2.2 Safety Assessment Document ................................................................................................. 8 2.2.1 Purpose and Scope of the Safety Assessment Document ............................................... 8 2.2.2 SAD Format and Content ............................................................................................. 13 2.2.3 Safety Analysis ............................................................................................................. 14 2.2.4 SAD Review and Approval Process ............................................................................. 17 2.3 Accelerator Safety Envelope ................................................................................................. 17 2.3.1 Purpose and Scope ........................................................................................................ 17 2.3.2 ASE Format .................................................................................................................. 18 2.3.3 ASE Content ................................................................................................................. 19 2.3.4 ASE Review and Approval Process ............................................................................. 21 2.3.5 ASE Implementation .................................................................................................... 21 2.3.6 Oversight of ASE Implementation ............................................................................... 22 2.3.7 ASE Updates and Revisions ......................................................................................... 22

2.4 Procedures Program Development for Safe Operations ........................................................ 23 2.4.1 General Considerations ................................................................................................ 23 2.4.2 Procedural Topics ......................................................................................................... 25 2.4.3 Establishing Policy for Controlling and Maintenance of Procedures ........................... 26 2.5 Training Program Development for Safe Operations ............................................................ 26 2.5.1 General Considerations ................................................................................................ 26 2.5.2 Training Program Elements/Content ............................................................................ 27 2.5.3 Training Documentation ............................................................................................... 30 2.6 Unreviewed Safety Issue Process Development ................................................................... 30 2.7 Configuration Management................................................................................................... 35 ii DOE G 420.2-1A 8-1-2014 2.8 Quality Assurance Program .................................................................................................. 36 2.9 Contractor Assurance System and Safety Reviews ............................................................... 36 2.10 Accelerator Readiness Review ......................................................................................... 38 2.10.1 When to Conduct an ARR ............................................................................................ 38 2.10.2 DOE and Contractor ARR Roles .................................................................................. 39 2.10.3 Preparing for the ARR and Commissioning ................................................................. 40 2.10.4 Conduct of the ARR ..................................................................................................... 42 2.10.5 Authorization to Commission ....................................................................................... 44 3 Accelerator Facility Operations Guidance ................................................................... 45 3.1 Managing the Accelerator for Safety and Mission Success .................................................. 45 3.1.1 Integrating Experimental Safety and Users into Operations ........................................ 49 3.2 Basic Operations Principles and Practices ............................................................................ 50 3.2.1 Implementing the USI Process ..................................................................................... 54 3.3 Maintaining Operator and Experimenter Training ................................................................ 55 3.4 Configuration Management during Operations ..................................................................... 56 3.4.1 Maintaining Credited Controls during Operations ....................................................... 57 3.4.2 Approved Alternatives for Credited Controls............................................................... 58 3.4.3 Performing Maintenance and Return to Service of Credited Engineered Controls ...... 58 3.4.4 Updates to the SAD during Operations ........................................................................ 59

3.5 Access Control System as a Credited Control....................................................................... 60 3.5.1 ACSs that Prevent Access to Accelerator Enclosures .................................................. 61 3.5.2 Testing, Diagnosing, and Use of ACS Development Computers ................................. 63 3.5.3 Writing and Reviewing Sweep Procedures for Accelerator Enclosures....................... 64 3.6 Accelerator Sub-System Operational Safety Issues .............................................................. 65 3.6.1 Sub-Systems Operations ............................................................................................... 65 3.6.2 Superconducting Magnet and RF Systems ................................................................... 65 3.6.3 Reusing Accelerator Components and Other Legacy Hazard Issues ........................... 67 3.6.4 Hazardous Energy Control (Lockout/Tagout) for Accelerator Operations .................. 69 3.6.5 Compressed Gas Safety during Operations .................................................................. 71 3.6.6 Cryogenic Safety during Operations ............................................................................ 73 3.6.7 Oxygen Deficiency Hazard Safety ............................................................................... 74 3.6.8 Special Materials Safety ............................................................................................... 74 3.6.9 Accelerator Software QA and Cyber Security for Operations Networks ..................... 75 3.6.10 Facilitating Post-Operations Work ............................................................................... 76 DOE O 420.2-1A iii 8-1-2014 4 Accelerator Facility Post-Operations ............................................................................ 76 4.1 Post-Operations Plans ........................................................................................................... 76 4.1.1 Types of Plans .............................................................................................................. 78 4.1.2 Stabilization/Shutdown Plan ........................................................................................ 78 4.1.3 Deactivation Plan .......................................................................................................... 78 4.1.4 Surveillance and Maintenance Plan .............................................................................. 79 4.1.5 Decommissioning Project Plan ..................................................................................... 79 4.1.6 General Notes on Planning and Lessons Learned ........................................................ 79 4.1.7 Transfer/Reuse of Accelerator Related Components and Equipment ................................ 80 4.2 Revisions to the SAD, ASE and Other Program Documents ................................................ 80 4.3 Project-Specific and Task-Specific Hazards and Controls .................................................... 81 4.4 Plan Modularization .............................................................................................................. 81 4.5 Identification of Records and Documents ............................................................................. 81 4.6 Concurrent Operations .......................................................................................................... 82

4.7 Completion of Post-Operations ............................................................................................. 83 4.7.1 Long-Term Records Retention ..................................................................................... 83 4.7.2 Final Verification .......................................................................................................... 83 5 Definitions and Acronyms .............................................................................................. 83 5.1 Definitions ............................................................................................................................. 83 5.2 Acronyms .............................................................................................................................. 85 6 References ........................................................................................................................ 87 7 Appendix A. Bibliography of Useful Hazard and Risk Analyses Methods ............... 91 DOE O 420.2-1A 1 8-1-2014 1 Introduction 1.1 Purpose The Department of Energy (DOE) Order 420.2C, Safety of Accelerator Facilities, approved by Deputy Secretary of Energy Daniel B. Poneman on July 21, 2011, states the applicability of the Order to all DOE accelerator facilities or modules thereof while unambiguously confirming the fundamental and operative distinctions between accelerator facilities and nuclear facilities. This document is a guide to understanding and meeting the requirements of DOE Order 420.2C, and shares lessons learned based on valuable experience within the community. This Guide is also intended to be a useful resource for managing accelerator facilities. This Guide does not impose requirements, although it may restate requirements of Order 420.2C or other requirements if the reference or source is adequately cited. An accelerator safety program may not need to fully implement all sections of this Guide to satisfy the requirements of DOE Order 420.2C. This Guide is not intended as an audit/assessment tool and should not be used as such without prior agreement between the contractor and DOE. 1.2 Scope The DOE Integrated Safety Management Policy (DOE P 450.4A) commits DOE to conducting work safely and efficiently in a manner that ensures protection of workers, the public, and the environment. This is the foundation for the DOE Integrated Safety Management (ISM) program consistent with 48 CFR 970.5223-1. The ISM process is founded upon a work planning approach that integrates safety into work planning, establishes a set of agreed-upon standards for performance of work, and provides performance-based measures to determine agreed-upon levels of safety. This Guide supports implementation of the Accelerator Safety Order (ASO), DOE Order 420.2C. The ASO was preceded by DOE Order 420.2B, issued in July 2004, and DOE Order 420.2A, issued in January 2001; DOE Order 420.2, issued in November 1998; and DOE Order 5480.25, issued in November 1992. The current ASO constitutes a significant improvement over the previous versions, benefiting from lessons learned from two decades of safe operating experience accumulated since DOE Order 5480.25 was first issued. Unless directed otherwise by the appropriate DOE PSO or Field Element Manager or National Nuclear Security Administration (NNSA) Administrator or organization having jurisdiction, Accelerator Safety

programs established under previous versions of the Order continue to be valid. This Implementation Guide has been developed to facilitate understanding of DOE expectations given in the ASO and to support the effective implementation of the ASO at DOE accelerator facilities. For the purpose of this document, an accelerator is defined as a device employing electrostatic or electromagnetic fields to impart kinetic energy to molecular, atomic, or sub-atomic particles and capable of creating a “radiological area” as defined in Title 10, Code of Federal Regulations, Part 835 Occupational Radiation Protection (10 CFR 835). The ASO and its predecessors were developed as a result of a need identified by the DOE accelerator community to establish a standard of design and operation that effectively addresses 2 DOE G 420.2-1A 8-1-2014 the unique attributes of particle accelerators. This Guide helps promote safe operations to ensure protection of workers, the public and the environment. DOE accelerator facilities must comply with the worker safety and health requirements contained in 10 CFR 835, Occupational Radiation Protection and 10 CFR 851, Worker Safety and Health Program. These Rules require the identification and control of hazards to which workers may be exposed. DOE Order 458.1 Admin Chg. 3 Radiation Protection of the Public and the Environment establishes requirements for programs to monitor and control potential exposures to the public and the environment. In addition, this document addresses implementation issues apart from those situations involving potential criticality. The ASO requirements apply to entire accelerators and accelerator facilities or modules thereof and their operations. This includes the accelerator and associated roads within site boundaries, plant and equipment utilizing, or supporting the production of, accelerated particle beams and the radioactive material created by those beams to which access is controlled to protect the safety and health of workers, the public or the environment. The term facilities includes injectors, targets, beam dumps, detectors, experimental halls, non-contiguous support and analysis facilities, experimental enclosures and experimental apparatus utilizing the accelerator, regardless of where that apparatus may have been designed, fabricated, or constructed, including all systems, components and activities that are addressed in the Safety Assessment Document (SAD). 1.3 Exemptions The ASO provides for two types of exemptions for those radiation-generating devices that otherwise fall within the general definition of an accelerator and accelerator facility. The first type of exemption is reserved for DOE facilities that are non-complex in nature and produce only local work area impacts. The term “complex” refers to an entity comprising many interrelated parts. Concerning accelerators, a complex accelerator is one, for example, with multiple beams and a staff of significant size. Small facilities confined to a single room with an individual operator are considered far less complex than larger facilities with multiple beam lines, access points, and/or a variety of particle types and energies. Some examples of the first type of exemption, based upon lacking complexity and producing only local work area impacts, are unmodified, commercially available units, accelerator facilities not capable of creating radiological areas, nonmedical x-ray generators below 10 MeV, and low-

voltage neutron generators with accelerating potential below 600 keV. These devices are typically bench-top in size or may be portable with a single external/extractable beam and may be operated in accordance with ANSI N43.3-2008, NCRP Report 72-1983, or other applicable consensus documents. For example, neutron generators conforming to NNSA/defense requirements and specifications could meet this type of exemption. These non-complex radiation-generating devices generally demonstrate low-level hazards that can be managed safely within the scope of an institutional ISM program and a 10 CFR 835 radiation protection program (RPP). These exemptions do not require DOE Field Element Manager or NNSA Organization having Jurisdiction approval. Since this list of examples is not intended to be a comprehensive list of possible exemptions, any questions of ASO applicability should be discussed between the DOE field organization and the contractor. DOE O 420.2-1A 3 8-1-2014 For these small low-hazard units, specified consensus standards and/or DOE Guide 441.1- 1C, Radiation Protection Programs Guide for Use with Title 10, Code of Federal Regulations Part 835, Occupational Radiation Protection, Section 7, Radiation Generating Devices, may be useful in complying with DOE requirements in 10 CFR 835, Occupational Radiation Protection. The guidance presented in DOE Guide 441.1-1C is also generally applicable to larger multi- purpose research accelerators. The second type of exemption provides the DOE Field Element Manager and NNSA Organization having jurisdiction with the flexibility to approve an exemption request should circumstances warrant. An example of the second type of exemption would be small research or developmental units. The experimental unit under development might undergo continuous change as the research and development project progresses. In this case, the preparation of a formal accelerator safety envelope (ASE) and SAD would be neither practical nor necessary because of the nature of the hazards and/or the developmental/operational characteristics. The second type of exemption may be applied to ASO requirements as appropriate. It has been demonstrated that ISM and RPP programs are the appropriate safety management tool in the research environment, where the research is an iterative process and not a routine operation. In cases such as the small units discussed above, the DOE Field Element Manager or NNSA Organization having Jurisdiction may approve specific exemptions from the requirements of the Accelerator Safety Order. 1.4 Equivalency Process The ASO also includes an equivalency process that states that the DOE program secretarial officer (PSO)/NNSA Administrator may specify alternate safety standards, requirements, or DOE Directives that provide equivalent (or greater) protection in lieu of or in addition to the requirements of the ASO. These alternate standards would be primarily for those accelerator facilities, modules, and their operation that contain, use, or produce fissionable materials in amounts sufficient to create the potential for criticality based on the configuration of the materials. Materials in amounts sufficient to create the potential for criticality based on configuration of the materials are those for which criticality is not precluded by segmentation and nature of process. Pursuant to DOE 420.1C, Facility Safety, DOE Field Element Manager or NNSA

Organization having Jurisdiction have responsibility for oversight of contractor criticality safety and criticality safety staff qualification programs and therefore are to be involved in these determinations. In the event that a module of an accelerator facility involves or produces a sufficient inventory of fissionable material to create the potential for criticality, alternate standards, requirements, or directives may be specified for that module of the facility alone. The approving PSO or NNSA Administrator may specify whether the remainder of the accelerator facility is or is not subject to the alternate requirements if it is demonstrated that the criticality hazards, controls, and operations are entirely associated with the module where the potential for criticality exists. 4 DOE G 420.2-1A 8-1-2014 1.5 Graded Approach to Implementation The graded approach is a process to ensure that a standard is applied at an appropriate level to the operations of an accelerator facility that best suits the needs of that facility. A graded approach to implementing accelerator program elements places the most emphasis on and allocates the proper resources to those operations that may have the greatest effect upon workers, the public, and the environment. The graded approach is a process for determining that the appropriate level of safety analysis, controls, and documentation is commensurate with the potential to  create an environmental, safety, security, health or radiological hazard  incur a monetary loss due to damage, or to repair/rework/scrap costs  reduce the availability of an accelerator facility or equipment  adversely affect the program or mission objective  unfavorably impact the public’s or other regulator’s perception of the contractor or DOE Those DOE and contractor representatives responsible for accelerator operations should consider and agree upon the risk of adverse Environment, Safety and Health (ESH) impacts and/or adverse programmatic impact associated with implementing a graded approach. 1.6 Tailoring Process for Implementation The tailored process involves adapting a safety program, practice, or requirement to suit the needs or purposes of a particular facility, taking into account the type of work and associated hazards. The tailored approach to implementing guidance allows the facility to adopt a Guideline if that standard is relevant to the needs of the contractor operating the accelerator facility. The tailored approach is based on potential impacts of a facility and helps in determining the DOE managerial level at which approval and authorization to initiate commissioning or routine operation is granted. The determination of the level of approval is given with authority granted to the DOE Field Element Manager or NNSA Organization having Jurisdiction or PSO/NNSA Administrator as provided in the ASO. Approval levels are summarized and shown in Table 1. For example, an accelerator facility with no potential hazards/impacts beyond the immediate work area/facility could be addressed by a brief Hazards/Safety Assessment Document, which references existing site/facility ISM program and RPP, uses simple qualitative hazard assessments, and analyzes the maximum credible incident. For accelerator facilities that pose potentially minor impacts outside of the immediate work area/facility and negligible impact beyond the site boundaries, DOE authorization is based on a

suitable ASE to bound proposed activities as supported by an appropriate SAD. The DOE Field Element Manager or NNSA Organization having Jurisdiction would then approve the facility ASE based upon the DOE agreement or concurrence with the associated SAD before authorizing the start of commissioning or routine operations. For those accelerator facilities with the potential for more than negligible offsite impacts, the DOE PSO/NNSA Administrator may require concurrence with the facility SAD in addition to DOE O 420.2-1A 5 8-1-2014 determining that an appropriate ARR was conducted, approving the ASE, and authorizing the start of commissioning or routine operations. Where accelerator facilities consist of several elements with hazards of widely varying types and magnitude, dividing the accelerator facility into modules for safety analysis purposes may be considered. Safety analysis methodologies and level-of-detail for each module of the accelerator facility should be established as appropriate for potential impacts. Consideration should be given to tailoring administrative programs associated with facility operations for each module of the accelerator facility. An overarching ASE and supporting SAD should be considered for common support facilities and administrative programs associated with the entire facility. For facilities that use a modularized approach, particular care should be used to ensure that boundaries and interfaces between facility modules are clearly established in the facility description and safety analysis portions of the safety documentation. Contractors are required by the ASO to maintain a current listing/inventory of accelerators and exemptions and equivalencies. Contractors should be prepared to supply the listing to the Field Element Manager and NNSA Organization having jurisdiction for transmittal to the DOE PSO/NNSA Administrator upon request. Such a listing/inventory should include the name of the facility, its operational status, the date of the current SAD, the approval of the ASE if applicable, date of exemption approval if applicable, and the programmatic sponsor. 1.7 ASO DOE and Contractor Requirements The Accelerator Safety Implementation Guide is intended to identify best management practices that may be of value in implementing the requirements found in the DOE ASO, DOE Order 420.2C. The ASO documents both DOE and contractor requirements. The ASO requirements that are applicable to DOE organizations are provided in Paragraph 4 of the Order. These requirements define the oversight of contractors who design, build, or operate accelerators, accelerator facilities or modules thereof, consistent with DOE mission and operational requirements and in line with the safety program provisions described in the ASO Contractor Requirements Document (CRD). The elements of an acceptable accelerator safety program include an approved ASE, a SAD, clearly defined roles and responsibilities, an unreviewed safety issue (USI) process, an accelerator readiness review (ARR) program, and a current inventory of accelerators addressed by the ASO. The responsibilities of the DOE PSO/NNSA Administrator, the DOE Field Element Manager, the NNSA Organization having jurisdiction and the cognizant contracting officer are provided in Paragraph 5 of the ASO. These topical areas are addressed in this Guide. The ASO CRD requires the contractor to comply with the requirements associated with safe

