DOE O 420.1 Chg 3, Facility Safety

DISTRIBUTION: INITIATED BY: All Departmental Elements Office of Environment, Safety and Health DOE O 420.1 U.S. Department of Energy ORDER Washington, D.C. Approved: 10-13-95 Review Date: 10-13-97 Chg 1: 11-16-95 Chg 2: 10-24-96 Chg 3: 11-22-00 SUBJECT: FACILITY SAFETY 1. OBJECTIVE. The objective of this Order is to establish facility safety requirements related to: nuclear safety design, criticality safety, fire protection and natural phenomena hazards mitigation. 2. CANCELLATION. The Orders listed below are canceled. Cancellation of an Order does not, by itself, modify or otherwise affect any contractual obligation to comply with such an Order. Canceled Orders which are incorporated by reference in a contract shall remain in effect until the contract is modified to delete the reference to the requirements in the canceled Orders. a. DOE 5480.28, NATURAL PHENOMENA HAZARDS MITIGATION b. DOE 5480.7A, FIRE PROTECTION c. DOE 6430.1A, GENERAL DESIGN CRITERIA (NUCLEAR AND EXPLOSIVES SAFETY REQUIREMENTS) d. DOE 5480.24, CRITICALITY SAFETY 3. APPLICABILITY. a. DOE Elements. Except for the exclusions in paragraph 3c, this Order applies to DOE Elements with responsibility for DOE-owned or leased facilities as follows (see Attachment 1, Table 1, "Facility and Activity Applicability"): (1) 4.2, 4.4 All DOE nuclear and non-nuclear facilities. (2) 4.1, 4.3 All DOE non-reactor nuclear facilities which are classified as Hazard Categories 1, 2, or 3; and explosives facilities. b. Contractors. Except for the exclusions in paragraph 3c, the Contractor Requirements Document (CRD), Attachment 2, sets forth requirements that are to be applied to the universe of contractors awarded contracts for management and operating contracts. Contractor compliance with the CRD will be required to the extent set forth in a contract. Contractors shall be directed to continue to comply with the requirements of Orders canceled by this Order until their contracts are modified to delete the reference to the requirements of the canceled Orders. Vertical line denotes change. CANCELE D 2 DOE O 420.1 10-13-95 c. Exclusions. (1) Activities that are regulated through a license by the Nuclear Regulatory Commission (NRC) or a State under an Agreement with the NRC, including activities certified by the NRC under section 1701 of the Atomic Energy Act; (2) Activities conducted under the authority of the Director, Naval Nuclear Propulsion Program, as described in Public Law 98-525; (3) Activities conducted under the Nuclear Explosives and Weapons Safety Program relating to the prevention of accidental or unauthorized nuclear detonations to the extent a requirement under this part cannot be implemented for a particular facility in a manner that does not compromise the effectiveness of such activities; (4) Activities that are regulated by the Department of Transportation or pursuant to 49 CFR 173.7(b); (5) Accelerator facilities that are covered by DOE Order 5480.25 (excluded from §§4.1 and 4.3 but not from §§4.2 and 4.4.); (6) Fusion facilities (excluded from §§4.1 and 4.3 but not from §§4.2 and 4.4.). 4. REQUIREMENTS. Each section of this Order has specific requirements, and where appropriate schedules for implementing requirements and specific exemptions, which are provided in the following corresponding sections of this Order. In complying with the provisions of this Order, determinations regarding the acceptability of design should include comparison with existing safety basis information, if available. All new construction shall, as a minimum, conform to the Model Building Codes applicable for the state or region, supplemented with additional safety requirements associated with the hazards in the facility in a graded manner.

Guidance associated with this Order are not mandatory requirements. The guidance provided in implementation guides and standards referenced therein are acceptable methods to satisfy the requirements of this Order. Alternative methods that satisfy the requirements of this Order are also acceptable. Any implementation method selected must be justified to ensure that an adequate level of safety commensurate with the identified hazards is achieved. CANCELE D DOE O 420.1 3 10-13-95 4.1. Nuclear and Explosives Safety Design Criteria Nuclear Safety The objectives of section 4.1 for nuclear safety are to ensure that Department of Energy (DOE) non-reactor nuclear facilities are designed and constructed so as to assure adequate protection for the public, workers, and the environment from nuclear hazards. The requirements of this section apply to the activities of design and construction of new Hazard Category 1, 2, and 3 DOE non- reactor nuclear facilities and to the design and construction of modification to existing DOE Hazard Category 1, 2, and 3 non-reactor nuclear facilities when the proposed modifications significantly degrades the approved safety basis for the facility. Modifications to facility design and construction during the design and construction phase shall conform to the requirements for new facilities. Section 4.1 does not apply to the decision process to modify a facility, except to serve as a standard of comparison for safety requirements. Activities associated with facility deactivation at end of life are exempt if justified by a safety analysis. Explosives Safety The objective of section 4.1 for explosives safety is to establish mandatory standards for explosives safety in the design and construction of DOE explosives facilities or modifications thereof. Explosives facilities are those facilities or locations used for storage or operations with explosives or ammunition. When these facilities are also non-reactor nuclear facilities, the requirements for nuclear safety design also apply. 4.1.1 Nuclear Safety 4.1.1.1 General Requirements Detailed application of these requirements shall be guided by safety analyses that establish the identification and functions of safety (safety class and safety significant) Structures, Systems, and Components (SSCs) for a facility and establish the significance to safety of functions performed by those SSCs. Safety analyses shall consider facility hazards, natural phenomena hazards, and external man-induced hazards. Factors such as proximity to nearby facilities such as airports, pipelines, and barge traffic peculiar to the site shall be considered. A safety analysis shall be performed at the earliest practical point in conceptual or preliminary design, so that required functional attributes of safety SSCs can be specified in the detailed design. Safety analyses shall be performed in accordance with Safety Analysis Report (SAR) guidance for safety analysis, as described in DOE guidance documents. 4.1.1.2 Design Requirements Non-reactor nuclear facilities shall be designed with the objective of providing multiple layers of protection to prevent or mitigate the unintended release of radioactive materials to the environment. Defense in depth shall include: siting, minimization of material at risk, the use of conservative design margins and quality assurance; the use of successive physical barriers for protection against the release of radioactivity; the provision of multiple means to ensure critical safety functions (those basic safety functions needed to control the processes, maintain them in a safe state, and to confine and mitigate radioactivity associated with the

CANCELE D 4 DOE O 420.1 Chg 2 10-24-96 potential for accidents with significant public radiological impact); the use of equipment and administrative controls which restrict deviations from normal operations and provide for recovery from accidents to achieve a safe condition; means to monitor accident releases required for emergency responses; and the provision of emergency plans for minimizing the effects of an accident. Facilities shall be sited and designed in such a manner that gives adequate protection for the health and safety of the public and for workers, including those at adjacent facilities, from the effects of potential facility accidents involving the release of radioactive materials. All nuclear facilities with uncontained radioactive materials (as opposed to material contained within drums, grout, and vitrified materials) shall have means to confine them. Such confinement will act to minimize the spread of radioactive materials and the release of radioactive materials in facility effluents during normal operations and potential accidents. For a specific nuclear facility, the number and arrangement of confinement barriers and their required characteristics shall be determined on a case-by-case basis. Factors that shall be considered in confinement system design shall include type, quantity, form, and conditions for dispersing the material. Engineering evaluations, trade-offs, and experience shall be used to develop practical designs that achieve confinement system objectives. The adequacy of confinement systems to effectively perform the required functions shall be documented and accepted through the Safety Analysis Report. Facilities shall be designed to facilitate safe deactivation, decommissioning and decontamination at end of life. Facilities shall be designed to facilitate inspections, testing, maintenance, and repair and replacement of safety SSCs as part of an overall reliability, availability, and maintainability program. The objective is that the facility can be maintained in a safe state, including during these operations, and in keeping with the as low as is reasonably achievable (ALARA) principle for occupational radiation exposure. Facilities shall be designed to keep occupational radiation exposure within statutory limits and incorporate ALARA principles in design, including design provisions to facilitate decontamination during the operational period. Facility process systems shall be designed to minimize the production of wastes and minimize the mixing of radioactive and non radioactive wastes. Vertical line denotes change. CANCELE D Vertical line denotes change. DOE O 420.1 Chg 2 4a (and 4b) 10-24-96 Safety SSCs identified in accordance with this section shall, commensurate with the importance of the safety functions performed, be designed: (1) so that they can perform their safety functions when called upon to operation, and (2) under a quality assurance program that satisfies 10 CFR 830.120. Facility safety class electrical systems shall be designed to the basic approach outlined in Section 5.2.3 (Electrical) of "Implementation Guide for Nonreactor Nuclear Safety Design Criteria and Explosives Safety Criteria." 4.1.2 Explosives Safety

