DOE O 5481.1B Chg 1, Safety Analysis and Review System

U.S. Department of Energy Washington, D.C. ORDER DOE 5481.1B 9-23-86 SUBJECT SAFETY ANALYSIS AND REVIEW SYSTEM 1. PURPOSE. To establish uniform requirements for the preparation and review of safety analyses of Department of Energy (DOE) operations, including identification of hazards, their elimination or control, assessment of the risk, and documented management authorization of the operation. Detailed requirements for the review and authorization processes for nuclear facilities and reactors are addressed in DOE 5480.5 and DOE 5480.6. 2. CANCELLATION. DOE 5481.1A, SAFETY ANALYSIS AND REVIEW SYSTEM, of 8-13-81. 3. SCOPE. The provisions of this Order apply to all Departmental Elements and contractors performing work for the Department as provided by law and/or contract and as implemented by the appropriate contracting officer. 4. EXCLUSIONS. a. Operations having hazards only of a type and magnitude routinely . encountered and/or accepted by the general public; b. The nuclear safety of weapon designs; c. Construction-related work activities; and d. The Federal employee occupational safety and health program as described in DOE 3790.1A. 5. REFERENCES. a. DOE 1324.2, RECORDS DISPOSITION, of 5-28-80, which establishes the Departmental records disposition program. b. DOE 3790.1A, FEDERAL EMPLOYEE OCCUPATIONAL SAFETY AND HEALTH PROGRAM, of 10-22-84, which establishes the policy and requirements for the occupational safety and health program for Federal employees. c. DOE 5480.1B, ENVIRONMENT, SAFETY AND HEALTH PROGRAM FOR DOE OPERATIONS of 9-23-86, which sets forth responsibilities and requirements for the program. DISTRIBUTION: INITIATED BY: All Departmental Elements Assistant Secretary for Environment, Safety, and Health 2 DOE 5481.1B 9-23-86 d. e. f. g. h. i. j. k. DOE 5480.3, SAFETY REQUIREMENTS FOR THE PACKAGING AND TRANSPORTATION OF HAZARDOUS MATERIALS, HAZARDOUS SUBSTANCES, AND HAZARDOUS WASTES, of 7-9-85, which establishes the requirements for packaging and transportation of hazardous materials, hazardous substances, and hazardous wastes. DOE 5480.5, SAFETY OF NUCLEAR FACILITIES, Of 9-23-863 which establishes DOE’s nonreactor nuclear facility safety program. DOE 5480.6, SAFETY OF DEPARTMENT OF ENERGY-OWNED NUCLEAR REACTORS, of 9-23-86, which establishes DOE’s nuclear reactor safety program. DOE 5610.1, PACKAGING AND TRANSPORTING OF NUCLEAR EXPLOSIVES, NUCLEAR COMPONENTS, AND SPECIAL ASSEMBLIES, of 9-11-79, which establishes safety policies and procedures applicable to packaging and transportation of nuclear explosives, nuclear components, and special assemblies outside of DOE-controlled sites. DOE 5610.3, PROGRAM TO PREVENT ACCIDENTAL OR UNAUTHORIZED NUCLEAR EXPLOSIVE DETONATIONS, of 12-18-80, which establishes safety policies and procedures applicable to activities involving nuclear explosives. DOE 5700.1C, MAJOR SYSTEM ACQUISITIONS, of 9-6-83, which establishes requirements and objectives and assigns responsibilities and authorities necessary to the acquisition of major systems. DOE 5700.6B, QUALITY ASSURANCE, of 9-23-86, which establishes DOE’s quality assurance program. MIL-STD-882B, “System Safety Program Requirements,” of 3-30-84, which provides detailed information for organizing, developing, and implementing system safety programs tailored to individual program needs. This document is available through the Department of Defense. 6. DEFINITIONS.