performance of work and to flow these requirements down to subcontractors to the extent necessary to ensure the contractor’s compliance with the requirements and safe performance of the work. The CRD requires that the contractor accelerator safety program include an approved ASE, a SAD, clearly defined roles and responsibilities for accelerator activities, a USI process, an ARR program, and a current inventory of accelerators under the ASO including exemptions or equivalencies approved under the responsibilities of the ASO. All of these requirements are addressed in the CRD included in the two-page Attachment 1 of the ASO. 6 DOE G 420.2-1A 8-1-2014 Table 1. Approval responsibilities for accelerator safety documents Facility characteristics Requirements Approval level Documentation requirements First type of exemption for small facilities that are non-complex in nature and produce only local work area impacts. Examples:  Radiation or current generating devices  Room-sized accelerator with single external /extractable beam, active safety system, and single point of entry  X-ray generators (see main text)  Neutron generators (see main text)  Unmodified commercially available equipment (see main text) Exempt from DOE Order 420.2C requirements Managed under local ISM/RPP programs DOE Order 420.2C documentation not required (see 10 CFR 835 requirements) Not entered into the accelerator inventory Second type of exemption. Example:  Small research or developmental units Exempt from DOE Order 420.2C requirements DOE Field Element Manager or NNSA Organization having Jurisdiction Formal submittal and approval of exemption request Included in accelerator inventory Accelerator facilities where site boundary consequences for credible postulated accident scenarios are less than 1 rem and Emergency Response Planning Guide (ERPG) -2 as determined by safety analysis DOE Order 420.2C requirements apply ASE approval at DOE Field Element Manager or NNSA Organization having Jurisdiction DOE Order 420.2C documentation required to address hazards and demonstrate no more than negligible offsite impacts Included in accelerator inventory Accelerator facilities where site boundary consequences for credible postulated accident scenarios are greater than 1 rem and/or ERPG-2 as determined by safety analysis DOE Order 420.2C requirements apply ASE approval by DOE PSO/NNSA Administrator DOE Order 420.2C documentation required to address hazards and assess potential impacts DOE O 420.2-1A 7 8-1-2014 Facility characteristics Requirements Approval level Documentation requirements Included in accelerator inventory Facilities or modules where  inventory of fissionable materials is sufficient to create potential for criticality based upon the configuration of the material and  site boundary consequences for credible postulated accident scenarios are less than 1 rem and ERPG-2 Alternate safety standards in lieu of or combination with DOE Order 420.2C ASE approval at DOE Field Element Manager or NNSA Organization having Jurisdiction Specified by identified standards Included in accelerator inventory Facilities or modules thereof where  inventory of fissionable materials is sufficient to create potential for criticality based upon the configuration of the material involved or produced and  Site boundary consequences

for credible postulated accident scenarios are greater than 1 rem and/or ERPG-2 Alternate safety standards in lieu of or combination with DOE Order 420.2C ASE approval by DOE PSO/NNSA Administrator Specified by identified standards Included in accelerator inventory 8 DOE G 420.2-1A 8-1-2014 2 Accelerator Facility Preoperational Activities This section provides guidance on the development of key documentation and processes required to be in place prior to commissioning or routine operations of an accelerator facility. An example flow diagram for authorization processes is exhibited in Figure 2.1. Documentation addressed in Section 2 of this Guide includes the development of a hazard analysis (HA), SAD, and ASE. Additionally, the ARR process for verifying readiness to operate is addressed. The USI process used to evaluate accelerator facilities, modifications and operations against existing documentation and supporting programs is addressed. The guidance provided is intended to provide an acceptable approach for complying with DOE Order 420.2C requirements for the SAD, ASE, and ARR and USI. The appropriate application of a tailored approach based on the specific circumstances of each particular facility should be used. 2.1 Hazard Analysis Development for New Projects Accelerator projects that go through formal project management reviews as required by DOE Order 413.3B, Program and Project Management for the Acquisition of Capital Assets, normally submit an HA as part of the critical decision (CD) process. A preliminary HA is normally expected during the CD-1 phase. The HA is normally updated during CD-2 and CD-3 phase. The HA addresses the standard and nonstandard hazards expected at the facility but not the risks or credited controls. By the time the project reaches CD-4, the HA should be complete. The SAD could be viewed as an extension of the HA required as part of the critical decision process. Because the HA is the starting point for a safety analysis, it may be advantageous to use the SAD as a means of documenting the HA rather than prepare separate HA documents. Accelerator projects at existing accelerators that require formal project management would follow a similar approach; however, in this instance, the SAD and ASE will already be in place. The SAD and USI process may be used to address 413.3B hazard assessment requirements as appropriate. A project-specific HA may still be developed to meet the needs for project management, and the USI process could be used to determine if the new project potentially introduces significant safety consequences or risk beyond those already addressed in the facility’s SAD. For projects at existing accelerators that do not require a formal project management and CD process, the USI process, coupled with the existing SAD, could be used to address the hazards and risk presented by the project. 2.2 Safety Assessment Document 2.2.1 Purpose and Scope of the Safety Assessment Document The purpose of the SAD is to provide a description of the facility and an analysis of hazards associated with its operation such that the necessary controls and risks associated with operating the facility are clearly understood and described. The SAD serves as the technical basis for the ASE and uses the safety analysis process to identify credited controls. DOE Order 420.2C requires that the SAD DOE O 420.2-1A 9 (and 10) 8-1-2014

 Identify hazards and associated onsite and offsite impacts to workers, the public, and the environment from the facility for both normal operation and credible accidents  Contain sufficient descriptive information and analytical results pertaining to specific hazards and risks identified during the safety analysis process to provide an understanding of risks presented by the proposed operations  Provide detailed descriptions of engineered controls (e.g., interlocks and physical barriers) and administrative measures (e.g., training) put in place to eliminate, control, or mitigate hazards from operation  Include or reference a description of facility function, location, and management organization in addition to details of major facility components and their operation There are distinct advantages in initiating preparation of the SAD early in the design life of a facility. Integrating safety decisions during the early stages of design provides an opportunity to optimize design aspects for safety and may serve to prevent costly retrofitting to correct design shortcomings. For accelerators that are large and complex in nature, the details of civil design and facility engineering may not be available in sufficient detail to provide for an effective assessment at an early stage. In these situations, it may be advantageous to prepare a preliminary SAD to capture the hazard assessment and to provide input into the design as needed to resolve identified safety issues. The SAD should be prepared by representatives of the contractor organization responsible for designing, constructing, and operating the accelerator facility. Professional engineering and professional environment, safety, and health expertise should be used to ensure an effective treatment. The SAD may be prepared by a centralized organization; in such cases, enlisting the participation of the line organization ultimately responsible for operating the facility helps ensure development of a relevant product. Supplemental documents may be referenced in the SAD and/or summarized in the SAD as a means of communicating the requisite information. The SAD should focus on accelerator-specific hazards. Hazards that are safely managed as part of a facility’s overall ISM program and addressed by meeting the requirements of 10 CFR 835, 10 CFR 851 and DOE ES&H directives may not need to be addressed in the SAD. However, where such hazards could serve as initiators or contribute to other evaluated accelerator-specific accidents should be addressed in the SAD. Consideration should be given to interfaces with adjacent structures/facilities as appropriate. For example, include adjacent operations, possible disruption of safety related systems shared between facilities (e.g., fire protection systems), structural impacts, radiation, oxygen deficiency hazards and operational impacts caused by disruption of access or services to other adjacent operations. The development of a SAD should follow a tailored approach. The amount of detail presented and the depth of analysis should be commensurate with relevant site-specific factors such as the magnitude and types of hazards present and the complexity of the facility. Certain advantages may exist in using a modular approach in the SAD which involves the development of separate SADs for different segments (or modules) of a facility. For example, should frequent changes affecting the SAD be anticipated for a particular segment, module or

activity, then that aspect of the facility could be addressed more efficiently in a separate SAD, which might be more readily supplemented or revised as the program develops. D O E O 4 2 0 .2 -1 A 1 1 (an d 1 2 ) 8 -1 -2 0 1 4 Figure 2.1 Example flow diagram for authorization processes. DOE O 420.2-1A 13 8-1-2014 2.2.2 SAD Format and Content The following outline is a SAD format currently used at several facilities. Other formats may be used that might be more amenable to a facility so long as they meet the requirements of DOE Order 420.2C. This section addresses acceptable approaches to meeting the requirement to provide a description of the facility function, location, details of major facility components and their operation, and management organization. Introduction—this chapter provides introductory material and addresses the scope of the document. Summary/Conclusions—this chapter provides an executive summary and an overview of the results and conclusions of the safety analysis. Site, Facility and Operations Description—This chapter provides a description of the site, facility, and facility operations that addresses the overall facility, major facility components, their operations, and support systems that relate to safety. The operations description should support the safety analysis. Design features that help ensure safety, such as permanent shielding, should be suitably addressed.  Facility function—an overview of the facility function and use (e.g., types of science/experiments to be conducted) should be provided.  Facility location—the accelerator site location should be characterized as appropriate, including any special site requirements or unusual design criteria including site geography, seismology, meteorology, hydrogeology, demography, and adjacent facilities, as appropriate. A tailored approach should be used that narrows this discussion to those points relevant to the safe operation of the accelerator facility. Safety Analysis—the safety analysis methodology and results are described to allow an understanding of the hazards posed by operation, including how hazards are identified and the methods used to evaluate impacts. The analysis should include;  Design criteria and as-built characteristics of the accelerator, its supporting systems and components with safety-related functions with sufficient detailed to support the hazard evaluation  Hazard evaluation information that includes credible initiating events, assumptions used in estimating the impacts, impacts, and controls required to reduce hazards and associated risk to acceptable levels Accelerator Safety Envelope—the ASE defines physical and administrative bounding conditions and credited controls for safe operation, including both engineered and administrative controls. The ASE may be incorporated into the SAD or may be submitted as a separate document. Credited Management Systems and Safety Programs—this chapter should describe those safety management systems and administrative programs that are credited to help ensure safety of the worker, the public, and the environment. It should include a summary description of the facility organizational structure for routine operation or commissioning, whichever is applicable. 14 DOE G 420.2-1A 8-1-2014 A delineation of safety-related roles, responsibilities, and authorities should be addressed, including those for configuration management (CM), internal review processes, safety-related

administrative controls, management of safety-related procedures and training, credited engineered controls and related management systems, other safety controls, and management of records. The level of detail should be tailored based on the needs of each particular facility. References—the reference documents supporting information for the SAD (e.g., shielding policy, site/facility environmental assessment, physics packages) should be included in this chapter. 2.2.3 Safety Analysis The common elements of a safety analysis process include design criteria, hazard identification, and an evaluation of probability and consequence of potential accidents, an identification of necessary controls, an evaluation of the effectiveness of controls, an evaluation of risk, and an assessment of whether risks are acceptably managed. The safety analysis methodology for each facility (or site, as appropriate) should be clearly described. The SAD should survey hazards present at the accelerator facility, including a characterization and inventory of hazards; energy sources; and potential sources of environmental pollution, including the form, type, location, and total quantity of radiological hazards. The entire accelerator facility operation, including supporting systems and components with safety-related functions, ancillary support facilities/activities, should be included in the safety analysis. Identified hazards should be “screened” to determine which need further consideration. The hazard evaluation process and information should include credible initiating events, impacts, and controls required to reduce hazards and associated risk to acceptable levels. For example, standard industrial and laboratory hazards that are adequately addressed by the facility’s institutional safety management programs need not be analyzed further in the analysis except as potential initiators for accidents related to specific accelerator processes. These ISM program(s) should be appropriately referenced. The safety analysis should focus on accelerator-specific hazards that are distinctive to the accelerator and not completely addressed by the ISM programs in place. Accelerator-specific hazards may include, for example, beam loss radiation, beam target interactions, oxygen deficiency, vacuum systems, beam related air contaminants, toxic materials, sulfur hexafluoride (SF6) and nanoparticles. For example, some facilities have determined that the nature and magnitude of oxygen deficiency hazard inside the accelerator tunnels was not adequately addressed by the existing ISM oxygen deficiency program and therefore warranted further assessment within the SAD. The SAD does not need to duplicate the facility’s ISM programs; however, specific hazards associated with the accelerator facility and its operations should be adequately addressed. Another example is target risk at high-energy high-intensity accelerators. Some accelerator facilities use a formal path for safety analysis of targets. Safety analysis should address overheating and/or breaking due to beam power and the need for protections from a potential contamination event. This could result in imposing greater formality on 1) interlocks, and 2) control of intensity limits for a particular target design. DOE O 420.2-1A 15 8-1-2014 The safety analysis should be tailored based on the complexity of the facility and the magnitude of its potential impacts. The analysis should be comprehensive and explore the full

range of impacts each hazard could have on workers, the public, and the environment. The potential impacts associated with identified hazards are to be evaluated. The evaluation involves postulating a range of accidental and off-normal events and evaluating potential consequences as well as frequency of occurrence. Methods that can be used to analyze hazards and risk include techniques such as: HAZOP - HAZard and OPerability study, FME(C) A - Failure Mode Effect (and Criticality) Analysis, and FTD - Fault Tree Analysis. A range of credible accident scenarios should be evaluated to fully understand potential impacts. Radiological shielding analysis and modeling efforts in support of the safety analysis may be based on the use of commercial or widely accepted public domain software packages, such as Microshield, MARS, FLUKA, MCNP, LAHET, and EGS. The appropriate level of detail involved in the evaluation of postulated consequences could range from a simple qualitative assessment of acceptable versus unacceptable consequences, to a sophisticated risk assessment in which consequences are quantified and categorized as a function of severity (e.g., minor, moderate, serious, catastrophic), and frequency of occurrence is factored into the estimate of acceptable risk. The appropriate level of detail involved in the evaluation of event frequencies could range from a qualitative determination of whether an event is credible to a sophisticated quantitative failure analysis based on system-specific information (e.g., propagation of documented component failure probabilities). Some analytical approaches sort event frequency estimates into a number of qualitative or quantitative “bins” or categories to facilitate a more quantitative analysis of impacts. The analysis should be based on conservative, yet sound and realistic, assumptions. Where considerable uncertainty exists, assumptions should be selected carefully to ensure a sensible and defensible outcome the limitations of which are readily understood. Implicit in the discussion is that analysis involves professional judgment. This judgment should be based on sound technical and/or scientific bases, using accepted HA methods suitable for the hazard types and magnitudes. Tailoring to the needs of the facility should be clearly described as part of the methodology. Once the postulated consequences and frequency of occurrence of accidents or failures are understood, the acceptability of risk may be evaluated. “Risk” may be defined as an estimate of the probability of occurrence of a hazard-related incident and the severity of the consequence associated with such an incident. The amount of rigor employed to assess risk should be a function of facility-specific factors such as the hazard magnitudes and types and the size and complexity of the facility. For example, as complexity increases, it may be advantageous to move from qualitative to semi- quantitative risk analysis. A rigorous quantitative determination of risk is usually not required. Semi-quantitative and qualitative estimates should be acceptable in most cases. Simply using best professional judgment and process knowledge is often sufficient for estimating risk. A low-energy accelerator facility with no off-site consequences and few failure mechanisms probably would not benefit from a detailed risk analyses; whereas at a more complex facility with the potential for greater impacts, such an approach might be very helpful in

