International Isotopes Fluorine Products, Inc. (IIFP) 

A Wholly Owned Subsidiary of 

International Isotopes, Inc. (INIS) 

Fluorine Extraction Process & Depleted 

Uranium De-conversion 

 (FEP/DUP) Plant 

License Application 

Chapter 3 

Integrated Safety Analysis 

Revision B 

November 30, 2011

 

LA-IFP-001 Revision B CHAPTER 3 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-ii 

TABLE OF CONTENTS 

LIST OF FIGURES .................................................................................................................................. 3-iv 

LIST OF TABLES.....................................................................................................................................3-v 

ACRONYMS and ABBREVIATIONS (Provided In License Application Chapter 1 Revision B) 

3 INTEGRATED SAFETY ANALYSIS ............................................................................................. 3-1

3.1 SAFETY PROGRAM AND ISA COMMITMENTS ................................................................. 3-2 

 3.1.1 Process Safety Information ............................................................................................... 3-2

 3.1.2 Overview of the Integrated Safety Analysis ...................................................................... 3-3 

 3.1.3  Management Measures ...................................................................................................... 3-4

 3.1.4  Human Factors Engineering and Implementation ........................................................... 3-4 

 3.1.4.1  Human Personnel Activities ................................................................................. 3-6 

 3.1.4.2 Human Factors Engineering Program Planning ................................................... 3-7

 3.1.4.3 Operating Experience Review .............................................................................. 3-8 

3.1.4.4 Functional Allocation Analysis and Task Analysis .............................................. 3-9 

3.1.4.5 Human System Interface Design, Inventory and Characterization ..................... 3-11 

 3.1.4.6 Staffing ............................................................................................................... 3-11 

 3.1.4.7 Procedure Development ..................................................................................... 3-12 

 3.1.4.8 Training Program Development ......................................................................... 3-13 

 3.1.4.9 Verification and Validation ................................................................................ 3-14 

 3.1.5 Codes and Standards ....................................................................................................... 3-16 

 3.1.5.1 General Building Codes and Standards .............................................................. 3-16 

 3.1.5.2 Structural and Foundation Codes and Standards ................................................ 3-17 

 3.1.5.3 Geotechnical and Geophysical Codes and Standards ......................................... 3-17 

 3.1.5.4 NFPA Codes and Standards ............................................................................... 3-18 

 3.1.5.5 Instrumentation and Controls Codes and Standards ........................................... 3-18 

3.2 INTEGRATED SAFETY ANALYSIS SUMMARY AND DOCUMENTATION .................. 3-19 

 3.2.1 Site Description ............................................................................................................... 3-19 

 3.2.2 Facility Description ......................................................................................................... 3-19 

 3.2.3 Processes, Process Hazards and Accident Sequences ..................................................... 3-20 

 3.2.4 Compliance with the Performance Requirements of 10 CFR 70.61 ............................... 3-20 

 3.2.4.1 Accident Sequence Evaluation and IROFS Designation ..................................... 3-20 

 3.2.4.2 Description of IIFP Management Measures ........................................................ 3-20 

 3.2.4.3 New Facilities or New Processes at Existing Facilities ....................................... 3-20 

 3.2.5 Integrated Safety Analysis Methodology ........................................................................ 3-25 

 3.2.5.1 Define Nodes to be Evaluated ............................................................................ 3-25 

 3.2.5.2 Hazard Identification .......................................................................................... 3-28 

 3.2.5.3 Identify Accident Scenarios ................................................................................ 3-33 

 3.2.5.4 Determine Consequence Severity Level ............................................................. 3-34 

 3.2.5.5 Determine Unmitigated Likelihood .................................................................... 3-34 

 3.2.5.6 Determine Unmitigated Risk .............................................................................. 3-37 

 3.2.5.7 Risk Assignment ................................................................................................. 3-37 

 3.2.5.8 IROFS and Risk Development ........................................................................... 3-38 

 3.2.5.9 "What-If"/Checklist, Risk Index and ISA Summary .......................................... 3-39 

 3.2.6 Integrated Safety Analysis Integration ............................................................................ 3-40 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-iii

 3.2.7 Integrated Safety Analysis Team .................................................................................... 3-40 

 3.2.8 Descriptive List of IROFS ............................................................................................... 3-41 

 3.2.9 Sole IROFS ..................................................................................................................... 3-41 

REFERENCES .................................................................................................................................. 3-42 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-iv 

LIST OF FIGURES 

Figure 3-1 IIFP Facility Human Factors Engineering Basic Design Process ..................................... 3-6 

Figure 3-2 Integrated Safety Analysis Process Flow Diagram ......................................................... 3-27 

 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-v

LIST OF TABLES 

Table 3-1 Consequence Severity Categories Based on 10 CFR 70.61 ............................................. 3-29 

Table 3-2 AEGL Thresholds from the EPA for Uranium Hexafluoride, Soluble Uranium 

 and Hydrogen Fluoride .................................................................................................... 3-30 

Table 3-3 "What-If" Example ........................................................................................................... 3-32 

Table 3-4 Unmitigated Likelihood Categories ................................................................................. 3-35 

Table 3-5 Event Likelihood Categories ............................................................................................ 3-35 

Table 3-6 Determination of Likelihood Category ............................................................................ 3-35 

Table 3-7 Unmitigated Risk Assignment Matrix .............................................................................. 3-37 

Table 3-8 Accident Sequence Summary and Risk Index Evaluation Example ................................ 3-39 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-1 

3 INTEGRATED SAFETY ANALYSIS 

International Isotopes Fluorine Products, Inc. (IIFP) will build and operate a depleted uranium deconversion processing facility near Hobbs in Lea County, New Mexico. The IIFP Facility, also referred to 

as the Fluorine Extraction Process and Depleted Uranium De-conversion (FEP/DUP) Plant, will not 

possess Special Nuclear Material (SNM) and therefore will be licensed under Title 10 Code of Federal 

Regulations (CFR) Part 40, “Domestic Licensing of Source Material” (CFR, 2008a). While the current 

regulations do not require applications submitted under Title 10 CFR Part 40 to include an Integrated 

Safety Analysis (ISA), the U.S. Nuclear Regulatory Commission (NRC) staff has been directed to use 

Title 10 CFR Part 70, Subpart H, performance requirements as part of the licensing basis for the 

application review of certain new source material facilities as an interim measure pending the completion 

of Title 10 CFR Part 40 rulemaking. 

A meeting conducted on May 7, 2009 between the IIFP representatives and the NRC did conclude that the 

ISA requirements will be imposed through orders and that these orders would require an ISA similar to 

that required by Title 10 CFR Part 70, Subpart H. The ISA has been developed for the IIFP Facility and 

an ISA Summary submitted to NRC. The ISA was done in anticipation of orders and subsequent 

rulemaking requiring the IIFP Facility meet requirements similar to those stipulated in Subpart H, 

“Additional Requirements for Certain Licensees Authorized to Possess a Critical Mass of Special Nuclear 

Material,” of Title 10 CFR, Part 70, “Domestic Licensing of Special Nuclear Material,” (CFR, 2009f). 

This chapter presents the IIFP ISA commitments and outlines the ISA methodology. The approach used 

for performing the ISA was based on NUREG-1520, “Standard Review Plan for the Review of a License 

Application for a Fuel Cycle Facility,” Chapter 3, Appendix A, “Example Procedure for Accident 

Sequence Evaluation” (NRC, 2002b). This approach employs a semi-quantitative risk index method for 

categorizing accident sequences in terms of their likelihood of occurrence and their consequences of 

concern. The risk index method identifies which accident sequences have consequences that could 

potentially exceed the performance requirements of 10 CFR 70.61, “Performance Requirements” (CFR, 

2009a). Items Relied on for Safety (IROFS) and supporting management measures are identified to 

reduce the unmitigated risk of these accidents to acceptable levels. Descriptions of these general types of 

high and intermediate consequence accident sequences are reported in the IIFP ISA Summary, Revision 

B. 

The ISA is a systematic analysis to identify facility and external hazards, credible initiating events, 

potential accident sequences, the likelihood and consequences of each accident sequence and the IROFS 

implemented to prevent or mitigate each credible high and intermediate consequence accident. The ISA 

team reviewed the hazards identified for the credible worst-case consequences. Credible high or 

intermediate consequence accident scenarios were assigned accident sequence identifiers and accident 

sequence descriptions and a risk index determination was made. The risk index method is regarded as a 

screening method for proving the adequacy or inadequacy of the IROFS for any particular accident. 

The primary scope of the ISA included fires, hazardous material releases, radioactive material releases 

and explosions that could result in injuries to workers and/or the public and significant environmental 

impacts during routine and non-routine (startup, shutdown, emergency shutdown, etc.) operations. The 

ISA Summary resulting from the ISA identifies which engineered or administrative IROFS must fail to 

allow the occurrence of consequences that exceed the levels identified in 10 CFR 70.61. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-2 

Consistent with the 10 CFR 70.4 definition of “Hazardous Chemicals Produced from Licensed Materials” 

(CFR, 2009i), the safety controls associated with those activities that involve the processing, collection, 

storage and transfer of hazardous chemicals that have been separated from licensed material will be 

governed by: 1) “Process Safety Management of Highly Hazardous Chemicals” regulations 29 CFR 

1910.119, developed by U.S. Occupational Safety and Health Administration (OSHA, 1996) and 2)“Risk 

Management Programs for Chemical Accidental Release Prevention” regulations developed by the U.S. 

Environmental Protection Agency (EPA) (CFR, 1994). These will be the applicable regulations as long 

as a release of these chemicals would not adversely affect radiological safety. 

For the purposes of this ISA and subsequent licensed operations, hazardous chemicals are considered 

“separated from licensed materials” if the source material in any chemical mixture, compound or solution 

is less than one-twentieth of 1 percent (0.05 percent) of the total weight of the chemical mixture, 

compound or solution, consistent with the criteria specified in 10 CFR 40.13 “Unimportant Quantities of 

Source Material,” (CFR, 2008a). 

3.1 SAFETY PROGRAM AND ISA COMMITMENTS 

The three elements of the Safety Program defined in 10 CFR 70.62(a) (CFR, 2009b), “Safety Program 

and Integrated Safety Analysis” are addressed in the following sections. Also, the IIFP Human Factors 

Engineering (HFE) Program description is included as part of the IIFP Safety Program commitment in 

Section 3.1.4 below. 

3.1.1 Process Safety Information 

IIFP is maintaining up-to-date documentation of process safety information. Written process safety 

information is used in updating the ISA and in identifying and understanding the hazards associated with 

the processes. The compilation of written process safety information includes information pertaining to: 

1. The hazards of materials used or produced in the process including information on chemical and 

physical properties such as those shown on Material Safety Data Sheets (MSDSs) meeting the 

requirements of 29 CFR 1910.1200(g) (CFR, 2009h), “Toxic and Hazardous Substances” 

2. Technology of the process that includes block flow diagrams or simplified process flow diagrams, 

a brief outline of the process chemistry, the range of operating parameters (e.g., temperature, 

pressure, flow and concentration) and evaluation of the health and safety consequences of 

potential process accidents 

3. Equipment used in the process including general information on topics such as the materials of 

construction, piping and instrumentation diagrams (P&IDs), ventilation requirements, design 

codes and standards employed, material and energy balances, IROFS (e.g., interlocks, detection, 

or suppression systems), electrical classification and relief system design and design basis 

After the IIFP Facility detailed design begins, the process safety information described above will be 

maintained up-to-date by the Configuration Management (CM) Program described in LA, Revision B 

Chapter 11 “Management Measures.” 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-3 

3.1.2 Overview of the Integrated Safety Analysis 

IIFP has conducted an ISA for each process that identifies radiological hazards, chemical hazards, 

potential accident sequences, consequences and likelihood of each accident sequence and IROFS, 

including the assumptions and conditions under which they support compliance with the performance 

requirements of 10 CFR 70.61. 

The entire facility was evaluated as part of a plant-wide process hazards analysis with respect to chemical 

and radiological hazards. However, once the licensed material (depleted uranium) is considered separated 

from the fluoride compounds, further analysis under the ISA methodology is not performed. These purely 

chemical process hazard evaluations are addressed under OSHA’s Process Safety Management (PSM) 

requirements that are administered under the IIFP Industrial Safety Program (also see LA, Revision B 

Chapter 6 “Chemical Process Safety”). These systems are isolated from processes containing licensed 

material to ensure that process upsets from these streams have no adverse effect on the control and safety 

of licensed materials activities. Risk-acceptable levels of safety control measures will be maintained for 

non-licensed material systems, but the safety systems will not be maintained as IROFS. These safety 

systems are defined as process or operational “safeguards” and are maintained and controlled based on 

the chemical hazards and risks associated with each process. An appropriate level of quality assurance is 

provided based on the safety importance of each item. 

A summary of the results of the ISA, including the information specified in 10 CFR 70.65(b) “Additional 

Content of Application,” (CFR, 2009c) is provided in Revision B of the ISA Summary. 

IIFP commits to implementing programs to maintain the ISA and supporting documentation so that it is 

accurate and up-to-date. After the IIFP License is approved, changes to the ISA Summary are submitted 

to the NRC in accordance with 10 CFR 70.72, “Facility Changes and Change Process,” (CFR, 2009d). 

The ISA update process accounts for design safety basis changes made relative to licensed materials or 

hazards potentially affecting licensed materials. The update will also verify that the initiating event 

likelihoods and IROFS reliability values that are assumed in the ISA remain valid. Any changes to the 

ISA required as a result of the update process will be included in a revision to the ISA and ISA Summary. 

