Hazard Controls - DOE-STD-1120-1-20050026

DOE-STD-1120-2005/Vol. 1

permanent or temporary SSC where necessary to support certain decommissioning actions. For

example, a concrete vault (i.e., design feature) that provides shielding to workers from radiation

may require penetrations during decommissioning to remove equipment. Temporary shielding

may be used during these operations and still provide adequate worker protection in accordance

with 10 CFR 835. As another example, active ventilation may only require protection of the

differential pressure and filter efficiency parameters. The number of fans required to provide the

requisite pressure differential will change as individual glovebox loads are removed. In this

case, the TSR targets the function, maintaining differential pressure, rather than specifying the

number of fans and interlocks.

There will be some balancing required to determine when engineered controls can be replaced or

supplemented by administrative controls. For example, an old fire suppression system that has

not been maintained per code may not have sufficient reliability and therefore may not be an

adequate safety basis control without considerable upgrades to the system. It may be appropriate

to replace or supplement this control with certain administrative controls such as combustible

material limits or ignition source controls. These decisions should consider factors such as

system availability and reliability and the effectiveness of selected administrative controls. The

final control strategy should maintain a level of defense in depth such that no single layer is

relied on to prevent or mitigate significant hazards.

By the very nature of decommissioning, facility equipment and systems will be removed. It is

expected that there will be less reliance on safety systems and other TSR controls as the project

progresses and as hazardous substances are reduced. For example, the operational limits

imposed on a SSC to prevent a release of hazardous substance are no longer valid if the material

has been removed. Care should be taken to ensure that safety controls are not retired

prematurely or that administrative controls are selected in lieu of available, functioning

engineered safety features.

Trigger points, or the conditions that allow step-out of a control should be supported by the

hazard analysis and described in the DSA. The following criteria should be used when

determining if it is appropriate to retire a control from the safety basis:

Hazardous condition being controlled is no longer present.

Hazardous substance's physical form has changed to a less dispersible form.

Hazardous substance quantities are no longer present or have been reduced to the point where

the consequences of releases are no longer a concern.

Stepping out of a control does not necessarily mean that the control may be de-energized, as it

still may be needed to satisfy life safety or emergency response requirements. It simply means

that a control may be retired from the safety basis without formally revising the DSA and TSR

and re-submitting for DOE approval. The use of this process requires pre-negotiated step-out

criteria that are reviewed and approved by DOE during the DSA/TSR review process.

3-9