a. DOE Operations are those DOE-funded activities for which DOE has assumed responsibility for the environment, safety, and health programs. It is a general term intended to encompass individual operations or efforts in the aggregate rather than separately. b. Line Organization is that unbroken chain of command which extends from the Secretary through the Under Secretary, to the Program Senior Officials (PSO) who set program policy and plans and develop assigned programs, to the field organization managers who are responsible to the PSO for execution of these programs, and to the contractors who conduct the programs. Environment, Safety, and Health are integral parts of each DOE 5481.1B 9-23-86 3 program. Accordingly, line management responsibility for ES&H functions flows from the Secretary through the Under Secretary, to the PSO, to the field organization managers, to the contractors. c. Program Senior Official (PSO) is a senior outlay program manager and includes the Assistant Secretaries for Conservation and Renewable Energy; Fossil Energy; Nuclear Energy; Defense Programs; and the Directors of Energy Research and Civilian Radioactive Waste Management. For purposes of this Order, this definition includes the Administrators of the Bonneville and Western Area Power Administrations. d. Risk is a quantitative or qualitative expression of possible loss which considers both the probability that a hazard will cause harm and the consequences of that event. e . Safety Analysis is a documented process to systematically identify the hazards of a DOE operation, to describe and analyze the adequacy of the measures taken to eliminate, control, or mitigate identified hazards, and to analyze and evaluate potential accidents and their associated risks. f. Significant modification is a change that involves an unreviewed safety question. See DOE 5480.1B. 7. POLICY. a. It is Departmental policy to: (1) Assure the protection of the environment and the health and safety of the public. (2) Provide safe and healthful workplaces and conditions of employ- ment for all employees of DOE and DOE contractors. (3) Protect Government property against accidental loss and damage. (4) Assure compliance with applicable statutory requirements affecting Federal facilities and operations and where possible, consistent with the Department’s mission and supported by appropriate cost/ benefit analysis, reduce identified environment, safety, and health risks, even though not mandated by specific requirements. (5) Assure that quality assurance is pursued (i.e., that research, development, demonstration, and production activities are performed in a controlled manner; that components, systems, and processes are designed, developed, constructed, tested, operated, and maintained according to industry accepted engineering standards, quality practices, and Technical Specifications/Operational Safety Requirements; and that resulting technology data are valid and retrievable). DOE 5481.1B 9-23-86 (6) Require line management to be responsible for effective Environment Safety, and Health (ES&H) performance in their programs. Through overview, the Assistant Secretary for Environment, Safety, and Health (EH-1) is responsible to assure acceptable ES&H performance for the Secretary and for Program Senior Officials. t b. These assurances are provided, in part, by the preparation and review of safety analyses for DOE operations. The basic responsibility for assuring implementation of this policy lies with the line organization responsible for the operation.

c. The objectives of the safety analysis preparation and review process assure that: (1) Potential hazards are systematically identified; (2) Potential consequences are analyzed; (3) Reasonable measures to eliminate, control , or mitigate the hazards have been taken, including where applicable, compliance with commitments made in environmental assessments and impact statements; and (4) There is documented management authorization of the DOE operation based upon an objective assessment of the safety analysis. JOHN S. HERRINGTON Secretary 4 DOE 5481.1B 9-23-86 i (and ii) TABLE OF CONTENTS CHAPTER I - GENERAL REQUIREMENTS Page 1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. Responsibilities and Authorities . . . . . . . . . . . . . . . . . . . I-1 3. Basic Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . I-2 4. Backfitting . . . . . . . . . . . . . . . . . . . . . . . . . . . . I-3 CHAPTER II - GUIDANCE 1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . . II-1 2. Extent of Applicability . . . . . . . . . . . . . . . . . . . . . . II-1 3. Hazard Classes . . . . . . . . . . . . . . . . . . . . . . . . II-1 4. Safety Analysis . . . . . . . . . . . . . . . . . . . . . . . . . II-1 5. Reviews by Line Organizations . . . . . . . . . . . . . . . . . . . . . . . . . II-3 6. Recordkeeping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II-4 7. Backfitting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II-4 I-1 U.S. Department of Energy Washington, D.C. SUBJECT: SAFETY ANALYSIS AND REVIEW SYSTEM PAGE CHANGE DOE 5481.1B Chg 1 5-19-87 1. PURPOSE. To transmit revised pages to Chapter I of DOE 5481.1B, SAFETY ANALYSIS AND REVIEW SYSTEM, of 9-23-86. 2. EXPLANATION OF CHANGE. a. Additions have been made to Paragraph 3, “Basic Requirements,” con- cerning safety analysis and documentation. These additions are in response to a recommendation contained in GAO Report RCED-86-175, “Nuclear Safety: Safety Analysis Reviews for DOE’s Defense Facilities Can Be Improved, ’ of 6-6-86, which recommends that safety analysis reports include a detailed comparison of the plant against current DOE design criteria, highlighting and explaining any deviations. b. Per letter of 8-21-86 to Congress, the Department committed to requiring that such evaluations be incorporated into the safety analysis reports, either through revisions of appropriate sections of the report or as an appendix. Paragraph 3 was revised to fulfill the congressional commitment. 3. FILING INSTRUCTIONS. a. Remove Page Dated Insert Page Dated I-1 9-23-86 I-1 9-23-86 I-2 9-23-86 I-2 5-19-37 I-3 9-23-86 I-3 9-23-86 I-4 9-23-86 I-4 5-19-87 b. After filing the attached pages, this transmittal may be discarded. BY ORDER OF THE SECRETARY OF ENERGY: HARRY L. PEEBLES Director of Administration DISTRIBUTION: INITIATED BY: All Departmental Elements Assistant Secretary for Environment, Safety and Health DOE 5481.1B 9-23-86 CHAPTER I GENERAL REQUIREMENTS 1. PURPOSE. This chapter assigns basic responsibilities and delineates general requirements. 2. RESPONSIBILITIES AND AUTHORITIES. a. Program Senior Officials, or their designees in the line organization? responsible for ES&H in operations under their cognizance, shall : (1) Require preparation of appropriate safety analyses for each DOE operation and subsequent significant modifications, including decommissioning.