Change management measures used to prepare and document revisions to the ISA are described in LA, 

Revision B Chapter 11. ISA methods are used for the evaluation of any facility changes or changes in the 

process safety information that may alter the parameters of an accident sequence. Personnel conducting 

revisions to the ISA will have qualifications consistent with those described in Regulatory Guide 1513, 

“Integrated Safety Analysis Guidance Document,” (NRC, 2001). The following specific commitments 

ensure that the ISA is maintained in accordance with NRC requirements: 

1. Personnel used to update and maintain the ISA and ISA Summary shall be knowledgeable of the 

ISA methods and suitably qualified. Qualifications of personnel used to update or maintain the 

ISA are included in the ISA Summary, Revision B. 

2. Proposed changes to the IIFP Facility or its operations shall be evaluated using the ISA methods. 

New or additional IROFS and appropriate management measures shall be designated as required. 

The adequacy of existing IROFS and associated management measures shall be promptly 

evaluated to determine if they are impacted by changes to the facility and/or its processes. If a 

proposed change results in a new type of accident sequence or increases the consequences or 

likelihood of a previously analyzed accident sequence within the context of 10 CFR 70.61, (CFR, 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-4 

2009a) the adequacy of existing IROFS and associated management measures shall be evaluated 

and the necessary changes made. 

3. Unacceptable performance deficiencies associated with IROFS that are identified through updates 

to the ISA shall be addressed by the IIFP Quality Assurance Program Description (QAPD). 

4. Written procedures shall be maintained on site. LA, Revision B Chapter 11 discusses the 

procedure and document control systems. 

5. All IROFS shall be maintained so that they are available and reliable when needed. 

3.1.3 Management Measures 

Management measures are utilized to maintain the IROFS so that they are available and reliable to 

perform their safety functions when needed. Management measures ensure compliance with the 

performance requirements assumed in the ISA documentation. The measures are applied to particular 

structures, systems and components (SSCs), equipment and activities of personnel, and may be graded 

commensurate with the reduction of the risk attributable to that IROFS. Management measures are 

described in LA, Revision B Chapter 11. 

3.1.4 Human Factors Engineering and Implementation 

IIFP commits to following acceptable Human Factors Engineering guidance, practices and principles for 

administrative components identified in IROFS where human actions are relied upon to ensure the 

performance of the administrative controls. The Integrated Safety Analysis process is used to identify 

those areas and to further determine whether an IROFS has special or unique safety significance relative 

to human factors. The goal of this application of HFE to personnel activities involving administrative 

IROFS is to ensure that the potential for human error is addressed during the design of the facility, 

operating procedure development and personnel training. IIFP intends to comply with HFE guidance 

provided in NUREG-0700, “Human-System Interface Design Review Guidelines” Revision 2, (NRC, 

2002a), NUREG-0711, “Human Factors Engineering Program and Review Model” Revision 2, (NRC, 

2004) , NUREG-1520, “Standard Review Plan for the Review of a License Application for a Fuel Cycle 

Facility” and Revision 1, Appendix E “Human Factors Engineering for Personnel Activities,” (NRC, 

2010). 

IIFP commits to adding a professional with a human factors engineering (or human factors) background 

to the IIFP Project. Prior to the Design and Build (DB) Contractor performing detailed design of IROFS 

structures, systems and components, this professional will be employed either as an IIFP employee or 

contractor. IIFP will evaluate and implement the HFE Program through an HFE Implementation Plan. 

The IIFP President will approve the makeup and membership of an HFE team and delegate the authority 

to this team to carry out the responsibilities of: 1) developing the IIFP HFE Implementation Plan prior to 

the DB Contractor beginning detailed design of IROFS SSCs and 2) reviewing and overseeing 

implementation of the Plan. 

The HFE Program will be developed in accordance with the nine (9) elements of the HFE design process 

described in NUREG-1520, Revision.1 Appendix E and will encompass all of the following elements and 

their sub-elements: 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-5 

Section 1.0 Identification of Personnel Activities (E1) 

Section 2.0 HFE Design Review Planning (E2) 

Section 3.0 Operating Experience Review (OER) (E3) 

Section 4.0 Functional Allocation Analysis (FAA) and Task Analysis (TA) (E4) 

Section 5.0 Human System Interface (HSI) Design, Inventory and Characterization (E5) 

Section 6.0 Staffing (E6) 

Section 7.0 Procedure Development (E7) 

Section 8.0 Training Program Development (E8) 

 Section 9.0 Verification and Validation (E9) 

General descriptions as to how the elements of HFE provided in Appendix E of NUREG-1520 will be 

implemented are provided in Sections 3.1.4.1 through 3.1.4.9 below. 

IIFP will be developing the HFE Implementation Plan during the initial detailed design phase of the 

project and will be implementing the Plan throughout the design and operation of the facility. The basic 

process methodology that will be used in most, if not all, of the nine (9) HFE element evaluation 

processes for obtaining the HFE information will include: 1) tabletop analysis, 2) and as the design 

progresses, “walk-downs” and “talk-through” using system descriptions and drawings, 3) subject matter 

expert interviews and interactions and 4) flowcharts of the related personnel activities in relationship to 

equipment and systems that will be developed to depict the interdependencies of personnel and actions to 

further aid in the development of procedures. The respective HFE element analysis will be refined during 

detailed design of the IROFS. These analyses are used for the development of the design, procedures and 

initial training. During operations, the analyses will be reviewed periodically and revised when process 

changes are undertaken through the design control process or through performance improvement 

initiatives. 

The basic HFE design process to be used for the IIFP Facility is depicted in Figure 3-1. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-6 

Figure 3-1 IIFP Facility Human Factors Engineering Basic Design Process 

3.1.4.1 Human Personnel Activities 

Identification of Human Actions

The ISA process determines and identifies which IROFS rely on administrative controls and upon human 

actions only. These Administrative Controls (AC) and Enhanced Administrative Controls (EAC) IROFs 

are documented in the IIFP ISA Summary, Revision B. For the Active Engineered Controls (AEC) and 

Passive Engineered Controls (PEC) IROFS, the equipment and systems are usually more complex. In 

cases where AC and EAC IROFS may require a human interface with AEC or PEC IROFS, the 

identification and specifics of SSCs within the IROFS must be done before specific human system 

interfaces can be thoroughly evaluated. 

Human Actions Identification - Implementation

Personnel actions will be identified and addressed during the OER, FAA, TA, HSI, procedures, training 

and design verification processes described in the following Sections 3.1.4.3 through 3.1.4.9 to determine 

if HSIs are applicable for inclusion into the HFE Implementation Program. This evaluation will also 

involve the identified IROFS SSCs and the boundary definitions of the AEC and PEC IROFS. Members 

of the HFE team will use the basic methodology and “tools” described in paragraph six (6) of Section 

3.14 above to evaluate and determine personnel activities where HFE practices and principles will be 

applied. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-7 

3.1.4.2 Human Factors Engineering Program Planning 

Scope and Goal Identification

The scope of the IIFP HFE Program shall be applicable to IROFS that have administrative components 

identified in the IROFS and where human actions are relied upon to ensure the performance of these 

administrative controls. These IROFS are determined, identified and documented through the IIFP 

Integrated Safety Analysis process. A list of the IROFS that are subject to the IIFP HFE Program are 

provided in Table 6-3 of the IIFP ISA Summary, Revision B. The list will be updated through the ISA 

Summary revision and amendment process.

The HFE Program for the IIFP Facility will be developed in accordance with Appendix E of NUREG1520 and goals will be established that assure the following are accomplished: 

• Critical personnel tasks are defined and accomplished within applicable time and 

performance criteria. 

• The anthropomorphic standards for the relevant population are defined and applied. 

• HSIs, procedures, staffing/qualifications, training, management and organizational variables 

support a high degree of operating crew situational awareness. 

• Allocation of functions accommodates human capabilities and limitations. 

• Operator vigilance is maintained and distractions are minimized. 

• Acceptable operator workload is met. 

• Operator interfaces contribute to an error free environment. 

• Error detection and recovery capabilities are provided. 

• Control areas minimize stressors and fatigue while assuring adequate communication. 

ISA Team Relationship to Human Factors

The ISA was the process for initially considering the human factors aspects through the process hazard 

analysis, consequence evaluations, accident sequences and determination of preventive and mitigation 

IROFS. This methodology resulted in the identification of the administrative control IROFS that 

primarily rely on human actions. 

Human factors and human-system interface were considered as part of the accident sequence analysis 

review and discussion process following NUREG-1520. However, these considerations of human factor 

aspects were not done at the level and structure of the current NUREG- 1520, Appendix E because the 

Accident Analysis and Process Hazard Analysis (PHA) information used in developing the IIFP License 

Application was conducted and completed prior to the revisions to NUREG-1520, Revision 1 Appendix 

E, criterion E. The HFE professional identified in Section 3.1.4 will become part of the IIFP ISA team. In 

relationship to the HFE planning and review process, the ISA team is responsible for developing, 

updating and maintaining the IIFP Facility safety analysis. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-8 

The ISA team and qualifications are further described in Section 3.2.7, “Integrated Safety Analysis 

Team.” 

Human Factors Engineering Expertise

The HFE professional will lead a team of individuals selected by the IIFP President and who have 

expertise in engineering, operations, safety and application of human factors principles to design and 

operations in chemical or nuclear facilities. The HFE professional will provide oversight and ensure the 

HFE Program is finalized. This person will be added prior to the DB Contractor beginning detailed design 

of IROFS SSCs. The first assignment will be to develop the HFE Implementation Plan for its subsequent 

use throughout the design process and the remainder of the project to include operation of the facility. 

IIFP will employ this individual either as a contractor or an employee. The qualifications for the human 

factors professional are provided in Section 2.2.12 of the IIFP LA, Revision B Chapter 2 “Organization 

and Administration.” 

This arrangement and approach provide for the HFE professional to give advice in HFE related matters, 

to become involved in subsequent accident analyses and to ensure continuity of HFE considerations by 

the detailed design team as the project progresses. The HFE professional will work with other members of 

ISA team and with the detailed design team to ensure that HFE and human-system interface requirements 

are being met. 

In addition to employment of the HFE professional identified above, human factors expertise and 

experience for the IIFP Project will be augmented through the DB Contractor. This DB design engineer 

with HFE experience has worked more than twenty (20) years in engineering, design, specification of 

instrumentation and control systems and equipment including instrumentation of process systems, the 

preparation of specifications, logic and loop diagrams, instrument lists and system descriptions. The 

Engineer’s expertise includes using HFE practices. The Engineer’s experience also includes development 

of instruments and control criteria including HFE criteria and HFE references used in nuclear power 

plants’ Control Room designs such as EPRI/NP-3659 (EPRI, 1984), NUREG-0700 (NRC, 2002a) and 

NUREG- 0711 (NRC, 2004) as well as ANS/IEEE Standard 1023 (IEEE, 2004). 

Human Factors Engineering Design Review Planning - Implementation Actions

During the detailed design and construction stages of the facility, IIFP will rely heavily on the HFE 

professional, the HFE team and the DB Contractor experience to accomplish the HFE Program goals. 

Various aspects of personnel activities including the HSIs will be developed, designed and evaluated on 

the basis of a structured approach using HFE as depicted in the HFE design process shown above. As the 

facility nears operating status, the staffing, training development and procedure development elements 

will be implemented by IIFP staff with review, advice and oversight by the HFE team. The tracking and 

maintenance of HFE elements will transition to the Quality Assurance and Configuration Management 

programs designed and maintained by IIFP personnel. In this way, HFE will be applied to any subsequent 

changes of equipment, controls or systems affecting IROFS and human-system interfaces. 

3.1.4.3 Operating Experience Review 

The IIFP HFE team and the DB Contractor will identify safety-related HFE events or potential events in 

past and existing facilities that are similar to the IIFP Facility. This knowledge base will be used in 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-9 

identifying safety-related issues. The Operating Experience Review Plan will cover the scope of the IIFP 

IROFS using the following OER processes. 

Review of Human Factors Engineering-Related Events - Implementation Actions

NRC and the U.S. Department of Energy (DOE) event and occurrence reporting systems will be reviewed 

to identify potential safety issues especially as they relate to HFE. Internet searches of recognized 

databases (to include the DOE Office of Scientific and Technical Information (OSTI) Information Bridge) 

will also be performed to find safety and HFE related information. 

Human System Interface Technology Review - Implementation Actions

Searches for relevant HFE events or potential events will focus not only on personnel actions involved but 

also on HSI technology employed at these facilities so that the same issues can be prevented in the IIFP 

Facility. It is recognized that improper design or equipment selection may be a root cause of safety and 

HFE related issues. 

Review of Similar Facilities – Implementation Actions

To a large extent, the use of OER has already been accomplished through conceptual design activities, the 

“what if” approach used for the PHA and the initial development of the IROFS. A combined operating 

experience of more than 200 years with the uranium hexafluoride industry was available to IIFP during 

the performance of these tasks. 

The OER will be expanded by conducting discussions with other personnel possessing a broad base of 

experience in uranium processing and other manufacturing applications. Examples of this experience 

include using autoclaves to feed uranium hexafluoride (UF6), reacting UF6 to produce other products (deconversion), producing and handling UF4 and uranium oxides, packaging fluorine products, using 

refrigeration systems and cold traps, handling hydrogen fluoride (HF) and transporting UF6, HF, fluorine 

products and radiological wastes. Potential sources for such reviews include, but are not limited to, the 

DOE depleted uranium hexafluoride (DUF6) de-conversion facilities in Paducah, Kentucky and 

Portsmouth, Ohio, uranium enrichment facilities located in the U.S. and the Sequoyah Fuels Corporation 

depleted uranium tetrafluoride (DUF4) former plant personnel. Other valuable resources which may be 

used include uranium conversion facilities (UF6 manufacturing), other uranium processing plants and 

chemical gas manufacturing and packaging facilities. 