The safety design of all new DOE explosives facilities and all modifications to existing explosives facilities shall conform to the DOE explosives safety requirements established in the DOE Explosives Safety Manual, DOE M 440.1-1. Facility structural design and construction shall comply with the requirements of TM5-1300, Structures to Resist the Effects of Accidental Explosions, and DOE/TIC-11268, A Manual for the Prediction of Blast and Fragment Loading of Structures. Blast-resistant design for personnel and facility protection shall be based on the TNT equivalency of the maximum quantity of explosives and propellants permitted. In accordance with TM5-1300, the TNT equivalency shall be increased by 20% for design purposes. CANCELE D DOE O 420.1 5 10-13-95 4.1.3 Implementation An Implementation Plan describing the process that will ensure that the requirements of this section will be invoked during the design and construction shall be submitted to the DOE Cognizant Secretarial Officer or his designee in accordance with section 5. Deviations from applicable requirements shall be appropriately documented and justified. 4.2. Fire Protection 1. The objectives of section 4.2 are to establish requirements for a comprehensive fire and related hazards protection program for facilities sufficient to minimize the potential for: (1) the occurrence of a fire or related event; (2) a fire that causes an unacceptable on- site or off-site release of hazardous or radiological material that will threaten the health and safety of employees, the public or the environment; (3) vital DOE programs suffering unacceptable interruptions as a result of fire and related hazards; (4) property losses from a fire and related events exceeding defined limits established by DOE; and (5) critical process controls and safety class systems being damaged as a result of a fire and related events. 2. Section 4.2 of this Order has primacy over all other DOE Orders with respect to matters concerning fire protection for facilities (refer to DOE 440.1 for worker protection requirements). To the extent that potential conflicts may arise resulting from the implementation of these requirements in relation to other DOE Orders or Directives, the cognizant fire protection Authority Having Jurisdiction (AHJ) within the Office of the Assistant Secretary for Environment, Safety and Health shall be responsible for resolving the issue in concert with the other AHJs. 3. DOE facilities, sites and activities (including design and construction) shall be characterized by a level of fire protection that is sufficient to fulfill the requirements of the best protected class of industrial risks ("Highly Protected Risk" or "Improved Risk") and shall be provided protection to achieve "defense-in-depth." This includes meeting the applicable building code and National Fire Protection Association Codes and Standards, or exceeding them (when necessary to meet safety objectives), unless an exemption has been granted. The applicable codes and standards are those in effect when facility design commences ("code of record"). When significant modifications to a facility occur, the current edition of the code or standard shall apply to the modification. 4.2.1 General Programmatic Requirements DOE Elements and contractors shall develop, implement and maintain an acceptable fire protection program with the following features: CANCELE D 6 DOE O 420.1 10-13-95

1. A policy statement that incorporates the requirements of this Section, related DOE directives, and other applicable Federal, state and local fire protection requirements. The statement shall affirm management's commitment to support a level of fire protection and fire suppression capability sufficient to minimize losses from fire and related hazards consistent with the best class of protected property in private industry. 2. Comprehensive, written fire protection criteria that reflect additional site-specific aspects of the fire protection program, including the organization, training and responsibilities of the fire protection staff, administrative aspects of the fire protection program, and requirements for the design, installation, operability, inspection, maintenance and testing of fire protection systems. 3. Written fire safety procedures governing the use and storage of combustible, flammable, radioactive, and hazardous materials so as to minimize the risk from fire. Such procedures shall also exist for fire protection system impairments and for activities such as smoking, hot work, safe operation of process equipment, and other fire prevention measures which contribute to the decrease in fire risk. 4. A system to ensure that the requirements of the DOE fire protection program are documented and incorporated in the plans and specifications for all new facilities and for significant modifications of existing facilities. This includes a documented review by a qualified fire protection engineer of plans, specifications, procedures, and acceptance tests. 5. Fire hazards analyses (FHA) for all nuclear facilities, significant new facilities and facilities that represent unique or significant fire safety risks. The FHA shall be developed using a graded approach. The conclusions of the FHA shall be incorporated in the Safety Analysis Report (SAR) Accident Analysis and shall be integrated into design basis and beyond design basis accident conditions. 6. Access to a qualified and trained fire protection staff, including a fire protection engineer(s), technicians and fire fighting personnel to implement the requirements of this Section. 7. A "baseline" needs assessment that establishes the minimum required capabilities of site fire fighting forces. This includes minimum staffing, apparatus, facilities, equipment, training, fire pre-plans, off-site assistance requirements, and procedures. Information from this assessment shall be incorporated into the site Emergency Plan. 8. Written pre-fire strategies, plans, and standard operating procedures to enhance the effectiveness of site fire fighting forces, where provided. Such procedures include those governing the use of fire fighting water or other neutron moderating materials to CANCELE D DOE O 420.1 7 10-13-95 suppress fire within or adjacent to moderation controlled areas. Restrictions on the use of water shall be fully justified on the basis of criticality safety. 9. A comprehensive, documented fire protection self-assessment program, which includes all aspects (program and facility) of the fire protection program. Assessments shall be performed on a regular basis at a frequency established by DOE. 10. A program to identify, prioritize and monitor the status of fire protection-related appraisal findings/recommendations until final resolution is achieved. When final resolution will be significantly delayed, appropriate interim compensatory measures shall be implemented to minimize the fire risk.

11. A process for reviewing and recommending approval of fire safety "equivalencies" and "exemptions" to the DOE Authority Having Jurisdiction for fire safety. 4.2.2 Fire Protection Design Requirements DOE Elements and contractors shall develop, implement and maintain a comprehensive fire protection program for facilities that includes: 1. A reliable water supply of adequate capacity for fire suppression. 2. Noncombustible or fire-resistive construction, where appropriate. Complete fire-rated barriers that are commensurate with the fire hazard to isolate hazardous occupancies and to minimize fire spread and loss potential consistent with defined limits as established by DOE. 3. Automatic fire extinguishing systems throughout all significant facilities and in all areas subject to loss of safety class systems, significant life safety hazards, unacceptable program interruption, or fire loss potential in excess of defined limits. 4. Redundant fire protection systems in areas where safety class systems are vulnerable to fire damage and where no redundant safety capability exists outside of the fire area. In new facilities, redundant safety class systems shall be in separate fire areas. Redundant fire protection systems shall also be provided in areas where the maximum possible fire loss (MPFL) exceeds limits established by DOE. 5. A means to summon the fire department in the event of a fire, such as a fire alarm signalling system. 6. A means to notify and evacuate building occupants in the event of a fire, such as a fire detection or fire alarm system and illuminated, protected egress paths. CANCELE D 8 DOE O 420.1 10-13-95 7. Physical access and appropriate equipment to facilitate effective intervention by the fire department, such as an interior standpipe system(s) in multi-story or large facilities with complex configurations. 8. A means to prevent the accidental release of significant quantities of contaminated products of combustion and fire fighting water to the environment, such as ventilation control and filter systems and curbs and dikes. Such features would only be necessary if required by the FHA or SAR in conjunction with other facility or site environmental protection measures. 9. Fire and related hazards that are unique to DOE and are not addressed by industry codes and standards shall be protected by isolation, segregation or use of special fire control systems, such as inert gas or explosion suppression, as determined by the FHA. 10. Fire protection systems shall be designed such that their inadvertent operation, inactivation or failure of structural stability will not result in the loss of vital safety functions or inoperability of safety class systems as determined by the SAR. 4.3. Nuclear Criticality Safety DOE Elements shall ensure that a contractor responsible for a DOE non-reactor nuclear facility shall establish a nuclear criticality safety program that (i) applies to fissionable materials that are produced, processed, stored, transferred, disposed, or otherwise handled, and (ii) includes the following elements in paragraphs 4.3.2 and 4.3.3. 4.3.1 Objectives The objective shall be to establish nuclear criticality safety program requirements to ensure that: 1. Criticality safety is comprehensively addressed and receives an objective review, with all identified risks reduced to acceptably low levels and management authorization of the operation is documented.