(2) Ensure that an independent review of each safety analyses is performed. Field organization or contractor internal reviews may be used to fulfill this requirement. (3) Ensure the construction, operation, and subsequent significant modifications, including decommissioning, of each DOE operation is appropriately authorized. Authorizations are to be based on an objective assessment of the safety analysis as well as other programmatic considerations. (4) Inform the Assistant Secretary for Environment, Safety, and Health (EH-1 ) by 12-1 of each year of all DOE operations requiring safety analysis which were authorized in the preceding fiscal year, including the organizational level at which the authorization was granted. This information should include a 3-year projection of the anticipated completion date for safety analyses, reviews thereof, and the anticipated authorization levels. (5) For those operations specified by EH-1, provide the safety analysis when available and, concurrent with an authorization, the completed review(s) which establish the basis for the authorization. (6) Maintain the official DOE file of all pertinent documentation relating to the authorization of each DOE operation. b. Assistant Secretary for Environment, Safety, and Health, is responsible for providing independent assurance that the line organization responsibilities are fulfilled in an effective and generally uniform manner. EH-1 shall: (1) Provide advisory and interpretative services on matters dealing with the policy, responsibilities, requirements, and procedures contained in this directive. I-1 (2) Provide technical assistance and support to the line organizations. (3) Provide an independent appraisal of the safety analysis and review activities of each line organization except the Office of Naval Reactors. The extent of this effort will include periodic appraisals of each line organization and associated independent reviews, including timely reviews of the 3-year projections provided by the line organization, to assure the uniform application of the general requirements of this directive throughout DOE, and the existence of adequate documentation. (4) Overview safety analysis required for weapons program activities and facilities, but not individual operations involving the assembly, disassembly, and testing of nuclear explosives, weapons or devices, nor those aspects of these facilities relating specifically to such operations which are covered by DOE 5610.3. Similarly, EH-1 overview of the weapons program transportation activities involving nuclear explosives, weapons or weapons components, nuclear devices , or special nuclear material will apply only to safety analysis of nonweapon shipping containers, but not to analyses of shipping operations which are covered by DOE 5610.1. (5) Audit the independent review of safety analyses required for major system acquisitions (see DOE 5700.1C), except Naval Reactors, and advise the Secretary of the results of this audit at the time of the key decision. (6) Establish policy and develop guidance for safety analysis and review activities. 3. BASIC REQUIREMENTS a. Safety Analysis. The analysis shall: (1) Be initiated during the earliest phases of the life cycle of the DOE operation to facilitate early hazard identification and their elimination or control. (2) Be provided by the organization with immediate operating responsibility. (3) Identify and demonstrate conformance with applicable guides,

I codes, and standards. Deviations from current DOE design criteria shall be evaluated and documented in the facility safety analysis report. Vertical line denotes change. I-2 DOE 5481.1B Chg 1 5-19-87 DOE 5481.1B 9-23-86 I-3 (4) Wherever possible, cover classes of efforts or individual operations within a facility (or under an activity or project) so that individual efforts or operations which are to be conducted are bounded by the general analysis. (5) Demonstrate that there is reasonable assurance that the DOE operation can be conducted in a manner that will limit risks to the health and safety of the public and employees, and adequately protect the environment. (6) Describe the features of the actual design and conduct of the DOE operation that demonstrate conformance with design or performance assumptions made in environmental assessments or impact statements previously issued by DOE, or satisfactorily account for deviations. b. Review of the Safety Analysis. (1) The review shall include a documented evaluation of the adequacy of the preventative or mitigative design features and the adminis- trative controls provided to limit the risk. (2) The line organization review shall serve as a basis for authorization of the proposed DOE operation. (3) The line organization review may be conducted at the Headquarters level, or at the field level, as delegated.. (4) The review provided by the line organization shall be conducted’ by individuals, the majority of whom are not directly involved in the management of the DOE operation being evaluated. (5) The review shall be sufficiently