PDF version

	
U.S. DEPARTMENT OF ENERGY			
Office of Nuclear Weapon Surety and Quality			DOE Manual 452.2-1


NUCLEAR EXPLOSIVE SAFETY MANUAL


1. PURPOSE.  This Department of Energy (DOE) Manual provides supplemental details to support the requirements of DOE O 452.2C, Nuclear Explosive Safety, dated 06-12-06.

2. CANCELLATIONS.  None.

3. APPLICABILITY.
a. Departmental Elements.  This Manual applies to all Departmental elements listed in DOE O 452.2C, Attachment 1 that are involved in performing, managing, overseeing, or directly supporting nuclear explosive operations (NEOs) or associated activities.
The Administrator of the National Nuclear Security Administration (NNSA) will assure that NNSA employees and contractors comply with their respective responsibilities under this Manual.

b. DOE Contractors.
(1) The Contractor Requirements Document (CRD) of DOE O 452.2C sets forth requirements of this Manual, if applicable.
(2) This CRD, attached to DOE O 452.2C, must be included in all contracts that involve performing, managing, overseeing, or directly supporting NEOs or associated activities.

c. Exclusions.  None.

4. SUMMARY.  This Manual is composed of five chapters that provide supplemental information to ensure adequate nuclear explosive safety for NEOs conducted by DOE, NNSA, and DOE/NNSA contractors.  These chapters address mandatory procedures and management processes.  Chapter I provides an introduction and assigns management responsibilities for the administration of this Manual.  Chapter II discusses two-person concept requirements.  Chapter III discusses electrical equipment requirements.  Chapters IV and V establish nuclear explosive-like assembly requirements and marking requirements.

5. CONTACT.  Questions concerning this Manual should be addressed to the Office of Nuclear Weapon Surety and Quality at 202-586-0377.


CHAPTER I.  INTRODUCTION AND RESPONSIBILITIES

1. INTRODUCTION.  The nuclear explosive safety (NES) supplemental information elaborated in this Manual establishes a formalized approach to ensuring the NES of all nuclear explosive operations (NEOs) conducted by the Department of Energy (DOE), including the National Nuclear Security Administration (NNSA), and DOE/NNSA contractors.

2. MANUAL ADMINISTRATION AND RESPONSIBILITIES.  The Director, Office of Nuclear Weapon Surety and Quality, is responsible for updating and maintaining this Manual.


CHAPTER II.  TWO-PERSON CONCEPT

1. BASIC REQUIREMENTS.  The two-person concept is implemented to ensure no lone individual has unrestricted access to a nuclear explosive.  Site offices may also require two-person concept protection for other operations.
Each person on a two-person concept team must-

a. be certified in the Human Reliability Program,
b. have authorized access to the nuclear explosive area (NEA),
c. have technical knowledge of the task being performed,
d. be knowledgeable of pertinent safety and security requirements, and
e. be in a position to detect incorrect or unauthorized acts and take appropriate action.

2. IMPLEMENTATION OPTIONS.  The two-person concept may be implemented using either person-to-person coverage or zone coverage.

a. Person-to-Person Coverage.  Person-to-person coverage is the more stringent form of the two-person concept.  Person-to-person coverage is designed to protect configurations that are particularly vulnerable to inadvertent acts (errors of omission or commission) or deliberate unauthorized acts.  Configurations requiring person-to-person coverage include the following.
(1) Exposed conventional high explosive (CHE) main charge in an NEA.
(2) Main charge high explosives (HEs) [both CHE and insensitive HE (IHE)] with accessible detonator cable assemblies in an NEA.
(3) Nuclear explosives connected to Category 1 electrical equipment.  (Category 1 electrical equipment is described in Chapter III, paragraph 2, of this Manual.)

b. Zone Coverage.  Zone coverage is designed to protect configurations that do not require person-to-person coverage.  Zone coverage requires a two-person concept team in an NEA when a nuclear explosive is not protected by a dual-lock system or other NES-approved security system.