2. The public, workers, property, both government and private, the environment, and essential operations are protected from the effects of a criticality accident. 4.3.2 General Requirements Operations with fissionable materials which pose a criticality accident hazard shall be evaluated and documented to demonstrate that the operation will be subcritical under both normal and credible abnormal conditions. Fissionable material operations shall be conducted CANCELE D DOE O 420.1 9 10-13-95 in such a manner that consequences to personnel and property that result from a criticality accident will be mitigated. No single credible event or failure shall result in a criticality accident having unmitigated consequences. The nuclear criticality safety program shall be evaluated and documented and shall include: (i) Nuclear criticality safety evaluations for normal and credible abnormal conditions that document the parameters, limits, and controls required to ensure that the analyzed conditions are subcritical. (ii) Implementation of limits and controls identified by the nuclear criticality safety evaluations. (iii) Reviews of operations to ascertain that limits and controls are being followed and that process conditions have not been altered such that the applicability of the nuclear criticality safety evaluation has been compromised. (iv) Assessment of the need for criticality accident detection devices and alarm systems, and installation of such equipment where total risk to personnel will be reduced. 4.3.3 Specific Requirements Fissionable materials shall be produced, processed, stored, transferred, disposed, or otherwise handled in such a manner that the probability of a criticality accident is acceptably low, and, to the extent practical, all persons, all government, public, and private property, and the environment are protected from damaging effects and undue hazards that may arise from a criticality accident. The Contractor Criticality Safety Program for non-reactor nuclear facilities shall include the following requirements: a. Contractor Criticality Safety Programs (CCSPs) shall apply to operations involving fissionable materials that pose a criticality accident hazard. Fissionable nuclides of concern to this section are listed in Table 4.3-1. The assignment of nuclides to the three columns in Table 4.3-1 is based on typical conditions. DOE Elements shall ensure that each contractor organization shall determine which column is appropriate to the fissionable nuclides existing in its inventory, whether listed in this table or not expressly included. Specific technical information concerning differences in behavior of these nuclides relevant to their differing abilities to support a self-sustaining nuclear chain reaction may be found in ANSI/ANS-8.1-1983,R88 and ANSI/ANS-8.15- 1981,R87. CANCELE D 10 DOE O 420.110 DOE O 420.1 10-13-9510-13-95 Table 4.3-1. Fissionable Nuclides of Criticality Concern Nuclide Nuclide Nuclide 92U233* 93Np237 91Pa231** 92U235* 94Pu238 92U232** 94Pu239* 94Pu240 92U234** 94Pu241 96Cm246** 94Pu242 98Cf250** 95Am241 98Cf252** 95Am242m 99Es254** 95Am243 96Cm243 96Cm244 96Cm245 96Cm247 98Cf249 98Cf251 * existing in quantities and forms that lead to the major focus of nuclear criticality safety ** existing in isolated quantities less than potential minimum critical mass (per ANSI/ANS-8.15-1981,R87, "Nuclear Criticality Control of Special Actinide Elements")

b. The basic elements and control parameters of programs for nuclear criticality safety shall satisfy the requirements of the following American Nuclear Society's ANSI/ANS nuclear criticality safety standards: ANSI/ANS-8.1-1983,R88, "Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors," however paragraphs 4.2.2 and 4.2.3, and paragraph 3.3 shall be followed as modified in section 4.3.3.d of this Order; ANSI/ANS-8.3-1986, "Criticality Accident Alarm System," however paragraphs 4.1.2, 4.2.1 and 4.2.2 shall be followed as modified in section 4.3.3.c and e of this Order; ANSI/ANS-8.5-1986, "Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in Solutions of Fissile Material"; CANCELE D DOE O 420.1 11 10-13-95 ANSI/ANS-8.6-1983,R88, "Safety in Conducting Subcritical Neutron- Multiplication Measurements in Situ," however paragraph 5.3 shall be followed as modified in section 4.3.3.f of this Order; ANSI/ANS-8.7-1975,R87, "Guide for Nuclear Criticality Safety in the Storage of Fissile Materials," however paragraph 5.2 shall be followed as modified by section 4.3.3.c of this Order. ANSI/ANS-8.9-1987, "Nuclear Criticality Safety Criteria for Steel-Pipe Intersections Containing Aqueous Solutions of Fissile Materials"; ANSI/ANS-8.10-1983,R88, "Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement"; ANSI/ANS-8.12-1987,R93, "Nuclear Criticality Control and Safety of Plutonium-Uranium Fuel Mixtures Outside Reactors"; ANSI/ANS-8.15-1981,R87, "Nuclear Criticality Control of Special Actinide Elements"; ANSI/ANS-8.17-1984,R89, "Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel Outside Reactors," however paragraph 4.3 shall be followed as modified in section 4.3.3.g of this Order; ANSI/ANS-8.19-1984,R89, "Administrative Practices for Nuclear Criticality Safety;" ANSI/ANS-8.21-1995, "Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors." Revisions to any of the ANSI/ANS standards listed above will place this Section under immediate review by DOE. Revised ANSI standards shall not be used unless an exemption is granted or it is incorporated into a DOE Order. c. All recommendations in the ANSI/ANS standards listed in paragraph 4.3.3.b shall be addressed. When recommendations are not implemented, justification shall be documented in a manner described in the Implementation Plan . Two ANSI/ANS recommendations shall be requirements: CANCELE D 12 DOE O 420.1 10-13-95 ANSI/ANS-8.3-1986, paragraph 4.1.2, the second sentence of which becomes, for this Order, "Where alarm systems are installed, emergency plans shall be maintained." ANSI/ANS-8.7-1975,R87, paragraph 5.2, the last sentence of which becomes, for this Order, "The effects of more significant moderation shall be evaluated." d. For DOE application, the following sections of ANSI/ANS-8.1-1983,R88, "Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors," shall be read as follows: (1) Application of Double Contingency (paragraph 4.2.2, Double Contingency). Process designs shall incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible. Protection shall be provided by either (i) the control of two independent process parameters (which is the preferred approach, when practical, to prevent common-mode failure), or (ii) a system of multiple controls on a single process parameter. The number of controls required upon a single controlled process parameter shall be based upon control reliability and any features that mitigate the consequences of control failure. In all cases, no single credible event or failure shall result in the potential for a criticality accident, except as referenced in the paragraph that follows.

An exception to the application of double contingency, where single contingency operations are permissible, is presented in paragraph 5.1 of ANSI/ANS-8.10- 1983,R88. This exception applies to operations with shielding and confinement (e.g., hot cells or other shielded facilities). Double contingency shall be demonstrated by documented evaluations. (2) Application of Geometry Control (paragraph 4.2.3, Geometry Control). Where a significant quantity of fissionable material is being processed and criticality safety is a concern, passive engineered controls such as geometry control shall be considered as a preferred control method. Where passive engineered control is not feasible, the preferred Order of controls is: active engineered controls, followed by administrative controls. The double contingency analysis shall justify the chosen controls. Full advantage may be taken of any nuclear characteristics of the process materials and equipment. All dimensions, nuclear properties, and other features upon which reliance is placed shall be documented and verified prior to beginning operations, and control shall be exercised to maintain them. CANCELE D DOE O 420.1 13 10-13-95 (3) Application of Definition of "Bias" (paragraph 3.3, Glossary of Terms). The uncertainty in the bias is interpreted as a measure of both the accuracy of the calculation and the precision of the experimental data. It is assumed also to include (a) the precision of the calculation if the calculation is stochastic (notwithstanding that such precision often can be made as great as desired), and (b) the accuracy of the experimental data if the experiment is a mock-up of a referenced system. Deterministic computer calculations are assumed to have very high precision, or should be made to have very high precision. Stochastic computer calculations should be forced to have appropriately high precision. An experiment that is not a mock-up is exactly accurate by definition. e. The requirements in ANSI/ANS-8.3-1986 relating to the needs for an alarm system (paragraphs 4.2.1 and 4.2.2), are not applicable to this Order. For the purpose of this Order, Criticality Accident Alarm Systems (CAS) and Criticality Detection Systems (CDS) shall be required as follows: In what follows, 10 per year is used as a measure of credibility, and does not-6 mean that a probabilistic risk assessment (PRA) has to be performed. Reasonable grounds for incredibility may be presented on the basis of commonly accepted engineering judgment. (1) In those facilities where the mass of fissionable material exceeds the limits established in paragraph 4.2.1 of ANSI/ANS-8.3-1986 and the probability of a criticality accident is greater than 10 per year (as documented in a DOE--6 approved Safety Analysis Report (SAR) or in the supporting analysis for an SAR), a CAS conforming to ANSI/ANS-8.3-1986 shall be provided to cover occupied areas in which the expected dose exceeds 12 rads in free air, where a CAS is defined to include a criticality accident detection device and a personnel evacuation alarm. (2) In those facilities where the mass of fissionable material exceeds the limits established in paragraph 4.2.1 of ANSI/ANS-8.3-1986 and the probability of a criticality accident is greater than 10 per year, (as documented in a DOE--6