documented to allow independent evaluation of its adequacy. c. Authorizations. (1) The level of management authorization of a DOE operation shall be determined by the line organization. It should be commensurate with the type and magnitude of the hazards involved. (2) Authorizations signify that a determination has been made by the line organization for DOE that the risk is acceptable. (3) Authorizations shall limit a DOE operation to those characteristics described and analyzed in the safety analysis. I-4 DOE 5481.1B Chg 1 5-19-87 d. Documentation. All pertinent details of the analysis, review, and authorization relative to any DOE operation shall be traceable from the initial identification of a hazard to its elimination or the application of controls necessary to appropriately reduce the risk. The second requirement of paragraph 3a(3) shall be incorporated in appro- priate sections of the safety analysis report or as an appendix. For existing safety analysis reports, the requirement shall be incorporated in the appropriate sections of the report or as an appendix at the next update. 4. BACKFITTING. Those ongoing DOE operations which can be reasonably expected to have the potential for major onsite or offsite impacts to people or the environment shall be identified and evaluated by the line organization in accordance with the following provisions: a. Where documentation (e.g., studies, evaluations, analyses) is available, the line organization shall determine whether the documentation adequately identifies the risk. b. Where documentation is not adequate, the line organization shall make necessary arrangements (funds and other resources) to provide for adequate safety analyses in accordance with this directive, or obtain an exemption from the responsible PSO. EH-1 shall be provided the opportunity to review requests for exemptions prior to approval.

c. Safety analyses prepared under subparagraph b, above, for ongoing DOE operations shall be based upon current technical criteria. When hazards are identified which can be eliminated, controlled, or mitigated through reasonable measures, appropriate upgrading actions shall be identified and implemented. Vertical line denotes change. DOE 5481.1B II-1 9-23-86 CHAPTER II GUIDANCE 1. PURPOSE. This chapter presents guidance and preferred practices for use by line organizations in implementing the policy, objectives, and require- ments of this Order. 2. EXTENT OF APPLICABILITY. a. DOE operations,’ as defined, embraces all activities for which DOE has assumed ES&H responsibility, regardless of whether or not there is a facility involved. Thus, the transportation of hazardous materials is included. Those activities for which DOE has assumed ES&H responsibility can be determined by the contract provisions. b. Recognizing that no activity is without some degree of risk, and that certain routine risks are accepted without question by the vast majority of- persons (e.g., machine shops which do not handle hazardous. materials, cars for personal transportation), the applicability of this Order has been limited to those DOE operations that involve hazards that are not routinely encountered and accepted in the course of everyday living by the vast majority of the general public. 3. HAZARD CLASSES. a. Consi (1) (2) (3) deration should be given to categorizing hazards into three c Low - Those which present minor onsite and negligible offsite impacts to people or the environment; lasses: impactsModerate - Those which present considerable potential onsite to people or the environment, but at most only minor offsite impacts; and High - Those with the potential for onsite or offsite impacts to large numbers of persons or for major impacts to the environment. b. Supplemental guidance on categorization of hazard levels as well as overall system safety methods can be found in MIL-STD-882B. 40 SAFETY ANALYSIS. a. The safety analysis should address in appropriate detail the following topics to the extent applicable: (1) A description and evaluation of the site; (2) Design criteria for systems, components, and structures; DOE 5481.1B 9-23-86 b. c. d. e. f. (3) Normal and emergency operating procedures to be used; (4) Identification of hazards; (5) Probability of occurrence and predicted consequences of hazards expressed in qualitative or quantitative terms; (6) Physical design features and administrative control s provided to prevent or mitigate potential accidents; (7) Potential accidents, including those resulting from natural phenomena; and (8) Operational limitations. The analysis for a DOE operation which involves only hazards of a type and magnitude routinely encountered and accepted by the public may be a simple, formal statement of this fact. There are long-standing requirements to analyze the safety of nuclear activities, including packaging of nuclear materials (DOE 5480.3). The continuation of these practices, including the application of Nuclear Regulatory Commission safety analysis guidelines, as appropriate, will generally satisfy the requirements of this Order.

