The Role of ACs in TSRs

DOE-STD-1186-2004

For site-wide safety management programs (e.g., radiation protection), the DSA should explain

the features of those programs that are important to the facility safety basis and can refer to the

site-wide program documentation for the details. As appropriate to the hazard, the DSA may

identify specific controls (e.g., hazardous material inventory limits) that are required for safety.

These controls should be considered for designation as an SAC as discussed in this Standard.

1.6.3

The Role of ACs in TSRs

There are instances where an AC may be the most important control. Such instances may

include limiting the Material-at-Risk (MAR) for the facility. Accident analysis consequences

could be unbounded if MAR is not established for the accident in question; therefore, MAR

becomes the most important underlying assumption for all accident analyses as an AC.

Another instance where an AC may be one of the most important controls for a nuclear facility is

in controlling transient combustible loading. Fire accident scenarios have the potential to

release large amounts of hazardous materials, including radioactive and chemical materials.

Therefore, controlling fire accidents in DOE facilities is of vital importance. If a facility's fire

protection system design assumes that the combustible loading does not exceed a certain level,

then required controls to ensure this level is not exceeded are expressed as an AC. Because

these instances represent bounding conditions for the safety basis, these ACs should be

designated as SACs, following the guidance given in this Standard for improving the

dependability of these controls.

1.6.4

Application of ACs and SACs

A clear distinction is made between programmatic ACs and SACs. Most ACs in the TSRs are

designed to provide broad programmatic support for safety management programs supporting

defense-in-depth, or worker safety. Failure to maintain all aspects of one of these programs will

not result in a safety basis violation unless there is a gross failure significant enough to render

the DSA assumptions invalid (i.e., a programmatic breakdown). These ACs are classified as

programmatic ACs. Programmatic ACs should not be used to provide specific or mitigative

functions for accident scenarios identified in DSAs where the safety function has importance

similar to, or the same as, the safety function of safety class or safety significant SSCs. The

classification of SAC, as defined in this Standard, was specifically created for this safety