Safety-Significant SSCs cont'd - doe-std-3009-94_cn3

DOE-STD -3009-94

of such preventive or mitigative functions (e.g., electrical power sources for

ventilation).

The total layers of defense in depth available are also key considerations in

designating safety-significant SSCs. If many effective barriers are available,

the significance of any one barrier is lim ited. If only one or two barriers can be

realistically counted on, their individual significance increases. Likewise, if

total hazardous material inventory is distributed over a hundred containers

(e.g., waste drum storage pad, plutonium storage vault), the failure of any one

container does not necessarily constitute a major uncontrolled hazardous

material release, depending on the nature of the material and the design

adequacy of the container. If all material is held in one container (e.g., 3000

gallon hydrogen fluoride storage tank), the failure of that container is of major

concern in controlling the release of hazardous material. In the case where

quantities of hazardous materials are being stored so that breached nuclear

material storage packages might result from facility accident conditions, the

containers themselves may need to be upgraded or another facility level

method (secondary containment or confinement) considered for defense- in-

depth.

A principle reason for designating such major features as safety-significant

SSCs is that they typically represent facility specific systems as opposed to

more generic systems. While all glovebox line facilities use zone systems of

ventilation for confinement, there is an enormous variation in the DOE

comple x with regard to specific design parameters such as number and types of

exhaust systems, means of flow control, etc. Accordingly, more detailed

descriptions of such equipment in a DSA is considered both appropriate and

necessary for Hazard Category 2 facilities. Such description would not

provide the same utility for relatively generic confinement items such as 55-

gallon waste drums. The need for designation as a safety-significant SSC

would also be superseded if that SSC was designated as a safety-class SSC in

accident analysis.

TSRs

Summarize those safety-significant SSCs, SACs and other aspects of defense

in depth that require TSR coverage. The scope of the TSR coverage is

determined by the degree to which barriers or the facility-safety basis are

seriously challenged.

Vital, passive components such as piping, vessels, supports, structures, and

containers would typically be considered design features. These components

are discussed in the Design Features Section of the TSR document. For

example, a glovebox is an obvious barrier to uncontrolled material release.

The windows, gloves, and cable/piping connectors are all necessary to

maintain the barrier, but do not specifically require operational limits or

administrative controls as contributors to defense in depth.

DOE G 423.1-1 provides basic screening criteria to identify defense-in-depth

Page 40