For complex or expensive operations, experience has indicated that it is sometimes desirable to perform a safety analysis as early as possible in the life cycle of the project. This permits early identification of potential health, safety, or environmental problems and facilitates their elimination or mitigation in the most cost effective manner. For such projects, a two-stage safety analysis and reviews thereof are permitted, a preliminary analysis prior to the start of substantial construction, and a final analysis prior to initial operation. The review and authorization levels for significant modifications to DOE operations should be the modification and not operation. For example, hazard than the original authorization is needed. selected based on-the hazards associated with on the original authorization for the if the modification contains a higher class of operation, the corresponding higher level of Among the factors that the line organization should consider in deter- mining whether a proposed physical or administrative change constitutes a significant modification are: (1) Increases in the risk from a hazard beyond that previously analyzed and reviewed. This may stem from changes in operating characteristics such as speed, temperature, or pressure; increases in the quantity of hazardous materials; and/or changes in design features or administrative controls. II-2 DOE 5481.1B 9-23-86 II-3 (2) Reductions in the reliability- of any item for which credit has been taken for the reduction or control of a hazard. (3) Introduction of a new hazard. (4) Application of new regulations. (5) Receipt of new information indicating. an increased hazard associated with an existing operation. g. The National Environmental Policy Act requires the preparation of an environmental impact statement (EIS) for major Federal actions with a significant environmental impact. The EIS is completed usually before significant detailed design is initiated. The safety analysis required by this Order naturally follows the EIS. It permits an evaluation of whether the design will meet performance assumptions made in the EIS, thereby providing the first level of assurance that environmental protection will be as intended. 5. REVIEWS BY LINE ORGANIZATIONS. a. Suggested review and authorization levels within DOE for the hazard classes are: “.. Hazard Review Level Authorization Level High Field and/or Headquarters Field and/or Headquarters Moderate Operating Organization, Field and/or Headquarters Field, and/or Headquarters Low Operating Organization Operating Organization b. The line organization may consider other factors in specifying its particular authorization levels. Public interest, political sensitivity, and program importance are considerations which may dictate a higher level than would be needed solely for ES&H reasons. c. The review that is required should be performed by DOE employees, contractors, consultants, or a combination thereof. The line organization may wish to obtain supplemental advice from outside organizations. d. The review process for large or complex operations may extend over several months and involve several persons or groups, each making comments and raising issues. Experience indicates that an efficient, effective, and auditable method of documenting the many separate efforts involved in a review is through an evaluation report. Such a report would summarize the concerns raised during the review, their resolutions, any commitments made, and final

II-4 DOE 5481.1B 9-23-86 conclusions. When review actions are numerous or over an extended period of time, the use of an evaluation report should be considered. This evaluation report serves as an excellent documented basis for the authorization. e. As new energy technologies are developed, it is expected that general design criteria will be established to provide stronger technical bases for safety analyses and reviews thereof. 6. 7. RECORDKEEPING. The permanent file that is required is to be maintained in accordance with the requirements of DOE 1324.2. Conformance with the record retention schedules to be issued as part of DOE 1324.2 will assure that the necessary records frill be maintained beyond the termination or decommissioning of a DOE operation and subsequent release of a site for unrestricted use. Such long-term retention of records has been shown by experience (e.g., excess sites) to be essential. BACKFITTING. In applying the requirements of paragraph 4, Chapter I, it is the intent of this Order that the efforts leading to the identifi- cation and evaluation of ongoing DOE operations be conducted in an orderly and reasoned manner. a. b. c. Only those ongoing DOE operations which could reasonably be expected to have the potential for onsite or offsite impacts to large numbers of persons or for major imp-acts to the environment are covered by this Order. The identification of such operations and estimation of required to perform and review safety analyses is to be before implementing this Order. the resources accomplished hazards orThe safety analysis may uncover previously unidentified unexpectedly high risks. What, if anything, should be done about these may be largely a matter of cost-benefit tradeoffs. Administrative controls over the DOE operation should be considered when cost-benefit results are marginal.