Safety-Significant SSCs cont'd - doe-std-3009-94_cn3

DOE-STD -3009-94

features/items that may require specific TSR coverage. Such features include

instrumentation designed to detect significant barrier degradation; equipment

that actuates or controls so as to reduce the likelihood of significant barrier

challenges; process variables controlled for that purpose; and active controls

that prevent criticality. Every control or indicator does not require specific

TSR coverage. Likewise, every design feature malfunction or abnormal

condition does not constitute a major barrier or facility safety basis

degradation/challenge.

Significant challenges to the facility safety basis are typically those events

which have a genuine potential to seriously damage safety SSCs, require

actuation of safety SSCs not on line as part of normal operations, or approach

conditions TSR controls are designed to prevent. Significant barrier

degradation is generally considered to mean substantial loss of barrier function

resulting in significant hazardous material release to areas of personnel

occupancy, or the occurrence of highly energetic events with the potential to

damage multiple barriers. To further explore barrier degradation, consider a

glovebox containing a dissolver vessel. A leak from the dissolver would not

be a major degradation of overall confinement because:

It is a slow, low energy phenomenon where the primary vessel itself

remains intact.

The release is into another layer of confinement not occup ied by

personnel.

Process upsets resulting in an eructation from the vessel would not be major

degradation either. Even small, vapor space deflagrations that rupture vessel

blowout ports would not be a major degradation if the glovebox itself would

not sustain significant damage.

In contrast, consider a large hydrogen deflagration or detonation that ruptures

the vessel and piping, drives debris through the glovebox structural elements,

and momentarily pressurizes the glovebox. This is a highly energetic e vent

and multiple barriers have been damaged allowing a potentially significant

release of hazardous material directly to occupied areas. Possible TSR

coverage could include the maximum hydrogen concentration limits or

requiring an air purge system to be functioning when the dissolver is operating.

TSRs may also be provided for safety management programs in the form of

TSR administrative controls to support adequate defense in depth. Such all-

encompassing TSRs should be used in lieu of individual TSRs for numerous

specific aspects of programs unless the control is significant to specific

accident risk reduction. These administrative controls, designated as SACs,

are addressed in the TSRs as limiting conditions for operation with

surveillance requirements, or as specific directive action AC in the

Administrative Controls section of the TSR. DOE Standard 1186 provides

additional guidance for implementing SACs in TSRs.

Page 41