identifying appropriate controls and determining the acceptability of risks posed by the facility. 16 DOE G 420.2-1A 8-1-2014 If an analysis were to show that all risks are acceptable, then no controls would be required to manage risk. However, accelerator operations generally involve some hazards that pose unacceptable risk (e.g., personnel exposure to direct beam), which signifies the need to identify control(s) to reduce risk to acceptable levels. Identification of the safety function(s) of controls should be clearly stated to facilitate the evaluation of both credited and engineered controls. Controls are identified as appropriate to eliminate, control, or mitigate risks determined to be unacceptable. Once the need for a control has been identified, an appropriate control for the circumstance is selected. Selection of appropriate controls must follow the “hierarchy of controls” (Elimination or substitution, Engineering, Work Practices and Administrative, and lastly Personal Protection) and may involve choosing from several controls that could potentially function to control the hazard. The following are some general Guidelines regarding the selection of appropriate controls, fully realizing that the Guidelines will not be appropriate for all situations and that engineering judgment and program constraints should be taken into account when selecting controls.  Engineered controls are preferred to administrative controls based on the assumed higher reliability of an engineered control versus human actions. Passive engineered controls are generally preferred over active engineered controls based on the assumed higher reliability of passive controls. Controls that would prevent an event are generally preferred over controls that would mitigate the event.  An evaluation that shows that selected controls effectively eliminate or mitigate hazards should be provided as needed. Identified controls should be evaluated to determine which, if any, are to be designated as credited controls. A credited control is one determined through hazard evaluation to be essential for safe operation directly related to the protection of personnel or the environment. It is strongly recommended that only those items essential for safe operation directly related to the protection of personnel and the environment be selected as credited controls. The credited controls should, in general, consist of a limited subset of the total number of controls employed for overall facility operation. This approach allows for a higher degree of operational assurance and resources (e.g., monitoring, surveillance, maintenance, control of documentation, etc.) to be devoted to the credited controls.  Identification of the maximum credible accident scenario with the worst-case consequences may provide a useful perspective on the magnitude of potential risks associated with the facility and may provide information helpful for emergency planning or site assistance agreements. Depending on the facility, there may be significant accelerator-related nonradiological accident scenarios that are more limiting in terms of consequences. Such nonradiological scenarios should also be captured in the accident analysis.  The safety analyses must conclude that all risks have been reduced to acceptable levels through either controls and/or limits on the operation (e.g., beam power) of the facility. It is recognized that several acceptable approaches for performing safety analyses exist that

differ in detail but have been effectively used at DOE accelerator facilities. Some useful references on hazard and risk analyses methods are provided in Appendix A. DOE O 420.2-1A 17 8-1-2014 2.2.4 SAD Review and Approval Process The following steps are recommended for the internal review of SADs by DOE contractors:  Representatives of an organization approved by contractor management should provide an internal review of the SAD. It is highly desirable that some of the reviewers be significantly independent of the preparers of the document to allow them to render an impartial review. It is not uncommon for multiple iterations to be required to ensure a credible, comprehensive, unified, and understandable SAD.  The contractor management review should be documented with a level of formality that expedites completion of the document and convergence of responses to comments.  Senior contractor management should demonstrate approval of the SAD by means of a documented protocol.  The approved SAD should be maintained in the contractor’s permanent records in accordance with applicable DOE requirements. Although the posting of a SAD on a web site may be an acceptable mechanism for accessibility, particular care should be taken to ensure protection and permanent retention of the document.  The DOE Field Element Manager and NNSA Organization having jurisdiction for the accelerator facility should be made aware of the SAD preparation status and receive advance notification of changes to the safety assessment documentation that may affect the ASE and/or project milestone completion status specified by other DOE requirements. 2.3 Accelerator Safety Envelope 2.3.1 Purpose and Scope The ASE is based upon the SAD safety analysis. The ASE serves as a high-level safety document that defines the physical and administrative bounding conditions and controls to ensure safe accelerator operations. The ASE is also a documentation of the DOE/contractor agreed-upon requirements for commissioning or operations. It is recommended that the scope of the ASE focus on controls and limits considered essential for safe operations as identified in the SAD safety analysis. It is also recommended that it include operational requirements based on the safety analysis included in the SAD. Other operational requirements should be addressed in documents other than the SAD and ASE. Preparation of the ASE requires close communication among; accelerator designers, accelerator physicists and engineers charged with construction of the accelerator facility, and accelerator operators, end-users and support staff to ensure that machine performance and beam characteristics meet desired specifications and controls are adequate to ensure safe operation. Accelerators are typically designed to accommodate transient events during normal operation, such as partial or total loss of beam or loss of electrical power, without degradation of safety status. The ASE should be carefully written to ensure such transient events would not 18 DOE G 420.2-1A 8-1-2014 constitute noncompliance with the ASE. Noncompliance with the ASE constitutes a reportable safety matter. Where the research mission of the accelerator facility requires frequent reconfiguration, new hardware, new experimental setups, or new materials, the ASE is particularly important. The contractor may choose to prepare a separate ASE for each experiment or group of experiments,

or to include the entire facility and anticipated experiments into a single ASE. Because the ASE is based on the SAD safety analysis, such an approach may be consistent with a modular approach to the SAD in which a separate SAD or SAD addendum would be developed to support each ASE. Strict adherence to the approved bounding conditions of the ASE is expected during all commissioning and operations activities. It may be advisable to establish an “accelerator operations envelope” (AOE) with limits more conservative than those addressed in the ASE as an aid to ensure the ASE is not exceeded. Other limitations, controls, and restrictions not directly based on the SAD safety analysis also could be addressed in the AOE. The contractor may also choose to establish an accelerator operations envelope for different types of accelerator operations. Different accelerator operations envelopes for different operating modes of an accelerator may be expected for an experimental environment, since the combinations of operating parameters or operational safety limits may need to change to carry out different sets of experiments. As an adjunct to an administrative accelerator operations envelope, several accelerators use routine operating procedures to keep beam parameters set below the ASE safety limits. These parameters are measured and are alarmed in the control room, and the alarms alert the operator to implement the procedure to bring accelerator operations back within the established parameters before ASE limits are exceeded. It is noted that a proposed activity expected to exceed the requirements of the ASE must be approved by DOE before that activity occurs. 2.3.2 ASE Format The following outline describes the structure of an ASE currently used at several accelerator facilities. Other formats may be used so long as the content of the ASE meets the requirements of DOE Order 420.2C. Introduction—the introduction to the ASE identifies the accelerator facility, the date of the initial ASE for the facility, the dates of any subsequent ASE revisions, and the contractor and DOE approvals for the current ASE. Assumptions and Credited Controls—this portion of the ASE summarizes the assumptions and credited controls that limit accelerator operations and upon which the maximum credible incidents in the safety analyses were based. For example, maximum beam energy, or beam power upon which shielding was based, may be listed in the ASE. This portion of the ASE also describes the credited controls that must be operational during operation with beam, or whenever other nonstandard industrial hazards are present in the accelerator. For example, this portion of the ASE may state that the access control system (ACS) must be operable when particle beams are in the accelerator. DOE O 420.2-1A 19 8-1-2014 Credited Control Systems—this section of the ASE describes the various systems assumed in the safety analysis to support the credited controls. For example, this portion may indicate that beam line shielding for the accelerator enclosure must be in the appropriate locations for beam operations, or it may indicate that area radiation monitors interfaced with the ACS must be in their appropriate locations. In addition, consideration should be given to Credited Management Systems, Safety and administrative programs that are credited to help ensure safety of the worker, the public, and the environment, i.e., management of safety-related procedures and

training. Credited Control Testing and Inspection—this portion of the ASE includes information on testing and inspection of systems (e.g., interlock, monitoring, detection, ventilation) that comprise or support credited controls with designated time frames for testing and recertification. Non-routine Operational Considerations—the ASE should describe the latitude allowing for continued safe operation in situations where required systems, devices, and credited controls may not be in place or fully operable. Contractor-approved compensatory measures, alternatives to credited controls, and a summary of emergency actions needed to protect the worker, the public, and the environment should be provided. 2.3.3 ASE Content The physical and administrative credited controls identified in the safety analyses in the SAD are to be addressed as appropriate in the ASE. This is to ensure that these controls are maintained operational in the manner intended in order to ensure safe operation. Careful specification of ASE requirements to facilitate the demonstration of compliance is an advantage. For example, operability of the ACS as intended can be signed off by the person responsible for the ACS and accelerator operators; managers and auditors can examine this record in the control room. Assumptions and credited controls identified in the SAD safety analysis will vary based on the facility-specific characteristics and may include the following:  limits on operating variables (e.g., currents, voltages, energy potentials, beam power, pressures, temperatures, flows) essential to safety  description of specific safety function of credited engineered controls  requirements to ensure credited engineered controls are maintained operational (e.g., calibration, testing, maintenance, or inspection) to ensure continued reliability  requirements to ensure administrative and engineered controls assumed in the safety analyses that support the credited controls remain up-to-date and operational  examples of systems assumed in a safety analysis to protect against radiation, oxygen deficiency, flammable gas, and fire/smoke inhalation hazards Typical assumptions to protect against radiation hazards may include configuration management and control of the following:  Shielding is in the correct location (e.g., berms, shield blocks) to provide for radiation protection.  ACSs that remove beam or shut down radio frequency devices when excessive beam loss or radiation exposure occurs are operating as designed. 20 DOE G 420.2-1A 8-1-2014  Radiation monitors are interfaced with the ACS at the correct location to remove beam when excessive beam loss is sensed or turn off radio frequency devices when excessive radiation is produced. Typical assumptions in the safety analysis to protect against ODH hazards may include these:  Emergency exhaust fan systems are operable to remove hazardous gases when a potential oxygen deficiency environment is possible.  The ACS is operable to limit access to an area when an oxygen deficiency hazard is present.  Approved alternatives that may include an escape pack or a self-contained breathing apparatus and a portable oxygen monitor are available and personnel are trained in their use. Typical assumptions in a safety analysis to protect against flammable gas hazards may include these:  Flammable gas detection systems are operable to detect a significant flammable gas hazard.

 Emergency exhaust fan systems are operable and can be activated during an emergency situation.  Inert purge gas is available in sufficient volume to dilute flammable gas volumes below the lower explosive limit. Typical assumptions in a safety analysis to protect against fire/smoke inhalation hazards may include the following:  Evacuation plans are in place and personnel are knowledgeable of the safe exit paths from a hazardous area.  Emergency equipment that may include breathing apparatus and monitors are available to be used until fan operability can be restored.  Emergency ventilation systems are operable with backup emergency power so that they may be activated during an emergency situation. It may be desirable to include within the ASE the latitude to allow for continued safe operation in those situations in which a required system or device classified as a credited control may not be in place or fully operable. In such circumstances, the development of an approved alternative would be beneficial. For example, changes within an accelerator facility requiring changes in credited controls, while the overall operating envelope of the machine remains consistent may require an additional or alternative approval or authorization process. Where an accelerator facility has an additional process for authorizing operations, e.g., Beam Authorization, that additional process should include requirements for specific controls that must be in place for operations. The ASE should describe the process and credited controls and incorporate the specific authorization and conditions. If a credited control or an approved alternative is not in place, accelerator operations that rely upon the credited control must be stopped as soon as possible and the accelerator facility, equipment or module placed into a safe configuration. A departure from the use of credited DOE O 420.2-1A 21 8-1-2014 controls or an approved alternative must be treated as a violation of the ASE and reported as an occurrence. Modification of credited controls requires approval by accelerator facility management. It should be noted that modifications to credited controls would require a review of other accelerator safety requirements. Emergency actions may be taken that depart from credited controls when such actions are needed to protect the public, the worker, or the environment. The emergency actions should be approved by facility management as defined in facility operating procedures. 2.3.4 ASE Review and Approval Process The ASE should be reviewed as part of the ARR process and should receive contractor and DOE review and approval before the start of commissioning and/or routine operations as appropriate. The ASE shall be based on a safety analysis as documented in an approved SAD. For new accelerator facilities or modules, the review of the ASE may be conducted as an integral part of the overall accelerator readiness review process. Contractor line management should select appropriate individual(s) to review the ASE. It is highly desirable that operations personnel be represented to ensure practical, operations-friendly wording. Senior contractor management should demonstrate approval of the ASE by means of a documented protocol. The approved ASE should be maintained in the contractor’s permanent records in accordance with applicable DOE requirements. Although the posting of an ASE on a

web site may be an acceptable mechanism for accessibility, particular care should be taken to ensure the electronic document is secure and configuration-controlled. The DOE Field Element Manager and NNSA Organization having jurisdiction approves the ASE, except at accelerator facilities at which the site boundary consequences for credible postulated accident scenarios potentially exceed 1 rem (0.01Sv) and/or ERPG-2. For such facilities, the DOE PSO/NNSA Administrator must approve the ASE. Review by DOE should be conducted using a tailored approach based upon the scope and nature of the accelerator facility or module addressed by the ASE. 2.3.5 ASE Implementation Any activity violating the ASE must be terminated immediately and the accelerator facility or affected operations placed in a safe and stable configuration as appropriate. Activities that violate the ASE might include exceeding ASE-specified limits on operation parameters (e.g., beam intensity limits) and/or operating without ASE-required controls in place. Any activity that was shut down by DOE must not recommence until DOE approves the activity. If a planned operational activity would result in exceeding the boundaries or limits in the ASE, DOE approval of the activity is required. This may include, but is not limited to, experimental beam tests of future operation modes that would be at a higher power compared with the current ASE bounding conditions. Planned changes to operations or equipment are the primary reason for a USI process, which is a process to force thoughtful review for safety before a change occurs. Operating limitations of the ASE should be readily verifiable to facilitate demonstration of compliance. Variations of operating parameters within an appropriate accelerator operations envelope would still be considered normal operations. Variation outside an established 22 DOE G 420.2-1A 8-1-2014 accelerator operations envelope, but within the ASE, merits appropriate attention but does not require termination of activities or notification of DOE. It is important to note that shutting down an activity in response to an ASE noncompliance does not automatically extend to the entire facility operation. The decision to terminate an activity or set of activities associated with an ASE noncompliance are based upon the scope and nature of the accelerator activity in question and the associated ASE bounding conditions and controls. Accelerator managers and operators should consider operational and emergency notifications to the DOE field element as appropriate. 2.3.6 Oversight of ASE Implementation If a planned operational activity would result in a noncompliance with the ASE, DOE approval of that activity is required. This may include, but is not limited to, experimental beam tests of future operation modes that would be at a higher power than the planned ASE bounding conditions. If an activity being conducted is found to exceed the approved ASE limits, the contractor must terminate activity and the affected accelerator system(s) must be put in a safe and stable configuration as soon as it is safe to do so. The contractor should notify the local DOE authority should an ASE noncompliance occur. Use of a recognized causal analysis process should be considered as appropriate to determine the root cause of the ASE noncompliance. A report outlining the cause of the incident and describing actions taken to mitigate future occurrences should be completed. The DOE field

element should be informed of any corrective actions prior to restart activities. If the ASE noncompliance leads to a DOE-mandated shutdown, DOE approval is required before restart of the activity. 2.3.7 ASE Updates and Revisions The ASE may need to be updated for a variety for reasons as a result of planned facility modifications, desired updates to operational limitations/controls, or other planned activities. The contractor should have practices in place that trigger the USI review process for equipment and operations changes. Updates to the ASE may be an outcome of this USI review process. Contractors may also identify opportunities to refine the language and parameters in the ASE to better represent current operational conditions. The implementation of technological advances may or may not require a revision of the ASE. Periodic reviews of the ASE play an important role in ensuring that the ASE is maintained current, and they may serve to identify material that needs to be updated. Such reviews should be conducted by the appropriate reviewer(s) as determined by contractor management. The technical basis for any modification to the ASE should be supported by a safety analysis in the form of a revision or an addendum to the SAD. The documented analysis made available during the USI review process may serve as the addendum to the SAD. If the ASE requires revision, it must be submitted to DOE for approval before running under the revised parameters according to the accepted ASE review and approval process. DOE O 420.2-1A 23 8-1-2014 The methodology to be used by DOE to review and approve the revised ASE should be scaled to the scope and nature of the accelerator facility and level of significance of the proposed revision. All revisions to an ASE should be documented as part of the permanent record of the accelerator facility. 2.4 Procedures Program Development for Safe Operations 2.4.1 General Considerations Title 10 CFR 835 establishes requirements for written procedures and 10 CFR 851 establishes requirements for procedures to incorporate hazard controls. The following considerations should be incorporated into the development of procedures as part of an administrative controls program:  Before operation begins, an effort should be made to identify what procedures need to be written and to write them, understanding that they may lack the benefit of operational experience. The best operations procedures are written in the operator’s own words.  Lessons learned from commissioning and initial operations provide an opportunity to improve procedures and identify additional procedures that are needed. A good practice within the accelerator community has been the practice of discussions across laboratories on operational issues associated with similar facilities and equipment.  Procedures should provide specific direction to ensure safe operations for processes, systems, and equipment during routine, nonroutine, and emergency conditions. The scope and level of detail of written procedures should be a function of the facility hazards, operational complexity, and workforce expertise.  The format of the written procedure may be customized for the specific facility or task. Uniformity in the format of written procedures at an individual facility is highly recommended to facilitate clearer understanding. Topics for consideration during the development of an appropriate facility-specific procedure format could include items such as