3.1.4.4 Functional Allocation Analysis and Task Analysis 

Functional Allocation Analysis

The OER, the ISA process and actual operating experience provides the basis for determining functional 

allocation to accomplish necessary work tasks in a safe and efficient manner. 

Functional Allocation Analysis - Implementation Actions

Considerable Functional Allocation Analysis has already been performed through the performance of the 

PHA and the development of the IROFS. The safety philosophy of the ISA team was to minimize human 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-10 

involvement in the activation and performance of IROFS as much as available technology would allow. 

The preferential use of active and passive engineered controls for IROFS is a concept which is consistent 

with NRC guidance. Where engineered controlled IROFS and administrative action IROFS are used in 

the same accident sequence, the engineered control IROFS take precedence over human actions. 

The FAA covers the scope of the IROFS and is determined by using information from the OER to 

develop training and procedures after the tasks have been defined. Additional information obtained 

through the OER and the FAA process will be used to supplement the knowledge base for evaluating the 

use of machines or humans for safely performing tasks relative to IROFS requirements. 

IIFP intends to use applicable standards as guidance for the functional allocation analysis process. The 

FAA will utilize applicable description analysis methods drawn from NUREG/CR-3331, “A 

Methodology for Allocation of Nuclear Power Plant Control Functions to Human and Automated 

Control,” (NRC, 1983) consistent with the sections needed to demonstrate compliance with the 

acceptance criteria in NUREG-1520 Appendix E. 

Task Analysis

Task Analysis involves determining the requirements of personnel to successfully and safely perform 

complex real-time control actions as part of the job assignments which result from functional allocation. 

TA is also used extensively in procedure development. 

The Task Analysis performed by IIFP will ensure that the following are accomplished: 

• The TA will cover the scope of the IROFS where human actions are involved. 

• Human actions in IROFS will be identified and defined in procedures. Talk-through and walkdown methods will be used to validate procedures prior to training. These will also be used 

during training to identify issues and achieve operator ownership. It is anticipated that 

procedures will be living documents and subject to configuration controlled modification 

throughout the training process. 

• Some preliminary TA is considered as conceptual procedures are developed. However, it is 

anticipated that TA will be an ongoing activity extending through the training process. Issues 

identified at any point of procedure development and/or training may impact staffing and 

qualification requirements.

Task Analysis - Implementation Actions

TA will include the scope, identification and analysis of critical tasks focusing on personnel demands in 

the performance of these tasks. The TA process will be used to evaluate normal operations and also 

startup, shutdown and emergency operations. TA results will be used to support the functional allocation 

and are a primary consideration in HSI design as ways to best perform these tasks. Also, job design issues 

are considered. 

IIFP intends to use applicable standards as guidance for the task analysis process. The TA will utilize 

applicable task description analysis methods drawn from MIL-STD-1478 (MIL, 1991) and/or MIL-
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-11 

HDBK-46855A (MIL, 2011) consistent with the sections needed to demonstrate compliance with the 

acceptance criteria in NUREG-1520, Appendix E. 

3.1.4.5 Human System Interface Design, Inventory and Characterization 

A structured methodology will be used to identify and select the Human System Interface design 

approach, define the detailed design and perform validation and verification testing. 

The minimum inventory of HSIs, displays, alarms and control instruments for each control process 

involving the administrative components identified in IROFS where human action are relied upon will be 

developed from structured review and evaluation of: 1) the IROFS control function, 2) the IROFS 

functional information and 3) input derived from OER, FAA and TA results. 

The ISA change control process that is implemented through the IIFP configuration management 

measures will be the method of ensuring the inventory list is kept up-to-date during design stage and later 

during facility maintenance. This structured methodology and its results will be documented in 

accordance with requirements of the IIFP Quality Assurance Program (QAP). 

 Human System Interface Design - Implementation Actions

The HSI design will incorporate the processes into the detailed design of safety-significant HSI for 

administrative components identified in IROFS where human actions are relied upon to ensure the 

performance of the administrative controls (e.g. alarms, displays, controls and operator aids). The work 

environment where these human actions are performed will also be considered. 

Human factors design relative to HSI will be established using proven HFE principles, guidelines and 

experience gained from similar facilities and design review criteria derived from published standards as 

guidance. The HSI design process will utilize applicable methods drawn from IEEE-1023 “IEEE 

Recommended Practice for The Application of Human Factors Engineering to Systems, Equipment and 

Facilities of Nuclear Power Generating Stations and Other Nuclear Facilities” consistent with the sections 

needed to demonstrate compliance with the acceptance criteria in NUREG-1520 Appendix E. 

Design review criteria and style guidance with consideration for human factors for affected layouts, 

locations and configurations of alarms, displays and control instrumentation will be developed for use by 

the design engineers prior to beginning actual design. Extraneous controls and displays will be identified 

during the Task Support Verification process. Unnecessary HSI components will be identified for HSIs 

that are available in the HSI, but are not needed for any task. If an HSI component has no associated 

personnel tasks because the function and task analysis was incomplete, then any shortcomings in that 

analysis are identified and resolved. 

3.1.4.6 Staffing 

While primary emphasis will be placed on sufficient staffing to operate the plant safely, the need to 

operate the plant efficiently will also be a factor to be considered in the development of staffing goals. 

The conceptual design team and the DB Contractor have extensive staffing experience in facilities where 

similar work is performed such as UF6 cylinder handling and feeding, drum handling and filling, chemical 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-12 

process operations, waste treatment operations, radiation monitoring and laboratory sampling and 

analysis. 

 Staffing - Implementation Actions

The OER, the FAA and the TA are initially used to determine staffing requirements; consideration will be 

given to these requirements throughout the design process. Qualifications for skilled positions will be 

established and candidates will be measured against those qualifications in the selection of the workforce. 

The initial estimates of staffing requirements and the acceptability of staffing goals will be evaluated 

throughout the design process as facility layout and required worker activities are progressively defined. 

Categories of personnel will be based on types of personnel activities and issues identified in the OER, 

the FAA and TA. HSI design, procedure development and verification and validation will be used to 

address staffing considerations. Regulatory requirements will also be considered and may impact staffing. 

3.1.4.7 Procedure Development 

IIFP will incorporate HFE principles and criteria and design requirements that are within the scope of the 

HFE Program into procedures. The elements of HFE set forth in Appendix E of NUREG-1520 will be 

considered in procedure development. Procedures may include generic technical guidance, plant and 

system operations, abnormal and emergency operations, system or process testing (e.g. pre-operational, 

startup and surveillance) and alarm response. 

Procedures are developed or modified through a formal process incorporating the change controls 

described in Section 11.1.5 of the LA, Chapter 11 Revision B. The procedures process utilizes nine (9) 

basic elements to accomplish procedure development, review, approval and control. These elements are 

Identification, Development, Verification, Review and Comment Resolution, Approval, Validation, 

Issuance, Change Control and Periodic Review. (See Revision B Chapter 11 Section 11.4.2 of the License 

Application for details of these elements.) 

Procedure Development - Implementation Actions

• Production work aside from routine custodial and office duties will be governed by approved 

procedures. Additionally, IIFP Facility requirements will be implemented via procedures, where 

applicable. Procedures are necessary to provide consistent and reliable performance of site-wide 

activities. Applicable safety limits and IROFS will be clearly identified in the procedures. IIFP 

will incorporate methodology for identifying, developing, approving, implementing and 

controlling operating procedures. Identifying needed procedures will include consideration of ISA 

results. The method will ensure that, as a minimum: Operating limits and IROFS are specified in 

the procedure. 

• Procedures include required actions for off-normal conditions of production, as well as normal 

production. 

• Needed safety checkpoints are identified at appropriate steps in the procedure. 

• Procedures are validated through field checks. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-13 

• Procedures are approved by functional managers responsible and accountable for the operation. 

• A mechanism is specified for revising and reissuing procedures in a controlled manner. 

• The QA elements and CM Program at the facility provide reasonable assurance that current 

procedures are available and used at all work locations. 

IROFS and other safety related items will be highlighted in work procedures, typically as “cautions” and 

“warnings.” Procedures will be developed and approved by the responsible organizations. Employees will 

be trained on all procedures they follow as part of their work assignments, and work procedures and 

supplemental safety related procedures are expected to be located in the general work areas. Temporary 

work will be performed under temporary work orders or radiation work permits (RWPs). 

Facility and process changes will require procedure updates in the form of revisions, and such revisions 

shall be in place before restart of the operation can commence. Changes to safety systems and safety basis 

documentation shall also be incorporated into respective procedures. Refinements and changes to 

procedures that are within the scope of the HFE Program will receive review for consideration of human 

factors. Employees will be retrained on the revised procedures before the restart of work tasks involving 

that respective procedure. 

3.1.4.8 Training Program Development 

The principle objective of the IIFP Training Program is to ensure job proficiency of facility personnel 

through effective training and qualification. The Training Program is designed to accommodate future 

growth and meet commitments to comply with applicable established regulations and standards. 

Employees are provided with training to establish the knowledge foundation and on-the-job training 

(OJT) to develop work performance skills. Continuing training will be provided, as required, to maintain 

proficiency in these knowledge and skill components and to provide further employee development. 

Training Program Development - Implementation Actions

Training Program development will address all personnel activities in the performance of job tasks 

involving IROFS. Training will involve familiarization with procedures, equipment, systems, controls, 

alarms, etc. The personnel will be trained in all areas involving IROFS necessary to perform their job 

assignments safely and efficiently. The evaluation of personnel knowledge and skill requirements will be 

a part of this process. It is intended that the Training Program development will be coordinated with other 

activities of the HFE Program and will be implemented in an effective manner consistent with human 

factors principles and practices where such training is within the HFE Program scope. Qualifications and 

training requirements will be established for each functional type of work. Qualifications will include 

minimum education, technical background, experience, etc., along with physical skills needed to perform 

individual tasks. Employees will be provided formal classroom training and on-the-job training specific to 

their duties, as applicable. Workers shall read, understand and follow formal area procedures when 

performing work. Additionally, workers shall understand and obey requirements in work orders, hot work 

permits and radiation work permits (RWP) along with posted limits and controls. Job Task Analysis will 

be used to supplement the development of training when tasks associated with IROFS are involved. 

Job qualification will be indicated by successful completion of prescribed training, demonstration of the 

ability to perform assigned tasks and the maintenance of requirements established by regulation. A graded 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-14 

approach to systematic training will be used that applies the level of detail needed relative to safety. This 

graded approach incorporates methods to accomplish the analysis, design, development, implementation 

and evaluation of training. 

Along with job specific training mentioned above, all employees will be given formal general employee 

training and safety training, as needed. General worker training includes site access information and an 

overview of site hazards, emergency alarms and evacuation plans. Safety training may include radiation 

worker training, hazards communication and general health and safety training. Training and qualification 

related documentation will be maintained as quality records. Continuing training and continuous 

improvement will be an emphasis for the workforce. 

3.1.4.9 Verification and Validation 

Human System Interface Task Support Verification

HSI task support verification will be a part of the HFE verification and validation (V&V) process where it 

is within the scope of the HFE Implementation Plan and Program. The objective of task support 

verification is to verify that the HSI provides all alarms, information, control capabilities and procedures 

required for personnel tasks that are within the HFE Program scope. It verifies that all monitoring and 

operating functions are available and that all operational controls are both possible and functional. 

Human System Interface Task Support Verification - Implementation Actions

The criteria for Task Support Verification come from task analyses of HSI requirements for performance 

of personnel tasks that are defined for selected operational conditions. 

An example of the criteria to be used is as follows: 

 i. General Methodology - The HSIs and their characteristics (as defined in the HSI 

 inventory and characterization) will be compared to the personnel task 

 requirements identified in the task analysis. 

ii. Task Requirements Deficiencies – Human Engineering Discrepancies (HEDs) 

 will be identified when: 

• An HSI needed for task performance (e.g., a required control or display) is not 

 available, or 

• HSI characteristics do not match the personnel task requirements, (e.g., a display shows 

the necessary plant parameter but not the range or precision needed for the task). 

a. Unnecessary HSI Components - An HED will be identified for 

 HSIs that are available in the operating area, but are not needed for any 

 task. Unnecessary HSIs introduce clutter and can distract personnel from 

 selecting the appropriate HSIs. It is important to verify that 

 the HSI is actually unnecessary before declaring it unnecessary. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-15 

b. If an HSI component has no associated personnel tasks because the 

 function and task analysis was incomplete, then any shortcomings in that 

 analysis are identified and resolved. 

Human Factors Engineering Design Verification

HFE design verification is used to determine whether HFE has been used in the design of HSIs. Sections 

11.1.2 and 11.1.3, Chapter 11 Revision B of the IIFP License Application contain the commitment to 

conduct design verification. The commitment will also apply to human factors involved in HSI. 

Human Factors Engineering Design Verification - Implementation Actions

Where design verification is within the scope of the HFE Program, it will be performed to determine that 

each HSI identified for personnel activity has HFE incorporated into the design. Deviations from accepted 

HFE principles and guidelines will either be justified or documented for resolution.

Integrated System Validation 

Integrated System Validation (ISV) testing will be used where it is applicable within the HFE Program 

scope. “Integrated system validation is the process by which an integrated system design (i.e., hardware, 

software and personnel elements) is evaluated using performance-based tests to determine whether it 

acceptably supports safe operation of the plant. It is intended to evaluate the acceptability of those aspects 

of the design that cannot be determined though such analytical means as HSI task-support verification and 

HFE design verification” (NRC, 2004). 

Integrated System Validation - Implementation Actions

It is anticipated that validation testing will be performed using a test bed that is a “part-task” simulator. 

The part-task simulator is not a “full scope, high realism” simulator, but one that will provide a suitable 

representation of the Process Control Rooms and local control panels using analytical means that will 

adequately validate and test the design. The part-task simulator will also be used as a training tool as well 

as a design tool for developing new or upgraded software. 