approved SAR or in the supporting analysis for an SAR), but there are no occupied areas in which the expected dose exceeds 12 rads in free air, a CDS shall be provided, where a CDS is defined to be an appropriate criticality accident detection device but without an immediate evacuation alarm. The CDS response time should be sufficient to allow for appropriate process-related mitigation and recovery actions. DOE Elements shall ensure that appropriate response guidance to minimize personnel exposure shall be provided by the contractor. CANCELE D 14 DOE O 420.1 10-13-95 (3) In those facilities where the mass of fissionable material exceeds the limits established in paragraph 4.2.1 of ANSI/ANS-8.3-1986, but a criticality accident is determined to be impossible due to the physical form of the fissionable material, or the probability of occurrence is determined to be less than 10 per-6 year (as documented in a DOE-approved SAR or in the supporting analysis for an SAR, or in other appropriate documentation), neither a CAS nor a CDS is required. Neither a CAS nor a CDS is required for fissionable material during shipment when packaged in approved shipping containers, or when packaged in approved shipping containers awaiting transport provided that no other operation involving fissionable material not so packaged is permitted on the shipping dock or in the shipment area. (4) If a criticality accident is possible wherein a slow (i.e., quasistatic) increase in reactivity could occur leading from subcriticality to supercriticality to self- shutdown without setting off emplaced criticality alarms, then a CAS might not be adequate for protection against the consequences of such an accident. To aid in protecting workers against the consequences of slow criticality accidents in facilities where analysis has shown that slow criticality accidents are credible, CASs should be supplemented by warning devices such as audible personnel dosimeters (e.g., pocket chirpers/flashers, or their equivalents), area radiation monitors, area dosimeters, or integrating CASs. If these devices are used solely as criticality warning devices in accordance with this Section, they shall be exempt from the calibration requirement of DOE Order 5480.11 (Radiation Protection for Occupational Workers, 12-21-88). (5) Neither a CAS nor a CDS is required to be installed for handling or storage of fissionable material when sufficient shielding exists that is adequate to protect personnel (e.g., spent fuel pools, hot cells, or burial grounds); however a means to detect fission product gasses or other volatile fission products should be provided in occupied areas immediately adjacent to such shielded areas, except for systems where no fission products are likely to be released. f. For DOE application, in section 5.3 of ANSI/ANS-8.6-1983,R88, "Safety in Conducting Subcritical Neutron-Multiplication Measurements in Situ," "i.e." should be read as "e.g." g. For DOE application, in section 4.3 of ANSI/ANS-8.17-1984,R89, "Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel Outside Reactors," the guidance on alarm systems is specifically modified in this Order. CANCELE D DOE O 420.1 Chg 3 15 11-22-00 h. It is acceptable to DOE to follow DOE-STD-3007-93 (Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Non-Reactor Nuclear Facilities) when preparing Criticality Safety Evaluations.

For DOE application, the following sections of DOE-STD-3007-93 shall be read as follows: (1) II. DEFINITIONS. The definition of “BIAS” should be interpreted as discussed in paragraph 4.3.3.d.(3). (2) 4.0 METHODOLOGY. When computer neutronics calculations are used, the type of computing platform should be stated along with relevant code configuration control information and code development and user documentation. i. DOE Elements shall ensure that the contractor shall have a program to detect inadvertent accumulation of significant quantities of fissionable material. j. Transportation Requirements for Fissionable Material. (1) The requirements of this section shall apply to all activities where fissionable material is transferred from one operation to another within a facility and from one on-site location to another. (2) The requirements of DOE O 460.1 (Packaging and Transportation Safety, 9-27- 95) shall be complied with regarding off-site shipment of fissionable material. DOE O 460.1 (Packaging and Transportation Safety, 9-27-95) shall apply to the safe transportation of weapon components and special assemblies shipped in national defense. k. Guidelines for Fire Fighting The fire protection program (Section 4.2.1) shall establish guidelines for fire fighting within, or adjacent to, moderation controlled areas. These guidelines shall be based on comparisons of risks and consequences of a criticality accident with the risks and consequences of postulated fires for the respective area(s). Risk and consequence comparisons may be a qualitative evaluation. The basis for the guidelines shall be documented. Vertical line denotes change. CANCELE D DOE O 420.1 Chg 3 15a 11-22-00 l. Training and Qualification A Program for Training and Qualifying Nuclear Criticality Safety Staff shall be implemented. This Program shall be described and established in the Implementation Plan. DOE-STD-1135-99, "Guidance for Nuclear Criticality Safety Engineer Training and Qualification," is acceptable to DOE to provide guidance to assist DOE contractors in developing this Program. The requirements in DOE-STD-1135-99 shall not be requirements per DOE O 420.1 (FACILITY SAFETY), Section 4.3 (Nuclear Criticality Safety). DOE shall approve modifications to the Program. DOE Federal staff shall follow the requirements in DOE O 360.1 (FEDERAL EMPLOYEE TRAINING) and in DOE M 426.1-1, "Federal Technical Capability Manual" to meet the requirements of this paragraph. The Program for Training and Qualifying Nuclear Criticality Safety Staff should be implemented using a graded approach. This graded approach should be based on the duties and responsibilities of individual nuclear criticality safety engineers and should establish priorities that are appropriate to ensure all aspects of nuclear criticality safety. 4.4 Natural Phenomena Hazards Mitigation The objectives of this section are to ensure that all DOE facilities are designed, constructed, and operated so that the general public, workers, and the environment are protected from the impact of Natural Phenomena Hazards Vertical line denotes change CANCELE D 16 DOE O 420.1 10-13-95 (NPHs).The provisions of this section apply to DOE sites and facilities. The provisions of this section cover all natural phenomena hazards such as seismic, wind, flood, lightning. Where no specific requirements are specified, model building codes or national consensus industry standards shall be used.

4.4.1 General Requirements For hazardous facilities, safety analyses shall include the ability of Systems, Structures, Components (SSCs) and personnel to perform their intended safety functions under the effects of natural phenomena. 4.4.2 Natural Phenomena Mitigation Design Requirements Systems, structures and components shall be designed, constructed and operated to withstand the effects of natural phenomena as necessary to ensure the confinement of hazardous material, the operation of essential facilities, the protection of government property, and the protection of life safety for occupants of DOE buildings. The design process shall consider potential damage and failure of systems, structures and components due to both direct and indirect natural phenomena effects, including common cause effects and interactions from failures of other systems, structures and components. Furthermore, the seismic requirements of Executive Order 12699 shall be addressed. Systems, structures and components for new DOE facilities, and additions or major modifications to existing systems, structures and components shall be designed, constructed and operated to meet the requirements in the previous paragraph. Any additions and modifications to existing DOE facilities shall not degrade the performance of existing systems, structures and components to the extent that the objectives in this Section cannot be achieved under the effects of natural phenomena. 4.4.3 Evaluation and Upgrade of Existing DOE Facilities Systems, structures and components in existing DOE facilities shall be evaluated in accordance with Section 4.4.2 when there is a significant degradation in the safety basis for the facility. Furthermore, the seismic requirements of Executive Order 12941 shall be addressed. If any of the conditions above are satisfied then the contractor/operator shall establish a plan for evaluating the affected systems, structures and components. The plan shall incorporate a schedule for evaluation taking into account programmatic mission considerations and the safety significance of the potential failure of systems, structures and components due to natural phenomena. If the evaluation of existing systems, structures and components identifies natural phenomena mitigation deficiencies, the contractor/operator shall establish an upgrade plan for the affected systems, structures and components. CANCELE D DOE O 420.1 17 10-13-95 The upgrade plan shall incorporate a prioritized schedule for upgrading the systems, structures and components. The upgrade plan shall address possible time or funding constraints as well as programmatic mission considerations. 4.4.4 Natural Phenomena Hazards Assessment The design and evaluation of facilities to withstand natural phenomena shall be based on an assessment of the likelihood of future natural phenomena occurrences. The natural phenomena hazards assessment shall be conducted commensurate with a graded approach and commensurate with the potential hazard of the facility. For new Sites; natural phenomena hazards assessment shall be conducted commensurate with a graded approach to the facility. Site planning shall consider the consequences of all types of natural phenomena hazards.