3. APPLICATION OF PERSON-TO-PERSON COVERAGE.  Configurations requiring person-to-person coverage must be determined based on specific system characteristics.  The application of person-to-person coverage allows recognition of the protection provided by design safety features (such as IHE, coded-signal-controlled detonators, and unique-signal-operated strong-link devices) and physical protection (such as closed shipping and storage containers and specially designed covers).

a. Assembly/Disassembly Operations Involving Conventional High Explosive.
(1) For assembly operations involving CHE main charge, person-to-person coverage of the CHE components must begin when the CHE container is opened in an NEA.
(2) Coverage continues until the nuclear explosive is in a configuration in which the application of design-specific environmental stimuli or unique or coded signals is necessary for nuclear detonation or detonation of the main charge HE.
(3) For disassembly operations, this requirement applies in reverse.

b. Assembly/Disassembly Operations Involving Insensitive High Explosive.
(1) For assembly operations involving IHE main charge, person-to-person coverage must be provided for main charge components located in an NEA, and assemblies containing these components, that have accessible detonator cables attached.
(2) Coverage continues until the nuclear explosive is in a configuration in which the application of design-specified environmental stimuli or unique or coded signals is necessary for nuclear detonation or detonation of the main charge HE.
(3) For disassembly operations this requirement applies in reverse.
For purposes of person-to-person coverage, systems with installed and unactuated (safe/reset) mechanical safe and arm devices are not considered to have accessible detonator cables.  Configurations with physical protection that precludes immediate and unrestricted access to the configuration by a lone individual are not considered to be exposed.  When such physical protection is in place, zone coverage provides adequate protection for configurations that would otherwise require person-to-person coverage.

4. PERSON-TO-PERSON COVERAGE REQUIREMENTS.  When a configuration requires person-to-person coverage, a qualified two-person concept team must be either working on or observing the configuration.  Specific person-to-person coverage requirements are as follows.
a. No lone individual must be allowed within the immediate vicinity (approximately 6 feet) of a configuration that requires person-to-person coverage.
b. The two people providing person-to-person coverage must each be responsible for the safe conduct of the operations.

c. During the performance of operations on a configuration requiring person-to-person coverage-
(1) the two-person concept team must be in the immediate vicinity of the configuration;
(2) each person on the two-person concept team must observe all operations, ensure that only authorized operations are performed, and ensure that operations are performed correctly; and
(3) a reader-worker process that includes the following must be incorporated.
(a) The procedure must be read aloud, the operation must be performed, and the completion of the operation must be documented in the stated sequence.
(b) One of the two people performing the operation may read the procedure aloud to the other person provided that both people can move away from the immediate vicinity of the configuration while the reading is accomplished.
(c) If both people cannot move away from the immediate vicinity of the configuration while the reading is accomplished, then a third person must read the procedure aloud to the other people.

d. When operations are not being performed on a configuration requiring person-to-person coverage-
(1) the two-person concept team must be in the immediate vicinity of the configuration when another individual is in the immediate vicinity of the configuration;
(2) the two-person concept team is not required to be in the immediate vicinity of the configuration when other individuals are not in the immediate vicinity of the configuration.  However, team members must remain in a position to directly observe the approach of any individual to the configuration.

e. Only one configuration requiring person-to-person coverage is allowed in a vacated bay or cell.  This requirement does not apply to emergency evacuations.

CHAPTER III.  ELECTRICAL EQUIPMENT

1. BASIC REQUIREMENTS.  For purposes of defining electrical equipment requirements, this Manual categorizes electrical equipment used in NEAs as Category 1, Category 2, or Category 3.  Electrical equipment categorization is intended to ensure that controls are implemented commensurate with the various levels of potential electrical threat.

