Safety Function

DOE-STD -3009-94

4.4.X [Applicable Safety-significant System, Structure, or Component]

Identify the safety-significant SSC.

4.4.X.1

Safety Function

This subsection states the reason for designating the SSC as a safety-significant

SSC, followed by specific identification of its preventive or mitigative safety

function(s) as determined in the hazard and accident analysis. Do not discuss

non-safety functions.

Safety functions are top- level statements that express the objective of the SSC

in a given accident scenario. For example, the safety function of a hydrogen

detector in a dissolver vessel offgas line could be stated as: "To monitor

hydrogen concentration in the dissolver offgas and provide a signal to

shutdown the dissolving operation before explosive concentrations of

hydrogen are reached."

The specific accident(s) or general rationale associated with the safety function

should be identified. Safet y-significant SSCs are designated for overall

purposes such as defense- in-depth, for which even normal operation

considerations are involved. There may, or may not be, a single accident that,

by itself, completely defines the safety function.

4.4.X.2

System Description

This subsection provides a description of the safety-significant SSC and the

basic principles by which it performs its safety function (e.g., sensor and

interlock for hydrogen detector discussed in section 4.3.X.1). Describe its

boundaries and interface points with other SSCs relevant to the safety function.

Identify SSCs whose failure would result in a safety-significant SSC losing the

ability to perform its required safety function. These SSCs would also be

considered safety-significant SSCs for the specific accident conditions or

general rationale for which the safety-significant designation was made

originally.

When describing the SSC, provide a basic summation of the physical

information known about the SSC, including simplified system drawings. If

known, summarize pertinent aspects of manufacturer's specifications.

Pertinent aspects are considered to be those that directly relate to the safety

function (e.g., diesel generator load capacity, time to load if critical) as

opposed to general industrial equipment specifications that fall out from these

capabilities (e.g., starting torque, motor insulation, number and type of

windings). Such lower tier details should be implicitly included only by

reference to the overall specifications.

Page 60