 objective of the procedure  roles and responsibilities for individuals or organizations as they pertain to the successful execution of the procedure  identification of the hazards associated with the activity  safety and health precautions and controls  descriptions of tasks to be performed  requirements for initial conditions to be verified  operating conditions to be maintained  instructions at the appropriate level of detail for performing the task  data to be recorded 24 DOE G 420.2-1A 8-1-2014  record keeping and logs  review and approval status  effective date of issuance Procedure developers should consider identifying which procedures or procedural steps implement ASE requirements to point out their importance and to ensure compliance with ASE requirements. Procedure developers should consider establishing a policy for how to deal with procedural steps that cannot be followed or that are questioned by users. Consideration should be given to identifying or categorizing procedures based on use expectations. Employing a classification scheme similar to the following has proved useful at some facilities.  Continuous-use procedures might be appropriate for complex or infrequent work activities for which consequences of an improper action could have immediate, possibly irreversible impact on safety, mission, or reliability. An example might be manipulating an accelerator target containing significant amounts of radioactivity. Expectations associated with continuous use procedures assume procedure users o read and understand each step before performing the step o complete each step before starting the next step o complete the steps as written in the sequence specified o use a place-keeping method o keep the procedure open to the appropriate step at the location of the activity continuously  Reference-use procedures might be appropriate for complex or infrequent work activities for which the consequences of an improper action are reversible. An example might be lining up valve positions for cool down of a cryogenic system. Expectations associated with reference use procedures assume procedure users o review and understand segments of the procedure before performing the work o perform some procedure segments from memory o use place-keeping as needed o keep the procedure or associated checklist available at the work site o review the procedure or associated checklist at the completion of the task  Information-use procedures might be appropriate for work activities that have no immediate negative consequences if performed improperly. Such activities might include tasks that are performed frequently and those that could be completed based on operator knowledge and skills. Consideration should be given to the scope of the activity being covered by the procedure and this should be clearly defined. An example might include performing equipment or experiment rounds. Expectations associated with information use procedures assume that users DOE O 420.2-1A 25 8-1-2014 o may perform activities from memory o review the procedure before using it if the work activity has not been done before o keep the procedure available for review as needed o establishing clearly defined work scopes for "skill-of-the-craft" type activities. 2.4.2 Procedural Topics Procedures for the safe operation of an accelerator facility should cover routine operations

and maintenance and responses to off-normal and emergency situations. The following are some topics that could be considered in developing a comprehensive set of procedures:  Routine startup of systems  Non-Routine startup (extended downtimes and significant modifications)  Normal operation of systems  Shutdown of systems  Response to abnormal and emergency conditions  Response to alarms  Conduct of maintenance  Equipment/system removal from service and return to service  Testing and maintenance of accelerator safety systems/credited controls  Inspection checklists  Operator rounds  Approval and conduct of experiments  Management of safety-related changes  Management of compressed gases, i.e., SF6 use, storage, capture, reuse, recycle, and disposition  USI process  Configuration/movement of shielding  ACS operation procedures  Sweep procedures for accelerator enclosures  Response to water leaks  Review and approval of facility modifications  Control of facility access  Log-keeping  Procedures to ensure ASE requirements are met 26 DOE G 420.2-1A 8-1-2014  Procedures for how to communicate inoperable alarms, or temporary set points  Reporting and next-up notifications—for example, what events/conditions require notifications, whom to notify, record keeping  Operational safety limits (e.g., maximum rad levels, cryogenic pressures, flammable gas pressures) 2.4.3 Establishing Policy for Controlling and Maintenance of Procedures Procedures should be maintained as controlled documents with approval status and effective dates clearly indicated. A procedure on controlling and maintaining procedures may address topics such as the following:  format to be used  revision process  instructions for reviewing, authorizing, revising, canceling, distributing, and ensuring training  how to implement/rescind temporary changes  how to make sure controlled versions are used Procedure developers should consider establishing a process to ensure periodic review of ASE, operational and/or safety-related procedures. Issues such as task complexity and associated hazard should be considered in determining the technical disciplines and level of management attention necessary for approval and the frequency of review. A process should be developed to ensure revisions are communicated to the responsible parties in a manner that clearly identifies obsolete versions. Each DOE site has a configuration management program and procedures should be considered an important element to ensure they are controlled and maintained. 2.5 Training Program Development for Safe Operations Title 10 CFR 835 and 851 establish requirements for education, training, skills, and qualification of individuals responsible for implementing safety and health measures and all workers who may be exposed to hazards. The purpose of this section is to offer guidance in the development of a suitable training program for accelerator-specific activities to assist the contractor in achieving DOE approval to commission or routinely operate a facility. Guidance for implementing the training program during the operations and post-operations phase of the facility lifetime is addressed in later sections of this Guide. 2.5.1 General Considerations A tailored training approach, based on a facility’s complexity and potential impacts, to developing an appropriate facility-specific training program should be considered. For example,

a simple low-energy, small-staff accelerator might require only minimal programs to ensure safe operation, whereas a high-power complex facility might require very comprehensive programs. Additionally, a tailored approach to the level of training applied to different modules within the DOE O 420.2-1A 27 8-1-2014 same facility may be advantageous should a particular module be significantly different in hazard types or complexity from the other modules of the same facility. A trained and qualified workforce is essential to the safe and environmentally responsible operation of accelerators. Training serves as the primary means of familiarizing personnel with operations hazards, and communicating the required actions. Accelerator management should grant qualification to an individual based upon a review of that person’s credentials and experience, or through documented training, or through a combination of both. Safe and efficient operation of the accelerator should be emphasized in all training programs. An appropriate understanding of the physics and engineering principles underlying key operations and the development of diagnostic skills for early recognition of abnormal equipment performance is important. Training should also convey an understanding of the regulatory requirements associated with a particular hazardous operation. 2.5.2 Training Program Elements/Content The major elements of the training program are to be in place before initial accelerator- commissioning activities begin and should be reviewed as part of the ARR process. It should be recognized that specific requirements for safety and health training are contained in 10 CFR 835 and 851. The training programs pertaining to accelerator operations will be subject to revision based on operational experience gained. This section provides guidance for establishing the major elements of the training program, and subsequent sections provide guidance on specific training pertinent during operations and decommissioning. Elements of a facility’s accelerator training program might address topics such as  authorizations and policies  ASE and credited controls  startup and operations protocols  emergency procedures  operation of unique processes  quality, safety, and health programs  environmental protection  USI process  radiation protection How the organization administers its training and qualification programs should be described in a controlled document. It is good practice to have a designated senior line management official approve the overall training program and ensure that a process is in place for periodic evaluation of the program’s adequacy. Management should incorporate the accelerator training developed to implement the ASO into the overall training program. A qualification process for personnel whose activities could affect the safety and health of themselves or others is necessary to ensure each person’s competence to safely undertake the 28 DOE G 420.2-1A 8-1-2014 proposed activity. Consider establishing minimum training requirements for all individuals who work in and around the accelerator facility with a focus on activities that could affect the working environment. Limiting access to the site or facility to trained and qualified personnel is a good practice. Trainees should only be given authorization to access the facility when they are under the direct supervision of trained and qualified persons. Personnel performing accelerator-related activities

such as commissioning or operational tasks that may affect safety and health should be trained and qualified through the documented training process. In addition to initial training and qualification, and a general safety orientation addressing facility-specific hazards, requalification requirements for operations, maintenance, and support personnel and for experimenters to carry out their responsibilities safely may be required and should be developed based on the unique hazards of the facility. For some procedures, managers could confirm appropriate monitoring and training of personnel with periodic testing or performance reviews. Accelerator managers should train accelerator or supporting-system operators on the layout of systems and equipment, and on system interactions that directly relate to their responsibilities. Training at accelerators typically covers the following safety topics using a tailored approach based on the individual’s responsibilities:  the SAD, providing it provides an overview of potential accelerator-specific accidents and potential consequences  the ASE, including the bases for each ASE requirement, to provide an understanding of the importance of satisfying each ASE requirement and the reason that it is specified  normal, off-normal, and emergency procedures  the USI process, which ensures that any new or modified systems satisfy the assumptions and the safety analysis Training for maintenance and other support personnel is required by 10 CFR 851. During this training, special emphasis should be placed on the accelerator structures, systems, and components related to safety and identified in the SAD if work is to be performed on those structures or equipment. These systems are often identified in the ASE as credited controls. This training should include experimental components and systems that are important to worker safety and health and/or protection of the public and environment. The training should also take into account specific duties the individuals will perform and the level of supervision required. Use of the facility-specific portion of the training to communicate information about local work hazards and their control and to convey knowledge of safe operating procedures should be considered. Facility-specific training could include, but is not restricted to, such topics as:  oxygen-deficiency hazards  controlled-entry procedures into accelerator enclosures  control of activated material  primary and secondary beam control DOE O 420.2-1A 29 8-1-2014 It is good practice to train all personnel assigned to or using the accelerator facility, including emergency response personnel, in the safety and health practices and emergency plans consistent with their involvement and the hazards present. At a minimum, a general safety orientation for all personnel permitted unescorted access to the facility should be considered, addressing hazards to be encountered, actions to minimize or mitigate exposure to the hazards, and the unescorted person’s role in the emergency response plan. Examples of topics to address in this process include but are not limited to  emergency notification and evacuation procedures  safety characteristics of the facility  radiation-safety practices It is a good practice to not permit users or experimenters unescorted access to an accelerator facility until they have satisfactorily completed the general safety orientation and appropriate

portions of the facility-specific training. Practices that users or experimenters may follow at their home institutions may be quite different from those used at the host DOE institution. Because users come from many different institutions throughout the world, they may be initially unfamiliar with the safety expectations of the DOE accelerator community. This lack of familiarity and support, coupled with potential pressures of limited beam time and high research expectations, may create stresses on the safety program. In addition, some user groups may assume responsibility for the operation of a beam line or an accelerator module, adding further challenges to the operational and ESH programs. Training should account for this lack of familiarity with facility practices. Retraining of experimenters, users and other personnel who have intermittent experience at the facility, or when site conditions have significantly changed since their initial training, should be considered. It is critically important to ensure the proper training of all experimenters and users at the accelerator facility, regardless of their time in residence, because their activities under some circumstances can greatly affect the safety of themselves and others. Experimenters should be required to demonstrate appropriate knowledge of the hazards for the systems with which they are involved, and the means of controlling them, before management permits them to interface their experimental equipment with the accelerator or engage independently in experimental work at the accelerator or accelerator facilities. Training should account for language and cultural differences. Processes should be considered for assessing proficiency and granting qualifications that set minimum proficiency levels to qualify to perform safety-related functions without direct supervision. Processes for describing how to maintain the acquired qualification should also be considered. Qualification may be valid for a specified time established by management for each position, after which the person should be requalified in accordance with established requirements. Processes for granting exceptions to specific areas of the training program based on an individual’s prior education, certifications, and experience should be considered. It is good practice to document the basis for granting an exception. 30 DOE G 420.2-1A 8-1-2014 2.5.3 Training Documentation Maintaining documentation for operations personnel and users, including an auditable record of training received (e.g., examination results, qualifications) should be considered. Operations personnel is intended to include several disciplines including but not limited to; maintenance staff and engineers, particularly staff responsible for design, testing and maintenance for safety- related systems and credited controls. Suggested documentation may include:  education, relevant experience, certifications  status of health evaluation where directly relevant to facility and personnel safety, maintained in compliance with medical privacy requirements  most recent, graded, written examinations in each training element  written critiques of task performance during training, including tasks observed and overall conclusion of the evaluator  summary of training attendance, training completed, proficiency demonstrated, and other information used as the basis for judging whether the individual was qualified

 documentation of qualification and consider the signature of the qualifying official  documentation of the basis for granting an exemption to a training element It is good practice to document training and qualification of individuals and to ensure individuals keep their qualifications current. Retention of training records (types of records and duration of retention) may be specified at the institutional level. 2.6 Unreviewed Safety Issue Process Development The USI process allows for the evaluation of accelerator facilities and operations that have the potential to significantly impact safety. The USI process allows for each facility or site to develop a framework, such as a risk table, that addresses the safety or hazard analysis for a significant increase in the probability or consequence of an analyzed or unanalyzed event. The USI process should address modifications to documentation, systems, or components, and the facility, including new activities. CM should be used as a tool to flow significant changes in documentation, systems, or components to initiate a USI process whenever those changes impact on accelerator safety requirements. The USI process should focus primarily on preventing a change from significantly affecting safety of the accelerator facility, and if necessary, the USI process should be used to support a discovery or an “as-found condition” that impacts on safety. As part of the USI process, the contractor should evaluate or screen proposed changes to accelerator facilities, approved documentation, operations, or the organization. The contractor should ensure work control processes evaluate maintenance on credited controls, occurrences at other accelerator facilities, and new experiments. Figure 2.2 shows an example flow diagram for a USI process. Hazard analysis, safety analysis, contractor assurance programs, the SAD, the ASE, and ARR processes are all critical elements of an effective accelerator safety program. These critical elements may all be connected to or interface with a USI process. A USI process should be in place as early as possible; it is necessary that it be in place and functioning prior to the DOE O 420.2-1A 31 8-1-2014 commissioning and operations phases of a facility. The USI process is a key process during facility modification of critical accelerator safety or control systems or during significant operations changes (e.g., beam type, decreased beam-energy, increased beam-energy, increased beam power). The USI process may be used to help determine needed changes to the SAD and ASE during reviews that follow an incident at an accelerator facility; however, bringing an after-the-fact incident through the USI process is not the primary purpose or use of the USI process. It should be noted that a USI process can help establish specific program parameters after an incident, e.g., was the event previously analyzed, was the consequence of the event properly addressed and evaluated. Accelerator management should use a reasonable amount of time to confirm the existence and significance of a discovery safety issue. If a discovery is confirmed to exist and is determined to represent a significant increase in the probability of or consequences from an accident or condition, then accelerator management must communicate the concern to the DOE field element. The DOE field element should work with the contractor and consider whether

interim actions are required, including facility shutdown until the safety issue is resolved. If operations can go forward with alternate protection providing equivalent safety, as agreed upon by the DOE field element, then accelerator management should document the alternate protection. The USI process is not a substitute for a safety analysis. The purpose of the USI process is (1) to inform the DOE field element of discoveries or proposed changes in activities judged to significantly affect the previously accepted risks and (2) to ensure that the DOE field element is aware of proposed changes or discoveries that significantly increase risk. The USI process does not determine the safety of a proposed change or discovery. Rather, the accelerator manager does that through a safety analysis. The USI process provides a structured approach for decision making and helps to determine who should approve the proposed change or continued operation after a discovery; that is, determine whether accelerator management or the DOE field element is the approver. The USI process should allow accelerator management flexibility to make changes to accelerator facilities and experiments and to operate the accelerators and experiments without prior DOE field element approval as long as these changes or discoveries do not significantly affect the risk conclusions in the safety analysis or result in a change to the ASE. As a good practice, the contractor should develop a risk-matrix table for decision making to help define “significant increase in the probability or consequence of an analyzed or unanalyzed event” for use in the USI process. Examples when a risk-matrix table would be useful are helping to determine if multiple minor deviations from an ASE constitute a significant event or condition, or if a significant condition exists based on review of earlier versions of facility documentation that may have been inaccurate. In these cases the ASE probably would not change; however, the DOE field element should be consulted and may consider approving any corrective actions that alleviate or eliminate the significant event or condition. If the contractor concludes an ASE is impacted or perceives a change to the ASE is needed, then the associated condition or event should be considered significant. The USI process is typically used to determine whether planned accelerator operations or modifications will introduce significant safety consequences beyond those addressed in the facility’s SAD or ASE as part of early operations. Personnel involved in the USI evaluation or screening process should be knowledgeable in the ASE requirements and assumptions in the 32 DOE G 420.2-1A 8-1-2014 SAD and should include personnel familiar with the design of the accelerator facility. This path in the USI process is aimed at preventing an unsafe condition or event from arising from a planned change. Use of the USI process to address facility modifications should involve an evaluation or screening of changes in accelerator operations, modifications of credited controls, or changes in accelerator safety administrative programs if they have the potential to significantly affect safety. In addition, accelerator management should screen or evaluate changes in administrative programs credited in the ASE (e.g., safety, quality assurance [QA], CM, or human performance improvement programs). To ensure that facility modifications or operational changes are