These evaluations will be performed, where IFOFS within the scope of the HFE Program are involved, by 

knowledgeable personnel to perform task walk-downs, reviews of task analysis and functional analysis 

findings, engineering drawing reviews against field conditions, flow charting of procedural steps, 

operational task charts and analysis of simulator results. These techniques, where applicable, will be used 

to validate the following (as a minimum): 

• The role of plant personnel 

• Staffing assignments 

• Each human ergonomic function 

• Specific personnel tasks 

• That integrated system performance is tolerant of failures 

• Procedure adequacy, allocation and fidelity 

Human Factors Engineering Issue Resolution Verification
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-16 

The HFE Program will be subject to the requirements of the Quality Assurance Program Description and 

all HFE requirements and design documents will be controlled under the design control provisions of the 

Configuration Management Program and subject to the same change control as analysis, specifications 

and drawings. 

Additionally, an Incident Investigation and Corrective Action Program is described in Revision B Chapter 

11, Section 11.6 and in the QAPD, Section A.16 of the IIFP License Application Revision B. This 

Corrective Action Program and the related implementation procedures include root-cause analysis of 

issues related to Quality Assurance and Environmental, Safety and Health. Consideration of human 

factors is one of the basic elements and integral parts of the root-cause analysis methodology. When HFE 

issues arise, those will be incorporated into the Corrective Action Program with a commitment to follow 

through on the corrective action to resolution. 

Human Factors Engineering Issue Resolution Verification - Implementation Actions

The check and review process will be performed by qualified, independent reviewers (other than those 

who performed the design) as described in the QAPD. The results of HFE V&V activities will be 

summarized in a summary report and any discrepancies will be identified in a Human Engineering 

Discrepancy report. The HED report will also include the resolutions. 

HFE will be included in the facility modification procedure as a review/evaluation activity for any 

modifications that may impact Human-System Interfaces. Modifications affecting HSIs may be 

implemented for the following reasons: 

• Obsolescence 

• Lack of spare parts 

• Lack of vendor support 

• New functionality requirements 

• Improved process performance 

• Enhanced operator performance 

• Others 

If the assessment reveals that the modification affects HSI, the HFE process will be applied. This 

approach to assessing modifications will be included in the HFE Implementation Plan. 

3.1.5 Codes and Standards 

The design and construction of the on-site IIFP Facility buildings conform to applicable building codes 

and standards. The codes applied are shown below by category. 

3.1.5.1 General Building Codes and Standards 

2009 New Mexico Commercial Building Code (adopts by reference the 2009 International Building Code (IBC) with 

amendments) 

2009 New Mexico Energy Conservation Code (adopts by reference the 2009 International Energy Conservation Code 

(IECC) with amendments) 

2009 New Mexico Plumbing Code (adopts by reference the 2009 Uniform Plumbing Code (UPC) with amendments) 

2009 New Mexico Mechanical Code (adopts by reference the 2009 Uniform Mechanical Code (UMC) with amendments) 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-17 

2008 New Mexico Electrical Code (adopts by reference the 2008 National Electrical Code (NEC) with amendments) 

2007 New Mexico Electrical Safety Code (adopts by reference the 2007 National Electrical Safety Code (NESC) with 

amendments) 

2009 International Fire Code 

2010 American Society for Mechanical Engineering (ASME) Section VIII, Division 1 Design and Fabrication of Pressure 

Vessels 

2010 ASME B31.1 “Power Piping” 

2009 ASME B31.3 “Process Piping” 

2010 ASME B31.5 “Refrigeration Piping and Heat Transfer Components” 

2008 ASME B31.9 “Building Services Piping” 

3.1.5.2 Structural and Foundation Codes and Standards

ASCE 7-05 Minimum Design Loads for Buildings and Other Structures 

ACI 318-08 Building Code Requirements for Structural Concrete 

ACI 530-08/ Building Code Requirements for Masonry Structures 

ASCE 5-08/ Building Code Requirements for Masonry Structures 

TMS 402-08 Building Code Requirements for Masonry Structures 

ANSI/ AISC 360-05 Specification for Structural Steel Buildings 

AISC Steel Construction Manual 13th Edition 

ANSI/ AISC 341-05 Seismic Provisions for Structural Steel Buildings 

AWS D1.1-2004 Structural Welding Code - Steel, American Welding Society

ANSI/AISC N690-06 Specification for Safety-Related Steel Structures for Nuclear Facilities

ACI-349-06 Code Requirements for Nuclear Safety Related Concrete Structures

ASCE 4-98 Seismic Analysis of Safety-Related Nuclear Structures

3.1.5.3 Geotechnical and Geophysical Codes and Standards 

Editions listed are shown exactly as designated by ASTM organization as being active editions. If the 

standard identifier number does not have a date in parenthesis, the active date is designated by the last 

two digits in the standard identifier number. 

ASTM D420-98 (2003) Standard Guide to Site Characterization for Engineering, Design and Construction Purposes 

ASTM D421-85 (2007) Standard Practice for Dry Preparation of Soil Samples for Particle Size Analysis and Determination of Soil 

Constants 

ASTM D422-63 (2007) Standard Test Method for Particle Size Analysis of Soils 

ASTM D854-10 Standard Test Method for Specific Gravity of Soils 

ASTM D1140-00 (2006) Standard Test Method for Amount of Material in Soils Finer than the No. 200 Sieves 

ASTM D1452-09 Standard Practice for Soil Investigation and Sampling by Auger Borings 

ASTM D1557-09 Test Method for Laboratory Compaction Characteristics of Soil Using Modified Effort (56,000 ft-lb/ft3

(2,700 KN – m/m3

) 

ASTM D1586-08a Standard Method for Penetration Test and Split-Barrel Sampling of Soils 

ASTM D1883-07e2 Test Method for California Bearing Ratio (CBR) of Laboratory-Compacted Soils 

ASTM D2216-10 Standard Test Method for Laboratory Determination of Water (Moisture) Content of Soil and Rock 

ASTM D2487-10 Standard Classification of Soils for Engineering Purposes (Unified Soil Classification System) 

ASTM D2488-09a Standard Practice for Description and Identification of Soils (Visual Manual Procedure) 

ASTM D2850-03a (2007) Test Method for Unconsolidated, Un-drained Strength of Cohesive Soils in Triaxial Compression 

ASTM D4220-95 (2007) Standard Practices for Preserving and Transporting Soil Samples 

ASTM D4318-10 Standard Test Method for Liquid Limit, Plastic Limit and Plasticity Index of Soils 

ASTM D4428-07 Standard Test Method for Cross-hole Seismic Testing 

ASTM D4633-10 Standard Test Method for Energy Measurement for Dynamic Penetrometers 

ASTM D4767-11 Standard Test Method for Consolidated-Un-drained Triaxial Compression Test on Cohesive Soils 

ASTM D5434-09 Guide for Field Logging of Subsurface Explorations of Soil and Rock 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-18 

ASTM D5778-07 Standard Test Method for Performing Electronic Friction Cone and Piezocone Penetration Testing of Soils 

ASTM D6635-01 (2007) Standard Test Method for Performing the Flat Dilatometer (Supplier shall implement method exceptions 

cited in Subpart 3.2.6 of this specification because of obsolescence of major elements in ASTM D6429) 

ASTM D6429-99 (2006) Standard Guide for Selecting Surface Geophysical Methods 

3.1.5.4 NFPA Codes and Standards 

NFPA 10-2010 Portable Fire Extinguishers 

NFPA 13-2010 Installation of Sprinkler Systems 

NFPA 14-2010 Standard for the Installation of Standpipe and Hose Systems 

NFPA 15-2007 Standard for Water Spray Fixed Systems for Fire Protection 

NFPA 20-2010 Installation of Stationary Pumps for Fire Protection 

NFPA 22-2008 Water Tanks for Private Fire Protection 

NFPA 24-2010 Installation of Private Fire Service Mains and Their Appurtenances 

NFPA 30-2008 Flammable and Combustible Liquids Code 

NFPA 45-2011 Fire Protection for Laboratories Using Chemicals 

NFPA 54-2011 National Fuel Gas Code 

NFPA 55-2010 Storage, Use and Handling of Compressed Gases and Cryogenic Fluids in portable 

 and Stationary Containers, Cylinders and Tanks 

NFPA 70-2011 National Electric Code 

NFPA 70E-2009 Standard for Electrical Safety in the Workplace® 

NFPA 72-2010 National Fire Alarm Code 

NFPA 80-2010 Standard for Fire Doors and Other Opening Protectives 

 NFPA 80A-2007 Recommended Practice for Protection of Buildings from Exterior Fire Exposures 

 NFPA 85-2011 Boiler and Combustion Systems Hazards Codes 

 NFPA 90A-2009 Installation of Air-conditioning and Ventilating Systems 

NFPA 90B-2009 Installation of Warm Air Heating and Air-conditioning Systems 

NFPA 91-2010 Standard for Exhaust Systems for Air Conveying of Vapors, Gases, Mists and 

 Noncombustible Particulate Solids 

NFPA 101-2009 Life Safety Code 

NFPA 110-2010 Emergency and Standby Power Systems 

NFPA 220-2009 Standard on Types of Building Construction 

NFPA 221-2009 Standard for High Challenge Fire Walls, Fire Walls, and Fire Barrier Walls 

NFPA 251-2006 Standard Methods of Tests of Fire Resistance of Building Construction and 

 Materials 

NFPA 430-2004 Storage of Liquid and Solid Oxidizers 

NFPA 600-2010 Standard on Industrial Fire Brigades 

NFPA 780-2011 Standard for the Installation of Lightning Protection Systems 

NFPA 801-2008 Standard for Fire Protection for Facilities Handling Radioactive Materials 

NFPA 1410-2010 Standard on Training for Initial Emergency Scene Operations 

3.1.5.5 Instrumentation and Controls Codes and Standards 

The criteria in the following regulatory guides and standards will be used to ensure that the 

instrumentation and control IROFS will be designed to monitor and control their behavior: 

 NRC Regulatory Guide 1.100-2009 Seismic Qualification of Electric and Mechanical Equipment for Nuclear Power Plants 

NRC Regulatory Guide 1.105-1999 Setpoints for Safety-Related Instrumentation 

NRC Regulatory Guide 1.118-1995 Periodic Testing of Electric Power and Protection Systems 

NRC Regulatory Guide 1.152-2006 Criteria for Digital Computers in Safety Systems of Nuclear Power Plants (Endorses IEEE Std. 

603-2009) 

NRC Regulatory Guide 1.153-1996 Criteria for Safety Systems (Endorses IEEE Std. 603-2009) 

NRC Regulatory Guide 1.168-2004 Verification, Validation, Reviews and Audits for Digital Computer Software Used in Safety 

Systems of Nuclear Power Plants (Endorses IEEE Std. 1012-1998) 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-19 

NRC Regulatory Guide 1.169-1997 Configuration Management Plans for Digital Computer Software Used in Safety Systems of 

Nuclear Power Plants (Endorses IEEE Std. 828-1990) 

NRC Regulatory Guide 1.170-1997 Software Test Documentation for Digital Computer Software Used in Safety Systems of 

Nuclear Power Plants (Endorses IEEE Std. 829-1983) 

NRC Regulatory Guide 1.171-1997 Software Unit Testing for Digital Computer Software Used in Safety Systems of Nuclear 

Power Plants (Endorses IEEE Std. 1008-1987) 

NRC Regulatory Guide 1.172-1997 Software Requirements Specifications for Digital Computer Software Used in Safety Systems 

of Nuclear Power Plants (Endorses IEEE Std. 830-1993) 

NRC Regulatory Guide 1.173-1997 Developing Software Life Cycle Processes for Digital Computer Software Used in Safety 

Systems of Nuclear Power Plants (Endorses IEEE Std. 1074-1995) 

NRC Regulatory Guide 1.180-2003 Guidelines for Evaluating Electromagnetic and Radio-Frequency Interference in Safety-Related 

Instrumentation and Control Systems (Endorses IEEE Std. 1050-1996, IEC Std. 61000-2005, 

IEEE Std. C62.41-1991 and Mil Std. 461F-2007) 

NRC Regulatory Guide 1.209-2007 Guidelines for Environmental Qualification of Safety-Related Computer-Based Instrumentation 

and Control Systems in Nuclear Power Plants 

NRC Regulatory Guide 1.53-2003 Application of the Single-Failure Criterion to Safety Systems (Endorses IEEE Std. 603-2009) 

ANSI/ISA-67.04.01-2006 Setpoints for Nuclear Safety-Related Instrumentation 

IEEE Std. 323-2003 IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations 

IEEE Std. 336-2010 IEEE Standard Installation, Inspection, and Testing Requirements for Power Instrumentation 

and Control Equipment at Nuclear Facilities 

IEEE Std. 338-2006 IEEE Standard Criteria for Periodic Surveillance Testing of Nuclear Power Generating Station 

Safety Systems 

IEEE Std. 344-2004 IEEE Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear 

Generating Stations 

IEEE Std. 384-2008 IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits 

IEEE Std. 603-2009 IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations 

IEEE 7-4.3.2-2010 IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating 

Stations 

IEEE 730-2002 IEEE Standard for Software Quality Assurance Plans 

NUREG-0800-2011 Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants 

NUREG/CR-6090-1993 The Programmable Logic Controller and its Application in Nuclear Reactor Systems 

Branch Technical Position 

HICB - 11-1997 

Guidance on the Application and Qualification of Isolation Devices 

Branch Technical Position 

HCIB - 17-1997 

Guidance on Self-Test and Surveillance Test Provisions 

The most recent versions of the regulatory guides and Branch Technical Positions adopted by the NRC 

will be used at the time of the Instrumentation and Controls systems detailed design. 

3.2 INTEGRATED SAFETY ANALYSIS SUMMARY AND DOCUMENTATION 

The following sections provide detail on the contents of the ISA Summary and documentation. 

