Safety Structures, Systems, and Components - Continued

DOE-STD-6003-96

being SSCs required to implement safety. In addition, the safety analysis would verify the ade-

quacy of safety-significant SSCs in addressing the potential safety concerns. Worker protection

and potential safety concerns associated with the public safety function are identified in

DOE-STD-6002.

Descriptions of each SSC that is providing safety functions are required in the SAR. A basic

descriptive model of the facility and its equipment must be provided in which the required SSCs

are addressed in detail commensurate with their preventive or mitigative role in meeting off-

normal condition evaluation guidelines. For example, consider a facility that cannot meet

evaluation guidelines, as discussed in DOE-STD-6002, unless credit is taken for system A.

Besides being noted in the general facility description, system A together with associated codes

and standards would be described in the section on safety-class SSCs. This system would typi-

cally be associated with a specific TSR (discussed in Section 5.7) and would be described in

detail commensurate with its importance to the safety basis. However, only the characteristics of

the SSC that are necessary to perform the safety function are classified as part of the safety

system. For example, if a valve in a system is only required to provide an external pressure

boundary, then only the pressure boundary function would be classified as a safety system

characteristic and all other functions, such as the valve operability, response time, etc. would

not be included in the safety system definition.

Conversely, if the consequences of all hazardous releases or off-normal conditions exam-

ined meet the evaluation guidelines without relying on the safety-class function of process

system B, then system B would not be considered to be a safety system performing a safety

function. Detailed identification of its functional basis and construction is not necessary because

it is not a significant contributor to the overall facility safety basis. There would also be no need

to discuss administrative provisions (e.g., initial testing, maintenance) required to ensure the

operability of system B, nor would there be a need for a specific TSR (e.g., Safety Limit, Limiting

Condition For Operation, etc.) covering system B. If a system is designated as safety-significant,

industry recognized codes and standards are to be applied and minimal, if any, TSRs are to be

specified for the operation of the system components (see Section 5.7).

A risk-based prioritization approach can be used to develop requirements for the safety-

class and safety-significant SSCs. One of the dominant factors governing risk-based prioritiza-

tion is the severity of the off-normal condition consequences associated with the facility and the

number and type of the SSCs needed to prevent evaluation guidelines from being exceeded. If,

for example, the defense-in-depth principles are satisfied by providing other SSCs to mitigate

the consequences, then added inspections and other quality pedigree requirements of the first

system would not be as important as if the original SSCs were the only means of accomplishing

the safety function. If the consequences of the off-normal condition exceed the evaluation guide-

lines by a large margin and there is no other system that will mitigate or prevent the release for

the off-normal condition, then special precautions should be taken in the design and in develop-

ing the inspection program to ensure that the system will be available to function when called

upon. This may involve special inspections, alternate design approaches, or other actions that

would significantly enhance system reliability. The rigor of compliance with the design and

inspection requirements could be relaxed for systems that have multiple backups for preventing

off-normal conditions or mitigating the off-normal condition consequences.