addressed effectively, even if the ASE will not change, the USI process ensures the assumptions of the safety analysis in the SAD are evaluated to ensure they remain valid after the modification or change. Since a safety analysis often precedes the complete construction of a large accelerator facility, sometimes by years, a USI process needs to be in place before commissioning to ensure the as-built accelerator is consistent with the original safety analysis assumptions. For example, a change in beam-energy from design to construction might not be reflected in the final as-built accelerator. As a result of unanticipated manufacturing or economic factors, beam energy may be either higher or lower than is assumed in the safety analyses; and this change may impact the shielding assumptions in the safety analyses. If the USI process results in a modification of the ASE, DOE review and approval of the revised ASE is necessary. In such an instance, completion of an appropriate hazard/safety analysis for the proposed activity may be beneficial when seeking DOE approval. D O E O 4 2 0 .2 -1 A 3 3 (an d 3 4 ) 8 -1 -2 0 1 4 Figure 2.2. Example flow diagram for the USI process. DOE O 420.2-1A 35 8-1-2014 2.7 Configuration Management A facility configuration management (CM) program is a critical element of an accelerator safety program. This guidance focuses on accelerator-specific hazards and their corresponding credited controls as identified in the SAD and ASE. Appropriate CM is considered necessary for both the research mission and safe operation. CM systems and safety controls should be consistently managed using a graded approach so that as-built drawings, system and design requirements, and actual field configuration remain consistent, documented, and accurate. An effective CM program typically includes an effective safety documentation program, a records management and a training program, and a maintenance program. Current and well-maintained safety documentation is founded upon the following:  an ongoing safety analysis program for credited controls in support of the SAD  an effective ASE supported by an up-to-date SAD  identified levels of CM appropriate to specific credited control systems with a prioritization of the identified systems and controls An effective records management and training program typically would include the following:  records of design requirements that define the constraints and objectives placed on the credited controls  current record of credited safety engineered systems and credited safety management programs  training of system owners and users in CM requirements and safety documentation for credited controls  training in maintaining system and component labeling for credited controls  training on verification of physical configuration by system owners and users Processes for controlling maintenance and changes of credited controls systems may include the following:  use of current, approved versions of documents to operate, maintain, and modify credited controls  use of current validated software to operate and maintain credited controls  control of work activities identified, initiated, planned, scheduled, coordinated, performed, approved, validated, reviewed for adequacy and completeness, and documented  change control process for credited controls to maintain consistency among design requirements, physical configuration, and related facility documentation

 post-maintenance testing of credited controls  periodic assessments of the credited control CM 36 DOE G 420.2-1A 8-1-2014 A USI process is an important component of a CM program. Accelerator safety program managers should implement a USI determination process as part of the overall integrated set of the CM process for maintaining the ASE. 2.8 Quality Assurance Program A graded approach to QA should be used to place the most emphasis on and allocate proper resources to those items and/or processes that may have the greatest effect upon personnel, environment, safety, security, health, cost, data, equipment, performance, and schedule. Accelerator managers should consider implementing a graded approach to QA for determining the appropriate level of analysis, management controls, documentation, and necessary actions to comply with requirements in order to avoid the potential of a process to:  create an environmental, safety, security, health, or radiological hazard  cause a monetary loss due to damage or to repair/rework/scrap costs  reduce the availability of a facility or equipment  adversely affect the accelerator’s mission or degrade data quality  unfavorably impact public or regulator perceptions of DOE Accelerator managers could consider integrating the ISM principles and functions with the QA criteria provided in DOE Guide 414.1-2B, Quality Assurance Management System Guide, to aid in developing the QA program. Accelerator management could create an integrated program that operates so as to fulfill the core functions and guiding principles of ISM. Likewise, the integrated program could operate in a manner that fully conforms to the ten QA criteria established in DOE Order 414.1D Admin Chg. 1. In addition, use of National consensus standards (ASME NQA-1-2000 and ISO-9000- 2000) can be used in the implementation of quality assurance for an accelerator facility. For example, the contractor’s work planning and control program normally provides the processes by which accelerator managers plan work. The QA program could be integrated into the contractor’s work planning and control program so that managers consider programmatic and QA issues like public perception, downtime of a program, and potential equipment loss. At the same time, managers should ensure ESH issues are addressed in a manner that follows the ISM principle for “balanced priorities.” 2.9 Contractor Assurance System and Safety Reviews The ASO, when supplemented by other applicable safety and health requirements such as a contractor assurance system (CAS), promotes safe operations to ensure protection of workers and the public. Accelerator managers shall implement a CAS in accordance with DOE O 420.2C, that provides reasonable assurance that accelerator safety program elements will be met; workers, the public, and the environment will be protected; and the accelerator facility will be operated effectively and efficiently. Accelerator managers should ensure the CAS is integrated with the requirements in the ASO and should include a periodic assessment of DOE O 420.2C CRD requirements. Managers of an accelerator facility should consider operating the accelerator so that management systems for identifying deficiencies, performing assessments, conducting peer reviews and oversight, completing corrective actions, and sharing lessons learned are consistent with and support the overall DOE O 420.2-1A 37 8-1-2014

CAS. The contractor assurance processes for accelerator facilities should address accelerator safety requirements and any discovered events and conditions that might affect the safety documentation related to the facility. This should be done to assess the effectiveness of corrective actions and to improve the ASE and SAD. Additionally, any discovered conditions or events that are found to be present in similar facilities or systems should be shared with the DOE accelerator community. For example, lessons learned from a discovered unsafe event or condition could flow out of the USI process. This would help communicate significant safety issues to other DOE field elements and other contractor organizations within the accelerator community, helping to make the overall practice of operating these complex facilities safer and more efficient. To that end, accelerator managers could implement the following CAS related practices for operating an accelerator facility:  Define performance goals, metrics, and targets.  Periodically evaluate performance via a process that includes a robust review for identifying deficiencies and negative performance trends.  Ensure timely completion and effective implementation of corrective actions based on a reasonable priority system.  Share lessons learned to facilitate and improve on accelerator safety requirements.  Identify a means to foster continuous feedback and improvement for meeting performance metrics. For external CAS safety-related processes, accelerator managers should consider employing peer reviews and assessments that include accelerator subject matter experts from other accelerator facilities. For internal CAS safety-related processes, accelerator facility managers should consider using CAS programs for operational concerns as they relate to facility-specific hazards such as hazardous waste, radioactive emissions, shielding, and training and qualification. The following are examples of topics for external and internal reviews:  External accelerator-safety–related reviews o ALARA practices o radiation safety practices o assessment tracking system, action closure, and effective implementation o occurrence reporting practices o lessons learned programs o implementation of 10 CFR 851 and 10 CFR 835 o implementation of DOE Order 420.2C, Safety of Accelerator Facilities o if implemented, ISO 14001, OHSAS 18001, or similar ESH management systems  Internal accelerator-safety–related reviews o safety review programs for experiments and modifications o safety review programs for accelerators and accelerator facilities and modifications 38 DOE G 420.2-1A 8-1-2014 o shielding inspection program o training and qualification program o ASE-related procedures and associated training programs o work planning and control program o accelerator operator training programs o QA program o USI process 2.10 Accelerator Readiness Review Accelerator Readiness Reviews (ARRs) must be performed before DOE approval for commissioning and routine operation and as directed by the DOE PSO/NNSA Administrator or a DOE Field Element Manager and NNSA Organization having jurisdiction, as appropriate. The ARR provides a means to verify that an accelerator facility’s personnel, documentation, and equipment are adequate to safely support the full scope of activities proposed for commissioning and/or routine operations. The ARR is a performance based requirement that ensures facilities are

prepared for safe operations and provides a basis for the applicable DOE manager to approve commissioning and/or routine operation. In addition, the tailored approach should be embraced to perform an ARR based upon the size, complexity, and inherent hazards associated with operation of the accelerator. The basis for the contractor’s implementation of the tailored approach should be documented in the readiness plan/process or commissioning plan. 2.10.1 When to Conduct an ARR An ARR is performed in accordance with DOE Order 420.2C as required before DOE approval is granted to commence commissioning and/or routine operation. Once an accelerator facility is approved for routine operation, there are situations that may warrant review to ensure safety prior to operating with beam, such as:  a new module to an existing facility is constructed  a substantial upgrade or change to an existing facility  resuming operation of an existing facility that has been shut down for an extended period of time, if readiness to operate might be in question In general, major additions to or modifications of the accelerator itself justify an ARR. Contractor- focused reviews may be more appropriate to support minor facility modifications, equipment or instrumentation upgrades. Instrument readiness reviews can also help to ensure that accelerator safety requirements are reviewed and applied as appropriate. Communications between the contractor and DOE field element manager is encouraged to ensure there is an agreement on the path forward for the ARR. These communications have proven to be productive and useful. DOE O 420.2-1A 39 8-1-2014 2.10.2 DOE and Contractor ARR Roles DOE 420.2C places the requirement to perform an ARR solely on the contractor and requires that DOE field element managers “ensure the safe operation of accelerator facilities through implementation of this Order.” The implementation of the order includes essential elements that include “an accelerator readiness review (ARR) program that ensures facilities are adequately prepared for safe commissioning and/or operations….” Consequently, the DOE field element manager must approve the “start of routine operations” and “the start of commissioning activities after ensuring that an appropriate Accelerator Readiness Review (ARR) has been conducted.” Normally, for large and complex facilities, an ARR is warranted both before commissioning and before routine operation begins because the nature of activities associated with each phase is markedly different. In some cases, depending on facility-specific circumstances, the DOE field element may grant a single approval for both commissioning and routine operation at the same time, following performance of a single ARR. This would be the case in situations in which the readiness to both safely commission and operate is clearly verified by a single ARR. Likewise, the DOE Field element may require an ARR before each phase (commissioning and operations) of the startup depending on the nature of the facility or activity. DOE review and approval should be based on contractor performance associated with each phase or the overall performance of a single ARR. The DOE Field Element Manager and NNSA Organization having jurisdiction is responsible for ensuring that the contractor has conducted an appropriate ARR before approving commissioning activities. The process used by the DOE field element for ensuring an appropriate ARR involves many

factors and may include activities such as  maintaining awareness of the contractor plans for conducting the ARR  evaluating information related to the planned activity as necessary as a component of oversight activities  providing sufficient real-time oversight, supplemented where needed by first-hand sampling to support a determination by DOE of the appropriateness of the contractor ARR results  participating in an observer capacity  verifying that findings/observations of the ARR are satisfactorily addressed  informing line management and/or headquarters of status as appropriate ARR team members are selected by the contractor. The contractor would typically confer with the DOE field element on an upcoming ARR, including items such as the approach to conducting the ARR (e.g., phased, modular) and ARR team membership. The team may be composed of contractor personnel and/or consultants and may include DOE employees. All should possess expertise in their assigned areas. To the extent practicable, the team members should have minimal current involvement with the activity being reviewed, and past involvement should be sufficiently distant or of such a nature that the members have reasonable independence from the activity being assessed. The overall approach, review plan and lines of inquiry if used, should be discussed and/or vetted with the ARR team in advance or before the ARR is conducted. These discussions should address items such as scope, pre-start conditions, work or maintenance evolutions, planned operations, and objectives of the review. 40 DOE G 420.2-1A 8-1-2014 2.10.3 Preparing for the ARR and Commissioning The contractor should develop an internal-readiness plan/process, and it is recommended that it be completed prior to ARR approval. The internal-readiness plan/process is an overarching process that captures several aspects involved in preparing for the ARR, conducting commissioning, and transitioning to operations. The internal-readiness plan/process helps prepare the contractor to declare readiness before the ARR, aids in addressing commissioning planning, and should address DOE authorization processes for commissioning and routine operations. See Figure 2.1. The internal-readiness plan/process should describe the necessary activities to be completed by the contractor before the declaration of readiness—activities to be addressed as part of the ARR team activities, if needed, and before commencing either commissioning or routine operations of the accelerator. The plan/process is intended to ensure the contractor avoids unsafe or environmentally unsound readiness, commissioning, or operations activities. The internal-readiness plan/process may include other activities, such as experiments or instruments. The contractor should update the plan/process when significant changes are made to conduct of operations, training, safety-related controls, or contingencies. The accelerator community has embraced the use of “Lines of Inquiry” (LOIs) to assist ARR team members in their review of assigned areas. LOIs can be quite extensive or rather simple in their construction and use and have benefitted ARR team members in their review. LOI are not designed to guide the review or reviewer but does help to facilitate information sharing and the generation of thought in specific program areas. 2.10.3.1 Preparing for the ARR The internal readiness plan/process should briefly identify the expected milestones to be achieved,

to include planning for the ARR before commissioning, the commissioning process, and any planning activities and the process for ensuring safe operation. Such milestones could include items such as low- power measurements taken to verify key safety-related parameters (e.g., shielding effectiveness) and other operational characteristics needed to support decisions related to safety or an increase or decrease in energy, power, or intensity of beam. Keep in mind that the scope of the internal-readiness plan/process should identify which aspects of the accelerator commissioning and organization are to be ready for verification by the ARR team, including  roles, responsibilities, accountabilities, and authorities that establish the expectations and duties of managers, supervisors, and operators for carrying out the commissioning consistent with external and internal requirements  procedures, administrative controls, and personnel training and qualification for commissioning at the stated intensity  engineered safety systems that will be operable for the accelerator and accelerator-associated experimental facilities  specific facilities, sub-systems, and modes of commissioning to be exercised https://sbms.bnl.gov/sbmsearch/subjarea/58/58_SA.cfm?parentID=58 DOE O 420.2-1A 41 8-1-2014 A schedule of the most current internal-readiness plan/process, and the planned date for achieving readiness for the onsite ARR, should be established. The internal-readiness plan/process does not take the place of the contractor ARR plan that is usually developed in concert with the ARR team. Note: The ARR team leader may choose to develop an ARR plan and LOIs that reviews specific areas of the accelerator facility and program; it should include aspects of operational evolutions and be performance based consistent with the complexity of the facility and equipment. Performance based ARRs are a good practice. To facilitate an effective ARR, the internal readiness plan/process should briefly establish the following:  reporting chain to whom problems encountered are reported, (e.g., operational, safety, scheduling problems)  responsible party who makes the necessary notifications or arrangements for authorizations  location of documented authorizations  training records to be audited  number and types of qualified personnel required to maintain safe commissioning activities after the ARR and DOE approval to commission or routinely operate  list of procedures required for commissioning readiness, including contingency procedures for situations that use equivalent safety or protection techniques in commissioning large accelerator facilities  list of operational evolutions and performance based activities that demonstrate the facility is adequately prepared for safe commissioning and operations  list of open action items from various internal and external safety reviews that will remain open but will not significantly impact safety or environmental protection during a commissioning period Another consideration during the development of the internal readiness plan/process would be for the contractor to consider the exemption process in DOE Order 420.2C, Safety of Accelerator Facilities, paragraph 3.c. (2). For example, to conduct or perform low-power testing prior to conducting an ARR for commissioning would require an exemption. Accelerator management should request an exemption from the ARR requirement as found in paragraph 4.b. (5) of the DOE Order

420.2C. Specifically, in this example, low-power tests were determined to be needed prior to construction or project completion. Systems undergoing development or performance testing needed low-power beam operations to develop an operational efficiency or parameter during an instrument readiness review. Conducting an ARR at this stage was determined neither practical nor necessary because of the nature of the hazard and the developmental nature of the accelerator. The safety basis for the exemption request could be based on the limited power level and/or the low-level (localized) radiation hazard allowed for the performance test. In this example, the device at this power limit would not produce an accessible radiological area. 2.10.3.2 Commissioning an accelerator facility It is important to recognize the sequence of activities leading up to commissioning an accelerator facility. Commissioning follows the contractor’s internal readiness process/plan, the ARR, and the DOE approval to commission. Commissioning is a phase of accelerator facility operation typically 42 DOE G 420.2-1A 8-1-2014 used to conduct beam testing and to verify specifications in a new or designed functional mode, as defined within the parameters of the commissioning. In other words, commissioning is the process of bringing an accelerator facility on line in a safe, efficient manner that ensures protection of workers and members of the public and protects the operation of the equipment, to the extent practical, while ensuring compliance with DOE Order 420.2C. The guidance provided in this section addresses accelerator safety aspects of commissioning to help the contractor prepare an internal readiness plan/process for an ARR. No attempt has been made to address other programmatic drivers (e.g., mission accomplishment, preservation of capital equipment) that may also be present during the commissioning phase of a project’s life cycle. Commissioning periods may be tailored to the needs of each facility and there may be great variation in their duration, breadth, and formality; but in all cases, the commissioning activities will be bounded by an ASE and preceded by an ARR. Commissioning often can be done in phases or modules, where each module is brought on line safely before proceeding to the next module. These modules can follow or correspond to geographical locations within a facility (e.g., a specific beam line) or can represent stages of operation (e.g., step functions of increased intensity, energy, or beam power) or combinations of both factors, depending on the configuration of the facility. Under some conditions, commissioning activities may encompass operations under restricted conditions that are necessary to accomplish specific tasks. An example would be the need to conduct specified measurements of the prompt radiation levels needed to support the ASE. Other examples could include magnetic field measurements, measurements of beam losses, flammable gas levels, or airborne radioactivity levels. At the conclusion of commissioning, the accelerator is ready for performance of the final ARR, which is for routine operations. Alternatively, the contractor may prepare for and request a combined commissioning/routine operation ARR if accelerator construction is complete and the internal readiness process/plan justifies an advance to operations. The DOE Field elements’ early involvement and agreement and approval to this approach are recommended.