3.2.1 Site Description 

A description of the IIFP Site focusing on those factors that could impact safety is contained in the ISA 

Summary, Revision B Section 1 and a summary description of those factors is in LA, Revision B Chapter 

1 “General Information” Section 1.1.1. 

3.2.2 Facility Description 

The ISA Summary, Revision B Section 2 provides a description of the IIFP Facility. A summary 

description of the IIFP Facility is also provided in the LA, Revision B Chapter 1 Section 1.1.2. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-20 

3.2.3 Processes, Process Hazards and Accident Sequences 

The ISA Summary, Revision B Section 3 provides a description of the IIFP Facility processes, the 

process hazards and a general description of the accident sequences evaluated in the ISA. A summary of 

the facility processes is also provided in the LA, Revision B Chapter 1 Section 1.1.3. 

3.2.4 Compliance with the Performance Requirements of 10 CFR 70.61 

The ISA Summary, Revision B provides information that demonstrates IIFP's compliance with the 

performance requirements of 10 CFR 70.61. 

3.2.4.1 Accident Sequence Evaluation and IROFS Designation 

The ISA Summary, Revision B provides sufficient information to demonstrate that credible high 

consequence events are controlled to the extent needed to reduce the likelihood of occurrence to "Highly 

Unlikely" and credible intermediate consequence events are controlled to the extent needed to reduce the 

likelihood of occurrence to "Unlikely." 

3.2.4.2 Description of IIFP Management Measures 

The ISA Summary, Revision B provides a description of the management measures to be applied to 

IROFS for each accident sequence for which the consequences could exceed the performance 

requirements of 10 CFR 70.61. Management measures are further described in LA, Revision B 

Chapter 11. 

3.2.4.3 New Facilities or New Processes at Existing Facilities 

Baseline design criteria (BDC) that must be used for new facilities are specified in 10 CFR 70.64, 

“Requirements for New Facilities or New Processes at Existing Facilities,” (CFR, 2009e). The ISA 

accident sequences for the credible high and intermediate consequence events for the IIFP Facility 

consider accidents defined as design basis events (DBE), which include seismic and other bounding 

credible events. The IROFS for these events ensure that the associated BDC are satisfied. The BDC in 10 

CFR 70.64 are used as bases for the design of the IIFP Facility as described in the following paragraphs. 

Quality Standards and Records 

SSCs are designed, fabricated, erected and tested in accordance with the graded levels of the IIFP QAPD. 

Appropriate records of the design, fabrication, erection, procurement and testing of SSCs that are IROFS 

are maintained throughout the life of the IIFP Facility. Management measures applicable to IROFS are 

discussed in the IIFP LA, Revision B Chapter 11. The IIFP QAPD, including a discussion of 

requirements, records management and document control, is provided as Appendix A, Revision B in the 

IIFP LA. 

Natural Phenomena Hazards 

The IIFP Facility design has been developed with natural phenomena hazards (NPH) considered such that 

if an external event should occur, the health and safety of the public and the workforce from licensed 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-21 

material or chemicals produced from licensed material are maintained. SSCs that are determined to be 

IROFS are designed to withstand the effects of, and be compatible with, the environmental conditions 

associated with the IIFP Facility operation, maintenance, shutdown, testing and accidents for which the 

IROFS are required to function. 

Applicable federal, state and local codes and standards will be used by IIFP and the DB Contractor during 

detailed design, engineering and construction of the IIFP Facility to ensure protection of the safety and 

health of the workers and the public. A listing of those codes and standards is provided above in Section 

3.1.5. 

Extreme Weather Hazards

Discussions of natural phenomena hazards relative to extreme weather and related hazard assessments 

and design bases are provided in the IIFP LA Revision B: 1) Chapter 1 Section 1.7.3.3 and the ISA 

Summary Section 1.3.2.3 for extreme winds, including tornadoes and straight winds, 2) the ISA Summary 

Section 1.3.2.6 and Chapter 1 Sections 1.7.3.3 and 1.7.3.4 for floods, 3) the ISA Summary Section 1.3.2.7 

and Chapter 1 Section 1.7.3.3 for snow and 4) Chapter 1 Section 1.7.3.3 for lightning. 

Seismic hazards and associated hazard analyses and design basis are discussed below. 

Seismic Hazard

IIFP will follow the guidance in DOE-STD-1020-2002 to determine seismic design criteria for IROFS 

including the process buildings. 

The IIFP Facility will have five (5) process buildings or other structures that contain licensed material or 

have processes or materials potentially affecting licensed materials and that may have IROFS and related 

SSCs. These process buildings are: 1) the Autoclave Process Building, 2) the DUF6 to DUF4 Process 

Building, 3) the FEP Process Building, 4) the DUF4 Container Storage Building and 5) the FEP Oxide 

Storage Building. 

The process buildings will be designed based on, and consistent with, the methods outlined in DOE-STD1020-2002, "Natural Phenomena Hazards Design and Evaluation Criteria for the U.S. Department of 

Energy Facilities," (DOE, 2002a). By definition, DOE Performance Category 3 (PC-3) buildings and 

other structures are buildings and other common structures not classified as PC-4 structures but do 

contain sufficient quantities of toxic or explosive substances to be dangerous to the public if released. PC4 SSCs are designated as “reactor like” in that the quantity of hazardous material and energy is similar to 

a large Category A reactor (>200MWt). For the purposes of evaluating risks and determining design basis 

criteria relative to NPH events, the IIFP conservatively used DOE-STD-1020-2002 and the equivalent 

PC-3 category for the IIFP process buildings and other structures containing licensed material or for 

process buildings containing processes or materials potentially affecting licensed materials. 

To define the design basis earthquake for the IIFP process buildings that are assumed to withstand 

seismic events in the ISA, the guidance of DOE-1020-2002 and DOE-1023-1995 (DOE, 2002b) are 

considered along with the ISA results. The applicable portions of DOE-1023-1995 guidance for a PC-3 

facility will be used in determining the site response amplification factors and other appropriate seismic 

design input. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-22 

DOE-1020-2002 outlines a methodology to demonstrate compliance to a target performance goal of 1 x 

10-4 annual probability for a PC-3 facility by designing to a seismic hazard of 4 x 10-4 annual probability. 

The difference between the design level and the performance target is accounted for in the detailed design 

process by using a risk reduction factor of 4. The risk reduction factor is obtained through conservatism in 

the design as detailed in Appendix "C" of DOE-1020-2002. 

The DBE for the IIFP process buildings that are assumed to withstand seismic events has been selected as 

the 2,500-year return period earthquake. IIFP will apply, at a minimum, the risk reduction factor of 4 in 

accordance with the guidance of DOE-1020-2002 to achieve the PC-3 performance goal of 1 x 10-4. 

Therefore, consistent with guidance in NUREG-1520 Revision 1, using the DOE-STD-1020-2002 

standard approach will satisfy the "highly unlikely” requirement for accidents caused by the bounding 

NPH that involves a building collapse or a structural deformation that may compromise the effective 

function of an IROFS SSC. In this approach, the affected process building designs that prevent the 

accident as an engineered feature for reducing the likelihood of the consequences of the NPH event are 

designated as IROFS. 

Design basis spectral analysis for process buildings is based upon the “JAVA Ground Motion Parameter 

Calculator” application developed from the U.S.G.S. National Seismic Hazard Maps located on the 

U.S.G.S. website with the exception that the 2/3 multiplier will not be applied in determining the SDs 

(0.2-second response spectra) and SD1 (1-second response spectra). The IIFP process building structural 

components are being designed beyond the point of collapse and to remain stable at the maximum 

calculated ground motions; therefore, the two-thirds (2/3) multiplier is not applicable. By taking this 

approach, the DOE-1020-2002 target performance of less than 10% probability of unacceptable 

performance at input ground motion defined by a 1.5 safety factor (SF) times the design basis event is 

achieved. 

The process buildings and the IROFS within those buildings are designed and maintained and have 

management measures to remain available and reliable during any of the postulated NPH events. IIFP is 

committed to the use of management measures as stated in Section 3.1.3 above. The process buildings 

IROFS design integrity will be maintained using: 1) graded Quality Level 1 (QL-1) or Quality Level 2 

(QL-2) requirements and 2) the management measures applied as described in Revision B of the IIFP 

Quality Assurance Program Description and in Chapter 11 Revision B of the IIFP License Application. 

The ISA Accident Sequence Summary and Risk Index Assignment detail information for the DBE is 

provided in Tables 4-3, 4-4 and 4-5 of the IIFP ISA Summary, Revision B Section 4. The ISA Summary, 

Revision B Section 6 also presents in Table 6-1 the descriptive lists of IROFS where process building 

design is credited and maintained relative to design basis earthquake and bounding NPH events.

Geotechnical and Geophysical Investigation and Analysis

A geotechnical and geophysical investigation and analysis plan will be followed to determine the site 

class, seismic site response, liquefaction potential, soil settlement potential, and allowable bearing 

capacity of the soil for the IIFP Facility site. The proposed scope of the IIFP Facility geotechnical 

investigation, including the planned tests and their use for determining soil parameters, is as follows: 

• Perform pathfinder surveys for determination of essential settlement parameters with 

dilatometer soundings to 150 feet of depth or blade thrust refusal load of 25 tons 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-23 

• Perform pathfinder surveys for determination of approximate small strain seismic data and 

large strain shear strength data with Seismic Cone Penetration Test soundings to 150 feet of 

depth or cone thrust refusal load of 25 tons 

• Perform critical determination of small strain seismic shear modulus and Poisson Ratio data 

with Cross-hole Seismic Tests to depths of 150 feet or so depending on the requirements as 

defined by the Engineering use of the individual buildings and geology determined by the 

dilatometer and seismic cone penetration test soundings 

• Perform drilling and borings in select locations, based on data from dilatometer and Seismic 

Cone Penetration Test soundings, including Standard Penetration Test borings, to 150 feet of 

depth 

• Perform soil sampling in Standard Penetration boreholes to obtain disturbed and undisturbed 

soil samples 

• Perform auger borings to 15 feet of depth and obtain bulk disturbed soil samples 

The proposed drilling and boring location guidelines are as follows: 

• Structures: 1 boring for every 2500 square feet 

• Pier Foundations: 1 boring for every pier 

• Roads: 1 boring for every 500 feet 

Geotechnical Standards, under which activities and tests are performed, will be done in accordance with 

American Society for Testing and Materials standards. This commitment includes the provision that the 

geotechnical and geophysical investigation will be conducted in accordance with appropriate ASTM 

standards listed above in Section 3.1.5.3 “Geotechnical and Geophysical Codes and Standards.” 

Fire Protection 

The IIFP Facility design provides adequate protection from credible fire and explosion accident scenarios 

by adherence to the requirements of the ISA and recognized codes and standards. SSCs that are IROFS 

are designed and located so that they can continue to perform their safety functions effectively under 

credible fire and explosion exposure conditions. Non-combustible and heat resistant materials are used 

wherever practical throughout the IIFP Facility, particularly in locations vital to the control of hazardous 

materials and to the maintenance of safety control functions. Fire detection, alarm and suppression 

systems are designed and provided with sufficient capacity and capability to minimize the adverse effects 

of fires and explosion on IROFS. The design includes provisions to protect against adverse effects that 

may result from either the operation or the failure of the fire suppression system. 

Environmental and Dynamic Effects 

The IIFP Facility design has been developed with dynamic effects considered such that if an external or 

abnormal event should occur, the health and safety of the workforce from licensed material or chemicals 

produced from licensed material are maintained. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-24 

Potential nearby external events, other than NPH events, have been considered in the ISA. Potential 

events, and their analysis, such as nearby facility events, explosion hazards from nearby transportation 

routes, nearby gas pipeline explosions and aircraft crashes are discussed in the IIFP ISA Summary, 

Revision B Section 1.2. 

SSCs that are IROFS are protected against dynamic effects, including effects of missiles and discharging 

fluids that may result from: 1) natural phenomena, 2) accidents at nearby industrial, military or 

transportation facilities, 3) equipment failure and 4) other similar events and conditions both inside and 

outside the IIFP Facility. 

Chemical Protection 

The IIFP Facility design provides for adequate protection against chemical risks produced from licensed 

material. Chemical protection is addressed in the LA, Revision B Chapter 6. 

Emergency Capability 

The IIFP Facility design provides for emergency capability to maintain control of licensed material and 

hazardous chemicals produced from licensed material, evacuation of on-site personnel and on-site 

emergency facilities and services. SSCs that are required to support the IIFP Emergency Management 

Plan (EMP), Revision B are designed for emergencies. The design provides accessibility to the equipment 

of onsite and available off-site emergency facilities and services such as hospitals, fire and police 

departments, ambulance service and other emergency agencies. 

Utility Services 

On-site utility service systems required to support the BDC are provided. Each utility service system 

required to support IROFS is designed to perform its function under normal and abnormal conditions. 

Utility systems are described in the ISA Summary, Revision B. 

Inspection, Testing and Maintenance 

SSCs are inspected, tested and maintained in accordance with the graded levels of the IIFP QAPD 

Revision B. SSCs that are determined to be IROFS have applicable management measures applied as 

discussed in IIFP LA, Revision B Chapter 11. 

Instrumentation and Controls 

Instrumentation and control systems are provided to monitor variables and operating systems that are 

significant to safety over anticipated ranges for normal operation, abnormal operation, accident conditions 

and safe shutdown. These systems ensure adequate safety of process and utility service operations in 

connection with their safety function. 

The variables and systems that require surveillance and control include process systems having safety 

significance requiring or involving IROFS including overall confinement system, confinement barriers 

and their associated systems and other systems. Controls shall be provided to maintain these variables and 

systems within the prescribed operating ranges under normal conditions. Instrumentation and control 

systems are designed to fail into a safe state or to assume a state demonstrated to be acceptable on some 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-25 

other basis if conditions such as disconnection, loss of energy or motive power or adverse environments 

are experienced. 