2. CATEGORY 1 ELECTRICAL EQUIPMENT.  Electrical equipment intended for connection to an electrical circuit of a nuclear explosive or HE subassembly is referred to as "Category 1 electrical equipment."  Category 1 electrical equipment must meet the following minimum requirements.

a. General Requirements.
(1) Category 1 electrical equipment must use the lowest practical values of internal and output currents and voltages.
(2) Category 1 electrical equipment must not apply unacceptable stimuli as the result of a single-point failure.
(3) Each item of Category 1 electrical equipment must have safety characteristics independent of the nuclear explosive's safety features.
(4) Each item of Category 1 electrical equipment and its interface with a nuclear explosive require the performance and documentation of a comprehensive safety analysis, including consideration of relevant abnormal environments.

(5) Each drawing issue of Category 1 electrical equipment and its interface with a nuclear explosive requires a completed NES evaluation.
(6) Computer-controlled Category 1 electrical equipment must have controls that preclude inadvertent or unauthorized actuation of NES critical components (e.g., strong-link switches).
(7) Software for computer-controlled Category 1 electrical equipment that could affect the state of components essential to NES must be identified as NES critical software.  NES critical software must be evaluated for designation as safety software (See DOE O 414.1C, Quality Assurance, dated 6-17-05). 
(8) NES critical software must be subjected to an independent vulnerability analysis.

(9) Accepted or reaccepted NES critical software must be protected by a two-person concept team.
(10) Procedures must be established to operate, control, calibrate, maintain, and store Category 1 electrical equipment.
(11) A record of approved Category 1 electrical equipment must be established and maintained.
(12) Category 1 electrical equipment must have a safety requirements document that identifies the safety features.

b. Two-Person Control.  Calibration and maintenance of Category 1 electrical equipment require protection by a two-person concept team.
(1) Person-to-person coverage is required during calibration and all operations that afford internal access to Category 1 electrical equipment and associated cables and adapters.
(2) Zone coverage is required for fully assembled Category 1 electrical equipment and associated cables and adapters when that equipment is not protected by a dual-lock system or other NES-approved security system.

3. CATEGORY 2 ELECTRICAL EQUIPMENT.  Electrical equipment that is not intended for connection to an electrical circuit of a nuclear explosive or HE subassembly but makes mechanical connection to, or could come in contact with, a nuclear explosive or HE subassembly is referred to as "Category 2 electrical equipment."  Category 2 electrical equipment must be clearly identified and meet the following minimum requirements.
a. General Requirements.
(1) Category 2 electrical equipment must not be connected to the electrical circuitry of a nuclear explosive.
(2) Category 2 electrical equipment must be positioned in a manner to preclude contact with a nuclear explosive except when a mechanical connection is required to perform its intended and authorized function.
(3) The potential for inadvertent connection between the Category 2 electrical equipment and the nuclear explosive circuitry must be minimized.

b. Positive Electrical Isolation.  Positive electrical isolation must be established and demonstrated for Category 2 electrical equipment and its mechanical connection to a nuclear explosive.  Electrical isolation must account for both normal and credible abnormal conditions (such as equipment faults or lightning strikes).  The electrical isolation scheme used must be clearly identified and documented using one of the following subcategories, listed in priority order.

(1) Path-on isolation reducing leakage or fault current, from electrical energy sources associated with the equipment, to a defined safe value.  This must be verified annually.
(2) Path-off isolation reducing leakage or fault current, from electrical energy sources associated with the equipment, to a defined safe value.  This must be verified annually.
(3) An electrical isolation scheme requiring at least two independent failures before exposing the nuclear explosive to unacceptable leakage or fault current from electrical energy sources associated with the equipment.  Each failure mechanism must be identified.

c. Records.  A record of approved Category 2 electrical equipment must be established and maintained.

4. CATEGORY 3 ELECTRICAL EQUIPMENT.  Moveable and facility electrical equipment used in an NEA that is not intended for connection to an electrical circuit of a nuclear explosive or HE subassembly and does not make mechanical connection to, and cannot come in contact with, a nuclear explosive or HE subassembly is referred to as "Category 3 electrical equipment."