2.10.4 Conduct of the ARR The ARR is not a method of achieving operational readiness but rather a structured method for verifying that hardware, personnel, and procedures associated with commissioning and/or routine operations are ready, to permit the activity to be undertaken safely. The ARR process is recognized by DOE as an activity used to ensure hardware, personnel and administrative systems and programs are ready and the contractor can demonstrate readiness to operate the component, equipment, or facility safely. An ARR is generally not an extensive wall-to-wall assessment of all contractor analyses and operations but an overview or sampling of the full scope of proposed activities. The ARR may sample many of the same activities addressed by the contractor’s internal readiness plan/process. The ARR should not use the contractor’s internal readiness plan/process as a substitute for verification of any specific activity. DOE O 420.2-1A 43 8-1-2014 The contractor may choose a modular approach, which allows for portions of the accelerator facility to be verified for readiness. This approach provides a basis for commissioning of that particular section of the facility. The scope of the ARR should reflect the size, complexity, and hazards associated with the accelerator facility. A tailored approach may be used to perform an ARR based upon the size, complexity, and hazards. The basis for the scope should be documented as part of the readiness review process. The ARR team should exercise due diligence. The ARR should include document reviews, inspections, staff interviews, and witnessing of the performance of operations and/or training as appropriate to ensure whether the needed accelerator facility safety programs are in place. For large, complex facilities, an ARR may be warranted both before commissioning and before routine operation because the nature of activities associated with each phase are markedly different. In some cases, depending on facility-specific circumstances, the DOE field element may grant a single approval for both commissioning and routine operation at the same time, following performance of a single ARR. If available, the ARR should incorporate past operational experience. Where commissioning of an accelerator facility is accomplished in discrete segments (i.e., using a modular approach), the ARR can be performed incrementally. For ARRs performed under the modular approach, in considering elements to cover in the ARR, credit may be taken for those elements that have not appreciably changed since performance of the previous ARR(s). In other words, those unchanged elements that were covered in a previous ARR may be omitted from the next ARR; however, the omission and justification for omission should be documented in the ARR report. This practice serves to avoid duplication of effort. The ARR should verify whether the following accelerator facility programs are in place:  approved procedures program, including an appropriate USI process  approved training and qualification programs  appropriate internal review program  effective records management program  reviewed and approved SAD adequate to support approval of the ASE  approved ASE, including an effective credited control program  appropriate internal-readiness plan/process undertaken by the contractor Through the ARR process, verification of the implementation of the following institutional

management programs should be performed:  CAS  CM program for safety systems/programs and credited controls  QA program In addition to the items listed above, the ARR should also verify that  an acceptable SAD developed in accordance with DOE Order 420.2C that has been reviewed and approved by contractor management 44 DOE G 420.2-1A 8-1-2014  an acceptable approved ASE is developed in accordance with the CRD of DOE Order 420.2C  roles and responsibilities are clearly defined for accelerator activities, including those for training and procedures as related to accelerator safety  an appropriate USI process is developed in accordance with DOE Order 420.2C  there is an appropriate process for the review of the contractor accelerator safety program elements as specified in the CRD of DOE Order 420.2C  records important for operational and post-operational activities are controlled, including National Environmental Policy Act documentation and local, state, and federal regulatory permits  equipment and systems having safety importance (including credited engineered controls) meet criteria established in the SAD and have been appropriately tested (Note: these are good performance activities)  the facility is in compliance with ASE requirements The ARR team should draft a report that adequately documents the activities of the review team. The report should document the review and address items such as  team members  scope of the review  review criteria (e.g., the elements listed above may be used)  results of the review (includes findings both pre and post start, deficiencies, and so on)  a conclusion that indicates whether the accelerator safety implementation is adequate to support safe operation Contractor line management should satisfactorily address findings/observations of the ARR and communicate them, along with a copy of the ARR report, to the DOE field element. The ARR report serves as a basis for DOE approval of the commencement of commissioning and/or routine operation. 2.10.5 Authorization to Commission Commissioning begins after a successful ARR process and formal approval by DOE. Routine operation begins following completion of the operational ARR and formal approval for routine operations from DOE. The DOE PSO or the NNSA Administrator for the accelerator project must approve the ASE if the site boundary consequences for credible postulated accident scenarios potentially exceed 1 rem (0.01Sv) and/or ERPG-2. For less than 1 rem or less than ERPG-2, the DOE Field Element Manager and NNSA Organization having jurisdiction has the responsibility to approve the ASE. In either case, the DOE Field Element Manager and NNSA Organization having jurisdiction must approve the start of commissioning activities after ensuring that an appropriate ARR was conducted. For accelerator projects that require alternate safety standards, the DOE PSO or the NNSA Administrator will consult with the DOE Field Element Manager and/or NNSA Organization having jurisdiction before approving the start of commissioning activities. The DOE Field Element Manager DOE O 420.2-1A 45 8-1-2014 and NNSA Organization having jurisdiction will provide to the PSO or Administrator their recommendations on any alternative standards that are to be applied to the accelerator facility. 3 Accelerator Facility Operations Guidance The purpose of this operations guidance section is to establish recognized documentation,

practices, and actions that support mission success and promote worker, public, and environmental protection. Accelerator operations guidance given here supports safety and mission success for a wide range of hazardous, complex, or mission-critical operations, and can enhance routine operations. Accelerator safety order requirements for contractors are explained in detail in the context of operating an accelerator. Contractor requirements such as 1) "clearly defined roles and responsibilities for accelerator activities including those for training and procedures", 2) "A Facility Configuration Management Program that is related to accelerator safety; and 3) "Credited controls and appropriate administrative processes related to accelerator safety (e.g. training, procedures, etc.)" are addressed in detail by experienced accelerator operations workers. This makes the Guide unique and specific to the accelerator community. The topics covered in this section interface unique ASO-driven requirements such as the ASE, SAD, ARR, credited controls, and USI process with requirements or guidance from other drivers such as CM, contractor assurance, software QA, operator training, experimenter training, operating procedures, and use of work planning tools. The “tailored” approach to implementing guidance allows the accelerator operator to implement an operations Guide if, and to the extent that, it fits the needs of the accelerator facility. The appropriate application of a tailored approach should be based on the specific circumstances of each particular facility. Guidance on various pre-operational and operational topics is interrelated, and either topic often addresses several specific requirements in the ASO. This is particularly true for training, procedures, and credited control guidance. Both sections of the Guide, pre-operations and operations, should be consulted for these specific topics. The guidance presented represents the “Best Practices” found at many of the DOE accelerator facilities. 3.1 Managing the Accelerator for Safety and Mission Success Using the tailored approach, accelerator managers should specify goals and the means to achieve them. Managers could derive goals, objectives, and targets from institutional-level documents, and integrate them into the accelerator organization’s management programs, such as environmental management, occupational safety and health management, and self-assessment. The goal for work- related illness and injury should be zero. The goal for risk from all hazards should be “as low as reasonably achievable” (ALARA). Safety is an overarching priority for all accelerator activities. For radiation exposure, the accelerator manager is required to incorporate ALARA into planning activities. Consider expanding the ALARA philosophy to include waste generation and the potential for pollution and greenhouse gas (GHG) emissions from accelerators and experiments. For worker safety and health, requirements for establishing goals and objectives can be found in 10 CFR 851. Managers should review performance against the accelerator organization’s goals, and could review the performance annually and assign resources, if appropriate, following the review. 46 DOE G 420.2-1A 8-1-2014 Using the tailored approach, managers should consider operations goals that include the following:  minimizing the unavailability of safety systems  minimizing personnel errors  conforming to ALARA Guidelines

 minimizing loss of the facility capability  minimizing the number of unscheduled shutdowns  minimizing the number of missed inspections  minimizing the amount of overtime  achieving and maintaining complete staffing and training requirements  minimizing waste  minimizing SF6 and other GHG emissions  minimizing the number of alarms Operations goals should be measurable, achievable, and auditable. Accelerator operators should develop an action plan to meet goals and report audit results to the accelerator manager. Accelerator managers must consider the hierarchy of controls and specify the types of controls necessary to implement safety programs and policy. Accelerator managers should use engineered safety systems, work practices, administrative controls such as supervision, training, and procedures and lastly personnel protective equipment to implement safety policy. Accelerator managers should communicate the safety policy to staff along with the associated authorities, responsibilities, and accountabilities. Consider defining authority, responsibility, accountability, and interfaces with other groups clearly in procedures. Consider assigning specific individuals for commissioning and operations roles, training them and holding them accountable for safety and emergency response. Using the tailored approach, accelerator managers should specify the types of controls necessary to implement the physical security of the accelerator facility. Physical security may include locking doors, locking down shielding, locking down lifting equipment, surveillance cameras, passwords on computerized controls, and other methods to help ensure safety is not compromised by a breach in security. Accelerator managers should provide sufficient resources, material, and labor to accomplish the mission in a safe and environmentally responsible way. Managers could define a minimum number of accelerator operators during operations, for example. Managers should judge the minimum number of operators sufficient for safe operation, although managers may use a greater number of operators routinely for operational efficiency. During operation of larger accelerators and accelerator facilities, the accelerator manager should have practices and procedures to manage materials and resources day- to-day, including during planned shutdown periods and during periods when bad weather or any unplanned event forces a shutdown. Accelerator managers should consider using shift operations to avoid excessive overtime. Managers should consider providing technical support personnel to the operations organization. The DOE O 420.2-1A 47 8-1-2014 technical support personnel may include motor-generator set operators, radiological control technicians, watch personnel, and cryogenic systems personnel. Accelerator managers should staff according to various changes in operations. Consider developing a long-range staffing plan by monitoring operations performance. Managers should observe operations and maintenance activities frequently and document problems for evaluation. Consider using scheduled inspections, work observations, performance indicators, audits, reviews, critiques, injury and illness reports, self-assessments, and self-evaluations to document problems for further evaluation. Consider employing critiques or similar thoughtful review practices for minor issues to reduce the chances that they lead to future occurrences. Managers should consider

reviewing SF6 leak detection surveys and usage data routinely to estimate the potential GHG emissions. Operators should use a machine-performance-monitoring log and regularly inform the accelerator managers on equipment availability and downtime. Managers should participate in safety inspections and audits, attend meetings of safety review committees, and “manage by walking around.” Managers should enhance safety in the workplace by observing work and learning how the workers have integrated safety into daily activities. By doing this, managers are able to evaluate the effectiveness of safety management systems, the communication of these systems to the worker, and any impediments that might influence the worker away from performing the work as required. If an unsafe act is observed, managers should use the observation as a topic for discussion in which the manager and worker come to an agreement as to how to eliminate such an act from reoccurring. In addition, managers and workers should discuss how safety is integrated into the worker’s activities, determine if there are any areas of concern a worker has for himself or his co-workers, and learn if the worker has any positive suggestions. Accelerator managers should consider implementing procedures for performance of accelerator activities. Operations procedures can help minimize the unavailability of safety systems by requiring operations be curtailed if safety systems fail to operate. Human performance approaches to implementing procedures can minimize events by training accelerator personnel to recognize error- likely situations. Managers should ensure ALARA is integrated into routine operations and work- planning procedures. For example, procedures should emphasize that operators reduce beam losses using the concept “as low as reasonably achievable.” It should be noted that radiation exposures in controlled areas are controlled using the ALARA concept through engineering or administrative controls, consistent with 10 CFR 835. High reliability is a useful goal for achieving safe operations. At accelerators, equipment breakdown can be a likely source of potential radiation exposure to workers. Managers can build high reliability into components based on experience gained with the accelerator equipment. Managers can use a computer-aided maintenance program on a daily basis to aim for maximum equipment performance and accelerator availability. Unscheduled shutdowns should be minimized through periodic maintenance, formal reporting of problems, good communication between experimenters and operators through weekly meetings, and designing equipment to be “radiation hardened.” Managers should consider investigating events that do not meet the criteria of a DOE-reportable occurrence via a contractor occurrence reporting system. An operator’s log could document day-to-day changes in accelerator facility status, and managers could review it each day. A good practice is to review reports of deficiencies using trouble reports or in the electronic logs of the groups that perform regular tours of the accelerator. 48 DOE G 420.2-1A 8-1-2014 Operators at some accelerators visit experimenters and the experimental areas each shift, and managers should also visit the experimental areas periodically. Managers should consider describing effective ways to perform tour activities in a procedure. Tour activities may include a periodic review

of equipment status, including an examination of radiation levels, particle fluence rates, system pressures, and temperatures and access control mode, or discussions with users and workers about how they planned their work that day. A good practice is to have shift operators routinely monitor SF6 pressure gauges and track undesirable trends in SF6 additions to top-off the equipment. Use of radiological control technicians, cryogenic system watches, experiment shift leaders, and other groups to perform tours and record their findings should be considered. These personnel may use approved tour sheets to record findings. Managers should consider reviewing radiation surveys and area monitoring data routinely to estimate the potential exposure of workers and experimenters. A good practice is to have shift operators continually monitor equipment operations from a control room and track undesirable trends in advance of equipment failures. For example, the radiation monitoring system should detect low- level beam losses well before serious radiation events occur. Consider training operators to respond to these trends, for example, by realigning the beam through magnet current settings. Accelerator managers should consider having the radiation safety system electronically record important radiation alarms. Reviewing the long-term trend of radiation levels and alarms is a good management practice. Managers should review long-term dose trends to workers and users. Annually, an ALARA committee or similar team should review important radiological parameters from the prior year and make recommendations to the accelerator manager on ALARA activities for the coming year. Accelerator managers should take prompt action to investigate abnormal or unexpected radiation- level indications. Managers should ensure operators are instructed to believe instrument readings and treat them as accurate unless proven otherwise. Accelerator managers should ensure that operators understand current conditions before resetting protective devices. If a protective device trips the accelerator to a safe state, as would happen if an area-radiation monitor sees unexpected radiation, then operators should investigate. Managers should ensure operators understand the reason for that trip before resetting the device. To do so, it is good practice to write expected operator-response actions into procedures, for example, for radiation alarm response and for oxygen-deficiency alarm response. Accelerator managers should consider formally approving any power or process rate changes. Even changing to lower beam energy should be considered a potential safety issue, since the change might introduce increased beam losses or result in low-momentum beams being bent around shielding by magnetic fields used for higher-energy beams. Providing guidance to operators on which major loads to turn off when they are no longer needed for safety, equipment protection, or programmatic reasons is also a good management practice. Managers should establish places for administration, communications, and shift turnover. A main control room should serve as the operating base. Managers should ensure it is equipped with communication and office equipment needed to conduct duties. Using a separate conference room or other area for conducting shift changeover activities is a good practice because it reduces distractions during operations. Accelerator managers should consider prohibiting potentially distracting material

DOE O 420.2-1A 49 8-1-2014 and activities from control rooms. Prohibiting written material not pertinent to operations and prohibiting entertainment devices in control rooms should be considered and is strongly encouraged. 3.1.1 Integrating Experimental Safety and Users into Operations To provide a safe working environment, it is good practice for facility management to incorporate the following principles into the safety program for user groups and collaborations:  Roles and responsibilities for the safety of experimenters and users in the operation and maintenance of a beam line and equipment, and for the conduct of an experimental program, should be fully defined, particularly at the interface points where facility workers and operators are involved.  Experiments should be reviewed and approved by accelerator facility management before operation with accelerator beam; any changes or the addition of any significant hazards to an already approved experiment must be reviewed and approved.  User teams or research collaborations will vary greatly in their experience in working at a beam line and in their understanding of requirements; facility management should address support and oversight of user/collaborator activities to ensure safe operation on a 24/7 basis.  Frequently, user groups will bring an experimental apparatus from their home institutions to the facility; this equipment may be “homemade” and not meet recognized standards, i.e., electrical safety. User equipment must meet the same safety requirements applied to all other components associated with the accelerator facility.  There should be a clear understanding by user groups of the types of changes that users and collaborators are authorized to make during their work on the experimental floor. This is considered critical for changes to electrical service, flammable gas systems, inert gas systems, pressurized systems, beam-line shielding, and target materials or target configuration.  Each user/collaborator should receive sufficient training to ensure understanding of accelerator facility requirements and emergency response requirements.  Accelerator facility management should respond at an appropriate level to users/collaborators whose actions are noncompliant or irresponsible; the range of response by management could include limited or supervised use or denial of access to the facility.  Accelerator facility management should establish a communication process that will ensure communication of pertinent ESH and operations information routinely to and from users or research collaborations. Management must involve users or collaborators in the development and review of pertinent policies and procedures aimed at eliminating or reducing ESH concerns associated with an experiment, and should provide users and collaborators with an opportunity and mechanisms to voice their concerns. DOE encourages the use of employee concerns and differing professional opinion programs to allow employees to raise issues and work problems toward positive outcomes. 50 DOE G 420.2-1A 8-1-2014 3.2 Basic Operations Principles and Practices Accelerator operations principles and practices identified in this section are based on the collective experience of managers from all types of DOE accelerators. The tailored approach to implementation should be used because some principles and practices were drawn from complex accelerators that may