Defense-in-Depth Practices 

The IIFP Facility and system designs are based on defense-in-depth practices. The design incorporates a 

preference for engineered controls over administrative controls to increase overall system reliability. 

Furthermore, the engineered controls preference is for use of passive engineered controls over active 

engineered controls. The design also incorporates features that enhance safety by reducing challenges to 

IROFS. The IIFP Facility and system IROFS are identified in the ISA Summary, Revision B. 

3.2.5 Integrated Safety Analysis Methodology 

IIFP used methodologies identified in NUREG-1520, Chapter 3, Appendix A (NRC, 2002) to identify 

hazards and evaluate accident scenarios. This approach employs a semi-quantitative risk index method for 

categorizing accident sequences in terms of their consequences of concern and their likelihood of 

occurrence. The risk index method framework identifies which accident sequences have consequences 

that could exceed the performance requirements of 10 CFR70.61 and therefore, require designation of 

IROFS and supporting management measures. Descriptions of these general types of higher-consequence 

accident sequences are in the ISA Summary, Revision B. The ISA is a systematic analysis to identify 

facility and external hazards, potential accidents, accident descriptions, the likelihood and consequences 

of the accidents and the IROFS. 

The ISA uses a hazard analysis method, the “What-If”/Checklist Method, to identify the hazards relevant 

to each node or the IIFP Facility in general. The ISA team reviewed the hazards identified for the 

"credible worst-case" consequences. The credible high or intermediate severity consequence accident 

scenarios were assigned accident description identifiers, accident descriptions and a frequency or 

probability and then a risk index determination was performed. The risk index was used to evaluate 

unmitigated risk as unacceptable or acceptable. 

For each accident scenario having an unacceptable unmitigated risk index, IROFS were defined and the 

mitigated likelihood was determined for each accident scenario. Using the unmitigated initiating event 

frequency and the failure probability of each IROFS, the mitigated scenario likelihood and mitigated risk 

was determined. The risk index method is regarded as a screening method for proving the adequacy or 

inadequacy of the IROFS for any particular accident. The credible accidents that potentially exceed the 

levels identified in 10 CFR 70.61 are evaluated using a risk analysis approach. 

Figure 3-2, “Integrated Safety Analysis Process Flow Diagram,” shows the ISA process steps. The 

following sub-sections correspond to the blocks in the flow diagram and provide descriptions of the 

individual steps. 

3.2.5.1 Define Nodes to be Evaluated 

The first step of the ISA is for the ISA team to systematically break down the process system, subsystem, 

facility area or operation being studied into well-defined nodes. The ISA nodes establish the study area 

boundaries in which the various process systems and supporting systems entering or exiting the node, or 

activities occurring in the area, can be defined in order to allow interactions to be studied. 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-26 

The IIFP Site was divided into four types of processes as part of the PHA effort: DUF4 Process, Silicon 

Tetrafluoride (SiF4) Process, Boron Trifluoride (BF3) Process and the Support Facilities. Specific process 

operations are separated logically into “nodes” for PHA evaluation. The PHA is broken down in this 

manner to help reduce the complexity of the facility to a manageable level and to organize the PHA 

process and results in a consistent format. These nodes define process boundaries for the PHA and are 

unique process steps within the facility. Equipment located outside the process boundary is not evaluated 

in the node, although interaction between systems and potential initiating events from other systems is 

considered. 

The entire IIFP Facility was evaluated in a logical process flow approach. This approach is also used to 

evaluate the hazards associated with each process or operation and to identify any new hazards resulting 

from modifications made to an existing process or operation. Boundaries were indentified that define the 

point of process separation of a hazardous chemical as well as segregation points where the release of a 

hazardous chemical would not adversely affect licensed materials. The IIFP Facility defined primary 

nodes are identified as part of the accident sequence tables in the ISA Summary Revision B Section 3.3. 

Information used to define the nodes and to perform the process hazard analysis includes, but are not 

limited to, the following: 

• System descriptions 

• Plot plans 

• Process flow diagrams 

• Topographic maps 

• Equipment arrangement drawings with general equipment layout and elevations 

• Design temperatures and pressures, based on the existing level of design detail, for major process 

equipment and interconnected piping 

• Materials of construction for major process equipment and interconnected piping based on the 

existing level of design detail 

• MSDSs for any chemicals involved in the process (including any intermediate chemical reaction 

products) and other pertinent data for the chemicals or process chemistry (such as, chemical 

reactivity hazards) 

• Utility system drawings 
LA-IFP-001 Revision B CHAPTER 3 November 30, 2011 

Page 3-27 

Figure 3-2 Integrated Safety Analysis Process Flow Diagram 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-28

3.2.5.2 Hazard Identification 

The “What-If” analysis method was used for identifying the hazards for the IIFP process. This method is 

consistent with the guidance provided in NUREG-1520 (NRC, 2002) and the later Revision 1 (NRC, 

2010) and NUREG-1513, “Integrated Safety Analysis Guidance Document,” (NRC, 2001). The hazard 

identification process documents materials that are: 

• Radioactive 

• Flammable 

• Explosive 

• Toxic 

• Reactive 

The hazards identification process results in identification of radiological and chemical characteristics that 

have the potential for causing harm to workers, the public or to the environment. The hazards of concern 

for the IIFP Facility are related to a release (loss of confinement) of UF6, uranium tetrafluoride (UF4), 

uranium oxide, HF or chemicals that may generate HF. The loss of confinement of UF6 would initially 

result in moisture in the air reacting with the UF6, forming uranyl fluoride (UO2F2) and HF as byproducts. UO2F2 becomes a significant inhalation problem due to its dispersion characteristics and small 

particle size. HF can also be generated by the exposure of SiF4 or BF3 to air. HF is produced as a byproduct in the UF6 de-conversion reaction and could be released from that process if an equipment failure 

were to occur. The gaseous HF and UO2F2 could be transported through the IIFP Facility and ultimately 

beyond the Site boundary. Uranium compounds and HF are toxic chemicals with the potential to cause 

harm to the workers or the public (see LA, Revision B Chapter 6 for identification and more detailed 

descriptions of potentially toxic chemicals related to the IIFP processes). 

For licensed material or hazardous chemicals produced from licensed materials, chemicals of concern are 

those that, in the event of release, have the potential to exceed concentrations defined in 10 CFR 70, 

“Domestic Licensing of Special Nuclear Material.” Criteria for evaluating potential releases and 

characterizing their consequence as either "High" or "Intermediate" for members of the public and facility 

workers are presented in Table 3-1, “Consequence Severity Categories Based on 10 CFR 70.61” and 

Table 3-2, “AEGL Thresholds from the EPA for Uranium Hexafluoride, Soluble Uranium and Hydrogen 

Fluoride,” (AEGL, 2009). 

Worker exposures were assessed based on amount of time required for the worker to conservatively 

evacuate the airborne material released from a hazardous material leak. Public exposures were estimated 

to last for 30-minutes duration. This is consistent with self-protective criteria for UF6/HF plumes listed in 

NUREG-1140, “A Regulatory Analysis on Emergency Preparedness for Fuel Cycle and Other 

Radioactive Material Licensees,” (NRC, 1988). The Acute Exposure Guideline Levels (AEGL) -1, -2, and 

-3 values were used as the threshold concentration levels for establishing a low, intermediate, or high 

severity consequence as shown in Table 3-1 for the exposure times indicated. AEGL values for other time 

periods are utilized when more appropriate for the accident scenarios in question. 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-29

Table 3-1 Consequence Severity Categories Based on 10 CFR 70.61 

Severity 

Ranking

Consequence Description

3 

Workers Off-site Public Environment

Radiological dose greater than 1 Sv (100 rem) Radiological dose greater than 0.25 Sv 

(25 rem) 

N/A 

75 mg soluble uranium intake 30 mg soluble uranium intake 

Chemical exposure greater than 3 AEGL-3 (for 

accident specific exposure time) 

Chemical exposure greater than 

AEGL-2 (30 minute exposure) 

A criticality accident occurs A criticality accident occurs 

2 

Radiological dose greater than 0.25 Sv (25 

rem) but less than, or equal to 1 Sv (100 rem) 

Radiological dose greater than 0.05 Sv 

(5 rem) but less than or equal to 0.25 

Sv (25 rem) 

Radioactive release 

greater than 5,000 

times 10 CFR 20, 

Appendix B, Table 2 

(CFR, 2009g) 

Chemical exposure greater than AEGL-2 but 

less than or equal to AEGL-3 (for accident 

specific exposure time) 

Chemical exposure greater than 

AEGL-1 but less than or equal to 

AEGL-2 (30 minute exposure) 

1 

Accidents with radiological and/or chemical 

exposures to workers less than those above 

Accidents with radiological and/or 

chemical exposures to the public less 

than those above 

Radioactive releases 

to the environment 

producing effects 

specified above 

The consequence designation for dermal HF exposure previously indicated in the original LA, Revision A 

Table 3-1 is considered to be bounded by the chemical exposure consequence based on the airborne 

concentration limit of HF because currently there is no known authoritative quantitative standard for HF 

dermal exposure. The assessment of HF exposure is discussed in the IIFP ISA Summary, Revision B 

Section 4.1.2 “Consequence Analysis.” 

10 CFR 70.61 (b) (3) states (in part) for a high consequence event: 

 “An intake of 30 mg or greater of uranium in soluble form by any individual located 

 outside the controlled area identified pursuant to Paragraph(f) of this section...” 

The UF6 concentration in air is not directly equivalent to soluble uranium intake. Therefore, IIFP uses an 

accepted intake value of 75 mg or greater, corresponding to the threshold for permanent renal damage 

consistent with a high consequence event to a worker, which is an “acute chemical exposure” as defined 

in 10 CFR 70.61(b)(4) (CFR, 2009a). 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-30

Table 3-2 AEGL Thresholds from the EPA for Uranium Hexafluoride, Soluble Uranium and 

Hydrogen Fluoride 

Uranium Hexafluoride [mg/m3] 

10 min 30 min 60 min 4 hr 8 hr 

AEGL 1 3.6 3.6 3.6 NR NR 

AEGL 2 28 19 9.6 2.4 1.2 

AEGL 3 216 72 36 9 4.5 

Soluble Uranium [mg/m3] 

10 min 30 min 60 min 4 hr 8 hr 

AEGL 1 2.4 2.4 2.4 NR NR 

AEGL 2 19 13 6.5 1.6 0.8 

AEGL 3 145 48 24 6 3.0 

Hydrogen Fluoride [mg/m3] 

10 min 30 min 60 min 4 hr 8 hr 

AEGL 1 0.8 0.8 0.8 0.8 0.8 

AEGL 2 78 28 20 10 10 

AEGL 3 139 51 37 18 18 

 

The “What-If” analysis method was used for identifying process hazards for the DUF6, DUF4, SiF4 and 

BF3 process systems at the IIFP Facility. This PHA technique is used to identify and document items 

identified in the hazard analysis meetings. For identified single-failure events (that is, those accidents that 

result from the failure of a single control), the “What-If” method is the recommended approach. 

The results of the ISA team meetings are summarized in the ISA “What-If” Tables which form the basis 

of the hazards portion of the Hazard and Risk Determination Analysis. The “What-If” Tables are 

contained in the ISA documentation. The format for this table, which has spaces for describing the node 

under consideration and the date of the workshop, is provided in Table 3-3, “What-If Example.” The 

“What-If” Table is divided into nine (9) columns, which are as follows: 

1. Scenario Number - This is a unique number assigned to each “What-If” question. 

2. “What-If” - This column provides a description of the “What-If” question to be analyzed. 

3. Causes - This column provides a description of the initiating event required to cause the accident. 

4. Likelihood Category - This column is the qualitative assessment of the unmitigated probability 

or frequency of occurrence for the causes. 

5. Consequences -This column provides a description of the design basis event (for example, the 

potential and worst-case consequences from fire, potential release event, etc.). 

6. Consequence Category -This column provides the qualitative severity category, based on the 

consequence analysis, affecting workers, the public and the environment. 

7. Prevention Features -This column identifies the available design features that are judged to 

prevent the likelihood and/or consequence of the scenario. 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-31

8. Mitigation Features - This column identifies the available design features that are judged to 

mitigate the likelihood and/or consequence of the scenario. 

9. Comments - This column includes references to related PHAs or other information justifying the 

information contained in preceding columns. 

This approach was used for the process system hazard identification. The results of the unmitigated 

“What-If” scenarios are used directly as input to the risk index development. In addition, the hazard 

identification identifies potentially hazardous process conditions. Most hazards were assessed 

individually for the potential impact on the discrete components of the process systems. However, hazards 

were assessed on a facility-wide basis for credible hazards from fires (such as, external to the process 

system) and external events (such as, seismic, severe weather, etc.). 

For the purpose of evaluating the impacts of fire hazards, the ISA team, 

• Postulated the development of a fire occurring in in-situ combustible material from an 

unidentified ignition source (such as, electrical shorting or other source) 

 

• Postulated the development of a fire occurring in transient combustible material from an 

unidentified ignition source 

• Evaluated the uranic content in the space and its configuration (for example, UF6 solid/gas in 

cylinders, UF6 gas in piping, UF6 and/or by-products bound on chemical traps, UO2F2 particulate 

on solid waste or in solution). The appropriate configuration was considered relative to the 

likelihood of the target releasing its uranic content as a result of a fire in the area. 