5. CHANGE CONTROL.  Proposed changes to electrical equipment, procedures, and interfaces with a nuclear explosive are subject to the NEO change control process required by DOE O 452.2C, paragraph 4b(4).


CHAPTER IV.  NUCLEAR EXPLOSIVE-LIKE ASSEMBLY (NELA) REQUIREMENTS
The following requirements support the NELA standards defined in DOE O 452.2C.

1. NUCLEAR EXPLOSIVE-LIKE ASSEMBLY DEFINITION.  An assembly with components representing the main charge HE and pit that has the potential for component substitution resulting in accidental, inadvertent, or deliberate unauthorized assembly or transfer of a nuclear explosive may be considered a NELA.

a. A NELA represents a nuclear explosive in the U.S. nuclear weapons program, including assemblies for development, testing, training, or other purposes.
b. A NELA contains one of the following.
(1) Mock HE and high-fidelity dummy pit-referred to as an "Inert NELA."
(2) Live HE and high-fidelity dummy pit-referred to as a "High Explosive NELA."
(3) Mock HE and live pit-referred to as an "Inert-with-Live-Pit NELA."

2. ASSEMBLY/DISASSEMBLY OF NUCLEAR EXPLOSIVE-LIKE ASSEMBLIES.  NELAs must not be assembled or disassembled in close proximity to nuclear explosives where components may be interchanged.  A two-person concept team is required to perform all assembly/disassembly operations on Inert-with-Live-Pit NELAs.

3. VERIFICATION OF NUCLEAR EXPLOSIVE-LIKE ASSEMBLY COMPONENTS BEFORE ASSEMBLY.

a. Inert Nuclear Explosive-Like Assemblies.  Repeated compliance with the verification requirements of this section is not necessary for repeated disassembly and reassembly training operations provided the mock HE and high-fidelity dummy pit remain in a training area where main charge HE and live pits are not authorized.

(1) Mock High Explosive Verification Requirements.
(a) All mock HE used in place of live main charge HE must be nondetonable and must be clear or colored pink.  Where possible, preference must be given to noncombustible formulations.  Live main charge HE must not be colored pink.
(b) Pink mock HE used in place of live main charge HE must be chemically verified before assembling the NELA.  Clear mock HE refers to LEXAN or similar inert substances and does not require chemical verification.
(c) An auditable record of chemical verification of the mock HE must be available.

(2) High-Fidelity Dummy Pit Verification Requirements.
(a) The pit must be verified by radiation detection means before assembly into an Inert NELA to verify the absence of radioactive material.  If radiation is detected, the pit must be assayed by using gamma spectrometry/multichannel analyzer to verify the absence of fissile material.  This verification must be either performed or observed using person-to-person coverage.
(b) After dummy pit verification, the pit must be controlled until the pit is assembled into the basic NELA configuration or until the pit is delivered into an assembly area where live pits are not authorized.  This control must be achieved by a two-person concept team or a dual-lock or other NES-approved security system.
(c) An auditable record of radiation detection verification of the high-fidelity dummy pit must be available.

b. High Explosive Nuclear Explosive-Like Assemblies.  High Explosive NELAs and Inert-with-Live-Pit NELAs must not be assembled or disassembled in close proximity where components may be interchanged.

(1) High-Fidelity Dummy Pit Verification Requirements.
(a) The pit must be verified by radiation detection means before assembly into a High Explosive NELA to verify the absence of radioactive material.  If radiation is detected, the pit must be assayed by using gamma spectrometry/multichannel analyzer to verify the absence of fissile material.  This verification must be either performed or observed using person-to-person coverage.
(b) After dummy pit verification, the pit must be controlled until the pit is assembled into the basic NELA configuration.  This control must be achieved by a two-person concept team or a dual-lock or other NES-approved security system.
(c) An auditable record of radiation detection verification of the high-fidelity dummy pit must be available.