have multiple injectors and multiple experimental programs operating at the same time. Complex accelerators may have maintenance activities occurring at the same time as operations. Complex accelerators may use 365/24/7 shifts and have experiments large enough to have user groups with their own structured shifts and procedures. Therefore, accelerator managers should consider the tailored approach and adopt some or all of the following principles and practices if they fit the accelerator’s needs:  implementation and maintenance of procedures  notification of ESH and/or mission issues  responding to abnormal events  responding to alarms  normal and emergency communications  USI process  on-shift training  operator training on the assumptions in the safety analyses and ASE to include bounding limits and conditions  operator training to understand safety requirements  operator training on experiments and ancillary operations To the extent practicable, contractor management should establish principles and practices with input from those who have operations responsibilities, safety and health professionals, maintenance personnel, supervisors, and affected experimental operations personnel. With regard to managers accepting risk, it is important to note that the priority that managers give to safety is the most important controller of worker-injury and/or accident performance. If workers see managers taking unacceptable risks (e.g., starting operations while maintenance or construction on an accelerator facility are performed at the same time), then scientists, engineers, designers, and other workers down the line will take unacceptable risks, too, to meet that manager’s expectation to operate. In the context of the following guidance on the practices, the term “operator” or “operations personnel” implies shift staff, physicists, engineers, construction and maintenance personnel, technicians, experimenters, users, radiation protection staff, and safety professionals. The contractor’s design review process should have procedures that require the lead scientist or the accelerator project manager to ensure that safety reviews are complete for new projects or new experiments, and to ensure that changes to existing accelerator facilities or experiments are reviewed against the assumptions in the SAD. Procedures rely on the capabilities of operations personnel who are responsible for their development and application, and the effectiveness of the chain-of-command system for accelerator DOE O 420.2-1A 51 8-1-2014 operations. To achieve a superior level of effectiveness in the implementation of procedures and controls for safe operations, the following steps may be taken:  ensure appropriate operations personnel selection  develop and apply work planning programs  provide training and supervision for accelerator operators  implement operations and maintenance work schedules  employ job rotation and schedule rest periods for operations and experiment personnel  implement management-of-change programs for accelerator facility safety systems  investigate all injuries and occurrences, alarms, and abnormal events  perform on-site inspections on a daily or weekly basis For proper implementation of procedures, it is important that staff understand a procedure’s intent and purpose. Understanding of the overall purpose and strategy of procedures promotes safer

outcomes. Managers and supervisors can promote understanding through training forums and other types of procedure walk downs in which staff are allowed to ask questions. Following a procedure without question does not guarantee safety because procedures may contain hidden flaws that may be identified by the workers or users. Staff should understand that the overall purpose of procedures is to prevent injury and keep the accelerator configuration safe and within its safety envelope. As new tasks arise, there may be a need to develop a new procedure or revise existing procedures to ensure tasks can be effectively carried out. Guidance provided in the pre-operations section may be of value in developing procedures for commissioning a new accelerator, whereas guidance here applies to accurately maintaining procedures and keeping them up to date over the operating life of a facility. Factors to consider in determining if a task requires a modification to a written procedure include  the complexity of a task  the consequences of improper operator actions  an operator’s experience and proficiency with a task At accelerators, the nature of the procedures may need to change based on the phase of the facility or equipment. Procedures written by system experts for system experts during the commissioning phase may need to be less narrative and structured more as a series of steps when used by operators during the routine operations phase or in responding to abnormal situations. Post-operations procedures may need to focus on maintaining systems against deterioration to prevent environmental impacts. These procedures may become more narrative in style to address legacy issues or provide instruction on addressing future environmental requirements as systems or requirements change. Managers should consider implementing practices to ensure procedures are complete, administratively up to date, accurate, internally consistent, and easy to understand and follow. These practices should address factors such as the installation of new systems, equipment and updates to existing equipment, changes in hardware, software and administrative changes. For example, managers should consider training operators to follow the following practices: 52 DOE G 420.2-1A 8-1-2014  Verify the procedure is the most recent revision before using it.  Review all prerequisites, limits and precautions, initial conditions, and instructions before use.  Follow the procedure as written without deviating from its intent; stop and alert the supervisor if problems listed in the next paragraph are encountered.  Be aware of the potential impact a procedure step can have on equipment.  Report procedure problems promptly and correct important deficiencies before using the procedure.  Submit feedback to supervisors and managers on procedure accuracy and usability. Consider implementing a practice that establishes appropriate actions should an operator experience trouble when implementing a procedure. Examples of problems that may be encountered with procedures include  procedure step cannot be performed as written  operator believes use of the procedure will result in incorrect or unsafe equipment configuration  operator believes that injury or damage to equipment may occur if a procedure is used as is  procedure appears to be technically incorrect  unexpected results are achieved after performing a procedure step

 procedure conflicts with another procedure In general, behaviors such as the following are considered poor practices and should be discouraged:  commencing a procedure without establishing initial equipment conditions  performing a procedure step without understanding its purpose  performing a procedure without knowing critical steps  using a procedure for a task for which the operator is not qualified  believing operators do not need procedures  using multiple procedures at the same time  skipping steps of a procedure because those steps have been unnecessary in the past  using a previous, superseded revision of a procedure  marking steps “N/A” or “not applicable” on a procedure without approval  using a procedure for a task other than that intended Regarding maintenance of procedures, accelerator management should consider establishing practices that ensure procedures are maintained and up to date as appropriate. Such practices should address factors such as the installation of new systems and equipment and updates to existing equipment, changes in hardware, software and administrative changes. DOE O 420.2-1A 53 8-1-2014 Consider implementing a QA practice for the periodic review of existing operations procedures to ensure they are effective and up to date. For example, an ASE-related operations procedure and/or other safety-related procedures might benefit from routine periodic review by an independent QA professional. A practice that encourages operators to identify deficiencies and areas for improvements within the procedures should also be considered. Regarding notification of ESH and mission issues up and down the management line, accelerator managers should consider the practice of using notification procedures for events and conditions that need reporting. Notification procedures should include  designation of specific responsibilities for notifications  identification of events and conditions requiring notifications (e.g., fire, smoke, water spill, SF6 emissions, violation of ASE limit)  identification of primary and alternate personnel to notify in various situations  establishment of time requirements for notifications  definition of record-keeping requirements Notification procedures should include primary and alternate names of responsible parties, and phone numbers and pager numbers should be kept in a readily accessible place. Operations personnel should maintain records of notifications. Accelerator facility management should provide adequate equipment to address communication requirements for notification activities. Regarding responding to abnormal events, the practice should consider what impact, if any, the event could have on the approved safety documents and the safety analysis for the accelerator facility, specifically the SAD and ASE. It is for this reason that managers at accelerator facilities should take additional steps to ensure investigation and reporting of abnormal events. Managers should consider using procedures to analyze events, evaluate them for facility safety impact, and implement corrective actions to prevent recurrence. Sharing information within the DOE accelerator community is considered a good practice. By screening all abnormal events against any internal contractor-developed criteria and the assumptions in the accelerator’s safety analyses and ASE requirements, not only can accelerator facility managers

maintain the ASE requirements, but they can also help ensure that their safety analyses and controls are adequate. Accelerator managers should consider establishing an accelerator facility abnormal-events management practice that includes concepts to address ownership, corrective actions, and lessons learned objectives. In addition, the abnormal events management practice should include  establishing and documenting the requirements used to identify abnormal events and situations that might be considered “near misses” or below reporting thresholds  establishing additional requirements for capturing abnormal events in accelerator facility operating procedures where institutional level requirements do not go far enough  determining investigative methods applicable to accelerator abnormal events 54 DOE G 420.2-1A 8-1-2014 Accelerator managers should consider establishing documented practices or procedures for use by operators when responding to alarms or to trouble with alarms, and for effectively communicating normal or emergency information. A warning system is reactionary since it alerts operations personnel to a problem after it occurs. However, a warning system should be used to mitigate events. Mitigation relies on administrative practices specific to the types of safety systems in use, which may include specific response procedures, training, drills, safety system maintenance, and testing. Radiation detector systems, inert gas detection systems, smoke detection systems, and their alarms and backup alarms are engineered controls; whereas signs and warnings or alerts, which may be identified in operating procedures or manuals or on equipment, are administrative practices that should be periodically reviewed by managers and addressed in training. Accelerator managers should consider a practice to ensure operators in control rooms are aware of inoperable alarms, alarms with temporary set points, multiple input alarms that do not provide indication of a subsequent condition, or other limitations. Operators should document deficient alarms and share information with all affected personnel. Accelerator managers may consider procedures for entering alarm deficiencies into a work control or equipment-status system for correction. Operators should take appropriate actions to monitor conditions when alarms are unreliable. Operators and supervisors should be aware of alarms expected during normal operations, and managers should consider information-use procedures for this purpose. 3.2.1 Implementing the USI Process Implementation of an effective USI process allows accelerator facility management to make physical and procedural changes to facility operations without prior DOE approval, as long as these changes are in compliance with the SAD safety analysis and ASE. Using a tailored approach, the following aspects may require the application of a USI process at an operating accelerator:  facility modifications; changes in accelerator operations or credited control systems; addition of new materials or equipment to accelerator operations; or changes in administrative safety programs, including accelerator QA or human performance improvement programs  changes to safety-related roles, responsibilities, and authorities or an internal safety review  changes to engineered controls such as shielding, magnet current, beam energy, and the operability of safety systems

 changes to the work planning process or the process for approval of safety systems or credited control changes  changes to the training of those involved in operations and maintenance on compliance with the SAD safety analysis, ASE, or normal and off-normal safety procedures  managing and tracking assumptions in the safety analysis that form the bases of credited controls in the ASE DOE O 420.2-1A 55 8-1-2014  training of those reviewing accelerator facility modifications, operational changes, and off- normal events on the use of the USI process to reflect changes in the SAD safety analysis, ASE changes, or changes in operating procedures From an operational standpoint, the USI process is an important part of accelerator facility CM efforts that ensure ASE and SAD documents are current and administratively up to date. From a practical standpoint, the different aspects of the USI process may have to be assigned to different standing groups or safety committees to ensure knowledge about the specific accelerator safety systems is retained and used over the years. If an informal approach is used to address an aspect of the USI process, then a formal system should be used to track and close recommendations made by the informal group. If the USI process review results in a modification of the ASE for the operating accelerator facility, then it is required that the modified ASE receives review and approval by DOE before operations may continue. If a USI review results in a change to the assumptions used in the safety analysis in the SAD, then the contractor’s review and approval process for changes to an SAD should be implemented. 3.3 Maintaining Operator and Experimenter Training On-shift training under the supervision of a previously qualified operator or systems expert should be considered for operators and experimenters. The purpose of on-shift training is to apply what operators learn in a classroom or self-study. This is the on-the-job training portion of the training program. This makes the operator proficient in performing their new responsibilities and ensures that they can effectively handle routine and unexpected situations. Operations and maintenance personnel should maintain familiarity with relevant portions of the safety analysis in the SAD. Operators and maintenance workers should be retrained in the assumptions in the safety analysis if the approved safety analysis or ASE is modified. Accelerator operators should maintain familiarity with the safety system design, operation, maintenance, records, and testing for engineered systems used to protect against high-risk hazards. At accelerators and accelerator facilities, these hazards may include ionizing radiation from beams, oxygen deficiency inside accelerator enclosures, x-ray and RF radiation from beam-bunchers and RF cavities, and intense beams of ultraviolet radiation or light. For example, operators should maintain familiarity with the design and operation of an accelerator ACS, which is an example of a credited engineered control. Because of technology improvements, ACSs tend to be improved over a period of years. Specific training and retraining for the identification and control of a number of hazards is required by 10 CFR 835 and 851. Consequently, credited engineered control re-training should also cover the following:  changes in the functional description of credited engineered controls, including o hazards protected against

o means of protection o entry and search protocols if applicable, including announcements, alarms and emergency responses 56 DOE G 420.2-1A 8-1-2014 o response of the system in normal operation and to fault conditions and foreseeable error, as well as to equipment failure o physical and electrical configuration of the system, including circuit diagrams, wiring diagrams, and component specifications  changes in test procedures, including test frequency and completeness  changes in the CM system for controlling design, modifications, and replacements, and for maintaining complete and accurate documentation for the ACS  changes in the process for determining how an operator determines the credited engineered control is available for operation  changes in software, updates that effect functional safety or modify the operator interface, include displays, fault/trip diagnostics/logging. Managers should consider implementing a refresher training course for accelerator operators and for users/experimenters to allow unescorted access to the accelerator experimental areas and to the accelerator facility areas. The training should provide facility-specific knowledge and hazard training related to work and or experimental activities. Retraining should occur when a significant change to hazards within the facility occurs. The frequency of retraining should also depend on the frequency of unescorted access. For example, users who access the facility a few times per year may need more frequent retraining than users who access the facility every week. Managers should refer to 10 CFR 851 to identify required refresher training for specific hazardous work activities. For work activities for which refresher training is not specified by regulation, the frequency of refresher training should depend on the frequency of the work activity. Examples of work activities that should require refresher training for accelerator operators and users include  working at heights  handling compressed gas cylinders  working in magnetic field areas  operating a man-lift or aerial lift  working in high-noise areas  using powered machine-shop equipment  working with cryogens 3.4 Configuration Management during Operations The ASO CRD states “the process for identifying a USI is considered to be an important component of CM.” The focus of CM guidance in this section is on nonstandard industrial hazards and maintaining their corresponding credited controls identified in the ASE. Appropriate CM is considered necessary for mission and safety success, as is evidenced by documented cases attributed to CM inadequacies in several formal investigations, occurrences, and mission delays at DOE accelerator laboratories. Maintaining the CM program should include methods and processes for: DOE O 420.2-1A 57 8-1-2014  Establishing and maintaining changes to the ASE and SAD documents.  Maintaining a list of credited engineered controls and credited safety management programs and administrative controls under formal CM. This may include a prioritization of the identified systems and controls and assignment of different degrees of formal CM; in order to avoid scope creep, CM system boundaries should be defined.  Maintaining changes to the safety bases for credited controls.  Maintaining changes to design requirements that define the constraints and objectives placed on the physical and functional configuration of credited engineered controls.

 Ensuring that only the most recently approved versions of documents are used to operate, maintain, and modify credited controls.  Implementing a change control process for credited controls to maintain consistency among design requirements, the physical configuration, and the related facility documentation.  Maintaining system and component labeling for credited controls.  Performing testing of credited engineered controls following preventive or corrective maintenance.  Performing periodic verification of physical configuration of credited engineered controls by engineers or system owners using controlled documentation.  Performing periodic CM assessments to determine the effectiveness of different aspects of the credited control CM process.  Retraining system owners and users whenever changes to CM requirements are implemented. 3.4.1 Maintaining Credited Controls during Operations Credited controls listed in the ASE must address nonstandard industrial, accelerator-specific hazards and risks described in the SAD safety analysis. Modifications to credited controls during the operations phase should be evaluated against the assumptions in the safety analysis. If a standard industrial hazard introduced during the operations phase of an accelerator affects the frequency or the consequences of a previously identified safety incident in the safety analysis, then managers should re- evaluate the assumptions in the safety analysis to determine if a new or modified credited control is necessary. Examples of credited controls that may need modification during routine operations include  active and/or passive systems that protect personnel from primary and secondary beam hazards and/or exposure  large detector flammable gas system alarms  ventilation systems for large volumes of cryogenic, target assemblies, or other inert gasses that could cause an exposure or oxygen deficiency hazard  target cooling systems that prevent melting and dispersal of activated materials  beam intensity and/or annual integrated beam limits 58 DOE G 420.2-1A 8-1-2014  stack effluent monitoring systems;  control room staffing Credited engineered controls, including any applicable calibration and testing, should reference consensus standards to Guide modifications where applicable. Where applicable, credited engineered controls should use the referenced consensus standards and rules listed in Section 6 of this Guide. Once a credited control is operational, consider using operations personnel to ensure that required credited controls are in place and operational as specified in the ASE. Approved operating procedures should translate the ASE requirements and any other important SAD commitments into language readily understood by all who have assigned responsibility for maintaining credited control operability, including testing, maintenance, and inspections. Operating procedures should specify the operating and shutdown conditions under which each credited control in the ASE applies, including how to implement approved alternatives and how frequently calibration, inspection, and functional testing of the credited control should be performed. 3.4.2 Approved Alternatives for Credited Controls Approved alternatives to satisfy ASE requirements for conditions of operability are based on the fact that equipment is not 100 percent reliable. DOE and the contractor may specify an approved