In order to assess the potential severity of a given fire and the resulting failures to important systems, a 

Fire Hazards Analysis (FHA) was conducted. However, since the design supporting the license submittal 

for this facility is not yet at the detailed design stage, detailed in-situ combustible loading and in-situ 

combustible configuration information is estimated. Therefore, in order to place reasonable and 

conservative bounds on the fire scenarios analyzed, the ISA team estimated in-situ combustible loadings 

based on the FHA information for the in-situ combustible loading for the IIFP Facility. This information 

indicates that in-situ combustible loads are expected to be very low. 

External events were considered at the site and facility process level. The ISA team considered both 

natural phenomena and man-made hazards for the external events. During team meetings, each area of the 

proposed IIFP Facility was discussed as to whether or not it could be adversely affected by the specific 

external event under consideration. If so, specific consequences were then discussed. If the consequences 

were known or identified to be a low consequence, then a specific design basis with a likelihood of 

"Highly Unlikely" would be selected. Each external event was assessed for both the unmitigated case and 

then for the mitigated case. The mitigated cases could be a specific design basis for that external event, 

IROFS, or a combination of both. 

Natural phenomena hazards (NPH) considered for evaluation included: 

• Earthquakes 

• Hurricanes (including topical storms) 

• Tornados (including tornado missiles and extreme straight wind) 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-32

• Volcanoes 

• Flooding 

• Snow and ice 

• Precipitation 

External man-made hazards considered for evaluation included: 

• Transportation hazards onsite/offsite 

• Onsite facility hazards 

• Aircraft crashes 

• Wild land fires (range fires) 

• Gas and petroleum pipelines 

• Roadways and highways 

• Nearby industrial facilities 

• Nearby military installations 

• Railways 

• Waterways 

• Underground utilities (on-site use of industrial gases and electrical services) 

• Internal flooding from on-site above ground liquid storage tanks 

• Land use impacts 

Table 3-3 “What-If” Example 

Plant Node 

Drawing System 

Drawing Date System Description 

Scenario 

Number 

“What 

if”... Causes Likelihood Category Consequences Consequence Category 

Prevention 

Features 

Mitigation 

Features Comments 

 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-33

3.2.5.3 Identify Accident Scenarios 

The goal is to identify credible accident scenarios or sequences by analyzing single initiating events. The 

ISA team identified potential accident scenarios associated with a process or operation, including possible 

worse-case consequences, causes (events that can initiate the accident) and safeguards or controls that are 

available to prevent the cause of the event or mitigate the consequences. Safeguards are design or 

operational features or administrative programs that provide defense-in-depth, but are not credited as 

IROFS. Consequences of interest include radiological material releases, radiation exposures, 

chemical/toxic exposures from licensed material or hazardous chemicals produced from licensed material, 

fires and explosions. Hazards are defined to be materials, equipment or energy sources with the potential 

to cause injury or illness to humans or adversely impact the environment. 

An important product of an ISA is a description of accident scenarios identified and recorded during the 

analysis process. An accident scenario involves an initiating event, any factors that allow the accident to 

propagate (enablers) and any factors that reduce the risk (likelihood and consequence) of the accident 

(controls). The accident scenario is a specific potential real event. 

When analyzing accident scenarios, the ISA team considered process deviations, human errors, internal 

facility events and credible external events including natural phenomena. FCSS ISG-08, “Natural 

Phenomena Hazards,” (NRC, 2005) was used as guidance when evaluating natural phenomena hazards as 

initiating events. The team evaluated common mode failures and systems interactions where preventive 

actions and/or control measures are required to prevent and/or mitigate accident scenarios. The team 

identified scenarios considered not credible. In addition to normal conditions, the team considered 

abnormal conditions including start-up, shutdown, maintenance and process upsets. 

For each accident scenario, enabling conditions and conditional events that affect the outcome of the 

accident scenario (for example, conditions that affect the likelihood of the scenario or could mitigate the 

consequences to either workers or the public) were identified where appropriate. An enabling condition 

does not directly cause the scenario, but must be present for the initiating event to proceed to the 

consequences described. Enabling conditions are expressed as probabilities and can reflect such factors as 

the mode of operation (for example, percent of operational online availability). 

Conditional events that affect the probability of the undesired outcome were also identified. These include 

probabilistic consideration of individual or administrative actions that would not be considered IROFS 

but would affect the overall likelihood of the accident. For example, if a scenario involves personal injury 

hazards, at least one worker must be present in the affected area at the time of the event for the injury to 

occur. Thus, the presence of workers in the affected area is a conditional modifier for a consequence 

involving personal injury. Another example of a conditional event is the probability that a worker can 

successfully evacuate from an area given that a hazard is present. 

In considering accident scenarios at the IIFP Facility, it is necessary to determine which scenarios are 

considered not credible and which are credible. During the PHA, the ISA team considered each accident 

scenario as credible unless the scenario could be determined to be not credible. (See Section 3.2.5.5 for 

the criteria IIFP used to determine if an accident scenario is credible.) 

3.2.5.4 Determine Consequence Severity Level 

Table 3-1 presents the radiological and chemical consequences severity limits of 10 CFR 70.61 (CFR, 

2009a) for each of the accident consequence categories. Table 3-2 provides information on the chemical 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-34

dose limits specific to the IIFP Facility. 

For each credible accident scenario identified, the ISA team assigned a severity ranking for the 

consequences using the consequence severity rankings provided in Table 3-1. Assigning a severity 

ranking allowed each accident scenario to be categorized in terms of the performance requirements 

outlined in 10 CFR 70.61 (b), (c) and (d). The Severity Ranking System is listed below: 

• A severity ranking of 3 corresponds to high consequences. 

• A severity ranking of 2 corresponds to intermediate consequences. 

• A severity ranking of 1 corresponds to low consequences. 

When estimating the possible "worst-case" consequences of an accident scenario, the ISA team members 

used experience, guidance from NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook,” (NRC, 1998) and best judgment and experiences. 

10 CFR 70.61 specifies two categories for a credible accident description consequence: "High 

Consequence" and "Intermediate Consequence." Implicitly, there is a third category for accidents that 

produce consequences that are less than "Intermediate." These are referred to as "Low Consequence" 

accident descriptions in the ISA. The primary purpose of the PHA is to identify the uncontrolled and 

unmitigated accident descriptions. These accident descriptions are then categorized into one of the three 

consequence categories (High, Intermediate, Low) based on their predicted radiological, chemical and/or 

environmental impacts. 

The severity of consequences is determined through a variety of ways, both quantitatively and 

qualitatively. Quantitative methods include source term and dispersion modeling. Qualitative methods 

may assume worst case assumptions and/or comparison to similar events where bounding conservative 

calculations have been made. The consequences of concern are the chemo-toxic exposures to UF6, UF4, 

HF, uranium oxide(s) and UO2F2. The dose consequence for each of the accident descriptions was 

evaluated and compared to the CFR criteria for high and intermediate consequences. 

The inventory of uranic material for each accident considered was dependent on the specific accident 

description. Scenarios that resulted in a severity rank of 2 or 3 included large UF6/HF release (such as a 

multiple cylinder failure or process line failure) and an HF release (pressure vessel or process line). For a 

severity level of 1 (Low), there is "No Safety Consequence of Concern" and no further analysis is 

required and the “What-If” Table is updated. 

3.2.5.5 Determine Unmitigated Likelihood 

The likelihood of an accident scenario occurring was determined for the unmitigated case (unmitigated 

likelihood). Unmitigated likelihood is the likelihood or frequency that the initiating event or cause of the 

accident sequence occurs despite any actual or potential preventive or mitigating features. Therefore, this 

likelihood/frequency estimate assumes that none of the available safeguards or IROFS is available to 

perform its intended safety function. Table 3-4, “Unmitigated Likelihood Categories,” shows the 

likelihood of occurrence limits of 10 CFR 70.61 for each of the three likelihood categories. 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-35

Table 3-4 Unmitigated Likelihood Categories 

Likelihood Category Qualitative Description 

1 Consequence Category 3 accidents must be "Highly Unlikely" 

2 Consequence Category 2 accidents must be "Unlikely" 

3 Not Unlikely 

The team assigned a likelihood level for each accident scenario using the defined categories in Table 3-5, 

“Event Likelihood Categories” and Table 3-6 “Determination of Likelihood Category.” When assigning a 

likelihood category, the team made use of process knowledge, accident scenario information, operating 

history, and manufacturers’ product information to determine which category of likelihood was 

appropriate. For accident scenarios where multiple initiating events were identified, the team estimated 

the likelihood for the most credible initiating event. This ensured that the accident scenario was screened 

using the most conservative estimate of risk. 

Table 3-5 Event Likelihood Categories 

Likelihood Likelihood Category Frequency or Probability of Occurrence 

Not Unlikely (Credible) 3 More than or equal to 10-4 per-event per-year 

Unlikely (Credible) 2 Between 10-4 and 10-5 per-event per-year 

Highly Unlikely 1 Less than or equal to 10-5 per-event per-year 

 

Table 3-6 Determination of Likelihood Category 

Likelihood Category Likelihood Index T (= sum of index numbers) 

1 T ≤ -5 

2 -5 < T ≤ -4 

3 -4 < T 

The definitions of likelihood terms are presented in the following sections. 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-36

Highly Unlikely 

The guideline for acceptance of the definition of "Highly Unlikely" has been derived as the highest 

acceptable frequency that is consistent with a goal of having no inadvertent radioactive or hazardous 

material release accidents and no accidents of similar consequences in the industry. Within an order of 

magnitude, this is taken to mean a frequency limit of less than one such accident in the industry every 100 

years. This has been translated into a guideline limiting the frequency of individual accidents to 10-5 perevent per-year. As the goal is to have no such accidents, accident frequencies should be reduced 

substantially below this guideline when feasible. 

Unlikely 

Intermediate consequence events include significant radiation exposures to workers (those exceeding 0.25 

Sieverts or 25 rem). No increase in the rate of such significant exposures is the NRC's goal. This has been 

translated into a guideline of 4.0 x 10-5 per-event per-year. This guideline may be more generally 

considered as a range between 10-4 and 10-5 per-event per-year since exact frequencies at such levels 

cannot accurately be determined. 

Not Credible 

The definition of "Not Credible" is taken from NUREG-1520 (NRC, 2002). If an event is "Not Credible," 

IROFS are not required to prevent or mitigate the event. The fact that an event is "Not Credible" must not 

depend on any facility feature that could credibly fail to function. One cannot claim that a process does 

not need IROFS because it is "Not Credible" due to characteristics provided by IROFS. The implication 

of "Credible" in 10 CFR 70.61 is that events that are "Not Credible" may be neglected. Any one of the 

following independent acceptable sets of qualities could define an event as "Not Credible." 

• An external event for which the frequency of occurrence can conservatively be estimated as less 

than once in a million years 

• A process deviation that consists of a description of many unlikely human actions or errors for 

which there is no reason or motive 

 In determining that there is no reason for such actions, a wide range of possible motives, short of 

intent to cause harm, must be considered. Necessarily, no such description of events can ever 

have actually happened in any fuel cycle facility. 

• Process deviations for which there is a convincing argument, given physical laws that they are not 

possible, or are unquestionably extremely unlikely 

Credible 

A "Credible" accident is any event that does not meet the definition of "Not Credible" as defined above. 

3.2.5.6 Determine Unmitigated Risk 

Credible accident scenarios identified for the IIFP Facility, which have the capability of producing 

conditions that fail to meet the performance requirements of 10 CFR 70.61(b), (c) or (d) are included in 

the scope of the ISA Summary, Revision B. For each credible accident scenario, the ISA team used the 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-37

severity category ranking and unmitigated likelihood level to assign an unmitigated risk level. (The 

unmitigated risk is determined from the product of the severity category and the unmitigated-likelihood 

category.) The ISA team used the risk matrix in Table 3-7, “Unmitigated Risk Assignment Matrix,” to 

determine the unmitigated risk. The unmitigated risk associated with each accident scenario indicates the 

relative importance of the associated controls. Accident scenarios in which the consequences and 

likelihoods yield an unacceptable risk index require further evaluation to determine IROFS and mitigated 

risk, as described in Section 3.2.5.8. 

If the unmitigated risk is less than or equal to 4, the unmitigated risk is acceptable and no further action is 

required. The “What-If” Table is updated to reflect this conclusion of no further action. 

Table 3-7 Unmitigated Risk Assignment Matrix 

Severity of Consequences 

Likelihood of Occurrence 

Likelihood Category 1 

Highly Unlikely 

(1) 

Likelihood Category 2 

Unlikely 

(2) 

Likelihood Category 3 

Not Unlikely 

(3) 

Consequence Category 3 

High 

(3) 

Acceptable Risk 

3 

Unacceptable Risk 

6 

Unacceptable Risk 

9 

Consequence Category 2 

Intermediate 

(2) 

Acceptable Risk 

2 

Acceptable Risk 

4 

Unacceptable Risk 

6 

Consequence Category 1 

Low 

(1) 

Acceptable Risk 

1 

Acceptable Risk 

2 

Acceptable Risk 

3 

3.2.5.7 Risk Assignment 

If the unmitigated risk is more than 4, the unmitigated risk is unacceptable and further risk analysis is 

required. The risk analysis identifies the IIFP Facility node(s) to which it applies, describes the node 

operations and operational areas, identifies the PHA reference nodes, accident description, initiating 

events evaluated, potential preventive and mitigation features and describes management measures. The 

risk analysis accident evaluations follow analytical methods of NUREG-1520.