(2) Main Charge High Explosive Introduction Sequence.  The high-fidelity dummy pit verification must be accomplished before introduction of the main charge HE and dummy pit into the same immediate assembly area of the High Explosive NELA.

c. Inert-with-Live-Pit Nuclear Explosive-Like Assemblies.  Inert-with-Live-Pit NELAs and High Explosive NELAs must not be assembled or disassembled in close proximity where components may be interchanged.

(1) Mock High Explosive Verification Requirements.
(a) All mock HE used in place of live main charge HE must be nondetonable and must be clear or colored pink.  Where possible, preference must be given to noncombustible formulations.  Live main charge HE must not be colored pink.
(b) Pink mock HE used in place of live main charge HE must be chemically verified before assembling the NELA.  Clear mock HE refers to LEXAN or similar inert substance and does not require chemical verification.
(c) An auditable record of chemical verification of the mock HE must be available.

(2) Mock High Explosive Two-Person Concept Verification Requirements.
(a) In addition to the mock HE verification requirements, another chemical verification of all mock HE used in place of live main charge HE must be accomplished before assembly into an Inert-with-Live-Pit NELA.  This verification must be either performed or observed using person-to-person coverage.
(b) After the mock HE two-person concept verification, the mock HE must be controlled until the mock HE is assembled into the basic NELA configuration.  This control must be achieved by a two-person concept team or a dual-lock or other NES-approved security system.
(c) An auditable record of two-person concept chemical verification of the mock HE must be available.

(3) Live Pit Introduction Sequence.  The mock HE verifications required by 3c(1) and 3c(2) must be accomplished before introduction of the live pit and mock HE into the same immediate assembly area of the Inert-with-Live-Pit NELA.

4. OFFSITE TRANSPORTATION OF NUCLEAR EXPLOSIVE-LIKE ASSEMBLIES.  A configuration assembled as an Inert-with-Live-Pit NELA must not be transferred to the custody of the Department of Defense.

a. Identification Requirements.  NELAs that are shipped between DOE sites must be identified externally (e.g., stencil or tag) with the following information.
(1) NELA contents identified as one of the following.
(a) Inert NELA.
(b) High Explosive NELA.
(c) Inert-with-Live-Pit NELA.

(2) Name and agency of responsible person at the shipping location.

(3) Name and agency of person who authorized the shipment at the receiving location.

b. Permission to Ship Between DOE Agencies.  The shipping agency must obtain permission from the receiving agency to ship before shipment of a NELA.

c. Nuclear Explosive-Like Assembly Survey Before Transfer.
(1) Before offsite transfer of a NELA, the NELA must be surveyed in its shipping configuration by a radiation detection means to verify the absence or presence of fissile material.  Anomalies or ambiguities detected by radiation detection means must be resolved before shipment.
(2) An auditable record of this survey must be available.

d. Nuclear Explosive-Like Assembly Survey Upon Receipt.
(1) Upon receipt of a NELA, the NELA must be surveyed in its shipping configuration by a radiation detection means to verify the absence or presence of fissile material.  Anomalies or ambiguities detected by radiation detection means must be resolved before release.
(2) An auditable record of this survey must be available.

(1) 
CHAPTER V.  MARKING REQUIREMENTS
Nuclear explosives and NELAs must be permanently marked in accordance with the following requirements.  Additional markings such as serial numbers and configuration identification may also be required by design agencies.

1. PERMANENT MARKING LEGENDS.
a. Nuclear Explosives.  A "NUCLEAR" permanent marking legend must be applied to nuclear explosives (i.e., units containing a live pit and an HE main charge).
b. Nuclear Explosive-Like Assemblies.
(1) Inert Nuclear Explosive-Like Assemblies.  The "INERT" permanent marking is applied to a NELA containing mock HE or void in place of the live main charge HE and a dummy pit or void.
Using the permanent marking "INERT" does not preclude the presence of materials that may present a hazard to personnel.
(2) High Explosive Nuclear Explosive-Like Assemblies.  The "HIGH EXPLOSIVE" permanent marking is applied to a NELA containing live main charge HE and a dummy pit or void.
(3) Inert-with-Live-Pit Nuclear Explosive-Like Assemblies.  The "INERT-WITH-LIVE-PIT" permanent marking is applied to a NELA containing mock HE, in place of the live main charge HE, and a live pit.
Using the permanent marking "INERT-WITH-LIVE-PIT" does not preclude the presence of materials that may present a hazard to personnel.

