Additional Considerations

DOE-STD -3009-94

Appendix A

treated differently from typical industrial grade SSCs in release scenario characterization,

with the exception of their estimated failure probabilities.

A conceptually different approach is needed for safety analysis of existing facilities, where

an analysis of the safety of the `facility as is' is performed. The primary objective of the

analytical process must then turn to the identification of needed controls and their potential

inadequacies, and the corresponding corrective or compensatory measures. Furthermore,

for existing DOE facilities, DBAs are typically either non-existent or irrelevant, due to a

variety of reasons, such as changes in the original mission or early design philosophies.

Thus, this standard adopted the notion of derivative DBAs that for simplicity of notation

were summarized as DBA in the text. But these DBAs are not, in general, the actual

accident scenarios that formed some aspects of the basis for the facility design. For these

existing facilities, safety assurance is provided through an aggressive approach based on a

comprehensive analysis of all hazards leading to the release of radiological or toxicological

material, and ensuring that the controls identified against each hazard are relevant, specific,

and effective.

It is emphasized again that the value of 25 rem TEDE is not to be used as a `hard' pass/fail

level. Unmitigated releases should be compared against the EG to determine whether they

challenge the EG, rather than exceed it. This is because consequence calculations are

highly assumption driven and uncertain. There are uncertainties in initiating event

intensity, plant SSC and personnel response, accident phenomenology, DRs, ARFs and

RFs, and so on. The point here is that other factors may play a part in the decision, and the

EG value guides the decision making process towards a level of uniformity that could not

exist without some form of quantitative benchmark.

The EG is not used as any measure of acceptable or adequate safety. Rather, the EG is a

tool intended to carry the application of hazard analyses one step further to gradation of

hazard-based controls with tangible results on the operating floor. Specifically, C hapter 3

identifies two classifications of safety SSCs, SC and SS. Only two classifications of safety

SSCs are used in order to support meaningful distinctions in the requirements imposed on

safety SSCs.

It may be argued that in lieu of, or in addition to the EG, DOE should also promote the use

of some form of risk acceptance criteria, so risk or safety analysts would know what is safe

enough, or when the amount of analysis performed would be sufficient. However, DOE's

experience with previous DSAs for existing facilities has shown that use of risk acceptance

criteria of any kind has generally resulted in short cutting of the hazard analysis process,

and inadequate identification and understanding of needed controls. Additionally good

practice dictates that safety improvement should be made whenever practical, regardless of

the level of existing safety. In other words, there is no such thing as `safe enough' in an

absolute sense.

The EG value is not release frequency dependent, since as mentioned earlier, the

determination of need is solely driven by the bounding consequence potential. In addition,

calculation of frequencies and consequences of various release scenarios involve

accounting for large uncertainties on both scales. Limiting the EG to one value on the

consequence scale alone reduces the impact of uncertainties on SC designation of SSCs

with no loss of information on characterization of the needed controls because of

Page A-9