Formulation of SACs

DOE-STD-1186-2004

2.2

Formulation of SACs

DOE O 420.1A, Facility Safety, Section 4.1.1.2, addresses the design requirements for nuclear

safety. The Order states:

"Nuclear facilities shall be designed with the objective of providing multiple layers of

protection to prevent or mitigate the unintended release of radioactive materials to the

environment. Defense in depth shall include: ... the provision of multiple means to

ensure critical safety functions (those basic safety functions needed to control the

processes, maintain them in a safe state, and to confine and mitigate radioactivity

associated with the potential for accidents with significant public radiological impact)...".

These principles also apply to the formulation, development, and implementation of the

ensemble of hazard controls, including SACs. Engineering evaluations, trade-offs, and

experience shall be used to develop practical SACs that achieve the functional safety

objectives.

Redundancy, independence, and diversity of hazard controls are important principles for

ensuring that exposure to a high consequence accident does not come about due to the failure

of a single barrier. When SACs are part of the hazard control ensemble, these principles are

applied to the ensemble. Designation of an SAC as the primary line of defense (i.e., control)

should be avoided whenever possible, because ACs are generally regarded as less dependable

due to the introduction of potential human error. However, if an SAC is the primary line of

defense for protection of the public, these principles should be applied to the SAC. The terms

redundant, independent, and diverse are discussed below:

Redundant: Important safety functions should not be protected by a single control. The

design process should strive to achieve an appropriate level of redundancy in the

development of controls. In this context, redundancy refers to a second control to provide

the same safety function (as distinguished from diverse controls).

Independent: Controls should be independent of the process being controlled, and to the

extent practicable from other controls that have been credited.