2. PERMANENT MARKING LOCATION.  Nuclear explosives and NELAs must be permanently marked on an external surface.
a. The permanent marking must be on a part that encloses the live main charge or mock HE.
b. The marking location must be specified by the applicable design agency.

3. PERMANENT MARKINGS.  Nuclear explosives and NELAs must be marked in accordance with the following requirements.  The particular marking method must be specified by the applicable design agency.
a. The permanent marking method must produce the most durable mark possible, consistent with acceptable deleterious effect on the material to which the marking is applied.
(1) The preferred marking methods are mechanical engraving (with or without fill) and impression-die stamping.
(2) Other acceptable methods are impression freehand, impression sandblast, and surface conversion.
b. The preferred marking size is 1/4-inch characters with 1/4-inch spacing between lines, if space permits.

4. PERMANENT MARKING OBLITERATION.  When a nuclear explosive or NELA is altered or disassembled to the point that its permanent marking is no longer valid, the permanent marking must be obliterated in accordance with the following requirements.
a. Methodology.
(1) The preferred method of obliteration is overprinting the letter "X" on each letter of the permanent marking legend using the same permanent marking method as that used to apply the original marking.  
(2) If obliteration by overprinting is not feasible for technical reasons, the permanent marking must be removed using a method specified by the applicable design agency.

b. Authentication.  All obliterated permanent markings must be immediately authenticated with the DOE authentication stamp.
	-Obliterated permanent markings on components that will be scrapped need not be authenticated.

c. Components That Will Be Reassembled.  Permanent marking need not be obliterated on marked components that will be reassembled into the same configuration in accordance with the following requirements.
(1) General Requirements.
(a) After the marked component is removed, the disassembled components must be controlled until the disassembled components and marked component are reassembled into the same configuration.
(b) Control must be achieved by a two-person concept team or a dual-lock or other NES-approved security system.

(2) Nuclear Explosives.  Nuclear explosive components must not be assembled or disassembled in close proximity to NELAs, where components may be interchanged.

(3) Nuclear Explosive-Like Assemblies.  NELAs must not be assembled or disassembled in close proximity to nuclear explosives, where components may be interchanged.
(a) Inert Nuclear Explosive-Like Assemblies.  Inert NELAs must not be assembled or disassembled in close proximity to High Explosive or Inert-with-Live-Pit NELAs, where components may be interchanged.
(b) High Explosive Nuclear Explosive-Like Assemblies.  High Explosive NELAs must not be assembled or disassembled in close proximity to Inert or Inert-with-Live-Pit NELAs, where components may be interchanged.
(c) Inert-with-Live-Pit Nuclear Explosive-Like Assemblies.  Inert-with-Live-Pit NELAs must not be assembled or disassembled in close proximity to High Explosive or Inert NELAs, where components may be interchanged.

5. DOE AUTHENTICATION STAMP.  DOE authentication stamps must be designed and controlled in accordance with the following requirements.
a. Design of the DOE authentication stamp must be approved by NNSA.
b. DOE authentication stamp drawings and associated tooling must be administratively controlled by the Surety Assessment Center, Sandia National Laboratories, New Mexico.
c. NNSA-Service Center/Nuclear Explosive Safety Division must coordinate DOE authentication stamp distribution.
d. After the DOE authentication stamp is fabricated, the authentication stamp must be controlled.  Agencies receiving authentication stamps must establish controls to preclude their unauthorized use.