alternative for each ASE requirement in the event the contractor cannot meet the requirement. DOE and the contractor should specify agreed-upon approved alternatives in the ASE, since alternatives require time for thoughtful consideration. Approved alternatives are approved actions offering equivalent protection that, when implemented as specified in the ASE, prevent ASE violations and reduce unnecessary impact on operations. They are planned so that accelerator operators have the capability to handle minor failures in compliance with the DOE approved ASE. Basing approved alternatives on detailed risk analyses, previous experience, or informed engineering judgment should be considered. Approved alternatives should specify any allowed time to restore full operability of credited controls. Implementation of approved alternatives should not have significant risk impacts. Normally, they simply require that the adverse condition be corrected in a specified period and specify further action (e.g., turn off beam) if doing so is not possible. The intent is to take immediate actions to implement the approved alternative as soon as possible. If the approved alternative is not satisfied or if it has a limited time interval, the affected activity should stop in a controlled and safe manner as soon as possible when the time interval expires. If the accelerator contractor implements the approved alternative as specified in the ASE, this is not considered an ASE violation. 3.4.3 Performing Maintenance and Return to Service of Credited Engineered Controls Accelerator operators should use preapproved work plans or procedures for routine maintenance and one-for-one component replacement done on credited engineered controls. These procedures should ensure the following:  Maintenance or restart will not violate the ASE requirements.  Work is reviewed and workers obtain approval before starting the work or return to service. DOE O 420.2-1A 59 8-1-2014  Proper safeguards that provide equivalent protection are in place before the credited engineered control is taken out of normal operating mode.  Procedures are executed by authorized and qualified persons.  Validation tests of work done where appropriate.  Documentation is updated as required. For corrective or preventive maintenance that requires modifications to the credited engineered control, accelerator operators should employ a formal review of the proposed work, including completion of the USI process. Accelerator operators should consider using procedures or formal checklists to ensure that credited engineered controls are operable when required before returning to service or when restarting an accelerator or accelerator facility with beam. In addition, accelerator operators should consider ensuring real-time data collection systems are operable if the ASE specifies a limit or condition as a credited engineered control, if exceeding the limit or condition is within the capability of the as-built accelerator. Accelerator managers should consider making the following items available to accelerator operators who directly enable beam:  Notification that a credited engineered control that underwent preventive or corrective maintenance is ready to reuse. This notification has been done at some facilities using a sign off on a credited engineered control check list in the accelerator control room.  Notification that a credited engineered control is undergoing testing or diagnosing, or that a

development computer is attached to a credited engineered control’s logic controller. This notification should be displayed or easily accessible in the accelerator control room.  A display of all fault and trip conditions of the credited engineered control in the accelerator control room. 3.4.4 Updates to the SAD during Operations The SAD is to be maintained current. It is understood that the SAD is a living document and that it is impractical to immediately revise the document in response to minor changes or discrepancies. The contractor and DOE organization approving the ASE should agree upon the significance of modifications requiring an update to the SAD. Significant changes to an accelerator facility must be documented in a revision of the SAD or appended to the SAD for later incorporation. The SAD and appended updates should accurately reflect the engineered and administrative controls of safety systems at the facility. Operations personnel should be updated regarding changes to the SAD that impact safe operations. An updated SAD may be required in response to changes to the facility or changes in DOE requirements that impact safe operation of the facility. Updated SADs may be needed to reflect significant changes to the facility, altered operational conditions, or significant modifications to the experimental program. The USI process is an acceptable documented process for reviewing and approving changes to the facility and may be used as a vehicle for updating the SAD. The system used to document and 60 DOE G 420.2-1A 8-1-2014 implement updates between SAD revisions is left to the discretion of the contractor as long as the associated safety analyses are available for review. Updates in the form of USI documents and supporting analyses may be appended to the most current SAD until a SAD revision is conducted. Periodic reviews of the SAD play an important role in ensuring that the SAD is maintained current and may serve to identify material that needs to be updated. Such reviews should be conducted by the appropriate reviewer(s) as determined by line management. A benefit of the preparation of SAD documents in modular fashion is that changes in hazards or control measures necessitate revision only to those documents describing activities impacted by the changes. An important point to observe in preparing modular SADs is that the aggregate assembly of SADs must comprehensively describe the entire facility in an integrated fashion. Relationships between various operations must be clearly identified and described. Care must be taken to ensure that operational changes are integrated into all affected SAD documents. 3.5 Access Control System as a Credited Control If an ACS is identified in the ASE as a credited control, then accelerator operators should use procedures or formal checklists to ensure sensor calibrations, tests, inspections, or required data logging in accordance with the ASE requirements. A test and/or surveillance of an ACS should specify a frequency. Accelerator operators should ensure performance of all ACS tests and/or surveillances within the interval specified in the ASE or within a maximum extension of 25 percent of the interval between any two consecutive tests and/or surveillances. Accelerator managers should employ safety analysis, engineering judgment, and/or consensus standards to justify the allowed extension interval for ACS tests or surveillances. DOE and accelerator

contractors should allow extensions for operational flexibility of an ACS infrequently and should not employ extensions routinely. Accelerator operators should ensure complete functional testing after modification of any credited engineered control system, not just an ACS. The amount of testing should be relative to the complexity of the modification. Operators of accelerators should consider whether the modification directly relates to a safety function and if the modifications are hardware, software, or both. Accelerator operators should accomplish testing of an ACS with approved procedures to verify each safety function described in the SAD and/or design specification documentation. These procedures should include step check off for each observed response, thus providing an auditable record of execution. Whenever possible, tests should verify that the ACS provides protection in response to likely improper actions. At many accelerators, the ACS not only prevents access to accelerator enclosures but also is used to curtail abnormal beam loss, limit abnormal bending of beam, or limit the amount of energy stored in a magnetic field. The ACS may use radiation monitors or magnet current interlocks to accomplish these functions. If functions not related to access protection are part of an ACS, then verifying that these functions are operable as designed should be included in test procedures. DOE O 420.2-1A 61 8-1-2014 3.5.1 ACSs that Prevent Access to Accelerator Enclosures An ACS that prevents worker access to radiation may also limit access to other hazards associated with the accelerator enclosure, such as oxygen deficiency or electrical hazards. Accelerator operators often define hazardous equipment as equipment that contributes to the generation of radiation or particle beam. Guidance for specific ACS features to control other hazards such as oxygen deficiency is not presented here, although in general the guidance is applicable. A radiation protection ACS consists of two major parts: The first major part provides access control to accelerator enclosures and prevents beam production until an area is secure, that is, “swept” free of personnel. Operators may also clear adjacent accelerator enclosures affected by beam production in the immediate area. If any door opens after operators clear the enclosure of personnel, or any emergency function of the ACS activates inside the accelerator enclosure, then the system logic should abort the sweep, and the operators should restart the sweep from the beginning. The second major part provides a means of immediately shutting down beam production if an entrant compromises an accelerator enclosure—for example, by opening an access door or pressing an emergency shutdown button—or if an adjacent area becomes unsecure and must “trip” other areas whose beam production is hazardous to that area. Operators should not routinely use the ACS to turn off radiation-producing equipment. The equipment control system should provide this function by ramping down the output of power supplies in a controlled manner. Operators should establish an appropriate entry control program associated with the ACS including  entry procedures for specific beam lines or accelerator areas  entry procedures for entry into enclosures after abnormal conditions  escorting policies for accelerator enclosures  access procedures into high-radiation areas or areas with multiple hazards

Administrative procedures should define the required actions of personnel whenever the ACS disables beam in the accelerator, and line managers should review and approve the procedures. For accelerator enclosures capable of having residual radiation after the accelerator beam is disabled, entry procedures should include radiation surveys as part of the initial entry, and periodically, as necessary. Fundamental ACS design features should  be inherently fail-safe  be highly reliable  pose minimal risk of common mode failures  have high availability  have built in testability  be tamper-resistant Each safety function in an ACS for radiation protection relies on devices that ensure beam and/or radiation either is inhibited or is not steered into areas where people may be present. Some examples of 62 DOE G 420.2-1A 8-1-2014 these devices are beam stops, radiation stops, polarity of steering magnets such as dipoles, and power supplies to injector systems. Accelerator operators shall use two or more of these protective devices for areas where very high radiation, as defined in 10 CFR 835, can be present inside an enclosure during beam operation. Documentation for an ACS could follow methods found in ANSI/ISA-84.00.01-2004 (IEC 61511 Mod) sub clause 10.3. An ACS for radiation protection shall meet the requirements of 10 CFR 835, Occupational Radiation Protection, Subpart F, Entry Control Program. An ACS may have various modes of operation particular to each facility, and these ACS systems may have mode names that fit that facility. Other than “all access” to “no access” mode, the ACS design may accommodate a “limited access” or “controlled access” mode. Some sophisticated ACSs accommodate many access modes, depending on the accelerator’s size and complexity of hazards. Accelerator managers could display the current mode of an ACS at an operator’s primary location and at each entryway. Accelerator operators should perform an active search or sweep of an accelerator enclosure prior to controlled access mode, unless the enclosure is already secured. This would require that operators understand that they are transitioning the accelerator enclosure to controlled access mode, since entrants will follow different procedures after controlled access mode is established. Operator performance may be improved by ensuring each accelerator enclosure has its own approved procedure defining the search process. In this transition period to controlled access mode, an ACS should  lock all entry doors except when allowing operators to enter, exit, and sweep any occupants from the accelerator enclosure  enforce a predefined search sequence and path  prohibit the operational state of any equipment designed to control a hazard that is connected to the ACS Loss of power, signal, or communication to all or a self-contained subsection of the ACS should trigger a process for an operator to re-secure the affected area, which would involve searching any area opened during the loss of power, signal, or communication. The search should not be required for enclosures that have undisturbed positive tamper-proof seals on entryways (e.g., manual locks, tamper- proof tape, or wire). Controlled access is a situation in which operators permit a few workers to enter an already searched area to carry out specific tasks. These entrants should be tracked when they enter and when they leave. When all entrants leave the accelerator enclosure while it is in controlled access mode,

operators may return the accelerator to the beam-enabled condition without a search. The safety of controlled access entries depends on strict controls and well-defined procedures that make certain the same number of people who entered the enclosure during controlled access leave the enclosure. Operators should make a permanent, written, or electronic record of each controlled access; and the record should include the name of each person entering and the time of entry and exit. Operators should retain this record as a part of the operations records for the accelerator facility. In controlled access mode, the ACS for radiation protection should  prevent beam operation DOE O 420.2-1A 63 8-1-2014  lock all entry doors except one, where feasible, to allow each authorized entrant to enter or exit the accelerator enclosure  allow for some equipment in the accelerator enclosure to be energized while workers are present as long as the hazard from energized equipment is controlled in accordance with applicable requirements  revert to a safe mode if any emergency shutoff device is actuated  revert to a safe mode if any entryway is detected open that is not allowed open by the ACS  monitor and/or supervise the administrative controls used to count each entrant into and out of the accelerator enclosure The ACS should allow an operator action to open the door without aborting the searched condition of the accelerator enclosure. Operators should place administrative limits both on the number of people allowed into the accelerator enclosure when allowing controlled access and on the maximum elapsed time in controlled access without re-sweeping. After a controlled access is complete, the entry record should be reconciled to ensure those who entered have left, and a warning interval should be required before operators return the accelerator to the beam-enabled condition. The “no access” mode or the “beam-enabled” mode of an ACS for radiation protection should  generate audible and/or visual warning and time delay to allow safe exit from the enclosure before beam can be introduced into the accelerator enclosure  lock all entry doors  allow x-ray and/or beam generating equipment to be in the “on” state  remove all permits to x-ray and/or beam generating equipment and switch to safe mode if any entryway is breached or any emergency shutoff device is actuated  remove all permits to x-ray and/or beam-generating equipment and switch to safe mode if ACS detects a failure of any device deemed necessary or critical for a safety function  monitor any relevant radiation monitors for alarms 3.5.2 Testing, Diagnosing, and Use of ACS Development Computers During operations, testing and diagnosing of an ACS (including the connecting of development computers to an ACS) should be permitted only if  actions will not violate the ASE requirements  there is a redundant credited control still operating and/or there is more than one method to remove the hazard  very strict administrative controls are in place  review and approval are required before the action is performed  the planned action is a brief, temporary event to be permanently removed, leaving the ACS in its original configuration 64 DOE G 420.2-1A 8-1-2014 ACSs can accommodate approved-bypass procedures. ACS approved-bypass procedures should address the following  The accelerator manager should ensure a documented practice or procedure is in place to

ensure only appropriate approved-bypasses remain in place during operations with beam.  A cognizant ACS engineer and a designated specialist familiar with the hazard should review and document approved bypasses.  An approved-bypass documentation file should be in place with the following information: o documentation of approved-bypass with expected expiration date, o explanation of continued safety functionality or equivalent protection after an approved- bypass is incorporated, o description of approved-bypass validation test, o list of equipment used for the approved-bypass, including type and serial numbers when applicable, o copies of marked up drawings, state tables, logic diagrams, or other relevant documentation.  Test results after approved-bypass removal should verify that the safety function of the interlock system is returned to the non-bypassed condition. Operators should not allow ACS software-development computers or test boxes to link to computer-based/programmable logic controller (PLC) –based ACSs during beam operation. Software- development computers or tests boxes should be permitted to link to computer-based/PLC-based ACSs only if there are no beam operations in the area under test or development, and only if appropriate safeguards are in place to protect connected or contiguous accelerator enclosures. After software- development computers or test boxes are used, and before operators return the beam to operation, operators should verify that the ACS software was not changed. Operators should reset ACS to a safe mode, such as access–permitted, to ensure a software- development computer or test box did not leave the ACS in an unsafe mode, such as beam-enabled mode. In addition, before returning beam to operation, operators should ensure the following  no personnel have entered affected enclosures  controlled access was in use in affected enclosures  affected accelerator enclosures are swept before the accelerator is returned to the beam-enabled mode 3.5.3 Writing and Reviewing Sweep Procedures for Accelerator Enclosures Accelerator operators should use specific detailed sweep or search procedures for each accelerator enclosure protected by an ACS. Accelerator managers should approve and control these procedures to maintain accuracy and reliability. In a typical sweep or search procedure, steps should be clear and concise to enable a thorough, complete controlled search of the accelerator enclosure. Accelerator managers should clearly state the purpose of the procedure, in the procedure, and indicate that the only DOE O 420.2-1A 65 8-1-2014 purpose of the procedure is to ensure that no entrants remain inside the enclosure at the conclusion of the sweep. Accelerator managers should ask workers from areas other than those being swept, who are familiar with the accelerator enclosure, to perform a review of proposed or revised sweep procedures, including a walk down. This allows feedback from persons who work in the enclosure and helps ensure the sweep is able to detect their presence. 3.6 Accelerator Sub-System Operational Safety Issues 3.6.1 Sub-Systems Operations Sub-system equipment consists of infrastructure components that support operation of the accelerator facility. Sub-system equipment may include, but is not limited to, injectors, switchgear, motor-generators, ventilation equipment, compressors, cooling water systems, deionizer systems,

Dewars, control electronics, hot cells, and refrigeration plants. In some cases, these pieces of equipment and associated operations exist in other buildings or rooms that are noncontiguous to the accelerator facility spaces. Sub-system equipment and operations are part of the accelerator and therefore part of accelerator operations. Accelerator managers should consider using CM, procedures, training, and qualification of operators for sub-system equipment to the extent that they pose a risk to safe accelerator operations. 3.6.2 Superconducting Magnet and RF Systems Many accelerators use superconducting components to transport, contain, or accelerate particle and ion beams. Maintaining superconducting temperatures in magnets or in RF accelerating cavities requires operation of a cryogenic system. A cryogenic system for magnets at a large accelerator involves the use of refrigerators and compressors to produce the liquid helium required to maintain the electrical conductor in a superconducting state. The upper range of cryogenic systems in use at accelerators today includes systems that use megawatts of electric power, contain many mega-joules of stored electrical energy in magnets, and exist inside accelerator enclosures distributing tens of tons of helium in vacuum-jacketed piping and valve boxes. Additionally, the helium in the supply lines of these large cryogenic systems is maintained at high pressures, typically 250 psia or greater. Accelerator managers should consider these large cryogenic systems to represent oxygen deficiency, noise, limited visibility, and extreme temperature exposure concerns equal to or greater than radiological concerns. Pressure vessels and piping in cryogenic systems are required to meet requirements of the applicable ASME codes and have relief valves that open to prevent pressure vessel or process piping rupture. When active, these relief valves could be sources of extreme noise, large quantities of inert gas release, and extreme cold inside an accelerator enclosure. Superconducting RF cryomodules are assemblies used to accelerate a particle or ion beam. Typically, niobium makes up the wall of a superconducting RF cavity, which establishes an electromagnetic field for particle acceleration. When cooled to the temperature of liquid helium, the niobium cavity becomes a superconductor, reducing RF losses so that high electric fields can be set up 66 DOE G 420.2-1A 8-1-2014 in the cavity using tens of watts of RF power. Naturally, such high fields can lead to hazardous acceleration of electrons over short distances. These fields cause field emission of electrons from the surfaces of the cryomodules; the electrons are accelerated to various energies by these fields until they stop in the cavity wall, thus producing x-rays and releasing more electrons. Operation of superconducting components at an accelerator is a process that may occur without beam operations requiring specialized operator skills, and accelerator operators do not directly control the process. However, accelerator beam operations can affect, or be affected by, a cryogenic system operator’s activities. Operation of cryogenic systems entails the risk of creating oxygen-deficiency hazards and/or significant x-ray hazards that directly relate to the safety or reliability of the accelerator, compliance with health requirements, and fulfillment of the accelerator’s mission. Managers should consider controlling the routine operations aspects of cryogenic systems with procedures, and consider procedures for the actions taken to avoid an adverse impact on accelerator operations. To interpret indications in a cryogenic system correctly, and to determine the best response, the cryogenic system operator and the accelerat