For existing Sites; if there are significant changes in natural phenomena hazards assessment methodology or site-specific information, the natural phenomena hazards assessments shall be reviewed and shall be updated, as necessary. A review of the natural phenomena hazards assessment shall be conducted at least every 10 years. The review shall include recommendations to DOE on the need for updating the existing natural phenomena hazards assessments based on identification of any significant changes in methods or data. 4.4.5 Natural Phenomena Detection Facilities or sites with hazardous materials shall have instrumentation or other means to detect and record the occurrence and severity of seismic events. 4.4.6 Post-Natural Phenomena Procedures Facilities or sites with hazardous materials shall have procedures that include, inspecting the facility for damage caused by severe natural phenomena, and placing the facility into a safe configuration when such damage has occurred. 5. RESPONSIBILITIES. a. Secretary of Energy: The Secretary of Energy retains sole and final authority to determine what acts are necessary to comply with this Order. Further, the Secretary retains the authority to suspend any or all requirements under this Order whenever the Secretary deems it necessary. This authority may be delegated by the Secretary. b. Assistant Secretary for Environment, Safety and Health: The Assistant Secretary for Environment, Safety and Health is responsible for development, promulgation, and maintaining the CANCELE D 18 DOE O 420.1 10-13-95 policy, requirements, guidance, and technical standards, and providing advice and assistance, as requested, concerning implementation of DOE safety policy as it relates to this Order at DOE facilities; and for monitoring and reviewing the implementation of all aspects of this Order, including field organizations and contractor performance. c. Cognizant Secretarial Officers: Cognizant Secretarial Officers or designees for facilities or planned facilities under their programmatic responsibilities shall ensure that all programs comply with requirements falling within the scope of this Order, shall review and approve Implementation Plans submitted to implement the Order, and shall review and approve requests for exemptions. d. Heads of Field Organizations: As directed by the CSO, shall ensure that the requirements falling within the scope of this Order are in compliance with this Order. Field Elements are responsible for determining whether adequate protection can most effectively be achieved by continuing to operate under the terms of existing contracts requiring compliance with old Orders or by modifying the contract to incorporate the requirements of revised. Field Elements are responsible for determining that implementation of new rule or Order requirements will provide adequate protection prior to requesting contract modification to drop old Order requirements from contract. e. Heads of DOE Elements: Heads of DOE elements shall ensure that initiators of procurement requests shall identify in procurement requests if the requirements in the Contractor Requirements Document for this Order are to be applied to the award or subawards resulting from the procurement request. f. Contractor Organizations: As directed by the CSO or the Heads of Field Organizations and as directed by the Contracting Officer, contractors (including subcontractors) shall develop, implement, and maintain the policies, objectives, and requirements of the CRD of this Order.

6. CONTACT: Office of Environment, Safety and Health; Office of Nuclear Safety Policy and Standards; Office of Occupational Safety and Health Policy. CANCELE D DOE O 420.1 19 (and 20) 10-13-95 7. IMPLEMENTATION PLANS. Contractors shall submit an Implementation Plan to DOE to implement the requirements of this Order. The Implementation Plan shall be submitted after this Order is incorporated into applicable contracts and shall be developed with an integrated safety review process commensurate with the hazards. BY ORDER OF THE SECRETARY OF ENERGY: ARCHER L. DURHAM Assistant Secretary for Human Resources and Administration CANCELE D DOE O 420.1 Attachment 1 10-13-95 Page 1 (and 2) TABLE 1 FACILITY AND ACTIVITY APPLICABILITY WEAPONS FACILITIES SECTION NEW NUC NEW NON EXISTING NUC EXISTING NON MODS NUC MODS NON ACC & Fusion NEW EXISTING MODS ACTIVITIES (Note 3) 4.0 YES YES YES YES YES YES Note 2 YES NO YES NO 4.1 YES Note 1 Note 1 Note 1 YES YES NO YES NO YES NO 4.2 YES YES YES YES YES YES YES YES YES YES NO 4.3 YES NO YES NO YES NO NO YES YES YES NO 4.4 YES YES YES YES YES YES YES YES YES YES NO Note 1: Refer to each section Note 2: See Orders and Standards on Accelerators and Fusion Facilities Note 3: Activities within weapons facilities relating to the prevention of accidental or unauthorized nuclear detonations are subject to the 5600 series of DOE Orders NUC = Nuclear facility categorized as Hazard Category 1, 2, or 3 NON = All other facilities CANCELE D DOE O 420.1 Attachment 2 10-13-95 Page 1 CONTRACTOR REQUIREMENTS DOCUMENT FACILITY SAFETY 4.0 REQUIREMENTS Each section of this Document has specific requirements, and where appropriate schedules for implementing requirements and specific exemptions, which are provided in the following corresponding sections of this Document. In complying with the provisions of this Document, determinations regarding the acceptability of design should include comparison with existing safety basis information, if available. All new construction shall, as a minimum, conform to the Model Building Codes applicable for the state or region, supplemented with additional safety requirements associated with the hazards in the facility in a graded manner. Guidance associated with this Document are not mandatory requirements. The guidance provided in implementation guides and standards referenced therein are acceptable methods to satisfy the requirements of this Document. Alternative methods that satisfy the requirements of this Document are also acceptable. Any implementation method selected must be justified to ensure that an adequate level of safety commensurate with the identified hazards is achieved. 4.1 Nuclear and Explosives Safety Design Criteria In the performance of this contract, the contractor is required to comply with the following: Nuclear Safety The contractor is, for nuclear safety, required to ensure that Department of Energy (DOE) nuclear facilities are designed and constructed so as to assure adequate protection for the public, workers, and the environment by application of the requirements contained herein. These requirements apply to the activities of design and construction of new DOE nuclear facilities and of modifications to existing DOE Hazard Category 1, 2, and 3 non-reactor nuclear facilities when the proposed modifications significantly degrades the approved safety basis for the facility. Modifications to facility design and construction during the design and construction phase shall conform to the requirements for new facilities. Activities associated with facility deactivation at end of life are exempt if justified by safety analysis.

Explosives Safety The contractor shall apply the mandatory standards described herein for the design and construction of DOE explosives facilities or modifications thereof. Explosives facilities are those facilities or locations used for storage or operations with explosives or ammunition. When these facilities are also nuclear facilities, the requirements for nuclear safety design also apply. CANCELE D Attachment 2 DOE O 420.1 Page 2 10-13-95 4.1.1 Nuclear Safety 4.1.1.1 General Requirements Detailed application of these requirements shall be guided by safety analyses that establish the identification and functions of safety (safety class and safety significant) Structures, Systems, and Components (SSCs) for a facility and establish the significance to safety of functions performed by those SSCs. Safety analyses shall consider facility hazards, natural phenomena hazards, and external man-induced hazards. Factors such as proximity to nearby facilities such as airports, pipelines, and barge traffic peculiar to the site shall also be considered. A safety analysis shall be performed at the earliest practical point in conceptual or preliminary design, so that required functional attributes of safety SSCs can be specified in the detailed design. Safety analyses shall be performed in accordance with Safety Analysis Report (SAR) guidance for safety analysis, as described in DOE guidance documents. 4.1.1.2 Design Requirements Nuclear facilities shall be designed with the objective of providing multiple layers of protection to prevent or mitigate the unintended release of radioactive materials to the environment. Defense in depth shall include: siting, minimization of material at risk, the use of conservative design margins and quality assurance; the use of successive physical barriers for protection against the release of radioactivity; the provision of multiple means to ensure critical safety functions (those basic safety functions needed to control the processes, maintain them in a safe state, and to continue and mitigate radioactivity associated with the potential for accidents with significant public radiological impact); the use of equipment and administrative controls which restrict deviations from normal operations and provide for recovery from accidents to achieve a safe condition; means to monitor accident releases required for emergency responses; and the provision of emergency plans for minimizing the effects of an accident. Facilities shall be sited and designed in such a manner that gives adequate protection for the health and safety of the public and for workers, including those at adjacent facilities, from the effects of potential facility accidents involving the release of radioactive materials. Facilities shall be designed to facilitate safe deactivation, decommissioning, and decontamination at end of life. Facilities shall be designed to facilitate inspections, testing, maintenance, repair and replacement of safety SSCs as part of an overall reliability, availability, and maintainability program. The objective is that the facility can be maintained in a safe state, including during these operations, and in keeping with the as low as reasonably achievable (ALARA) principle for occupational radiation exposure. CANCELE D DOE O 420.1 Attachment 2 10-13-95 Page 3 Facilities shall be designed to keep occupational radiation exposure within statutory limits and incorporate ALARA principles in design, including design provisions to facilitate decontamination during the operational period.

