Safety Functions and Structures, Systems, and Components

DOE-STD-6003-96

ensuring afterheat removal when required;

providing rapid plasma shutdown when required;

controlling coolant energy (e.g., pressurized water, cryogens);

controlling chemical energy sources;

controlling magnetic energy (e.g., toroidal and poloidal field stored energy);

limiting airborne and liquid releases to the environment.

These safety concerns are normally addressed by SSCs, preferably passive, with a

design goal to eliminate the potential concern as a safety issue. If degradation or failure of such

SSCs could threaten the continued ability to perform a public safety function or significantly

reduce defense-in-depth relative to public safety, the SSCs should be designated as safety-

significant. If degradation or failure of such SSCs results in the exceeding of the public evalua-

tion guideline, the SSCs should be designated as safety-class.

Worker safety functions as defined in DOE-STD-6002-96 are those essential characteris-

tics needed to ensure the safety of the facility and protection of workers. DOE-STD-6002-96

defines the worker safety function for fusion facilities as

control of operating hazards such as worker exposure to: ionizing radiation,

hazardous materials, high magnetic fields, high power lasers, high voltage

sources, cryogenic fluids, etc.

SSCs required for the performance of a worker safety function should be designated as

safety-significant if acute worker fatality or serious injury could result from SSC failure. These

SSCs should be designed to function in operational states and during and following off-normal

events as specified in the safety analysis.

The concept of safety-significant SSCs is discussed in DOE 1994a. Incremental design

and QA standards (over and above conventional industrial practice) as well as functionality test-

ing, enhanced surveillance, etc. for safety-significant SSCs should be evaluated and applied for

each safety-significant SSC in a given facility considering

a. the degree to which failure can threaten a public or worker safety function (i.e.,

consequence of failure),

b. the potential degradation of defense-in-depth protection,

c. the probability of degradation or failure, and

d. the ability to restore or repair the SSC in a timely manner to resume operations.

The design of SSCs that are not safety-class items should, as a minimum, be subject to

conventional industrial design standards, codes, and quality standards. Failure of these items

should not adversely affect the environment or the safety and health of the public. In addition,

their failure should not prevent safety-class items from performing their required safety

functions.