3.2.5.8 IROFS and Risk Development 

For each accident scenario having an unacceptable unmitigated risk index, IROFS must be defined and 

the mitigated likelihood determined for each accident scenario. The mitigated likelihood is determined 

using the unmitigated initiating event frequency and the failure probability of each IROFS. 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-38

The risk analysis presents an accident evaluation including a detailed discussion concerning the selection 

of initiating events, IROFS and the evaluation of the accident sequences. The risk analysis provides 

sufficient background and operational information to understand and examine accident scenarios that 

result in undesired outcomes for each initiating event. Each risk analysis provides details concerning an 

accident scenario's quantification, including: 1) method used, 2) initiating-event frequency determination, 

3) the IROFS credited to prevent or mitigate the initiating event(s) being analyzed, 4) the failure 

probabilities for the credited IROFS and 5) the overall likelihood estimates. The risk analyses are 

controlled documents and are maintained up-to-date by the CM Program described in LA, Revision B 

Chapter 11. The results from each risk analysis are summarized in the ISA Summary, Revision B. 

The mitigated likelihood of the accident scenario occurring with the preventive or mitigating IROFS in 

place must meet the requirements in 10 CFR 70.61 which requires that unacceptable consequences be 

limited. The values of the index numbers for an accident scenario, depending on the number of events 

involved, are added to obtain a total likelihood index, "T." Accident scenarios are then assigned to one of 

the three likelihood categories of the risk matrix, depending on the value of the likelihood index in 

accordance with Table 3-5. 

The reliability and availability of IROFS to perform are a function of the management measures applied 

to each IROFS. The management measures provide the overall management oversight and assurance that 

the IIFP Safety Program is maintained and functions properly. Management measures are described in 

LA, Revision B Chapter 11. The ISA Summary, Revision B provides a consolidated list of IROFS.

Safeguards are design features or administrative programs that provide defense-in-depth, but are not 

IROFS and are not credited with preventing or mitigating accident scenarios. It is stated in 10 CFR 70.64 

that the design process must be founded on defense-in-depth principles and incorporate, to the extent 

practicable, preference for engineered controls over administrative controls and reduction of challenges to 

the IROFS that are frequently or continuously challenged. 

Safety controls used at the IIFP Facility can be characterized as either administrative or engineered. 

Administrative controls are generally not considered to be as reliable as engineered controls since human 

errors usually occur more frequently than equipment failures. Engineered controls may be categorized as 

being "Passive" or "Active." Passive controls include pipes or vessels that provide containment. Active 

controls include equipment such as pumps or valves that perform a specific function related to safety. In 

general, passive controls are considered to be less prone to failure than active controls. 

IROFS are those engineered or administrative controls or control systems which comprise the SSCs that 

form the preventive and/or mitigating barriers identified by the ISA. The IROFS selected for each 

accident scenario may be a control that reduces the likelihood that the initiating event occurs, detects or 

mitigates the consequences or reduces the amount of hazardous material released. IROFS are the 

protection features that prevent and/or mitigate the unacceptable consequences identified by the 

performance requirements of 10 CFR 70.61 (b) (c) and (d). IROFS must be independent of the initiating 

event so that the occurrence of the initiating event does not cause failure of the IROFS. IROFS must also 

be independent of other credited IROFS so that the failure of one IROFS does not cause failure of another 

IROFS. 

IIFP commits to identify IROFS as a part of the ISA process and include the identification of the IROFS 

in the ISA Summary, Revision B prepared and maintained for the IIFP Facility. The IROFS are defined in 

such a way as to delineate their boundaries, to describe the characteristics of the preventive/mitigating 

function and to identify the assumptions and conditions under which the item is relied on. 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-39

As described in Section 3.1.4, IIFP commits to following acceptable Human Factors Engineering 

guidance for administrative components identified in IROFS where human actions are relied upon to 

ensure the performance of the administrative controls. These IROFS will be designed in accordance with 

applicable guidance provided in (NRC, 2002a), (NRC, 2004) and (NRC, 2010). 

3.2.5.9 What-If/Checklist, Risk Index and ISA Summary 

The risk analysis results in the development of IROFS and the overall accident sequence frequency 

determination based on the evaluation of the potential accident. This information is then used to update 

the “What-If” Table, including the unmitigated likelihood and the unmitigated risk. 

Based on the updated “What-If” Table and the risk analysis, the Accident Sequence Summary and Risk 

Index (Table 3-8) is completed. For accident sequences that are of low consequence or that have a risk 

index of 4 or less, the risk is acceptable and Table 3-8 requires no entries (that is, "N/A") for the initiating 

event frequency, IROFS and their failure probabilities or likelihood index. 

The ISA process is an iterative process. The ISA Summary provides an overview of the ISA based upon 

the existing level of design detail. The ISA Summary, Revision B that supports the LA is based on the 

level of design necessary to establish the safety basis for the IIFP Facility and support the licensing effort. 

The final step of the ISA process (see Figure 3-1) is to update supporting ISA documentation and then 

develop the ISA Summary. As the design of the IIFP Facility progresses the ISA and supporting 

documents will be revised or new supporting documents will be developed. 

Table 3-8 Accident Sequence Summary and Risk Index Evaluation Example 

Accident identifier 

Initiating event 

Safety Parameter 1 

or IROFS 1 

Failure Probability 

Index 1 

Preventive Safety 

Parameter 2 or 

IROFS 2 

Failure Probability 

Index 2 

Preventive Safety 

Parameter 3 or 

IROFS 3 

Failure Probability 

Index 3 

Likelihood Index T 

Uncontrolled / 

Controlled 

(b+d+f+h) 

Likelihood Category 

Consequence 

Evaluation 

Reference 

Consequence 

Category 

Risk Index (j x l) 

Comments 

 and 

Recommendations 

(a) (b) (c) (d) (e) (f) (g) (h) (i) (j) (k) (l) (m) (n) 

 

3.2.6 Integrated Safety Analysis Integration 

The ISA is intended to give assurance that the potential failures, hazards, accident descriptions, scenarios 

and IROFS have been investigated in an integrated fashion so as to adequately consider common mode 

and common cause situations. Included in this integrated review is the identification of IROFS functions 

that may simultaneously be both beneficial and harmful with respect to different hazards and interactions 

that might not have been considered in the previously completed risk analyses. This review is intended to 

ensure that the designation of one IROFS does not negate the preventive or mitigation function of another 

IROFS. The ISA team performed an integrated review during the process hazard review and an overall 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-40

integration review after the nodes were completed. Some items that warrant special consideration during 

the integration process evaluation are: 

• Common mode failures and common cause situations 

• Support system failures such as loss of electrical power or water. Such failures can have a 

simultaneous effect on multiple systems 

• Divergent impacts of IROFS. Assurance must be provided that the negative impacts of an IROFS, 

if any, do not outweigh the positive impacts; that is, to ensure that the application of an IROFS 

for one safety function does not degrade the defense-in-depth of an unrelated safety function. 

• Other safety and mitigating factors that do not achieve the status of IROFS that could impact 

system performance 

• Identification of scenarios, events or event descriptions with multiple impacts, that is, impacts on 

chemical, fire and/or radiation safety. For example, a flood might cause both a loss of 

confinement and active safeguards. 

• Potential interactions between processes, systems, areas and buildings; any interdependence of 

systems or potential transfer of energy or materials 

• Major hazards or events that tend to be common cause situations leading to interactions between 

processes, systems, buildings, etc. 

• In all cases where a common mode failure may later be identified (during the detailed design 

phase of the project) among IROFS in the same accident sequence, a redundant independent 

system or component will be installed to actuate on failure of the primary system or component. 

3.2.7 Integrated Safety Analysis Team 

The ISA was performed, and will be maintained, by a team with expertise in engineering, process safety, 

safety analysis and facility process operations. Team member qualifications were consistent with 

guidance provided in NUREG-1520 (NRC, 2002). The ISA team consisted of a diverse group of 

individuals with experience and knowledge specific to each process or system being evaluated. The team 

was comprised of individuals who have experience, individually or collectively, in the following: 

• Nuclear facility safety 

• Radiological safety 

• Process hazards analysis 

• Safety analysis and risk assessment 

• Fire safety 

• Chemical process safety 

• Operations and maintenance 

• ISA methods 

• Human Factors (This discipline is being added to the ISA team as described above in 

Section 3.1.4.2 Subsection “ISA Team Relationship to Human Factors”). 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-41

The ISA team leader is trained and knowledgeable in the ISA methods chosen for the hazard and 

accidents evaluations. Collectively, the team has an understanding of the process operations and hazards 

under evaluation. The team leader is responsible for the overall direction of the ISA. As a team, the 

members are knowledgeable and experienced in ISA methodology related techniques including hazards 

identification, process hazards analysis and safety analysis and risk assessment at various 

chemical/nuclear facilities. Additional information on the ISA team is provided in the ISA Summary, 

Revision B. 

3.2.8 Descriptive List of IROFS 

The ISA Summary, Revision B Section 6, Table 6-1 provides a list of IROFS in the identified high and 

intermediate accident sequences. 

3.2.9 Sole IROFS 

There are very few sole IROFS and these are identified in Tables 8-1 and 8-2 of the ISA Summary, 

Revision B. 

 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-42

REFERENCES 

AEGL, 2009 U.S. Department of Energy, http://www.atlintl.com/DOE/teels/teel/teel_pdf.html, 

“Protective Action Criteria (PAC) with AEGLs, ERPGs and TEELS for Chemicals of 

Concern,” 2009. 

CFR, 1994 40 CFR 1910.119, “Process Safety Management of Highly Hazardous Chemicals,” U.S. 

Occupational Safety and Health Administration, 1996. 

CFR, 1996 20 CFR 1910.119, “Process Safety Management of Highly Hazardous Chemicals,” U.S. 

Occupational Safety and Health Administration, 1996. 

CFR, 2008a 10 CFR 40, “Domestic Licensing of Source Material,” 2008. 

CFR, 2009a 10 CFR 70.61, “Performance Requirements,” U.S. Nuclear Regulatory Commission, 

2009. 

CFR, 2009b 10 CFR 70.62, “Safety Program and Integrated Safety Analysis,” U.S. Nuclear 

 Regulatory Commission, 2009. 

CFR, 2009c 10 CFR 70.65, “Additional Content of Application,” U.S. Nuclear Regulatory 

 Commission,” 2009. 

CFR, 2009d 10 CFR 70.72, “Facility Changes and Change Process,” U.S. Nuclear Regulatory 

 Commission, 2009. 

CFR, 2009e 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

 Facilities,” U.S. Nuclear Regulatory Commission, 2009. 

CFR, 2009f 10 CFR 70, “Domestic Licensing of Special Nuclear Material,” U.S. Nuclear Regulatory 

 Commission, 2009. 

CFR, 2009g 10 CFR 20, “Standards for Protection Against Radiation,” U.S. Nuclear Regulatory 

 Commission, 2009. 

CFR, 2009h 29 CFR 1910.1200, “Toxic and Hazardous Substances,” U.S. Occupational Safety and 

 Health Administration, 2009. 

CFR, 2009i 10 CFR 70.4 definition of “Hazardous Chemicals Produced from Licensed Materials,” 

 2009 

DOE, 2002a U.S. Department of Energy, “Natural Phenomena Hazards Design and Evaluation 

Criteria for Department of Energy Facilities,” DOE Standard-1020-2002, 2002. 

DOE, 2002b U.S. Department of Energy, DOE Standard 1023-95, “Natural Phenomena Hazards 

Assesssments Criteria,” reaffirmed, 2002. 
LA-IFP-001 Revision B CHAPTER 3 November 29, 2011 

Page 3-43

EPRI, 1984 Kincaide, R.G., and Anderson J., EPRI/NP-3659, "Electric Power Research 

 Institute. Human Factors Guide for Nuclear Power Plant Control Room Development," 

 1984. 

IEEE, 2004 Institute of Electrical and Electronic Engineers, IEEE-1023. "IEEE Recommended 

 Practice for The Application of Human Factors Engineering to Systems, Equipment, and 

 Facilities of Nuclear Power Generating Stations and Other Nuclear Facilities," 2004. 

MIL-STD Military Standard: "Task Performance Analysis," 1991. 

-1478 

MIL-HDBK "Department of Defense Standard Practice: Human Engineering Requirements for 

-46855A Military Systems, Equipment and Facilities," 2011. 

 

NRC, 1983 NUREG/CR-3331, Pulliam, R., Price, H., Bongarra, J., Sawyer, C., and Kisner, R. (1983) 

 "A Methodology for Allocation of Nuclear Power Plant Control Functions to Human and 

 Automated Control," Washington, D.C., U.S. Nuclear Regulatory Commission, 1983. 

NRC, 1988 NUREG-1140, "A Regulatory Analysis on Emergency Preparedness for Fuel Cycle and 

 Other Radioactive Material Licensees," U.S. Nuclear Regulatory Commission, 1988. 

NRC, 1998 NUREG/CR-6410, "Nuclear Fuel Cycle Facility Accident Analysis Handbook," 1998. 

NRC, 2001 NUREG-1513, "Integrated Safety Analysis Guidance Document, U.S. Nuclear 

Regulatory Commission," 2001. 

NRC, 2002 NUREG-1520, "Standard Review Plan for the Review of a License Application for a 

Fuel Cycle Facility," U.S. Nuclear Regulatory Commission, 2002. 

NRC, 2002a U. S. Nuclear Regulatory Commission, NUREG-0700, "Human-System Interface Design 

 Review Guidelines," Revision 2, 2002. 

NRC, 2002b NUREG-1520, "Standard Review Plan for the Review of a License Application for a 

 Fuel Cycle Facility, Chapter 3, Appendix A, Example Procedure for Accident Sequence 

 Evaluation," 2002. 

NRC, 2004 U.S. Nuclear Regulatory Commission, NUREG-0711, "Human Factors Engineering 

 Program and Review Model," Revision 2, 2004. 

NRC, 2005 FCSS ISG-08, "Natural Phenomena Hazards," 2005. 

NRC, 2010 U.S. Nuclear Regulatory Commission, NUREG-1520. "Standard Review Plan for the 

 Review of a License Application for a Fuel Cycle Facility, Revision 1, Appendix E, 

 Human Factors Engineering for Personnel Activities," 2010.