Facility process systems shall be designed to minimize the production of wastes and minimize the mixing of radioactive and non radioactive wastes. Safety SSCs, identified in accordance with this section shall, commensurate with the importance of the safety functions performed, be designed: (1) so that they can perform their safety functions when called upon to operate, and (2) under a quality assurance program that satisfies 10 CFR 830.120. 4.1.2 Explosives Safety The safety design of all new DOE explosives facilities and all modifications to existing explosives facilities shall conform to the DOE explosives safety requirements established in the DOE Explosives Safety Manual, DOE M 440.1-1. Facility structural design and construction shall comply with the requirements of TM5-1300, Structures to Resist the Effects of Accidental Explosions, and DOE/TIC-11268, A Manual for the Prediction of Blast and Fragment Loading of Structures. Blast-resistant design for personnel and facility protection shall be based on the TNT equivalency of the maximum quantity of explosives and propellants permitted. In accordance with TM5-1300, the TNT equivalency shall be increased by 20% for design purposes. 4.1.3 Implementation An Implementation Plan describing the process that will ensure that the requirements of this section will be invoked during the design and construction shall be submitted to the DOE Cognizant Secretarial Officer or his designee in accordance with section 5. Deviations from applicable requirements shall be appropriately documented and justified. 4.2 Fire Protection In the performance of this contract, the contractor is to develop, implement and maintain a comprehensive fire protection program that is sufficient to meet the DOE's objectives for fire safety, as stated below. DOE objectives are to establish requirements for a comprehensive fire and related hazards protection program for facilities sufficient to minimize the potential for: (1) the occurrence of a fire or related event; (2) a fire that causes an unacceptable on-site or off-site release of hazardous or radiological material that will threaten the health and safety of employees, the public or the environment; (3) vital DOE programs suffering unacceptable interruptions as a result of fire and related hazards; (4) property losses from a fire and related events exceeding defined limits established by DOE; and (5) critical process controls and safety class systems being damaged as a result of a fire and related events. CANCELE D Attachment 2 DOE O 420.1 Page 4 10-13-95 DOE facilities, sites and activities (including design and construction) shall be characterized by a level of fire protection that is sufficient to fulfill the requirements of the best protected class of industrial risks ("Highly Protected Risk" or "Improved Risk") and shall be provided protection to achieve "defense-in-depth." This includes meeting the applicable building code and National Fire Protection Association Codes and Standards, or exceeding them (when necessary to meet safety objectives), unless explicit written relief has been granted by DOE. 4.2.1 General Programmatic Requirements To meet the above delineated objectives, the contractor shall develop, implement and maintain an acceptable fire protection program with the following features:

1. A policy statement that incorporates the requirements of DOE 420, related DOE directives, and other applicable Federal, state, and local fire protection requirements. The statement shall affirm management's commitment to support a level of fire protection and fire suppression capability sufficient to minimize losses from fire and related hazards consistent with the best class of protected property in private industry. 2. Comprehensive, written fire protection criteria that reflect additional site-specific aspects of the fire protection program, including the organization, training, and responsibilities of the fire protection staff, administrative aspects of the fire protection program, and requirements for the design, installation, operability, inspection, maintenance, and testing of fire protection systems. 3. Written fire safety procedures governing the use and storage of combustible, flammable, radioactive, and hazardous materials so as to minimize the risk from fire. Such procedures shall also exist for fire protection system impairments and for activities such as smoking, hot work, safe operation of process equipment, and other fire prevention measures which contribute to the decrease in fire risk. 4. A system to ensure that the requirements of the DOE fire protection program are documented and incorporated in the plans and specifications for all new facilities and for significant modifications of existing facilities. This includes a documented review by a qualified fire protection engineer of plans, specifications, procedures, and acceptance tests. 5. Fire hazards analyses (FHA) for all nuclear facilities, significant new facilities, and facilities that represent unique or significant fire safety risks. The FHA shall be developed using a graded approach. The conclusions of the FHA shall be incorporated in the SAR Accident Analysis and shall be integrated into design basis and beyond design basis accident conditions. CANCELE D DOE O 420.1 Attachment 2 10-13-95 Page 5 6. Access to a qualified and trained fire protection staff, including a fire protection engineer(s), technicians and fire fighting personnel to implement the requirements of this Order. 7. A "baseline" needs assessment that establishes the minimum required capabilities of site fire fighting forces. This includes minimum staffing, apparatus, facilities, equipment, training, fire pre-plans, off-site assistance requirements, and procedures. Information from this assessment shall be incorporated into the site Emergency Plan. 8. Written pre-fire strategies, plans, and standard operating procedures to enhance the effectiveness of site fire fighting forces, where provided. Such procedures include those governing the use of fire fighting water or other neutron moderating materials to suppress fire within or adjacent to moderation controlled areas. Restrictions on the use of water shall be fully justified on the basis of criticality safety. 9. A comprehensive, documented fire protection self-assessment program, which includes all aspects (program and facility) of the fire protection program. Assessments shall be performed on a regular basis at a frequency established by DOE. 10. A program to identify, prioritize and monitor the status of fire protection-related appraisal findings/recommendations until final resolution is achieved. When final resolution will be significantly delayed, appropriate interim compensatory measures shall be implemented to minimize the fire risk.

11. A process for reviewing and recommending approval of fire safety "equivalencies" and "exemptions" to the DOE Authority Having Jurisdiction for fire safety. 4.2.2 Fire Protection Design Requirements DOE elements and contractors shall develop, implement, and maintain a comprehensive fire protection program for facilities that includes: 1. A reliable water supply of adequate capacity for fire suppression. 2. Noncombustible or fire-resistive construction, where appropriate. Complete fire-rated barriers that are commensurate with the fire hazard to isolate hazardous occupancies and to minimize fire spread and loss potential consistent with defined limits as established by DOE. 3. Automatic fire extinguishing systems throughout all significant facilities and in all areas subject to loss of safety class systems, significant life safety hazards, unacceptable program interruption, or fire loss potential in excess of defined limits. CANCELE D Attachment 2 DOE O 420.1 Page 6 10-13-95 4. Redundant fire protection systems in areas where safety class systems are vulnerable to fire damage and where no redundant safety capability exists outside of the fire area. In new facilities, redundant safety class systems shall be in separate fire areas. Redundant fire protection systems shall also be provided in areas where the maximum possible fire loss (MPFL) exceeds limits established by DOE. 5. A means to summon the fire department in the event of a fire, such as a fire alarm signalling system. 6. A means to notify and evacuate building occupants in the event of a fire, such as a fire detection or fire alarm system and illuminated, protected egress paths. 7. Physical access and appropriate equipment to facilitate effective intervention by the fire department, such as an interior standpipe system(s) in multi-story or large facilities with complex configurations. 8. A means to prevent the accidental release of significant quantities of contaminated products of combustion and fire fighting water to the environment, such as ventilation control and filter systems and curbs and dikes. Such features would only be necessary if required by the FHA or SAR in conjunction with other facility or site environmental protection measures. 9. Fire and related hazards that are unique to DOE and are not addressed by industry codes and standards shall be protected by isolation, segregation or use of special fire control systems, such as inert gas or explosion suppression, as determined by the FHA. 10. Fire protection systems shall be designed such that their inadvertent operation, inactivation or failure of structural stability will not result in the loss of vital safety functions or inoperability of safety class systems as determined by the SAR. The contractor shall direct compliance with these requirements to the extent incorporated into the contract. Interpretations of the language of this document in relation to the contract shall be the responsibility of the DOE Contracting Officer after consultation with the cognizant DOE authority for fire protection. 4.3 Nuclear Criticality Safety In the performance of this contract, the contractor is required to establish a nuclear criticality safety program that (i) applies to fissionable materials that are produced, processed, stored, transferred, disposed, or otherwise handled, and (ii) includes the following elements. CANCELE D DOE O 420.1 Attachment 2 10-13-95 Page 7 4.3.1 General Requirements

Operations with fissionable materials which pose a criticality accident hazard shall be evaluated and documented to demonstrate that the operation will be subcritical under both normal and credible abnormal conditions. Fissionable material operations shall be conducted in such a manner that consequences to personnel and property that result from a criticality accident will be mitigated. No single credible event or failure shall result in a criticality accident having unmitigated consequences. The nuclear criticality safety program shall be evaluated and documented and shall include: (i) Nuclear criticality safety evaluations for normal and credible abnormal conditions that document the parameters, limits, and controls required to ensure that the analyzed conditions are subcritical. (ii) Implementation of limits and controls identified by the nuclear criticality safety evaluations. (iii) Reviews of operations to ascertain that limits and controls are being followed and that process conditions have not been altered such that the applicability of the nuclear criticality safety evaluation has been compromised. (iv) Assessment of the need for criticality accident detection devices and alarm systems, and installation of such equipment where total risk to personnel will be reduced. 4.3.2 Specific Requirements Fissionable materials shall be produced, processed, stored, transferred, disposed, or otherwise handled in such a manner that the probability of a criticality accident is acceptably low, and, to the extent practical, all persons, all government, public, and private property, and the environment are protected from damaging effects and undue hazards that may arise from a criticality accident. The Contractor Criticality Safety Program for nuclear facilities shall include the following requirements: a. Contractor Criticality Safety Programs (CCSPs) shall apply to operations involving fissionable materials that pose a criticality accident hazard. Fissionable nuclides of concern to this Contractor Requirements Document (CRD) are listed in Table 4.3-1. The assignment of nuclides to the three columns in Table 4.3-1 is based on typical conditions. Each contractor organization shall determine which column is appropriate to the fissionable nuclides existing in its inventory, whether listed in this table or not expressly included. Specific technical information concerning CANCELE D Attachment 2 DOE O 420.1 Page 8 10-13-95 differences in behavior of these nuclides relevant to their differing abilities to support a self-sustaining nuclear chain reaction may be found in ANSI/ANS-8.1-1983,R88 and ANSI/ANS-8.15- 1981,R87. Table 4.3-1. Fissionable Nuclides of Criticality Concern Nuclide Nuclide Nuclide 92U233* 93Np237 91Pa231** 92U235* 94Pu238 92U232** 94Pu239* 94Pu240 92U234** 94Pu241 96Cm246** 94Pu242 98Cf250** 95Am241 98Cf252** 95Am242m 99Es254** 95Am243 96Cm243 96Cm244 96Cm245 96Cm247 98Cf249 98Cf251 * existing in quantities and forms that lead to the major focus of nuclear criticality safety ** existing in isolated quantities less than potential minimum critical mass (per ANSI/ANS-8.15-1981,R87, "Nuclear Criticality Control of Special Actinide Elements") b. The basic elements and control parameters of programs for nuclear criticality safety shall satisfy the requirements of the following American Nuclear Society's ANSI/ANS nuclear criticality safety standards:

ANSI/ANS-8.1-1983,R88, "Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors," however paragraphs 4.2.2 and 4.2.3, and paragraph 3.3 shall be followed as modified in section 4.3.2.d of this CRD; ANSI/ANS-8.3-1986, "Criticality Accident Alarm System," however paragraphs 4.1.2, 4.2.1, and 4.2.2 shall be followed, as modified in section 4.3.2.c and e of this CRD; ANSI/ANS-8.5-1986, "Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in Solutions of Fissile Material"; ANSI/ANS-8.6-1983,R88, "Safety in Conducting Subcritical Neutron-Multiplication Measurements in Situ," however paragraph 5.3 shall be followed as modified in section 4.3.2.f of this CRD; CANCELE D DOE O 420.1 Attachment 2 10-13-95 Page 9 ANSI/ANS-8.7-1975,R87, "Guide for Nuclear Criticality Safety in the Storage of Fissile Materials," however paragraph 5.2 shall be followed as modified by section 4.3.2.c of this CRD; ANSI/ANS-8.9-1987, "Nuclear Criticality Safety Criteria for Steel-Pipe Intersections Containing Aqueous Solutions of Fissile Materials"; ANSI/ANS-8.10-1983,R88, "Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement"; ANSI/ANS-8.12-1987,R93, "Nuclear Criticality Control and Safety of Plutonium-Uranium Fuel Mixtures Outside Reactors"; ANSI/ANS-8.15-1981,R87, "Nuclear Criticality Control of Special Actinide Elements"; ANSI/ANS-8.17-1984,R89, "Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel Outside Reactors," however paragraph 4.3 shall be followed as modified in section 4.3.2.g of this CRD; ANSI/ANS-8.19-1984,R89, "Administrative Practices for Nuclear Criticality Safety;" ANSI/ANS-8.21-1995, "Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors." Revisions to any of the ANSI/ANS standards listed above will place the Order related to this CRD under immediate review by DOE. Revised ANSI standards shall not be used unless an exemption is granted or it is incorporated into a DOE Order. c. Contractors shall regard all recommendations in the ANSI/ANS standards listed in paragraph 4.3.2.b. When recommendations are not implemented, justification shall be documented in a manner described in the Implementation Plan. Contractors shall interpret two ANSI/ANS recommendations as requirements: ANSI/ANS-8.3-1986, paragraph 4.1.2, the second sentence of which becomes, for this CRD, "Where alarm systems are installed, emergency plans shall be maintained." ANSI/ANS-8.7-1975,R87, paragraph 5.2, the last sentence of which becomes, for this CRD, "The effects of more significant moderation shall be evaluated." CANCELE D Attachment 2 DOE O 420.1 Page 10 10-13-95 d. For DOE application, the following sections of ANSI/ANS-8.1- 1983,R88, "Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors," shall be read as follows: (1) Application of Double Contingency (paragraph 4.2.2, Double Contingency). Process designs shall incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible. Protection shall be provided by either (i) the control of two independent process parameters (which is the preferred approach, when practical, to prevent common-mode failure), or (ii) a system of multiple controls on a single process parameter. The number of controls required upon a single controlled process parameter shall be based upon control reliability and any features that mitigate the consequences of control failure. In all cases, no single credible event or failure shall result in the potential for a criticality accident, except as referenced in the paragraph that follows.

An exception to the application of double contingency, where single contingency operations are permissible, is presented in paragraph 5.1 of ANSI/ANS-8.10-1983,R88. This exception applies to operations with shielding and confinement (e.g., hot cells or other shielded facilities). Double contingency shall be demonstrated by documented evaluations. (2) Application of Geometry Control (paragraph 4.2.3, Geometry Control). Where a significant quantity of fissionable material is being processed and criticality safety is a concern, passive engineered controls such as geometry control shall be considered as a preferred control method. Where passive engineered control is not feasible, the preferred order of controls is: active engineered controls, followed by administrative controls. The double contingency analysis shall justify the chosen controls. Full advantage may be taken of any nuclear characteristics of the process materials and equipment. All dimensions, nuclear properties, and other features upon which reliance is placed shall be documented and verified prior to beginning operations, and control shall be exercised to maintain them. (3) Application of Definition of "Bias" (paragraph 3.3, Glossary of Terms). The uncertainty in the bias is interpreted as a measure of both the accuracy of the calculation and the precision of the experimental data. It is assumed also to include (a) the precision of the calculation if the calculation is stochastic (notwithstanding that such CANCELE D DOE O 420.1 Attachment 2 10-13-95 Page 11 precision often can be made as great as desired), and (b) the accuracy of the experimental data if the experiment is a mock-up of a referenced system. Deterministic computer calculations are assumed to have very high precision, or should be made to have very high precision. Stochastic computer calculations should be forced to have appropriately high precision. An experiment that is not a mock-up is exactly accurate by definition. e. The requirements in ANSI/ANS-8.3-1986 relating to the needs for an alarm system (paragraphs 4.2.1 and 4.2.2) are not applicable to this CRD. For the purpose of this CRD, Criticality Accident Alarm Systems (CAS) and Criticality Detection Systems (CDS) shall be required as follows: In what follows, 10-6 per year is used as a measure of credibility, and does not mean that a probabilistic risk assessment (PRA) has to be performed. Reasonable grounds for incredibility may be presented on the basis of commonly accepted engineering judgement. (1) In those facilities where the mass of fissionable material exceeds the limits established in paragraph 4.2.1 of ANSI/ANS-8.3-1986 and the probability of a criticality accident is greater than 10-6 per year (as documented in a DOE-approved SAR or in the supporting analysis for an SAR), a CAS conforming to ANSI/ANS-8.3-1986 shall be provided to cover occupied areas in which the expected dose exceeds 12 rads in free air, where a CAS is defined to include a criticality accident detection device and a personnel evacuation alarm. (2) In those facilities where the mass of fissionable material exceeds the limits established in paragraph 4.2.1 of ANSI/ANS-8.3-1986 and the probability of a criticality accident is greater than 10-6 per year, (as documented in a DOE-approved SAR or in the supporting analysis for an SAR), but there are no occupied areas in which the expected dose exceeds 12 rads in free air, a CDS shall be provided, where a CDS is defined to be an appropriate criticality accident detection device but without an immediate evacuation alarm. The CDS response time should be sufficient to allow for appropriate process-related mitigation and recovery actions. Appropriate response guidance to minimize personnel exposure shall be provided by the contractor.

(3) In those facilities where the mass of fissionable material exceeds the limits established in paragraph 4.2.1 of ANSI/ANS-8.3-1986, but a criticality accident is determined to be impossible due to the physical form of the fissionable CANCELE D Attachment 2 DOE O 420.1 Page 12 10-13-95 material, or the probability of occurrence is determined to be less than 10-6 per year (as documented in a DOE-approved SAR or in the supporting analysis for an SAR, or in other appropriate documentation), neither a CAS nor a CDS is required. Neither a CAS nor a CDS is required for fissionable material during shipment when packaged in approved shipping containers, or when packaged in approved shipping containers awaiting transport provided that no other operation involving fissionable material not so packaged is permitted on the shipping dock or in the shipment area. (4) If a criticality accident is possible wherein a slow (i.e., quasistatic) increase in reactivity could occur leading from subcriticality to supercriticality to self-shutdown without setting off emplaced criticality alarms, then a CAS might not be adequate for protection against the consequences of such an accident. To aid in protecting workers against the consequences of slow criticality accidents in facilities where analysis has shown that slow criticality accidents are credible, CASs should be supplemented by warning devices such as audible personnel dosimeters (e.g., pocket chirpers/flashers, or their equivalents), area radiation monitors, area dosimeters, or integrating CASs. If these devices are used solely as criticality warning devices in accordance with this CRD, they shall be exempt from the calibration requirement of DOE Order 5480.11 (Radiation Protection for Occupational Workers, 12-21-88). (5) Neither a CAS nor a CDS is required to be installed for handling or storage of fissionable material when sufficient shielding exists that is adequate to protect personnel (e.g., spent fuel pools, hot cells, or burial grounds); however a means to detect fission product gasses or other volatile fission products should be provided in occupied areas immediately adjacent to such shielded areas, except for systems where no fission products are likely to be released. f. For DOE application, in section 5.3 of ANSI/ANS-8.6-1983,R88, "Safety in Conducting Subcritical Neutron-Multiplication Measurements in Situ," "i.e." should be read as "e.g." g. For DOE application, in section 4.3 of ANSI/ANS-8.17-1984,R89, "Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel Outside Reactors," the guidance on alarm systems is specifically modified in this CRD. CANCELE D DOE O 420.1 Chg 3 Attachment 2 11-22-00 Page 13 h. It is acceptable to DOE to follow DOE-STD-3007-93 (Guidelines for Preparing Criticality Safety Evaluations at Department of Energy non-Reactor Nuclear Facilities) when preparing Criticality Safety Evaluations. For DOE application, the following sections of DOE-STD-3007-93 shall be read as follows: (1) II. DEFINITIONS. The definition of “BIAS” should be interpreted as discussed in paragraph 4.3.3.d.(3). (2) 4.0 METHODOLOGY. When computer neutronics calculations are used, the type of computing platform should be stated along with relevant code configuration control information and code development and user documentation. i. The contractor shall have a program to detect inadvertent accumulation of significant quantities of fissionable material.

j. Transportation Requirements for Fissionable Material. (1) The requirements of this Section shall apply to all activities where fissionable material is transferred from one operation to another within a facility and from one on-site location to another. (2) The requirements of DOE O 460.1 (Packaging and Transportation Safety, 9- 27-95) shall be complied with regarding off-site shipment of fissionable material. DOE O 460.1 (Packaging and Transportation Safety, 9-27-95) shall apply to the safe transportation of weapon components and special assemblies shipped in national defense. k. Guidelines for Fire Fighting The fire protection program (Section 4.2.1) shall establish guidelines for fire fighting within, or adjacent to, moderation controlled areas. These guidelines shall be based on comparisons of risks and consequences of a criticality accident with the risks and consequences of postulated fires for the respective area(s). Risk and consequence comparisons may be a qualitative evaluation. The basis for the guidelines shall be documented. Vertical line denotes change CANCELE D DOE O 420.1 Chg 3 Attachment 2 11-22-00 Page 13a l. Training and Qualification A Program for Training and Qualifying Nuclear Criticality Safety Staff shall be implemented. This Program shall be described and established in the Implementation Plan. DOE-STD-1135-99, "Guidance for Nuclear Criticality Safety Engineer Training and Qualification," is acceptable to DOE to provide guidance to assist DOE contractors in developing this Program. The requirements in DOE-STD-1135-99 shall not be requirements per DOE O 420.1 (FACILITY SAFETY), Section 4.3 (Nuclear Criticality Safety). DOE shall approve modifications to the Program. The Program for Training and Qualifying Nuclear Criticality Safety Staff should be implemented using a graded approach. This graded approach should be based on the duties and responsibilities of individual nuclear criticality safety engineers and should establish priorities that are appropriate to ensure all aspects of nuclear criticality safety. 4.4 Natural Phenomena Hazards Mitigation for DOE Facilities In the performance of this contract, the contractor is required to design, construct, and/or operate the facility as specified in the contract so that the general public, the workers, and the environment are protected from the impact of all Natural Phenomena Hazards (NPHs). Where no specific requirements are specified, model building codes or national consensus industry standards shall be used. Vertical line denotes change CANCELE D CANCELE D CANCELE D Attachment 2 DOE O 420.1 Page 16 10-13-95 5.0 Implementation Plan Contractors shall submit an Implementation Plan to DOE to implement the above requirements. The Implementation Plan shall be submitted after the requirements are incorporated into the applicable contract and shall be developed with an integrated safety review process commensurate with the hazards. CANCELE D DOE O 420.1 Chg 1 U.S. Department of Energy PAGE CHANGE Washington, D.C. 11-16-95 SUBJECT: FACILITY SAFETY DISTRIBUTION: INITIATED BY: All Departmental Elements The Office of Human Resources and Administration 1. PURPOSE. To transmit revised pages to DOE O 420.1, Facility Safety, of 10-13-95.

2. EXPLANATION OF CHANGE. Based on a decision by the Directives Management Board, Departmental Safety Orders, and other selected Orders will reflect no expiration date to clarify that they will remain in effect until superseded or replaced. Therefore, these Orders will show only an Approval Date and Review Date. The Directives System review cycle is discussed in DOE M 251.1-1, Directives System Manual, of 10-16-95. 3. FILING INSTRUCTIONS. a. Remove Page Dated Insert Page(s) Dated 1 and 2 10-13-95 1 11-16-95 2 10-13-95 b. After filing the attached pages, this transmittal may be discarded. BY ORDER OF THE SECRETARY OF ENERGY: ARCHER L. DURHAM Assistant Secretary for Human Resources and Administration CANCELE D DOE O 420.1 Chg 2 U.S. Department of Energy PAGE CHANGE Washington, D.C 10-24-96 SUBJECT: FACILITY SAFETY 1. PURPOSE. This Page Change transmits the revised pages of DOE O 420.1, FACILITY SAFETY, of 10-13-95. 2. EXPLANATION OF CHANGE. These changes accommodate comments made by the Defense Nuclear Facilities Safety Board. 3. FILING INSTRUCTIONS. a. Remove Page(s) Dated Insert Page(s) Dated 3 and 4 10-13-95 3 10-13-95 4 10-24-96 4a (and 4b) 10-24-96 b. After filing the attached pages, this transmittal may be discarded. BY ORDER OF THE SECRETARY OF ENERGY: ARCHER L. DURHAM Assistant Secretary for Human Resources and Administration DISTRIBUTION: INITIATED BY: All Departmental Elements The Office of Environment, Safety and Health CANCELE D Distribution: Initiated By: All Departmental Elements The Office of Environment, Safety and Health U.S. Department of Energy PAGE CHANGE Washington, DC 11-22-2000 SUBJECT: FACILITY SAFETY 1. PURPOSE. This Page Change transmits the revised pages of DOE O 420.1, FACILITY SAFETY, of 10-13-95. 2. EXPLANATION OF CHANGE. These changes satisfy a commitment made to the Defense Nuclear Facilities Safety Board (DNFSB) in response to DNFSB recommendation 97-2, CRITICALITY SAFETY. 3. FILING INSTRUCTIONS. a. Remove Page(s) Dated Insert Page(s) Dated 15 and 16 1-13-95 15, 15a 11-22-00 16 10-13-95 Attachment 2 13 and 14 1-13-95 13, 13a 11-22-00 14 10-13-95 b. After filing the attached pages, this transmittal may be discarded. BY ORDER OF THE SECRETARY OF ENERGY: T.J. GLAUTHIER Deputy Secretary DOE O 420.1 Chg 3 CANCELE D Implementing Instructions for Page Change 3 to DOE O 420.1, FACILITY SAFETY 1. PURPOSE. These implementing instructions are provided along with Page Change 3 to DOE O 420.1, FACILITY SAFETY. These instructions provide information for the development and submittal of plans for nuclear criticality safety engineer training and qualification programs. Training and qualification program requirements are the subject of Page Change 3. The Field Management Council approved these instructions for release on May 5, 2000 under Action #0003-EH-113. 2. IMPLEMENTING INSTRUCTIONS. a. Within 180 days of the effective date of this page change, program plans for nuclear criticality safety engineer training and qualification should be developed and submitted to DOE Field Elements for review and approval. b. These plans should include dates when appropriate criticality safety staff are scheduled to complete qualification. c. DOE Field Elements should provide copies of the approved plans to their Lead Program Secretarial Officers and to the Responsible Manager for the Department's 97-2 Implementation Plan on criticality safety (Assistant Deputy Administrator for Research, Development and Simulation, DP- 10). d. The training and qualification program plans should be updated in accordance with established schedules that are part of the overall training program. CANCELE D DOE O 420.1 Attachment 1, Table 1 Facility and Activity Applicability Attachment 2, Contractor Requirements Document Page Change 1 (Explanation Sheet) Page Change 2 (Explanation Sheet) Page Change 3 (Explanation Sheet) Implementing Instructions for Page Change 3 Print: