DOE G 423.1-1A, Implementation Guide for Use in Developing Technical Safety Requirements

DOE G 423.1-1A 11-3-2010 IMPLEMENTATION GUIDE FOR USE IN DEVELOPING TECHNICAL SAFETY REQUIREMENTS [This Guide describes acceptable, non-mandatory means for meeting requirements. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with associated rules or directives.] U.S. DEPARTMENT OF ENERGY Office of Health, Safety and Security NOT MEASUREMENT SENSITIVE DOE G 423.1-1A i (and ii) 11-3-2010 FOREWORD This Guide is approved for use by all Department of Energy (DOE) and National Nuclear Security Administration (NNSA) components and contractors. Throughout this Guide the use of the term DOE includes DOE and NNSA. Beneficial comments (recommendations, additions, deletions, and any pertinent data) that may improve this document should be sent to— Michael Hillman HS-21 U.S. Department of Energy Washington, D.C. 20585 Phone (301) 903-3568 DOE Implementation Guides are part of the DOE Directives System and are issued to provide supplemental information regarding the Department’s expectations of its requirements as contained in rules, Orders, Notices, and regulatory standards. Implementation Guides also provide acceptable methods for implementing these requirements. This Guide was developed in support of Subpart B of 10 Code of Federal Regulation (CFR) 830, Safety Basis Requirements, and provides guidance in meeting the provisions for Technical Safety Requirements defined in 10 CFR 830.205. This Guide does not establish or invoke any new requirements. DOE G 423.1-1 iii 11-3-2010 CONTENTS 1.  INTRODUCTION..............................................................................................................1  2.  APPLICATION..................................................................................................................1  3.  GENERAL INFORMATION ...........................................................................................2  4.  TECHNICAL SAFETY REQUIREMENTS GUIDANCE ............................................3  4.1  Technical Safety Requirement Users .......................................................................4  4.2  Derivation of 10 CFR Part 830.205 Technical Safety Requirements ......................4  4.3  Technical Safety Requirement Minimization ..........................................................4  4.4  Conditions Outside Technical Safety Requirements ...............................................5  4.5  Administrative Control of Technical Safety Requirements .....................................5  4.6  Public Safety ............................................................................................................5  4.7  Worker Safety ..........................................................................................................5  4.8  Technical Safety Requirement Organization ...........................................................6  4.9  Size and Complexity of Technical Safety Requirements ........................................6  4.10  Technical Safety Requirement Elements .................................................................6  4.10.1  Technical Safety Requirement Limits .........................................................7  4.10.2  Action Statements ........................................................................................9  4.10.3  Operability ...................................................................................................9  4.10.4  Allowable Outage Times ...........................................................................10  4.10.5  Fire Protection; Heating, Ventilating, and Air-Conditioning; and Natural

Phenomena Hazards Controls ..........................................................10  4.10.6  Surveillance Requirements ........................................................................11  4.10.7  Administrative Controls .............................................................................11  4.11  Violation of Technical Safety Requirements .........................................................12  4.12  Technical Safety Requirement Format ..................................................................13  4.13  Criticality Technical Safety Requirements ............................................................13  4.14  Technical Safety Requirements for Transportation ...............................................14  4.15  Safety Structures, Systems, and Components ........................................................15  4.16  Design Features ......................................................................................................15  4.17  Graded Approach ...................................................................................................16  4.18  Technical Safety Requirements Bases Appendix ..................................................16  4.18.1  Background ................................................................................................17  4.18.2  Applicable Safety Analysis ........................................................................17  4.18.3  Safety and Operating Limits ......................................................................17  4.18.4  Mode Applicability ....................................................................................17  4.18.5  Action Statements ......................................................................................18  4.18.6  Surveillance Requirements ........................................................................18  4.18.7  References ..................................................................................................18  4.19  Review and Audits .................................................................................................18  4.20  Reporting Requirements ........................................................................................19  iv DOE G 423.1-1A 11-3-2010 4.21  Implementation Verification Reviews (IVR) of Safety Basis Controls .................19  5.  ACCEPTABLE METHODS ...........................................................................................19  5.1  Organization ...........................................................................................................20  5.1.1  Front Matter .......................................................................................................20  5.1.2  Arrangement of Sections ....................................................................................20  5.1.3  Appendices .........................................................................................................21  5.2  Content 21  5.2.1  Section 1—Use and Application ........................................................................21  5.2.2  Section 2—Safety Limits ...................................................................................23  5.2.3  Section 3/4—Limiting Control Settings, Limiting Conditions for Operation,

and Surveillance Requirements .......................................................24  5.2.4  Section 5—Administrative Controls ..................................................................27  5.2.5  Section 6—Design Features ...............................................................................29  5.2.6  Bases Appendix .................................................................................................29  5.3  Format ....................................................................................................................30  5.3.1  Numbering of Pages, Sections, Tables, and Figures ..........................................30  5.3.2  Page Headings ....................................................................................................34  5.3.3  Continuation Pages ............................................................................................34  5.3.4  Highlighting .......................................................................................................35  5.3.5  Use of Logic Terms (AND, OR, IF, BUT, etc.) ................................................36  5.3.6  Notes and Cautions ............................................................................................36  5.3.7  Tables ...............................................................................................................36  5.3.8  Body of Section 1—Use and Application ..........................................................37  5.3.9  Body of Section 2—Safety Limits .....................................................................37  5.3.10  Body of Section 3/4—Limiting Control Settings, Limiting Conditions for Operation, and Surveillance Requirements .....................................37  5.3.11  Body of Sections 5 and 6—Administrative Controls and Design Features38  5.3.12  Body of Bases Appendix ...........................................................................38  5.4  Changes to Technical Safety Requirements ..........................................................38  APPENDIX A - TECHNICAL SAFETY REQUIREMENTS WRITER’S GUIDE .......... A-1  APPENDIX B - CONVERSION OF TECHNICAL SPECIFICATIONS/OPERATIONAL SAFETY REQUIREMENTS TO TECHNICAL SAFETY REQUIREMENTS .............................................................................................B-1  APPENDIX C - TECHNICAL SAFETY REQUIREMENT CONSIDERATIONS FOR NUCLEAR EXPLOSIVE OPERATIONS, INCLUDING TRANSPORTATION ....................................................................................... C-1  APPENDIX D - PERFORMANCE OF IMPLEMENTATION VERIFICATION REVIEWS (IVRs) OF SAFETY BASIS CONTROLS .................................. D-1  DOE G 423.1-1A 1 11-3-2010 1. INTRODUCTION 10 Code of Federal Regulation (CFR) 830.205 of the Nuclear Safety Management Rule requires Department of Energy (DOE) contractors responsible for Hazard Category 1, 2, and 3 DOE nuclear facilities to develop Technical Safety Requirements (TSRs). These TSRs identify the limitations to each DOE-owned, contractor-operated nuclear facility based on the documented safety analysis (DSA) and any additional safety requirements established for the facility. Although not required by the 830 rule, there also may be a need to establish TSRs for safe operation of radiological facilities. The TSR rule requires contractors to prepare and submit TSRs for DOE approval. This Guide provides guidance in identifying important safety parameters and developing the content for the TSRs that are required by 10 CFR 830.205.

Appendix A to Subpart B of the Nuclear Safety Management Rule specifies the types of safety limits (SLs), operating limits (OLs), surveillance requirements (SRs), and administrative controls (ACs) that define the safety envelope necessary to protect the health and safety of the public and workers. The TSR derivation chapter in the DSA is the key component that provides the basis for TSRs. This Guide provides elaboration for the content of TSRs. In providing this guidance, it is recognized that the diversity of DOE facilities may necessitate varying degrees of emphasis to be placed on some of the TSR Sections, but the following guidance is intended to be generally applicable. 2. APPLICATION The information contained in this Guide is intended for use by all Department elements, including the National Nuclear Security Administration (NNSA), and all contractors for DOE- owned or DOE-leased, Hazard Category 1, 2, or 3 nuclear facilities or nuclear operations. This Guide does not apply to (a) activities that are regulated through a license by the Nuclear Regulatory Commission (NRC) or a State under an agreement with the NRC, including activities certified by the NRC under section 1701 of the Atomic Energy Act of 1954, as amended (Act); (b) activities conducted under the authority of the Director, Naval Nuclear Propulsion, pursuant to Executive Order 12344, codified at Title 50 United States Code sections 2406 and 2511; (c) transportation activities that are regulated by the Department of Transportation (DOT); (d) activities conducted under the Nuclear Waste Policy Act of 1982, as amended, and any facility identified under section 202(5) of the Energy Reorganization Act of 1974, as amended; and (e) activities related to the launch approval and actual launch of nuclear energy systems into space. This Implementation Guide provides two different formats that are effective in highlighting the important features of TSRs. The older format is described in the attachment to DOE 5480.22, Technical Safety Requirements, dated 2-25-92. This directive was superseded by 10 CFR Part 830 and canceled by DOE Notice 251.42. The newer format, based on the NRC Tech Spec Improvement Program (TSIP), is designed to aid the use of the operations information by the operators. However, neither the older format nor the new TSIP format is required. Other 2 DOE G 423.1-1A 11-3-2010 formats may be used as long as they meet the content expectations of Appendix A to Subpart B of the Nuclear Safety Management Rule. A contractor for an environmental restoration activity may follow the provisions of 29 CFR 1910.120 or 1926.65 for construction activities (see 10 CFR 830, Table 2 of Appendix A to Subpart B) to develop the appropriate hazard controls (rather than this TSR guidance) provided the activity involves either (1) work not done within a permanent structure or (2) the decommissioning of a facility with only low-level residual fixed radioactivity. Implicit in this guidance is an understanding that reasonable efforts to remove radioactive systems, components, and stored materials have been completed and that the work does not prudently require the use of active safety systems or components designed to prevent or mitigate the accidental release of hazardous radioactive materials. DOE-STD-1120-2005, Integration of Environment, Safety, and Health Into Facility Disposition Activities also provides guidance that must be considered in the development of TSRs. Appendix D to this Guide provides guidance on performance of Implementation Verification Reviews (IVR) of Safety Basis Controls.

3. GENERAL INFORMATION DOE requires a DSA of its nuclear facilities, TSRs, and facility-specific commitments made to comply with DOE rules, Orders, and policies as the principal safety bases for decisions to authorize the design, construction, or operation of Hazard Category 1, 2, and 3 nuclear facilities. The approved DSA and TSRs, the safety evaluation report (SER), and facility- specific commitments made to comply with DOE nuclear safety requirements constitute the nuclear Safety Basis and facility authorization from DOE for the contractor to operate the facility. The safety requirements of 10 CFR 830.205 apply to all safety hazards for Hazard Category 1, 2, and 3 nuclear facilities and operations. Broad application of Section 830.205 to all hazards should ensure comprehensive risk management of all nuclear operations. Nonreactor nuclear facilities may develop a TSR document for an entire facility or the facility may be divided according to process, with a separate segment of the TSR generated for each process. In any case, every portion of the facility that contains category 1, 2, or 3 quantities of material should be covered by the TSR. When a facility uses segmented TSRs, careful attention should be given to those systems, such as the building heating, ventilating, and air- conditioning (HVAC) that perform a safety function common to multiple processes. The multiple sets of TSRs must be developed based on the identified system interactions, and ACTION statements from one set should not be in conflict with safety of the other operations. Contractors, in the preparation of DSAs, identify how the safety requirements of the Nuclear Safety Management Rule apply to a specific facility, and describe how the contractor undertakes to design, build, and operate the facility to be in conformance with the applicable statutes, DOE rules, and Directives to ensure facility safety. The analysis of operations and accidents defines the limits of safe operations, identifies the required performance of safety class and safety significant structures systems and components (SSCs), and describes any ACs or procedures that are necessary to meet the specific safety criteria for the facility. These limiting parameters are described in the DSA under “Derivation of Technical Safety DOE G 423.1-1A 3 11-3-2010 Requirements” and provide the principal bases for the TSRs required by 10 CFR 830.205. The Department reviews the TSRs and decides whether or not to approve the TSRs as part of the nuclear Safety Basis for the facility. Facility operation is required to be in compliance with the Safety Basis established and described in the approved DSA and the operating conditions and limitations contained in the TSRs. The TSR document is a controlled document and should be maintained with an authorized users list and is maintained under change control. The users list should be defined in the TSR and should include operations and support personnel, as necessary, and the DOE approval authority.

DOE Order (O) 460.1C, Packaging and Transportation Safety, dated 5-14-2010, or successor documents, and its companion Guide, DOE Guide (G) 460.1-1, Implementation Guide for Use with DOE O 460.1A, Packaging and Transportation Safety, dated 6-5-97, provide requirements and guidance for safe management of transportation activities associated with shipments of DOE-regulated hazardous materials not of national security interest. DOE O 460.1-1A, Packaging and Transfer or Transportation of Materials of National Security Interest, dated 4- 26-04, or successor documents, and DOE Manual (M) 461.1-1Admin Chg 1, Packaging and Transfer of Materials of National Security Interest Manual, dated 9-29-00, provide requirements and guidance for safe management of transportation activities associated with shipments of materials of national security interest. The requirements and guidance in these documents support the identification of the hazard controls that are necessary for the safe management of the transportation activities. These controls should address all activities associated with packaging and transporting the material from one location to another. 4. TECHNICAL SAFETY REQUIREMENTS GUIDANCE TSRs define the performance requirements of SSCs and identify the safety management programs used by personnel to ensure safety. TSRs are aimed at confirming the ability of the SSCs and personnel to perform their intended safety functions under normal, abnormal, and accident conditions. These requirements are identified through hazard analysis of the activities to be performed and identification of the potential sources of safety issues. Safety analyses to identify and analyze a set of bounding accidents that take into account all potential causes of releases of radioactivity also contribute to development of TSRs. Through analyses of the encompassing bounding accidents, the necessary safety systems and accident mitigating systems are identified and their characteristics are defined. Flowing from the analyses is information that provides the bases for controls, limits, and conditions for operation, known as TSRs. TSRs explicitly show this relationship. The content of the DSA must remain valid so that the Safety Basis of the facility, as implemented in operations through the TSR, remains valid. Therefore, there is a commitment to the process of unreviewed safety questions (USQs) regarding any proposed change to the facility or its operations as described in the DSA. Likewise, all changes to the TSR bases presented in the DSA (e.g., when the DSA annual update is performed) should be incorporated into the TSRs to ensure the information contained therein reflects the current Safety Basis of the facility. Any proposed revision to a TSR should be examined to ensure the basis for the change is supported in the DSA. The TSR rule requires that such revisions be submitted to DOE for 4 DOE G 423.1-1A 11-3-2010 review with the basis for the proposed change. The change to the TSR must be approved by DOE before it is implemented. 4.1 Technical Safety Requirement Users The prime users of TSRs are the facility operations personnel. They use TSRs to ensure the safety commitments identified in the DSA are observed in day-to-day operations. TSRs are also used by facility support staff who are responsible for developing and implementing procedures and training programs. TSRs play a key role in safety oversight for both the contractor and DOE. They provide the clear definition of the safety envelope imposed on the facility operations.

4.2 Derivation of 10 CFR 830.205 Technical Safety Requirements The DSA required by 10 CFR 830.204 furnishes the technical basis for TSRs. For some facilities, other documentation such as the SER may provide additional safety controls or operating restrictions that should be reflected in the TSRs. The TSR derivation section in the DSA is intended to provide a link between the safety analysis and the list of variables, systems, components, equipment, and administrative procedures that must be controlled or limited in some way to ensure safety. For existing facilities that have neither a DOE-approved DSA, nor DOE-approved technical specifications (TSs)/operational safety requirements (OSRs), the schedule for developing the TSR should be coordinated with the DSA upgrade so that the TSR will reflect the DOE- approved DSA. In areas for which the DSA does not directly supply all of the input for the TSR (e.g., surveillance frequencies and acceptance criteria), national and international codes, standards, and guides should be used wherever possible. Where no code, standard, or guide is applicable, other documents (e.g., reliability analyses, failure modes and effects analyses, manufacturer documentation, information from operating history, or engineering judgment) may provide the basis. 4.3 Technical Safety Requirement Minimization The process of developing a set of control parameters from the safety analyses does not necessarily lead to a minimum set of TSRs, particularly when the accident analysis has generated a large number of contributing sequences. However, there is great incentive in terms of operational flexibility and ease of use by operators to reduce the TSRs to the smallest number that will satisfy the safety criteria established for the facility. This task has never been simple and will continue to challenge even experienced professionals. Both the writers of the TSRs and the accident analyst should work together to ensure the TSRs represent the set of controls that are necessary to describe the bounds of safe operation. DOE G 423.1-1A 5 11-3-2010 4.4 Conditions Outside Technical Safety Requirements In an emergency, if a situation develops that is not addressed by the TSR, site personnel are expected to use their training and expertise to take actions to correct or mitigate the situation. Also, site personnel may take actions that depart from the requirements of a TSR provided (a) an emergency situation exists; (b) these actions are needed immediately to protect workers, the public, or the environment from imminent and significant harm; and (c) no action consistent with the TSR is immediately apparent. Such action must be approved by a certified operator for reactor facilities or by a person in authority as designated in the TSRs for nonreactor nuclear facilities. (The designation of the person or persons should be done with their job title.) If emergency action is taken, both a verbal notification should be made to the responsible head of the field element and a written report made to the Cognizant Secretarial Officer (CSO) within 24 hours. 4.5 Administrative Control of Technical Safety Requirements The facility must be operated in accordance with the provisions of a DOE-approved TSR. To ensure this is the case, the TSR and its appendices must be an administratively controlled document so that only current copies of the DOE-approved TSR are used for operation of the facility. Making the TSR controlled involves establishing a list of the copies of the TSR that serve as “official” copies and instituting a formal process for issuing and distributing these copies and incorporating DOE-approved changes into them.

4.6 Public Safety An evaluation guideline defined in DOE-STD-3009-94, Change Notice 3 or successor documents, is used to classify SSCs as safety class to provide protection to the off-site general public from hazards associated with nuclear facilities. Safety analyses also lead to the classification of additional safety significant SSCs for defense in depth. TSRs ensure the availability of these features. 4.7 Worker Safety DOE must ensure that its facilities are operated in a manner that protects workers. Safety significant SSCs can be identified for worker safety, as discussed in DOE-STD-3009-94, Change Notice 3 or successor documents. TSRs are intended to ensure the availability of these features. TSRs also can be established to require the implementation of ACs that have importance to worker safety. Because of the necessary and inherent presence of hazardous and radioactive materials at DOE nuclear facilities and the workers’ proximity to these materials, it is impractical to reduce worker risk to an insignificant level through selection of OLs as TSRs. Nevertheless, by the combination of (a) the development of TSRs for barriers to uncontrolled releases and for preventative and mitigative systems, components, and equipment and (b) identification of safety management programs that encompass additional worker safety features such as use of personal protective clothing and equipment, emergency protection programs, worker training, and drills, risk is significantly reduced and worker safety is enhanced. 6 DOE G 423.1-1A 11-3-2010 4.8 Technical Safety Requirement Organization The first section, “Use and Application,” provides the definitions and instructions necessary to understand and use the TSR. It was placed first to provide the ground rules for use of the TSR before presenting any requirements, and is vital information for understanding the rest of the TSR. It should reference the DSA as necessary but should not be a tutorial on the facility. The next four sections are in hierarchical order related to the roles they have in controlling hazards. SLs are the most important because a violation of an SL has the potential to result in an uncontrolled release of radioactive materials affecting the public. OLs, which include limiting control settings (LCSs) and limiting conditions for operation (LCOs), protect against exceeding SLs and can ensure availability of safety significant SSCs important to worker safety, while SRs support LCSs and LCOs by ensuring operability of the associated equipment. The ACs section provides the assurance that the basic conditions assumed by the safety analysis are met. Finally, the Design Features section describes the passive design features that, if altered or modified, would have a significant effect on safe operation. 4.9 Size and Complexity of Technical Safety Requirements Category A reactors and some highly hazardous nonreactor facilities are expected to have far more extensive TSRs than other facilities. This is because Category A reactors usually require a greater number of limits on operation and a larger number of safety-related systems for which limits must be established. Some highly hazardous nonreactor facilities may also have these characteristics. The number and complexity of the systems needed to maintain an acceptable level of risk may result in complex TSRs. TSRs are developed primarily to ensure proper operability of systems and to provide actions in the event that such systems become inoperable.

The scope and content of TSRs should be limited to include only the most important nuclear safety areas in order to make TSR documents more operationally useful for controlling facility safety. The TSR should be written in a clear, concise manner using language that is directed at the facility-operating organization. 4.10 Technical Safety Requirement Elements The DSA identifies those parameters that must be controlled to ensure the safety requirements for the facility are met. However, the TSR writer must exercise considerable expertise to ensure the TSRs control the required parameters, do not result in conflicting requirements, and do not impose unnecessary restrictions on operations. Even after the control parameters for TSRs have been chosen, several levels of TSRs may be selected to control a given parameter. There is a hierarchy to the selection process, with SLs providing protection against potentially high consequence events and ACs providing protection against lower consequence events and providing for safety management programs. Guidance for the use of various TSR elements, by facility type, is provided in the following discussion and in Table 4 of the Nuclear Safety Management Rule. DOE G 423.1-1A 7 11-3-2010 4.10.1 Technical Safety Requirement Limits There are three types of limits identified by Appendix A to Subpart B of the Nuclear Safety Management Rule: SLs, LCSs, and LCOs. The intent of these limits is to ensure that the operating regime is restricted to the bounds of safe operation as defined by the safety analyses. 4.10.1.1 Specification of Safety Limits SLs are limits on important process variables needed for the facility function that, if exceeded, could directly cause the failure of one or more of the passive barriers that prevent the uncontrolled release of radioactive materials, with the potential of consequences to the public above specified evaluation guidelines. “Needed for the facility function” means the process variable is operator controlled to accomplish the facility mission and, if the variable were left unchecked, would initiate an event that challenges the passive safety boundary. SL designation is distinct to process events because other events, such as external or natural phenomena events, that may also challenge the passive safety boundary have no SLs because they are not under operator control. Generally, containment/confinement should not be considered as barriers that require SLs because they are mitigative in nature. However, these systems should be considered in the development of LCOs. For reactors, typically these barriers are considered to be the fuel cladding and primary coolant system, including piping and pressure vessels. Typical reactor limits of importance and possible candidates for SLs are those placed on primary coolant system pressure, primary coolant system temperature, and reactor power. For reactors without closed primary coolant systems (such as pool-type reactors), or with primary coolant systems that operate at essentially atmospheric pressure, the main candidates for SLs would be maximum reactor power and water temperatures. For nonreactor nuclear facilities, the passive barriers preventing the uncontrolled release of radioactive and other hazardous materials are considered to be the process material boundary (shell casing, vessel, tank, etc.) closest to the source. Failure must be immediate and catastrophic upon reaching the failure value as opposed to a long-term degradation failure such as by wall thinning, chemical corrosion, etc. Limits of importance for non-reactor nuclear facilities are facility specific, but could relate to pressure, combustible/flammable material limits, and process heat-up limits.

4.10.1.2 Specification of Limiting Control Settings LCSs define the settings on safety systems that control process variables to prevent exceeding an SL. LCSs for reactors should include reactor trip system instrumentation set points. The reactor trip set-point limits are the nominal values at which the reactor trips are set and should be selected to provide sufficient allowances between the trip set point and the SL. This allowance will ensure the core and the reactor coolant system are prevented from exceeding SLs during normal operation and anticipated operational occurrences. 8 DOE G 423.1-1A 11-3-2010 LCSs of instruments that monitor process variables at nonreactor nuclear facilities are the settings that either initiate protective devices themselves or sound an alarm to alert facility personnel to take action to protect barriers that prevent the uncontrolled release of radioactive materials. An LCS is only specified for a variable that also protects an SL. LCSs should be chosen so that there is adequate time after exceeding the setting to correct the abnormal situation, automatically or manually, before an SL is exceeded. In general, each item requiring an SL will also have control or alarm settings to ensure that the SL is not violated. However, only those control or alarm settings that are relied upon in the safety analysis would become LCSs in the TSR. When developing TSR limiting values or set points based on the DSA, remember that the values in the DSA are generally the exact values at which something is assumed to happen. The values and set points in the TSR are measured, so the DSA values must be adjusted before use in the TSR to ensure that the action assumed in the DSA actually occurs on the conservative side of the DSA assumptions. The adjustments should account for: calibration uncertainty, instrumentation uncertainty during operation, instrument drift, and instrument uncertainty during accident conditions. 4.10.1.3 Specification of Limiting Conditions for Operation LCOs define the limits that represent the lowest functional capability or performance level of safety SSCs required to perform an activity safely. LCOs should include the initial conditions for those design basis accidents or transient analyses that involve the assumed failure of, or present a challenge to, the integrity of the primary radioactive material barrier. Identification of these variables should come from a search of each transient and accident analysis documented in the DSA. The LCO should be established at a level that will ensure the process variable is not less conservative during actual operation than was assumed in the safety analyses. LCOs should also include those SSCs that are part of the primary success path of a safety sequence analysis, and those support and actuation systems necessary for them to function successfully. Support equipment for these SSCs would normally be considered to be part of the LCO if relied upon to support the SSCs function. The primary success path of a safety sequence analysis is the sequence of events assumed by the safety analyses that leads to the conclusion of a transient or accident with consequences that are acceptable. Hence, any SSC providing a safety function in that assumed sequence should be included in the LCOs. Each transient or accident analysis that challenges the integrity of a radioactive material barrier, or involves its assumed failure, should be studied to compile a list of involved SSCs.

When an LCO is not met, action should be initiated within 1 hour (unless provided for differently in the ACTION statement) to place the facility in a mode in which the requirement DOE G 423.1-1A 9 11-3-2010 does not apply. However, note that at nonreactor nuclear facilities, the LCOs that provide for monitoring for a breach of the barriers containing radioactive material are applicable in all modes. The ACTION statement in this case should be rapid restoration of the capability, or compensatory measures. Entry into a different mode should not be made unless all of the LCOs are met for that mode, except for the passage through a mode as required to comply with ACTION statements. 4.10.2 Action Statements ACTION statements should describe the actions to be taken in the event that an OL is not met. Secondly, an ACTION statement should establish the steps and time limits to correct the condition or conditions that are beyond the TSR limits. The ACTION statement for LCOs should state the action required to address the condition not meeting the LCO. Normally this simply requires the adverse condition be corrected in a certain time frame and provides further action if this is impossible. For example, if an LCO requires two pumps to be OPERABLE at all times when in the operation mode, the ACTION statement would likely state that if one pump is inoperable it should be made OPERABLE in X hours or the facility should be placed in warm standby mode within the following Y hours; if both pumps were inoperable, the ACTION statement would likely require at least one pump be OPERABLE in Z hours and the second pump OPERABLE in the following W hours or the facility be placed in warm standby mode. An ACTION statement should provide a safe and unambiguous method to reach a safe, stable state. However, for complex facilities, considerable care should be exercised to ensure that an ACTION statement does not unacceptably decrease safety. Thus, ACTION statements should avoid causing a loss of safety function either directly or by making support systems inoperable. Occasionally, it may be necessary for an ACTION statement to specify transition through an operating mode even though required safety equipment would be inoperable. For such cases the transition condition should be carefully evaluated to ensure that the facility’s risk is not increased by the ACTION statement. The ACTION statement for nuclear criticality safety LCOs should normally specify that the process or activities not in compliance with the LCO should be stopped immediately (if this action would not result in a less stable condition) and the process, system, or area be restored to a safe condition in accordance with an approved recovery plan. 4.10.3 Operability Operability embodies the principle that a system, subsystem, train, component, or device (hereafter referred to as the system) can perform its safety function(s) only if all necessary support systems are capable of performing their related support functions. This definition extends the requirements of an LCO for those systems that directly perform a specified safety function (supported systems) to those that perform a required support function (support systems). 10 DOE G 423.1-1A 11-3-2010 A system or component can be degraded but still OPERABLE if it remains capable of performing its required safety function at the level assumed in the accident analysis. If systems, components, or equipment are observed to be functioning but under stress (e.g., with elevated temperature, vibration, or physical damage), then judgment must be used concerning a declaration of inoperability.

General principles of operability should be followed in generating LCOs. GENERAL PRINCIPLE 1: A system is considered OPERABLE as long as there exists assurance that it is capable of performing its specified safety function(s). GENERAL PRINCIPLE 2: A system can perform its specified safety function(s) only when all of its necessary support systems are capable of performing their related support functions. GENERAL PRINCIPLE 3: When all systems designed to perform a certain safety function are not capable of performing that safety function, a loss of function condition exists. GENERAL PRINCIPLE 4: When a system is determined to be incapable of performing its intended safety function(s), the declaration of inoperability should be immediate. 4.10.4 Allowable Outage Times Generally, the allowable outage time (AOT) of a support system should be shorter than the minimum AOT of the system it is supporting. In actual practice, however, situations may arise where the ACTION statements of a supported system LCO specify required actions (other than restoration) that have completion times shorter than the support system’s AOT. In most cases, upon failure to accomplish the required actions within the allowed completion time, the supported system LCO ACTION statements would require a mode change to one in which the operability of the supported system is not required. This would occur before the expiration of the support system’s AOT. 4.10.5 Fire Protection; Heating, Ventilating, and Air-Conditioning; and Natural Phenomena Hazards Controls Fire poses the most significant risk in some DOE facilities. For those facilities, certain key fire protection LCOs will need to be developed as dictated by the DSA accident analysis and the Fire Hazards Analysis (FHA) required by DOE O 420.1B, Facility Safety, dated 12-22-05, or successor documents. The TSR document may need to include a reference to general safety controls provided by the fire protection program, but it also needs to identify specific controls (usually LCOs) for any fire protection equipment that has been identified in the DSA as performing a safety function. Similarly, the HVAC systems and their filters may require TSRs for those elements of the system that have been identified with a safety function in the DSA. The natural phenomena hazard (NPH) assessment required by DOE O 420.1B may also result DOE G 423.1-1A 11 11-3-2010 in controls (mainly related to NPH detection and warning devices) that should be incorporated into the TSR document. 4.10.6 Surveillance Requirements Surveillance Requirements (SRs) are used to ensure operability or availability of the safety SSCs identified in the OLs. SRs are most often used with LCOs to periodically validate the operability of active systems or components that are subject to a limiting condition. SRs consist of short descriptions of the type of surveillance required and its frequency of performance. These statements should be as brief as possible but should identify those requirements needed to ensure compliance with the related OLs. Each SR should begin with a verb. Use of terms and sentence structure among requirements should be consistent.

Failure to perform a surveillance within the required time interval or failure of a surveillance to meet its acceptance criteria should result in the equipment/component/condition being declared inoperable and should be considered a failure to meet the LCO. When equipment or a component fails the SR, the action required by the TSR for the inoperable equipment or component should be taken. Failure to take the required action is a TSR violation. If an SR is not performed within its required time interval, including any extension allowed, it is considered to be a violation of the TSR. To avoid subjecting the facility to unnecessary transients, upon discovery of a missed surveillance test, 24 hours or the time limit of the specified surveillance frequency, whichever is less, is allowed to complete the surveillance before taking the required action of the LCO. Such exceptions should be clearly identified in the general SRs. There may be process systems for which it is not acceptable to apply the concept of a grace period because failing to perform the surveillance or maintenance places the system in a state that needs immediate corrective action. 4.10.7 Administrative Controls Administrative Controls (ACs) are the provisions relating to organization and management, procedures, record keeping, reviews, and audits necessary to ensure safe operation of the facility. ACs may include reporting deviations from TSRs (i.e., exceeding LCOs, LCSs, or SRs, or violation of a TSR), staffing requirements for facility positions important to safe operation of the facility, ACs of the criticality safety program (see Section 4.13), and commitments to safety management programs important to worker safety. In general, the ACs should document all those administrative functions that are required to meet facility safety criteria as identified in the DSA, including commitments to safety management programs. It is expected that the ACs will be tailored to the facility activities and the hazards identified in the DSA. This tailoring should be a direct result of the DSA, but it may also result from institutional requirements that address many facilities. As a general practice, safety controls for individual accident scenarios based on engineered SSCs are preferred to ACs because they are usually more reliable and more predictable. The tendency to use ACs as an expedient alternative to an LCO or LCS should be avoided when possible. Efforts should be made to use engineered SSCs whenever possible for 12 DOE G 423.1-1A 11-3-2010 controlling the likelihood and consequences of accidents. ACs should be considered for defense in depth rather than the primary or redundant controls. While ACs may be acceptable for ensuring safe operation, their generally lower reliability, compared with engineered controls, should be evaluated carefully when choosing safety measures for long-term hazardous activities. Human actions, taken either in response to an event or taken proactively to establish desired conditions, are subject to errors of omission or commission. Sets of ACs are prone to common cause failure. The following attributes, which can be tailored as appropriate, can increase reliability:  use of reader/worker/checker systems;  independent verification;  positive feedback systems;  human factor analysis;  operator training and certification;  continuing training and requalification;  abnormal event response drills; and  ergonomic considerations in procedures.

When invoking ACs for control of accident scenarios, the preceding attributes, appropriate to the consequences of the accidents they are intended to prevent, should be considered and also invoked. 4.11 Violation of Technical Safety Requirements Although the TSR elements have an importance hierarchy, a TSR violation can occur for each type of TSR. Violations of a TSR occur as a result of the following four circumstances.  Exceeding an SL.  Failure to complete an ACTION statement within the required time limit following exceeding an LCS or failing to comply with an LCO.  Failure to perform a surveillance within the required time limit.  Failure to comply with an AC statement. Failure to comply with an AC statement is a TSR violation when either the AC is directly violated, as would be the case with not meeting minimum staffing requirements, for example, DOE G 423.1-1A 13 11-3-2010 or the intent of a referenced program is not fulfilled. To qualify as a TSR violation, the failure to meet the intent of the referenced program would need to be significant enough to render the DSA summary invalid. TSR violations involving SLs require the facility to begin immediately to go to the most stable, safe condition attainable, including total shutdown. A grace period is sometimes provided to perform a missed surveillance (see paragraph 4.10.6 above) to provide time for the performance of the missed surveillance, thereby avoiding the need for a facility to take immediate, possibly unnecessary corrective action. Entering the grace period remains a TSR violation even though an immediate corrective action may not be required. 4.12 Technical Safety Requirement Format Examples of acceptable TSR formats and the expected content for each type of TSR limit are provided in Section 5. Both the new three-column format and the older single-column format are acceptable. If a facility wishes to use another format for its TSR, the contractor may request DOE’s permission to use it. 4.13 Criticality Technical Safety Requirements In the development of the DSA, the evaluation of normal, abnormal, and accident conditions that could lead to the uncontrolled release of radioactive materials must be analyzed per 830.204(b)(3). Corresponding hazard controls must be derived per 830.204(b)(4). Therefore, for category 1 and 2 facilities, postulated accidents involving inadvertent criticality must be considered and corresponding controls (TSRs) established. The criticality control TSRs will be principally derived from criticality safety evaluations (CSEs) supporting the DSA hazard analyses. A DSA considers all hazards, including inadvertent criticality, and TSRs include the appropriate controls. CSEs support the DSA. They and their resulting controls should be summarized and referenced in the DSA. The DSA also considers scenarios that might not be included in CSEs, such as common cause failures, and additional controls might be identified as necessary. Refer to Section 5.2.1.1 of the Implementation Guide for DSAs for a more complete discussion of criticality analyses and the DSA. The TSR includes controls so identified, including a commitment to a Criticality Safety Program. The basic requirements for the Criticality Safety Program are described in DOE O 420.1B or successor document. Depending on the situation, criticality-related TSRs would usually be design features, LCOs associated with active engineered features, or ACs. TSR-level controls should be identified on a case-by- case basis and should be developed according to the guidance in DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, dated July 1994, Change Notice 3, dated January 2000, or successor documents, with regard to the classification of controls.

14 DOE G 423.1-1A 11-3-2010 Design features providing protection from inadvertent criticality need to be subject to periodic surveillance and configuration management to ensure they do not degrade to the point that they can no longer be depended on to perform their intended function. Maintenance of the design features relied on for criticality control can be accomplished by functionally classifying this equipment as safety significant and invoking TSR mechanisms for surveillance and configuration management. 4.14 Technical Safety Requirements for Transportation Hazard controls should be developed for both on-site and off-site transportation using a graded approach commensurate with the risk of the activity and consistent with the approach used to develop the Safety Basis. Normally, all necessary hazard controls for on-site transportation are developed in the transportation safety document (TSD) (see DOE O 460.1C, Packaging and Transportation Safety, and DOE G 460.1-1, Implementation Guide for Use with DOE O 460.1A, Packaging and Transportation Safety). The TSRs should be developed from the TSD and would contain items such as—  allowable route(s);  vehicle speed limits;  packaging controls for each category of hazardous material;  loading and unloading controls, as applicable;  operator/worker qualifications; and  any other necessary restrictions based on the safety analysis. The transportation safety provisions are described in DOE O 460.1C and DOE O 461.1, or successor documents, and their associated guidance documents. Usually, LCOs and ACs are the appropriate level of TSR for transportation safety controls. No SLs are expected for transportation activities, because there are no processes or activities in which the operator causes a process variable to be manipulated that, if left unchecked or uncontrolled, would result in catastrophic failure of a passive safety barrier. For example, there are no operator-initiated processes to increase temperature, pressure, electrical or mechanical insult to the cargo that could lead to catastrophic failure. Off-site transportation of materials of national security interest is also subject to 10 CFR 830 requirements, through the designated safe harbors of DOE O 461.1, Packaging and Transfer or Transportation of Materials of National Security Interest, and DOE M 461.1-1, Packaging and Transfer of Materials of National Security Interest Manual. Because the Transportation Safety Documents (TSDs) for transport of these materials basically require compliance with Type A and Type B requirements under DOT hazardous material transportation regulations (49 CFR, parts 106–199), or the equivalent, no separate TSR provisions (from the on-site TSRs) are DOE G 423.1-1A 15 11-3-2010 required for these transport activities. The required Type A and Type B robust shipping packages are designed to survive the extreme of normal transport environments and hypothetical accident situations (essentially 10 CFR 71 requirements). 4.15 Safety Structures, Systems, and Components Safety class SSCs are those items relied upon to ensure the safety and health of the public. This may include radiation monitoring equipment and alarms. The distinction between what is Safety Class and what is not is made by the DSA or by other safety documentation. In general, Safety Class SSCs should have one or more associated TSRs to ensure performance of their safety function.

Systems that are identified in the DSA to operate and perform a safety function that is required in order to meet additional DSA safety criteria also need TSRs. Support systems for Safety Class SSCs would normally be considered to be Safety Class if they are relied upon to support a safety class function. Each Safety Class SSC should have a corresponding TSR. SLs are, by definition, associated with passive physical barriers that prevent the release of radioactive materials. Passive Safety Class systems and components, even those associated with an SL, will generally be listed in the Design Features as opposed to LCOs. Active Safety Class systems and components will generally have associated LCOs to ensure operability. All of the SSCs may have surveillance and maintenance requirements depending on their function and characteristics. Safety-Significant SSCs would be covered in the TSR document since their functions are important to defense in depth and/or worker safety. The coverage would likely be through an LCO or AC (e.g., through special treatment in a maintenance management program). Support systems for Safety-Significant SSCs should be considered safety significant. The decision to use an LCO or an AC will depend on the facility, the nature of the control, the characteristic of the hazard and the availability of applicable programmatic documents. The TSRs should derive from the identified component and system functional attributes that are important to implementing safety controls. 4.16 Design Features The Design Features section describes those design features that, if altered or modified, would have a significant effect on the safe operation. The important attributes of the passive design features that are taken credit for in the accident analyses should be described completely. These Design Features are normally passive characteristics of the facility not subject to change by operations personnel, e.g., shielding, structural walls, relative locations of major components, installed poisons, or special materials. Active safety features (see Section 4.15, above) are normally described in the DSA and are the subject of the various TSRs, so they are not normally described in the Design Features section. All changes or modifications that impact the Safety Basis of the facility are subject to the USQ process. The Design Features section captures those permanently built-in features critical to safety that do not require, or infrequently require, maintenance or surveillance. 16 DOE G 423.1-1A 11-3-2010 4.17 Graded Approach The graded approach is not directly applicable to the TSRs required by 10 CFR 830.205. However, the graded approach is specified for DSAs required by 10 CFR 830.204. Thus, the level of detail in the DSA and the number of safety parameters identified in the DSA section deriving the TSRs will have a direct effect on the number and type of resulting TSRs. 4.18 Technical Safety Requirements Bases Appendix The TSR bases appendix provides summary statements of the reasons for the selection of each specific SL, OL, and SR. The bases show how the numerical values, conditions, surveillances, and ACTION statements fulfill the purpose derived from the safety documentation. Included in the bases should also be a description of the safety functions that each safety system provides and identification of what is included in each safety system. The level of detail in the description should be sufficient for the operations staff to confirm that the system is OPERABLE. This description is provided so that the operations staff knows exactly what must be OPERABLE to consider the entire safety system OPERABLE. The bases appendix references the basis for specific parts of the TSR given in the DSA and other safety documentation.

The bases appendix should present all conditions of operation, including limiting accident conditions. All systems, subsystems, components, structures, and equipment that are to be included in the TSR should be presented or referenced to other DSA chapters and discussed in this appendix. The derivation of TSR chapters from the DSA provides guidance mostly on information that exists or is referenced in the DSA itself. Other guidance information needed for development of TSRs, but not usually found in the DSA itself (e.g., action completion times and surveillance test frequencies) should be developed from national standards, manufacturer’s recommendations, operating history or engineering judgment. The TSR bases should include the following.  Identification of any requirements relevant to the Safety Basis that have been selected by the facility or imposed on the facility by DOE.  Identification of specific information from the DSA used in the derivation of individual TSRs, including operating conditions limiting accident initial conditions, relevant parameters of safety class or safety significant SSCs, instrumentation, operator actions, assumed limits, and design features. As discussed in the “TSR Document of Example Technical Safety Requirements, Vol. 1: Examples,” Rev. 1, dated February 2001, the content of the bases appendix can be broken into seven areas: background, applicable safety analysis, SLs and OLs, mode applicability, ACTION statements, SRs, and references. Each of these areas is discussed in the following paragraphs. DOE G 423.1-1A 17 11-3-2010 4.18.1 Background The function of each system or component should be discussed and a description provided in what might be called the “background.” Include, if they relate to the requirement being covered, major components and a schematic (if a system), operational aspects, unique features, and general design features. In addition, the limits protected by the requirement and the consequences of exceeding the limit should be discussed. This area should also contain any cross referencing to other related or similar requirements. 4.18.2 Applicable Safety Analysis Discuss the applicable safety analysis and evaluations included in the safety analysis from which the requirement has been derived, including—  applicable accident or transient;  major input assumptions of the safety analysis;  the relationship of this TSR to the accepted consequence of the analysis;  the basis of each SL or OL, including allowances; and  the margin of safety for each SL and OL. The margin of safety discussion should address such factors as LCS, LCO, design parameters, equipment trip set points, response time, instrument errors, completion times, and surveillance test frequencies. 4.18.3 Safety and Operating Limits For SLs, identify from the DSA the specific barrier protected by the SL and the accident or accidents for which maintaining the integrity of the barrier is necessary to protect public health. For LCSs or LCOs, explain why the requirement is appropriate. Discuss how it was determined to be the lowest functional capability or performance level for that system or component to ensure safe operation of the facility. Discuss any other facets of the LCO that may be required, such as conditions required, numbers of components required, parameter requirements, exceptions or notes, and implications of LCO violations. 4.18.4 Mode Applicability

Information on expected operational conditions (e.g., start-up, operation, shutdown) that establish sufficient unique or distinguishing characteristics to permit development of TSR modes must be presented. Many DSAs do not categorize accident analysis by modes. Therefore, mode applicability should be developed from a synthesis of information from the DSA (e.g., accident or hazard analysis; facility description; testing, surveillance, maintenance, facility mission). For mode applicability, explain why operability is required in the given modes and why operability is not required in other modes (or provide a reference to another requirement that 18 DOE G 423.1-1A 11-3-2010 covers other modes). Discuss credible events addressed in various modes, conditions encompassed by safety analysis, related LCOs, and the relationship of the requirement to other modes, and variations in requirements between modes. 4.18.5 Action Statements For each ACTION statement— 1. Explain why the action should be taken and why continued operation is acceptable if the LCO is not met. Address the level of protection provided, the probability of an event occurring during the period covered, and how the required actions compensate for LCO deviations. 2. Explain why completion times are acceptable. 3. Describe why mode changes are required. 4. Discuss how all required actions for an LCO relate to each other. 5. Explain the source of all numbers in the ACTION statements (e.g., completion times, parameter values, or component requirements). 4.18.6 Surveillance Requirements Explain why the SR is necessary at the frequency specified. Discuss how the surveillance demonstrates operability of the LCO requirements. Discuss how the surveillance verifies the LCO requirements; this should establish a one-to-one correspondence between each SR and LCO. Provide justification for surveillance test frequencies (e.g., engineering judgment, or Probabilistic Risk Assessment [PRA]) and parameter values. Referencing national consensus standards may not be adequate basis without explaining the appropriateness of the application to the nuclear facility activity. 4.18.7 References For References, supply the DSA section, reports as applicable, and codes and standards as applicable. Provide a list of documents where more detailed information pertinent to the specification can be found. Revisions to the bases sections can be made without DOE approval if the changes are editorial in nature and do not make significant changes. 4.19 Review and Audits The method(s) established to conduct facility staff reviews and/or independent reviews and audits should be described. The methods may take a range of forms acceptable to DOE. These may include creating an organizational unit, a standing or ad hoc committee, or assigning individuals capable of conducting these reviews and audits. If deemed necessary, such reviews DOE G 423.1-1A 19 11-3-2010 should be performed by the review personnel of the appropriate discipline. Individual reviewers should not review their own work or work for which they have direct responsibility. Regardless of the method used, management should specify the functions, organizational arrangement, responsibilities, appropriate ANSI/ANS 3.1-1981 qualifications, and reporting requirements of each functional element or unit that contributes to these processes.

Reviews by an independent review and audit group should include proposed changes to the TSR. This review should cover the entire content of the TSR change including any safety analysis done in support of the change. Audits by the independent review and audit group should include conformance with TSR. Conformance can extend to maintenance of current documentation supporting the TSRs as well as adequacy of the TSRs to cover ongoing activities. Appendix D to this Guide provides guidance on performance of Implementation Verification Reviews (IVR) of Safety Basis Controls. 4.20 Reporting Requirements Reporting of all TSR violations (see Section 4.11, above) should be made in accordance with the provisions of DOE O 231.1A Chg 1, Environment, Safety and Health Reporting. The reporting of violations on ACs can involve judgment since the details of programs such as a program for criticality control do not appear directly as a TSR, and some program requirements are more important than others. Violations of controls identified in the accident or criticality scenarios in the DSA should be reported as if they were TSR violations. To ensure consideration for mitigation in potential enforcement actions, identified TSR violations should be evaluated for voluntary reporting to the DOE Noncompliance Tracking System. 4.21 Implementation Verification Reviews (IVR) of Safety Basis Controls Appendix D to this Guide provides guidance on performance of Implementation Verification Reviews (IVR) of Safety Basis Controls. 5. ACCEPTABLE METHODS This section provides guidance on the recommended format of TSRs. It is divided into three sections: Organization, Content, and Format. Section 5.1, Organization, presents a suggested organization to meet the requirements of the TSR rule and details to assist in unifying the document. Section 5.2, Content, presents the suggested content for each of the sections of the TSR. Section 5.3, Format, provides two suggested TSR formats. Examples are provided to illustrate various parts of a TSR. Additional examples of TSRs for specific types of facilities have been developed by the DOE Office of the Deputy Administrator for Defense Programs (NNSA). 20 DOE G 423.1-1A 11-3-2010 5.1 Organization 5.1.1 Front Matter Front matter should consist of the following parts. 1. Title page. The title page should include, at least, the name of the reactor or nonreactor nuclear facility, the facility location, the words “Technical Safety Requirements,” and the name of the responsible contractor. 2. Table of Contents. The table of contents should list every item in the volume (see Figure 1 for a reactor facility example and Figure 2 for a nonreactor nuclear facility example). 3. Tables. A list of tables should be included (see Figure 3 for a reactor facility example and Figure 4 for a nonreactor nuclear facility example). 4. Figures. A list of figures should be included (see Figure 5 for a reactor facility example and Figure 6 for a nonreactor nuclear facility example). 5. Acronyms. A list of acronyms, abbreviations, and symbols should be compiled and included. Acronyms, abbreviations, and symbols that appear only one time in the text should not be used or appear in the acronym list, rather they should be “spelled out” in the text. Acronyms, abbreviations, and symbols used more than one time in the text, should be spelled out at the first occurrence, with the acronym, abbreviation, or symbol following in parentheses. Thereafter, the acronym, abbreviation, or symbol should be used.

5.1.2 Arrangement of Sections The main body should include the following sections in the order indicated. 1. Section 1—Use and Application 2. Section 2—Safety Limits 3. Section 3/4—Limiting Control Settings, Limiting Conditions for Operation, and Surveillance Requirements. Section 3 is LCS and LCO operational limits, and Section 4 is surveillance requirements. SRs are established to demonstrate and ensure the LCS and LCO operational limits are met. These two sections are thus intimately related. They are presented together in the text of the TSR document because of this relationship. Such presentation makes it easier to ensure SRs are appropriate for the related LCS and LCO operational limits. The three-column format retains the same LCO and LCS number for related SRs. 4. Section 5—Administrative Controls DOE G 423.1-1A 21 11-3-2010 5. Section 6—Design Features A cover page with the section number and title centered on the page should precede each section. 5.1.3 Appendices Appendices should be placed at the end of the document. This Guide recommends using alphabetical designators for each appendix (Appendix A, Appendix B, etc.) and a cover page with the letter designator and title. The appendix that contains the TSR bases should be first (Appendix A). 5.2 Content The recommended content for each section of the TSR is described in the following paragraphs. 5.2.1 Section 1—Use and Application This section should contain basic information and instructions for using and applying the TSR. The following elements should be addressed under separate headings in this section. 1. Definitions. Provide an alphabetical list of terms used throughout the TSR and their corresponding definitions (Figure 7). Include a note on the first page of the list stating that defined terms appear in uppercase type throughout the TSR. 2. Operational Modes (Reactors). In the interest of uniformity, the operational conditions or modes listed below are preferred and an attempt should be made to fit each reactor facility into this scheme. If, however, a reactor facility cannot be made to fit, modes may be defined as needed, provided the definition is clearly written with definite lines of demarcation between modes. The number of modes should be held to a minimum. The number of modes should be established based upon the minimum number required to be able to distinguish between different facility conditions and to ensure the provision of an adequate level of safety while in each condition. Define the operational modes for reactor facilities as follows.  Operation Mode. To be in operation mode, the reactor is critical and may be at any power level up to and including maximum allowed power.  Start-up Mode. To be in start-up mode, the reactor will begin in a subcritical state and be intentionally made to increase reactivity in a controlled manner to achieve a critical condition and to increase flux in an exponential manner until a low power is reached. Specific low power values are usually associated with the onset of measurable heat.  Standby Mode. To be in standby mode, the reactor is subcritical but capable of operation without substantial administrative or mechanical actions. Keff limits or 22 DOE G 423.1-1A 11-3-2010 other limits needed to define the mode should be included.

 Shutdown Mode. To be in shutdown mode, the reactor is significantly subcritical and capable of operation only after completing substantial administrative and/or mechanical actions. Normally, this would be a procedure or series of procedures (such as multiple system valve lineups) that should be performed, but it could be mechanical or electrical repairs, calibration, or other activity. The Keff values should normally be included, unless they are of no use for a particular reactor, in which case control rod positions or other appropriate means should be defined for “significantly subcritical.” (This is to be understood to refer to reactor shutdown, not facility shutdown.)  Refueling Mode. To be in the refueling mode, the reactor vessel integrity is breached (in all non-accident conditions), or any core alterations including fuel rods, control rods, targets, or other vessel internals are occurring or have occurred. Normally this mode requires major mechanical and associated administrative steps be completed before operation is possible. Submodes may be created and defined as needed by reactor facilities. The definitions should be clearly written with numerical or other definite demarcation between submodes. The number of submodes should be limited as much as possible to avoid complexity and potential confusion. Normally, the definition of the modes in a TSR document will be a summary of the definitions above with whatever additional information is needed for a particular reactor (e.g., maximum allowed power, in the definition of operation mode). 3. Operational Modes (Nonreactor Nuclear Facilities). In the interest of uniformity, the operational conditions and modes listed below are preferred and an attempt should be made to fit each nonreactor nuclear facility into this scheme. If, however, a nonreactor nuclear facility cannot be made to fit, modes may be defined as needed, provided the definitions are clear and there are definite lines of demarcation between modes (such as a numerical value of pressure, temperature, or flow). The number of modes should be established based on the minimum number required to distinguish between different facility conditions as dictated by required equipment operability and needed parameter limits. If a mode is not used in the LCOs (except for the safest mode) or if it doesn’t have different equipment or parameter limits specified from other modes, then it shouldn’t be a mode. Define the operational modes for nonreactor nuclear facilities as follows.  Operation Mode. To be in operation mode, the mission of the facility or its current campaign is being performed.  Start-up Mode. To be in start-up mode, the facility is operating in a transient state DOE G 423.1-1A 23 11-3-2010 from shutdown or near shutdown to reach conditions in which the mission or campaign is performed. This mode is only prescribed for facilities where the procedures are complex and important to nuclear safety.  Shutdown Mode. To be in shutdown mode, the facility is not performing its mission or its current campaign, and is incapable of doing so in its present condition. (This is to be understood to refer to a process state and not facility shutdown.)  Warm Standby. To be in warm standby, the facility is not operating but still retains its inventory of hazardous material.  Repair Mode. To be in repair mode, the facility is not able to perform its mission in its current condition.

Submodes may be created and defined as needed for nonreactor nuclear facility TSRs. The definitions should be clearly written with numerical or other definite demarcation between submodes. The number of submodes should be limited as much as possible to avoid complexity and potential confusion. 4. Frequency Notation. The frequency notations, as used in the surveillances and elsewhere, should be defined as follows when included in the TSR. Notation Minimum Frequency (periodicity notation) S Shiftly (i.e., each shift) At least once every 12 hours D W Daily Weekly At least once every 24 hours At least once every 7 days M Monthly At least once every 31 days Q Quarterly At least once every 92 days S/A Semiannually At least once every 184 days C Campaign Before start-up of each campaign R Refueling Before entering standby or operation modes after reactor refueling S/U Start-up Before each start-up N/A Not applicable Not applicable 5.2.2 Section 2—Safety Limits SLs should describe as precisely as possible the process variables or the parameters being limited and state the limit in measurable units (pressure, temperature, flow, etc.). (See Figures 8a and 8b for examples of SLs.) In general, SLs should be monitored continuously. 24 DOE G 423.1-1A 11-3-2010 SLs should be based on and specified in terms of three basic rules. 1. Exceeding an SL is a TSR violation for each applicable mode. Upon exceeding an SL, the following steps should be taken:  the affected parameter must be immediately brought within the SL;  place the facility in the most stable, safe condition attainable, including shutdown if appropriate;  reactors are required to shut down immediately (e.g., scram);  at nonreactor nuclear facilities, the TSR should specify actions to be taken that place the involved process in the most stable, safe condition attainable, including shutdown if appropriate; and  all other ACTION requirements should be met. 2. Each SL should have a mode applicability statement. This statement should consist of a simple list of modes or other conditions for which the SL is applicable. 3. ACTION statements should describe the actions to be taken in the event that the SL is not met. These actions should first place the facility in a safe, stable condition or should verify that the facility already is safe and stable and will remain so. Secondly, an ACTION statement should establish the steps and time limits to correct the out-of- specification condition. The actions should bring the affected parameter immediately within the SL and should effect a shutdown of the facility, within a justified facility- specific time frame, normally less than an hour. Other actions required after exceeding an SL, including reporting requirements and an evaluation of possible damage caused by exceeding the SL, may be included in the ACTION statement or may be placed in Section 5, “Administrative Controls,” with proper reference to the requirement. A statement prohibiting restart, before DOE approval, of the facility after an SL violation should be included in the ACTION statement of each SL, in Section 5 of the TSR, or in both. 5.2.3 Section 3/4—Limiting Control Settings, Limiting Conditions for Operation, and Surveillance Requirements1

This section contains LCSs and LCOs. Mode and location applicability statements, ACTION statements, and SRs should also be included for each LCO or LCS, as appropriate. The most conservative value for each parameter or process variable contained in the safety analyses makes up the envelope within which the facility must operate to ensure that the DSA analyses bound safe operation. 1 Section 3 delineates LCS and LCO operational limits. Section 4 describes SRs. There is usually a one-to-one correlation between LCS and LCO operational limits and the surveillances related to them. The combined TSR section is designated Section 3/4. DOE G 423.1-1A 25 11-3-2010 1. Limiting Control Settings. LCSs should describe, as precisely as possible, the parameter or process variable being controlled or equipment being actuated and its limit, or the limiting setting of the device to control it. This information may be presented in tabular or graphic form, with whatever written information that is necessary placed in the body of the requirement. The LCS or an associated LCO should specify the allowed out-of- service time permitted when testing, resetting, repairing, or maintaining trip devices and similarly the time for associated equipment that must be removed from service for these activities. LCSs should be based on and specified in terms of three basic rules.  Compliance with an LCS is required in the modes specified.  Upon discovery that the instrumentation or interlock set point is less conservative than the required LCSs, the associated ACTION should require that it be reset. Other actions should be specified (e.g., the time allowed out of service for resetting, test, maintenance, repair, or calibration).  If an automatic safety system is not OPERABLE as specified, appropriate action should be described in the ACTION statement to compensate. In the case of reactors, that action may take the form of reactor shutdown and/or engineered safety feature initiation or adjustment. In the case of nonreactor nuclear facilities, such action might be manual process shutdown or process adjustment. Figures 9a and 9b provide example LCSs. 2. Limiting Conditions for Operation. The LCO statement should describe, as precisely as possible, the lowest functional capability or performance level of equipment required for safe operation of the facility. Each separate limiting condition should have an LCO with associated mode applicability, ACTION statements, and SRs. This part should contain the requirements for how LCOs should be applied. LCOs should be based on and specified according to three basic rules.  Compliance with an LCO is required in the modes specified.  The LCO should include an AOT to attempt restoration of the required functional performance (operability).  Upon failure to meet an LCO, the associated ACTION requirement should be met. 3. Applicability. Mode and location applicability statements should be included for each LCS and LCO. These statements should consist of a simple listing of the modes or conditions for which the LCS or LCO is applicable. 26 DOE G 423.1-1A 11-3-2010 4. Actions. ACTION statements should describe the actions to be taken in the event that an LCS is exceeded or an LCO statement is not met. ACTION statements should include the AOT to attempt to restore operability.

ACTION statements should be broken down whenever possible into separate statements describing a single deviated condition requiring operator action; this simplifies the explanation of the expected action and better ensures that the action will be performed correctly. Completion times for each action should be stated in simple units of time. Use the term “inoperable” to describe the deviated condition to avoid lengthy ACTION statements. Use the term “OPERABLE” to describe the corrected condition or part of the system without deviation. (While “inoperable” is presented in lowercase letters, OPERABLE is presented in uppercase letters.) Keep wording in ACTION statements as brief as possible. Be consistent in the use of verbs and tense. Use the same wording structure when specifying requirements. Do not use articles unless necessary for clarity. When a mode change is required by an ACTION statement, it is preferable to use the actual title of the modes (i.e., rather than numerical designation of modes) to avoid a misunderstanding or a typographical error that could cause the operator to take inappropriate action. ACTION statements should cover all reasonably expected combinations of OPERABLE and inoperable components in the systems described. Generic LCOs can cover the conditions not called out in individual ACTION statements. 5. Surveillance Requirements. SR statements consist of short descriptions of the type of surveillance required and its frequency of performance. These statements should be as brief as possible but should identify those requirements needed to ensure compliance with the LCS or LCO. Begin each SR with a verb. Be consistent in use of terms and sentence structure among requirements. Describe the purpose of SRs; that is, SRs are requirements relating to test, calibration, or inspection that ensure the necessary operability and quality of safety-related systems and components required for the safe operation of a facility. Surveillance should be based on the following rules.  SRs must be met for all equipment, components, and conditions for the facility to be considered OPERABLE.  Each SR should be performed at the specified frequency, with a maximum extension of 25 percent of the interval between any two consecutive surveillances. (This extension is intended to provide operational flexibility both for scheduling and for performing surveillances. It should not be relied upon as a routine extension of the specified interval.)  Special test exceptions to TSRs may be allowed under controlled conditions. These test exceptions should be placed in Section 3 (LCO). Any test exception DOE G 423.1-1A 27 11-3-2010 should be clearly written to state which LCOs are being excepted, for how long, and under what conditions. 5.2.4 Section 5—Administrative Controls This section should impose administrative requirements necessary to control operation of the facility such that it meets the TSR. The paragraphs that follow discuss some of the ACs that should be placed in this section. Where information is provided by reference, the specific ACs relied upon in the safety analyses should be identified and summarized. 1. Contractor Responsibility. The facility or plant manager is responsible for overall operation of the nuclear facility and should delegate in writing the succession to this responsibility during his or her absence. The shift supervisor is responsible for the local command function. During any absence of the shift supervisor from the area, a designated, qualified individual should be assigned the command function.

2. Contractor Organization. On-site and off-site organizations should be described for facility operation and contractor management. The on-site and off-site organizations should be described in terms of the lines of authority, responsibility, and communication for the highest management levels through intermediate levels to and including all operating organization positions. The individuals who train the operating staff and those who carry out health physics and quality assurance functions may report to the appropriate on-site manager; however, they should have sufficient organizational freedom to ensure their independence from operating pressures. 3. Procedures. Operations procedures should provide sufficient direction to ensure that the facility is operated within its design basis and supports safe operation of the facility. This should include emergency operating procedures; operating procedures for all phases of operation, maintenance, procedures for all surveillances required by TSR; Security Plan implementation; Emergency Plan implementation; fire protection; procedures for all programs listed in paragraph (4) below; and procedures governing the administrative aspects of operation of the facility. A system should be developed to control all procedures that provide assurance of safe operation. Procedures that are important to safety need to be identified for special attention to ensure that such procedures are given proper attention in proportion to the hazard that they control and that they are performed reliably (see the discussion in Section 4.10.7). The system should include the mechanism for review, approval, revision, control, and temporary changes to the procedures. The TSR should include appropriate identification and summary of or reference to the procedures. 4. Programs. Programs developed to ensure the safe operation of the facility should be discussed here and thereby committed to by reference. These programs should include as appropriate but not be limited to in-service inspection of components, pumps, and valves as per ASME Boiler and Pressure Vessel Code Section XI; worker protection such as radiation protection programs; in-plant radiation, process control programs; ventilation filter testing program; explosive gas and storage tank radioactivity monitoring programs; radiological 28 DOE G 423.1-1A 11-3-2010 effluent control; quality programs; configuration control programs; and document control. The basic elements of these programs should be described in this section but should be separate controlled volumes and are not to be included in the TSR. The detailed Nuclear Criticality Safety Program may be presented in this subsection of the TSR. 5. Minimum Operations Shift Complement. This section of the ACs should include the maximum daily working hours and maximum number of consecutive days on duty. The required staffing of operating shifts for nonreactor nuclear facilities and the members of the shift staff required to be present in the control room or control area for different operating conditions should be specified in the AC section on the basis of relevant safety analyses. 6. Operating Support. A list of facility support personnel by name, title, and work and home telephone number must be kept up to date. The list should include management, radiation safety, and technical support personnel. The list itself should not be in the TSR, but should be referenced in the TSR and is required to be readily accessible.

7. Facility Staff Qualifications and Training. Minimum qualifications for members of the facility staff in positions affecting safety should conform to the requirements of DOE 5480.20A or successor documents and should be provided in the AC section. 8. Record Keeping. Records need to be kept of all information supporting the implementation of the TSR, including operational logs of modes changes, entering actions, surveillances, deviations, procedures, programs, meetings, recommendations, etc. 9. Reviews and Audits. Describe the methods established to conduct independent reviews and audits. The methods may take a range of forms acceptable to DOE. These may include creating an organizational unit, a standing or ad hoc committee, or assigning individuals capable of conducting these reviews and audits. When an individual performs a review function, a cross-disciplinary review determination is necessary. If deemed necessary, such reviews will be performed by the review personnel of the appropriate discipline. Individual reviewers should not review their own work or work for which they have direct responsibility. Regardless of the method used, management should specify the functions, organizational arrangement, responsibilities, appropriate ANSI/ANS 3.1-1981 qualifications, and reporting requirements of each functional element or unit that contributes to these processes. Reviews and audits of activities affecting facility safety have two distinct elements. The first of these is the review performed by facility personnel to ensure that day-to-day activities are conducted in a safe manner. The second of these is the review and audit of facility activities and programs affecting nuclear safety that is performed independently of the facility staff. The independent review and audit should provide for the integration of the reviews and audits into a cohesive program to provide senior level facility operation and recommend actions to DOE G 423.1-1A 29 11-3-2010 improve nuclear safety and facility reliability. It should include an assessment of the effectiveness of reviews conducted by facility staff. Facility staff reviews should include USQ determinations; proposed tests and experiments; procedures; programs; facility changes and modifications; TSR changes; facility operation, maintenance, and testing; DOE and industry issues of safety significance; and any other safety-related items. Reviews by the off-site safety organization should include: USQ determinations; proposed changes to the TSR; violations of codes, orders, and procedures that have safety and health significance; Occurrence Reports; staff performance; unanticipated deficiencies of SSCs that could affect nuclear safety; significant, unplanned radiological or toxic material releases; and significant operating abnormalities. Audits by the off-site safety organization should include conformance with TSR; training and qualification of facility staff; program implementation; deficiency corrective actions; quality program adherence; and other activities of safety significance. Appendix D to this Guide provides guidance on performance of Implementation Verification Reviews (IVR) of Safety Basis Controls. 10. Deviations from Technical Safety Requirements. State the actions and reporting to be taken for deviations from TSRs. 5.2.5 Section 6—Design Features

A design features section should be included with the TSR. The purpose of the design features section is to describe in detail those features not covered elsewhere in the TSRs that, if altered or modified, would have a significant effect on safety. The following two areas should be addressed in this section. 1. Vital passive safety SSCs such as piping, vessels, supports, structures (such as confinement), and containers. 2. Configuration or physical arrangement including dimensions, the parameter(s) being controlled, and the reasoning behind the design should be provided as identified in the safety analysis. Examples of such situations are where criticality avoidance is dependent on physical separation and where equipment configuration is used to minimize radiation levels. 5.2.6 Bases Appendix This appendix provides summary statements of the reasons for the SLs, LCSs, LCOs, and associated SRs. The bases show how the numeric values, the conditions, the surveillances, and the ACTION statements fulfill the purpose derived from the safety documentation. The primary purposes for describing the bases of each requirement are to ensure future changes to the requirement will not affect its original intent or purpose by invalidating the safety analysis and to aid in understanding why the requirement exists. The bases appendix should reference the more 30 DOE G 423.1-1A 11-3-2010 specific detailed safety analyses related to the TSR and the derivation of TSR section of the DSA for other related analyses discussed in the DSA. 5.3 Format It is extremely important that the TSR document be both usable by the operations staff and understandable by the Department and any contractor organizations charged with review responsibilities. To these ends, a suggested format is provided in detail in the following sections. This standardized format should minimize the burden on oversight organizations and make any necessary training of operations staff easier. DOE recognizes, however, that wholesale changes for the sake of consistency may be counterproductive to safety. Thus, DOE will approve TSRs in other formats if the contractor provides adequate justification and the requirements of the TSR and DSA rules are met. In particular, the new three-column format recommended by the NRC TSIP provides an advantage in terms of clarity for the operator and is strongly suggested (but not required) for those facilities with complex operations and many safety or operational limits. Additionally, for those facilities with DOE-approved TSs or OSRs, operation with existing documentation is permissible as provided in the TSR rule. 5.3.1 Numbering of Pages, Sections, Tables, and Figures 1. Page Numbering. All page numbers should be centered at the bottom of the page. The following paragraphs describe the page numbering schemes for individual sections of the TSR.  Front Matter Pages. Number the front matter pages with successive lowercase Roman numerals (i, ii, iii, etc.).  Section Pages (except Sections 2 and 3/4). All section page numbers, except for Sections 2 and 3/4, should have two parts: an Arabic number for the section, followed by a dash, and an Arabic number designating the numerical page number within the section. For example, pages in Section 1 would be numbered 1-1, 1-2, 1-3, etc.; likewise, pages in Section 5 would be numbered 5-1, 5-2, 5-3, etc.

 Sections 2 and 3/4 Pages. Sections 2 and 3/4 are subdivided into numerous subsections corresponding to the individual requirement numbers. The first part of each page number for Sections 2 or 3/4 should, therefore, correspond to the subsection number. This subsection number should be followed by a dash and an Arabic number designating the numerical page number within the subsection (e.g., 2.1.1-1, 3/4.1-1, 3/4.1-2, 3/4.2-1, 3/4.2-2, 3/4.2-3; see also the examples in the figures that follow Section 5 of this Guide).  Appendix Pages. Number all pages of appendices, except for the bases appendix, with an alphanumeric number consisting of the appendix letter and the sequential page number separated by a dash. DOE G 423.1-1A 31 11-3-2010  Bases Appendix Pages. All page numbers for the bases appendix should begin with the word “Bases” followed by the section number for the particular section the basis supports (see examples below). —Bases 2.1-1, Bases 2.1-2, . . . —Bases 3/4.0-1, Bases 3/4.0-2, . . . —Bases 3/4.1-1, Bases 3/4.1-2, . . . 2. Paragraph Numbering for Sections 1, 5, and 6. Paragraphs should be numbered hierarchically with successive Arabic numerals separated by decimal points. The following scheme should be used for subordination of paragraphs.  1.1 Major Paragraph  1.1.1 First Subordinate Paragraph  1.1.1.1 First Subdivision of First Subordinate Paragraph  1.2 Second Major Paragraph 3. Numbering for Sections 2 and 3 (Safety Limits, Limiting Control Settings, and Limiting Conditions for Operation). All SLs, LCSs, and LCOs should begin with either 2 or 3, then the number associated with the group, which will be followed by the number of the requirement, per the following examples. (Complex systems may require further subdivision.)  2.11 Reactor Coolant Circulation System  3.10.2.1 Diesel Generator Fuel Oil Tank a. Number SLs beginning with 2.1 and continuing with 2.2, 2.3, etc. Any subdivision of SLs should be numbered with an additional number added to the number of the SL; for example, 2.1.1, 2.1.2, etc. b. Number OLs beginning with 3.1 and continuing with 3.2, 3.3, etc. Any subdivisions of OLs should be numbered with an additional number added to the number of the LCS (e.g., 3.2.2, 3.2.3, 3.2.4). OLs should be grouped by principal system or function and each OL within a group should be numbered sequentially. LCSs are normally the first requirements within a group. For reactors, normally all OLs can be put into the following groups. 0. Limiting Condition for Operability 1. Reactivity Control 2. Core Power Distribution 32 DOE G 423.1-1A 11-3-2010 3. Instrumentation 4. Coolant System 5. Safety Systems 6. Confinement/Containment 7. Plant Systems 8. Electrical Systems 9. Experiment Facilities 10. Rad Waste Systems 11. Special Tests 12. Refueling Requirements 13. Spent Fuel Pool Requirements For less complex reactor facilities, omit any inappropriate groups above (except 0) but retain the same numbering scheme to indicate that a group was omitted. Add other groups as necessary. For nonreactor nuclear facilities, standardized grouping of requirements is more difficult because of the diversity of facilities; however, many facilities will have the following. 0. Limiting Condition for Operability 1. Criticality, Radioactivity, and Hazardous Material Alarm Systems 2. Confinement/Ventilation 3. Fire Detection and Suppression 4. Emergency Power

5. Chemical Systems 6. Instrumentation 7. Experimental Facilities For less complex nonreactor facilities, omit any inappropriate groups above but retain the same numbering scheme to indicate that a group was omitted. Add other groups as necessary. DOE G 423.1-1A 33 11-3-2010 c. ACTION statements should be lettered with uppercase letters. Subdivisions of ACTION statements should be numbered 1, 2, 3, etc. (See Figure 10a for an example of numbering of LCO and ACTION statements.) 4. Numbering for Section 4 (Surveillance Requirements). SRs should be designated with numbers beginning with 4. The second number should correspond to the grouping scheme used for the LCS or the LCO, and the third number in the sequence indicates the LCS or the LCO that this surveillance principally supports. Hence, the SRs will have numbers the same as the LCS or the LCO that they support except for the first number, which will be a “4” instead of a “3.” Subdivisions should be identified with a lowercase letter and indented; further subdivisions should be labeled consecutively with a number enclosed in parentheses [e.g., (1), (2), etc.] and should be indented from the letter. 5. Numbering Bases (Bases Appendix). Bases are numbered in accordance with the number of the SL, LCS, or LCO that they support. 6. Numbering Tables. All tables should be located as close as possible after the place where they are first referenced. Where tables and figures are both referenced in a specification, present the tables before the figures. Table numbers in Sections 2 and 3/4 should begin with the number of the specification to which they apply, followed by a dash, and then sequential Arabic numerals. Example Table Numbers for Section 3/4 Table 3.3.1-1. Title Table 4.2.5-1. Title Numbers of tables in the bases appendices should begin with the words “Bases Table” and the subsection number that they support, followed by a dash and then sequential Arabic numbers. Example Table Numbers for Bases Appendix Bases Table 3/4.1-1. Title Bases Table 3/4.2-1. Title Table numbers in all other sections should begin with the applicable section number followed by a dash and then sequential Arabic numbers. Example Table Numbers for Sections Other Than Bases and Sections 2 and 3/4 Table 5-1. Title, (Sheet 1 of 6) Table 5-2. Title 34 DOE G 423.1-1A 11-3-2010 For multiple-page tables in all sections, use the phrase (Sheet 1 of __, Sheet 2 of __, etc.) after the table title (see example above). 7. Numbering Figures. All figures should be located as near as possible after the place where they are first referenced. Figure numbers in Sections 2 and 3/4 should begin with the number of the requirement to which they apply, followed by a dash, then sequential Arabic numbers. Example Figure Numbers for Section 3/4 Figure 2.1.1-1. Title Figure 3/4.2.1-1. Title Figure 3/4.2.5-1. Title Figure numbers in the bases appendixes should begin with the words “Bases Figure” and the subsection number that they support, followed by a dash and then sequential Arabic numbers. Example Figure Numbers for Bases Appendix Bases Figure 2.1-1. Title. Bases Figure 3/4.2-1. Title. Figure numbers in all other sections should begin with the applicable section number followed by a dash and then sequential Arabic numbers. For multiple-page figures in all sections, use the phrase (Sheet 1 of __, Sheet 2 of __, etc.) after the figure title. Example Figure Numbers for Sections Other Than Sections 2 and 3/4 and Appendix

Figure 5-1. Title, (Sheet 1 of 6). Figure 5-2. Title. 5.3.2 Page Headings Use uppercase letters in the page headings for consistency and to set the headings apart from the body text. Separate the heading information from the body of the requirement by a solid horizontal line across the entire page (see Figures 9a and 9b). 5.3.3 Continuation Pages Use the word “continued” in parentheses and in lowercase letters to denote continuation of a grouping of ACTION statements, surveillances, or bases to the next page (see Figures 13 and 15). DOE G 423.1-1A 35 11-3-2010 Example Page Headings Example 1. 3/4.4 REACTOR COOLANT SYSTEM 3.4.2 PRESSURE PROTECTION SET POINTS Example 2. 3/4.6 CONFINEMENT SYSTEMS 3.6.2 AIR CLEANING SYSTEM Example 3. 3/4.6 CONFINEMENT SYSTEMS 4.6.1 SURVEILLANCE REQUIREMENTS (continued) 5.3.4 Highlighting Various forms of highlighting may be used to improve visibility of the information presented. These include the following. 1. Bolding. Bold type may be used to highlight the major headings, table column headings, and to emphasize especially important information. Notes can also be in bold type for added emphasis. 2. Spatial Dedication. The SL, LCS, and LCO requirements may be offset or indented so that this information stands out from the surrounding text. Recognition and separation of the SL, LCS, and LCO requirements allows this information to be more quickly and easily located and scanned without interference from the surrounding text. Also, the SL, LCS, and LCO mode applicability headings may be separated by extra “white space” (blank lines), allowing for quick recognition and scanning of specific information. 3. Delimiters. Delimiters function as visual cues for the user, signaling the beginning and/or end of specific segments of information (two independent requirements on the same page, for example). Delimiters may take the form of two closely spaced horizontal lines, one dark, heavy line, a series of dark dashes, or any similar prominent marking. 4. Underscoring. Underscoring is an effective way of adding emphasis to specific information, when properly used; however, it tends to lose its effectiveness when used too much. For this reason, underscoring should be used only to add emphasis to logical connectors (AND, OR, etc.). 36 DOE G 423.1-1A 11-3-2010 5.3.5 Use of Logic Terms (AND, OR, IF, BUT, etc.) Logic terms should be used as little as possible. In preparing TSRs, try to avoid logic terms. When they must be used, the following guidelines apply.  All logic terms should be underscored, in uppercase bold type, and flush left between the two (or more) sets of connected conditions to which they apply.  AND should be used to connect two or more sets of criteria that must both (all) be satisfied for a given logical decision. If more than two sets of conditions are required, a list format is preferable.  OR should be used to denote alternative combinations or conditions, meaning either one or the other. Because it can be misinterpreted, the use of OR should be avoided whenever possible.  When action steps are contingent upon certain conditions, terms such as IF, BUT, IF NOT, etc., may be used as appropriate; however, use of such terms should be kept to a minimum. Where possible, rewrite the condition so the logic term is not needed. 5.3.6 Notes and Cautions

Notes and cautions should not normally occur within the context of the TSR. The TSR in itself is a compendium of potential cautions, and notes often indicate that the basic explanation is inadequate. When notes or cautions are necessary, the following apply.  Cautions should precede the information to which they refer, with no other intervening information. Notes may be placed before or after the text they amplify, whichever is most appropriate. All notes and cautions should be preceded by the centered heading “NOTE” or “CAUTION” in uppercase, bold type. Text in the note or caution statement should be bold type, indented from both sides of the page. Cautions should be delimited from standard text.  Notes and cautions pertaining to information inside the action and SR statements should be placed before the information to which they apply, with no other intervening information. 5.3.7 Tables When the volume of tabular information to be presented is small, consider integrating the information in text rather than using a separate table. When tables are necessary, they should be located as conveniently as possible for the user. They should have a formal title and number. DOE G 423.1-1A 37 11-3-2010 5.3.8 Body of Section 1—Use and Application This section is expected to be mostly text, so it should take the form of paragraphs numbered in accordance with Section 5.3.1. Other forms of input should follow the guidance outlined in Section 5.3. 5.3.9 Body of Section 2—Safety Limits SLs should be presented in the single-column format shown in Figures 8a and 8b or the three- column format shown in Figure 8c. The page heading, as described in Section 5.3.2, should be to the left margin of the page. The SL, denoted by the acronym SL, should follow, separated by at least one blank line from other text (see examples in the figures that follow this section). If the requirement has subdivisions, they should follow on separate lines and be indented. Below the requirement, with sufficient space left above to make the requirement stand apart, the word “APPLICABILITY” should appear at the left margin, in bold uppercase letters, followed by a colon (also bold). On the same line should be the applicability modes or other conditions. Below the applicability statement, separated by at least one blank line, the word “ACTIONS,” in bold, uppercase letters, followed by a bold colon, should appear. The ACTION statements should follow, indented from the left margin and labeled with capital letters. Subdivisions of the ACTION statements should be further indented and numbered. 5.3.10 Body of Section 3/4—Limiting Control Settings, Limiting Conditions for Operation, and Surveillance Requirements Figures 9a–9b, 10a–10b, and 11a–11c are examples of the way information for Section 3/4 should be presented. The page headings should be as described in Section 5.3.2 and should be to the left-hand margin of the page. Below the heading and indented should be the letters “LCS” or “LCO” in bold uppercase letters. This should be followed on the same line by a colon and then the requirement. For simple requirements a sentence or two may suffice, while for a complex requirement subdivisions may be necessary. Use uppercase letters for the main divisions and indented numbers as the first subcategory. Use indented lowercase letters for the next division, if necessary. If further division appears to be necessary, consider making an entire new requirement within the main group.

Below the requirement, separated by at least one blank line, the word “APPLICABILITY” should appear at the left margin, in bold, uppercase letters. On the same line should be the applicability modes or other conditions. Below the applicability statement, again, separated by at least one blank line, should appear the word “ACTIONS” in bold, uppercase letters. The ACTION statements should follow. The main divisions and subdivisions of the ACTION statements should be numbered/lettered according to conventional outlining practices or as described above for requirements. 38 DOE G 423.1-1A 11-3-2010 SRs should follow the ACTION statements, separated by at least one blank line. They should be labeled by the title (surveillance requirements) in bold, uppercase letters. The surveillance statement should include the surveillance number; a statement of the requirement (with indented subdivisions, if necessary); and an indication of the frequency. Examples of the suggested format for SRs are given in Figures 11b, 11c and 13. Additional examples of the three-column format have been developed by DOE for specific types of SSCs and are available in the Defense Programs TSR Document of Examples, Technical Safety Requirements, November 1993. 5.3.11 Body of Sections 5 and 6—Administrative Controls and Design Features These sections are expected to be mostly text, possibly with tables, so they should take the form of paragraphs numbered in accordance with Section 5.3.1 of this Guide. 5.3.12 Body of Bases Appendix The body of the bases appendix should be presented in the format shown in Figure 21. The page heading should be that described in Section 5.3.2, with the number of the SL, LCS, or LCO and the same title used in that requirement. Below the requirement number and title (B3/4.4 PRESSURE LIMITS in Figure 21, for example), the word BASES in bold, uppercase letters should be at the left margin, followed by a delimiter and the bases themselves. 5.4 Changes to Technical Safety Requirements Changes to the TSR should be designated in the following manner:  a list of pages in effect with page number and date,  a record of revision pages,  sidebar changes in the TSR text, and  each page should contain the page number, document number, and the revision number. DOE G 423.1-1A 39 11-3-2010 TABLE OF CONTENTS Section 1 Use and Application 1.1 DEFINITIONS .....................................................................................................................1 1.2 OPERATIONAL MODES ..................................................................................................1 1.3 FREQUENCY NOTATIONS ..............................................................................................2 1.3.1 Frequency Codes ......................................................................................................2 1.4 MODE APPLICABILITY SUMMARY .............................................................................4 Section 2 Safety Limits 2.1 POWER LIMITS ................................................................................................................6 2.2 PRESSURE LIMITS ...........................................................................................................7 2.3 TEMPERATURE LIMITS .................................................................................................7 Section 3/4 Operational Limits and Surveillance Requirements

3. GENERAL APPLICATION. ................................................................................................. 3.1 REACTIVITY CONTROL SYSTEMS ................................................................................ 3.1.1 Control Bank Insertion Limits .................................................................................. 3.1.2 Core Reactivity ......................................................................................................... 3.2 INSTRUMENTATION ......................................................................................................... Section 5 Administrative Controls Section 6 Design Features Appendix A TSR Bases ..................................................... ................................................... A-1 Appendix B .................................................................................................................................... Figure 1. Example Table of Contents for a Nuclear Reactor Facility TSR. 40 DOE G 423.1-1A 11-3-2010 TABLE OF CONTENTS Section 1 Use and Application 1.1 DEFINITIONS .....................................................................................................................1 1.2 OPERATIONAL MODES ..................................................................................................1 1.3 FREQUENCY NOTATIONS ..............................................................................................3 1.3.1 Frequency Codes ......................................................................................................4 1.4 MODE APPLICABILITY SUMMARY .............................................................................5 Section 2 Safety Limits 2.1 High Level Waste Storage Tank Pressure ............................................................................ Section 3/4 Operational Limits and Surveillance Requirements 3.0 GENERAL APPLICABILITY ............................................................................................. 3.1 CRITICALITY, AND RADIOACTIVITY ALARM SYSTEMS ........................................ 3.1.1 Criticality Alarms ...................................................................................................... 3.1.2 Area Monitors ........................................................................................................... 3.2 VENTILATION SYSTEMS .................................................................................................. 3.2.1 HEPA Filters .............................................................................................................. 3.2.2 Fire Screens ................................................................................................................ Section 5 Administrative Controls Section 6 Design Features Appendix A TSR Bases ........................................................................................................ A-1 Appendix B .................................................................................................................................... Figure 2. Example Table of Contents for a Nonreactor Nuclear Facility TSR. DOE G 423.1-1A 41 11-3-2010 LIST OF TABLES 2-1 Reactor Core Safety Limits ...............................................................................................15 2.2-1 Decay Heat Removal Rate Versus Shutdown Time .........................................................18

3.3-1 Control Rod Withdrawal Limits Versus Mode .................................................................35 3.4-1 Maximum Power Level Versus Primary Pump Configuration ..........................................40 4.3-1 Control Rod Surveillance ...................................................................................................50 Figure 3. Example List of Tables for a Nuclear Reactor Facility TSR. LIST OF TABLES 3-1 Limiting Control Settings .................................................................................................25 3.3-1 Criticality, Radioactivity, and Chemical Alarm Sensors ...................................................30 3.4-1 Fire Detection Sensor. ........................................................................................................32 4.3-1 Criticality Alarm Surveillances ..........................................................................................45 Figure 4. Example List of Tables for a Nonreactor Nuclear Facility TSR. 42 DOE G 423.1-1A 11-3-2010 LIST OF FIGURES 3-1 Maximum Vessel Pressure Versus Metal Temperature .....................................................25 3.3-1 Maximum Control Rod Withdrawal Versus Power ...........................................................30 3.4-1 Minimum Reactor Coolant Flow Versus Power ................................................................34 Figure 5. Example List of Figures for a Nuclear Reactor Facility TSR. LIST OF FIGURES 3.3-1 Location of Criticality Alarm Sensors ..............................................................................26 3.4-1 Location of Fire Detection Sensors ....................................................................................35 Figure 6. Example List of Figures for a Nonreactor Nuclear Facility TSR. DOE G 423.1-1A 43 11-3-2010 DEFINITIONS ACTION. The steps listed in each requirement that are required to be performed when the specified LIMITING CONDITIONS FOR OPERATION are not met. ACTUATION LOGIC TEST. The application of various simulated input signal combinations in conjunction with each possible interlock logic state and verifying the required logic output. Will include, as a minimum, a continuity check of output devices ANALOG CHANNEL OPERATIONAL TEST. Injection of a simulated signal into . . . Note: Terms defined in this list appear in uppercase type throughout these Technical Safety Requirements. Figure 7. Example Definitions List. 44 DOE G 423.1-1A 11-3-2010 RCS SL 2.1 SAFETY LIMITS 2.1.1 REACTOR COOLANT SYSTEM (RCS) PRESSURE SAFETY LIMIT SL: The RCS shall be maintained < 1000 psia APPLICABILITY: Operation Mode ACTIONS: 1. Go to SHUTDOWN mode IMMEDIATELY, 2. Notify the DOE CSO within one hour of reaching SHUTDOWN mode, and 3. Prohibit facility operation until authorized by DOE. HFR TSR 2.1-5 Rev.0 9/13/01 Figure 8a. Example of Safety Limit for a Nuclear Reactor Facility. DOE G 423.1-1A 45 11-3-2010 Heating Glovebox Temperatures SL 2.1 SAFETY LIMITS 2.1.1 HEATING GLOVEBOX, HEATING TEMPERATURE SAFETY LIMIT SL: The Safety Limit shall be the minimum auto-ignition temperature for the unstable material in the heating glovebox. MODE APPLICABILITY: All modes when unstable material and plutonium are present in the heating glovebox. ACTIONS TO TAKE 1. IMMEDIATELY evacuate the facility of all personnel.

ON SL VIOLATION: 2. Power to the affected heating glovebox shall be IMMEDIATELY interrupted in a safe manner as determined by the Facility Manager or alternate. Remote shutdown of all power to the facility should be considered as an alternative to entering the facility to shutdown only the affected heating glovebox. 3. Perform the Actions associated with Sections 5.3.2.1. TSR 2.1-5 Rev. 0 9/13/01 Figure 8b. Example of Safety Limit for a Nonreactor Nuclear Facility. 46 DOE G 423.1-1A 11-3-2010 RCS SL 2.1 SAFETY LIMITS 2.1.1 REACTOR COOLANT SYSTEM (RCS) PRESSURE SAFETY LIMIT SL: The RCS shall be maintained < 1000 psia MODE APPLICABILITY: Operation Mode ACTIONS: CONDITIONS REQUIRED ACTION COMPLETION TIME A. The RCS exceeds the Safety Limit (1000 psia). A.1. Go to SHUTDOWN mode. IMMEDIATELY AND A.2. Notify the DOE CSO. Within one hour of reaching SHUTDOWN mode AND A.3. Prohibit facility operation. Until authorized by DOE HFR TSR 2.1-5 Rev. 0 9/13/01 Figure 8c. Example of Safety Limit for a Nuclear Reactor Facility in Three-Column Format. DOE G 423.1-1A 47 11-3-2010 Heating Glovebox LCS 3/4.2 LIMITING CONTROL SETTINGS 3.2 HEATING GLOVEBOX, HEATING TEMPERATURE LIMITING CONTROL SETTING LCS: The temperature setting of the Temperature Control Heating Shutoff shall be no greater than the Safety Limit (SL 2.1) minus 36 o C. MODE APPLICABILITY: Operational and Maintenance when unstable materials and Plutonium are present in the heating glovebox ACTIONS: CONDITIONS REQUIRED ACTION COMPLETION TIME A. The temperature setting in the temperature control heating shutoff exceeds the Safety Limit (SL 2.1) minus 36 o C. A.1. Shutoff power to the heaters in the affected heating glovebox. IMMEDIATELY AND A.2. Evacuate the facility of all personnel, except for those directly involved with corrective actions. IMMEDIATELY AND A.3. Repair and functionally test the affected heating glovebox and equipment. Before returning power to the heaters in the affected heating glovebox. TSR 3/4.2-5 Rev. 0 9/13/01 Figure 9a. Example of Limiting Control Settings. 48 DOE G 423.1-1A 11-3-2010 Coolant Pressure LCS 3/4.4 LIMITING CONTROL SETTINGS 3/4.4.3 COOLANT PRESSURE LCS: Maintain Coolant system below 100 psia MODE APPLICABILITY: All Modes. ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME Pressure > 100 psia Open Relief Valve 15 minutes SURVEILLANCE REQUIREMENTS SURVEILLANCE REQUIREMENT FREQUENCY SR 3/4.2.3.1 Verify Pres. < 100 psia Shiftly (each shift) SR 3/4.2.3.2 Verify Pres. Relief Set Point = 95 +/- 4 psia Shiftly (each shift) HFR TSR 3/4.4-11 Rev. 0 9/13/01 Figure 9b. Example of Limiting Control Settings in Three-Column Format. DOE G 423.1-1A 49 11-3-2010 Heating Glovebox LCO 3/4.3 LIMITING CONDITIONS FOR OPERATION 3.2 HEATING GLOVEBOX TEMPERATURE SHUTOFF CONTROL SYSTEM LCO: Each Heating Glovebox shall have two OPERABLE Heating Glovebox Temperature Control Shutoff systems and one OPERABLE temperature recorder. MODE APPLICABILITY: Operation and Maintenance when unstable materials are present in the heating glovebox and plutonium is present ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. One heating glovebox temperature control shutoff is not OPERABLE OR the temperature recorder is not OPERABLE A.1 Shutoff power to the heaters in the affected heating glovebox. AND A.2 Repair the affected heating glovebox and equipment IMMEDIATELY

Before returning power to the heaters in the affected heating glovebox. B. Both heating glovebox temperature control shutoffs are not OPERABLE. B.1 Shutoff power to the heaters in the affected heating glovebox. AND B.2 Repair the affected heating glovebox and equipment. IMMEDIATELY Before returning power to the heaters in the affected heating glovebox. TSR 3/4.3-16 Rev. 0 9/13/01 Figure 10a. Example of LCO for Heating Glovebox. 50 DOE G 423.1-1A 11-3-2010 ECCS LCO 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3/4.5.2 ECCS-OPERATING LCO: Two ECCS trains shall be OPERABLE MODE APPLICABILITY: MODES 1 and 2 MODE 3 with pressurizer pressure <  [1700] psia. ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. One or more trains inoperable. OR At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is available. A.1 Restore train(s) to OPERABLE status. 72 hours B. Required Action and associated Completion Time not met. B.1 Be in MODE 3. AND B.2 Reduce pressurizer pressure to < [1700] psia. 6 hours 12 hours HFR TSR 3/4.5-11 Rev. 0 9/13/01 Figure 10b. Example of LCO in Three-Column Format. DOE G 423.1-1A 51 11-3-2010 GENERAL LIMITING CONDITIONS FOR OPERATION (LCOS) 3.0.X LCO 3.0.1 LCOs shall be met during the MODES or other specified conditions in the Applicability, except as provided in LCO 3.0.2. LCO 3.0.2 Upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. If the LCO is restored before the specified completion time(s) expires, completion of the ACTION is not required, unless otherwise stated. LCO 3.0.3 When an LCO statement is not met and the associated ACTIONS are not met, or when an associated ACTION is not provided, the facility shall be placed in a MODE or other specified condition in which the LCO is not applicable. If the LCO is applicable in all MODES, the facility shall be placed in the safest MODE. Activities shall be initiated to place the affected PROCESS AREA(S) or facility in STANDBY within 1 hour. The affected PROCESS AREA or facility shall be in STANDBY within 12 hours. Where corrective measures are completed that permit operation in accordance with the LCO or ACTIONS, completion of the ACTIONS required by LCO 3.0.3 are not required. LCO 3.0.3 is applicable in all MODES. Exceptions to LCO 3.0.3 may be stated in the individual LCOs. LCO 3.0.4 When an LCO is not met, a MODE or other specified condition in the Applicability shall not be entered, except when the associated ACTIONS to be entered permit continued operation in the MODE or other specified condition in the Applicability for an unlimited period of time. LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. Exceptions to LCO 3.0.4 are stated in the individual LCOs. When an individual LCO states that LCO 3.0.4 does not apply, it allows entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered permit operation in the MODE or other specified condition for only a limited time. LCO 3.0.5 Equipment removed from service or declared inoperable to comply with ACTIONS may be returned to service under administrative control solely to perform testing required to demonstrate its OPERABILITY or the OPERABILITY of other equipment. This is an exception to LCO 3.0.2 for the system returned to service under administrative control to perform the testing required to demonstrate OPERABILITY.

LCO 3.0.6 When a support system is declared inoperable, the supported systems are also required to be declared inoperable. However, only the support system’s ACTIONS are required to be entered, provided they reflect the supported system’s degraded safety condition. This is a clarification of the definition of OPERABILITY. Figure 11a. Example of General Application LCOs. 52 DOE G 423.1-1A 11-3-2010 4.0.X GENERAL SURVEILLANCE 3/4 OPERATING LIMITS AND SURVEILLANCE REQUIREMENTS 3/4.0 GENERAL APPLICATION SURVEILLANCE REQUIREMENTS 4.0.1 SURVEILLANCE REQUIREMENTS shall be met during the Operational Modes or other conditions specified for individual LCS and LCOs unless otherwise stated in an individual SURVEILLANCE REQUIREMENT. 4.0.2 Each SURVEILLANCE REQUIREMENT shall be performed with the specified frequency. 4.0.3 Failure to perform a SURVEILLANCE REQUIREMENT within 1.25 times the specified time interval (TSR violation) shall constitute a failure to meet the OPERABILITY requirements for a LIMITING CONDITION FOR OPERATION. Exceptions are stated in the individual requirements. Surveillances do not have to be performed on inoperable equipment. 4.0.4 Entry into an Operational Mode or other specified condition shall not be made unless the SURVEILLANCE REQUIREMENT(S) associated with the LIMITING CONDITION FOR OPERATION has been performed within the stated surveillance interval or as other otherwise specified. HFR TSR 4.0-17 Rev. 0 9/13/01 Figure 11b. Example of General Application for Surveillance. DOE G 423.1-1A 53 11-3-2010 Pressurizer Safety Valves SRs SURVEILLANCE REQUIREMENTS SURVEILLANCE REQUIREMENT FREQUENCY SR 3/4.5.10.1 Verify each pressurizer safety valve is OPERABLE as per In-service Testing Program. After testing, lift settings must be within 1%. Shiftly (each shift) HFR TSR 3/4.5-17 Rev. 0 9/13/01 Figure 11c. Example of Surveillance Requirements in Two-Column Format. 54 DOE G 423.1-1A 11-3-2010 3/4.3 FIRE DETECTION AND SUPPRESSION 3.3.1 FIRE DETECTION INSTRUMENTATION LCO: The fire detection instrumentation, associated isolation damper interlocks, and alarm system for each fire area in Table 3.3.1-1 shall be OPERABLE. AND At least half of the total fire detectors in a fire area shall be OPERABLE. MODE APPLICABILITY: OPERATION, STANDBY, PARTIAL SHUTDOWN, FULL SHUTDOWN, and OUTAGE PROCESS AREA APPLICABILITY: [area 1] ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. More than half of the total fire detectors in a fire area are inoperable. A.1 Restore the inoperable fire detectors to OPERABLE status. 14 days B. The ACTION and associated completion time of Condition A are not met. OR Two or more adjacent fire detectors in a fire area are inoperable. B.1 Establish a fire watch patrol to inspect the area(s). AND B.2 Inspect the area(s). 1 hour Hourly C. Any fire alarm or isolation damper interlock is inoperable. C.1 Establish a fire watch patrol to inspect the area(s). AND C.2 Inspect the area(s). 15 minutes Hourly TSR 3/4.3-5 Rev. 0 9/13/01 Figure 12. Example of Fire Detection Instrumentation LCOs. DOE G 423.1-1A 55 11-3-2010 3/4.3 FIRE DETECTION AND SUPPRESSION 3.3.1 FIRE DETECTION INSTRUMENTATION (continued) SURVEILLANCE REQUIREMENTS SURVEILLANCE REQUIREMENT FREQUENCY SR 4.3.1.1 Perform a TRIP ACTUATING DEVICE OPERATIONAL TEST on each fire detector instrument. Semiannually SR 4.3.1.2 Demonstrate that the NFPA Standard 72D supervised circuits supervision associated with the detector alarms of each fire detection instrument are OPERABLE.

Semiannually SR 4.3.1.3 Demonstrate that the unsupervised circuits associated with the detector alarms between the instrument and the control room are OPERABLE. Monthly TSR 3/4.3-6 Rev. 0 9/13/01 Figure 13a. Example of Fire Detection Instrumentation Surveillance Requirements. 56 DOE G 423.1-1A 11-3-2010 3/4.3 FIRE DETECTION AND SUPPRESSION 3.3.1 FIRE DETECTION INSTRUMENTATION (continued) TABLE 3.3.1-1. Fire Detection Instruments (for areas taken credit for in the safety analysis) Sheet 1 of 2 Total Number of Instruments Instrument Location [Illustrative] Heat Flame Smoke 1. Primary Containment a. Zone 1 b. Zone 2 c. Zone 3 2. Secondary Containment a. Zone 1 b. Zone 2 c. Zone 3 3. Tertiary Containment a. Zone 1 b. Zone 2 c. Zone 3 4. Gloveboxes a. b. c. 5. Hot Cells a. b. c. 6. Ventilation Ducts a. b. c. TSR 3/4.3-7 Rev. 0 9/13/01 Figure 13b. Example of Fire Detection Instrumentation Surveillance Requirements. DOE G 423.1-1A 57 11-3-2010 3/4.3 FIRE DETECTION AND SUPPRESSION 3.3.1 FIRE DETECTION INSTRUMENTATION (continued) TABLE 3.3.1-1. Fire Detection Instruments (for areas taken credit for in the safety analysis) (continued) Sheet 2 of 2 Total Number of Instruments Instrument Location [Illustrative] Heat Flame Smoke 7. Battery Room a. b. c. 8. Diesel Generators a. Zone 1 b. Zone 2 c. Zone 3 9. Engineered Safety Feature Cubicles(s) a. b. c. 10. Safety-Related Instrumentation a. b. c. [List all detectors in area required to ensure the OPERABILITY of safety-related equipment] TSR 3/4.3-8 Rev. 0 9/13/01 Figure 13b. Example of Fire Detection Instrumentation Surveillance Requirements (continued). 58 DOE G 423.1-1A 11-3-2010 Fire Suppression Water System LCO 3/4.3 FIRE DETECTION AND SUPPRESSION 3.3.2 FIRE SUPPRESSION WATER SYSTEM LCO: The Fire Suppression Water System shall be OPERABLE with— a. At least [two] fire suppression pumps, each with a capacity of [2500] gpm, with their discharge aligned to the fire suppression header b. Separate water supplies, each with a minimum usable volume of [ ] gallons c. An OPERABLE flow path capable of taking suction from the [ ] tank and the [ ] tank and transferring the water through distribution piping with OPERABLE sectionalizing control or isolation valves to the yard hydrant curb valves, the last valve ahead of the water flow alarm device on each sprinkler or hose standpipe, and the last valve ahead of the deluge valve on each Deluge or Spray System required to be OPERABLE in accordance with LCO 3.2.5. MODE APPLICABILITY: OPERATION, STANDBY, PARTIAL SHUTDOWN, FULL SHUTDOWN, and OUTAGE PROCESS AREA APPLICABILITY: [area 2] ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. One pump and or water supply is inoperable. A.1.1 Restore the inoperable equipment to OPERABLE status. OR A.1.2 Provide an alternative backup pump or supply. 5 days 7 days B. The Fire Suppression Water System is inoperable for reason other than those in Condition A. B.1 Provide a backup Fire Suppression Water System. 24 hours TSR 3/4.3-9 Rev. 0 9/13/01 Figure 14. Example of Fire Suppression Water System LCO. DOE G 423.1-1A 59 11-3-2010 3/4.3 FIRE DETECTION AND SUPPRESSION 3.3.2 FIRE SUPPRESSION WATER SYSTEM (continued) SURVEILLANCE REQUIREMENTS SURVEILLANCE REQUIREMENT FREQUENCY SR 4.3.2.1 Verify that the contained water supply volume contains [ ] gallons. Weekly

SR 4.3.2.2 On a STAGGERED TEST BASIS, start each electric motor-driven pump, and operate it for at least 15 minutes on recirculation flow. Monthly SR 4.3.2.3 Verify that each valve (manual, power- operated, or automatic) in the flow path is in its correct position. Monthly SR 4.3.2.4 Verify that a system flush was performed. Semiannually SR 4.3.2.5 Cycle each testable valve in the flow path through at least one complete cycle of full travel. Annually SR 4.3.2.6 Verify that each automatic valve in the flow path is actuated to its correct position. 18 Months SR 4.3.2.7 Verify that each pump develops at least [2500] gpm at a system head of [250] feet 18 Months SR 4.3.2.8 Cycle each valve in the flow path that is not testable during plant operation through at least one complete cycle of full travel. 18 Months SR 4.3.2.9 Verify that each fire suppression pump starts sequentially to maintain the Fire Suppression Water System pressure ≥ [ ] psig. 18 Months SR 4.3.2.10 Perform a flow test of the system in accordance with NFPA 25, Sections 3-3.1, 4- 4.1.1, 5-3.3.1, 8-3.5, 94.3.2.2, 9-4.4.2.2.2, and Table 7-4, as applicable. 3 Years TSR 3/4.3-10 Rev. 0 9/13/01 Figure 15. Example of Fire Suppression Water System Surveillance Requirements. 60 DOE G 423.1-1A 11-3-2010 3/4.1 CRITICALITY PREVENTION 3.1.1 INVENTORY MATERIAL LIMIT IN PROCESS STREAM LCO: The total FISSILE MATERIAL inventory in all gloveboxes and transport conveyors in the [facility] shall not exceed [ ] kg. MODE APPLICABILITY: OPERATION, STANDBY, and PARTIAL SHUTDOWN PROCESS AREA APPLICABILITY: [area 3] ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. The FISSILE MATERIAL inventory limit for a glovebox is exceeded. OR B. The FISSILE MATERIAL inventory limit for the facility gloveboxes and transport conveyors is exceeded. - - - - - NOTE - - - - - - Action A.2 should involve the Criticality Safety Section. - - - - - - - - - - - - - - - - - A.1 Enter STANDBY if in OPERATION, and stop all FISSILE MATERIAL transfers, handling, and sampling in the affected equipment. AND A.2 Develop and implement an approved plan to return the affected gloveboxes or transport conveyors inventory to within bounds of the specified limit. IMMEDIATELY Before resuming OPERATION TSR 3/4.1-11 Rev. 0 9/13/01 Figure 16. Example of Criticality Prevention TSR. DOE G 423.1-1A 61 11-3-2010 3/4.3 CRITICALITY PREVENTION 3.3.1 INVENTORY MATERIAL LIMIT IN PROCESS STREAM (continued) ACTIONS (continued) SURVEILLANCE REQUIREMENTS SURVEILLANCE REQUIREMENT FREQUENCY SR 4.3.1.1 Verify that the posted inventory in each glove box and transport conveyor is not exceeded. Shiftly (each shift) SR 4.3.1.2 Verify that the posted glovebox limit or transport conveyor limit will not be exceeded by beginning a new batch, transfer, or process operation in that equipment. Before beginning a new batch, transfer, or process operation TSR 3/4.1-12 Rev. 0 9/13/01 Figure 16. Example of Criticality Prevention TSR (continued). 62 DOE G 423.1-1A 11-3-2010 Criticality Alarm LCO 3/4.1 INSTRUMENTATION 3.1.7 CRITICALITY ALARMS LCO: Two Criticality Alarm Channels shall be OPERABLE for each monitored area listed below, with administratively controlled alarm set points set to actuate audible and visual alarms in the monitored area and the control room. MODE APPLICABILITY: OPERATION, STANDBY, and PARTIAL SHUTDOWN PROCESS AREA APPLICABILITY: [Product Receiving Area] [Recovery Room] [Process Room] [Recovery Room Mezzanine]

ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. One Criticality Alarm Channel in any monitored area is inoperable. A.1 Restore inoperable channel to OPERABLE status. 24 Hours B. The ACTION and associated completion time of Condition A are not met. B.1 Place the [ ] in PARTIAL SHUTDOWN. AND B.2 Restore inoperable channel to OPERABLE status. 1 Hour 4 Hours C. Two Criticality Alarm Channels in any monitored area are inoperable. C.1 Place the [ ] in PARTIAL SHUTDOWN. AND C.2 Restore at least one inoperable channel in OPERABLE status. 1 Hour 2 Hours D. The ACTION(s) and associated completion times of Conditions B or C are not met. D.1 Place the [ ] in FULL SHUTDOWN. 6 Hours TSR 3/4.1-13 Rev. 0 9/13/01 Figure 17. Example of Criticality Alarm TSR. DOE G 423.1-1A 63 11-3-2010 Criticality Alarm SRs 3/4.1 INSTRUMENTATION 3.1.7 CRITICALITY ALARMS (continued) SURVEILLANCE REQUIREMENTS SURVEILLANCE REQUIREMENT FREQUENCY SR 4.1.7.1 Perform a CHANNEL CHECK. Shiftly (each shift) - - - - - - - - - - - - - - NOTE - - - - - - - - - - - - - Test includes actuation of both visual and audible alarms in the control room and the monitored area. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SR 4.1.7.2 Perform a CHANNEL FUNCTIONAL TEST. Semiannually SR 4.1.7.3 Perform a CHANNEL CALIBRATION. Annually TSR 3/4.1-14 Rev. 0 9/13/01 Figure 17. Example of Criticality Alarm TSR (continued). 64 DOE G 423.1-1A 11-3-2010 3/4.1 CRITICALITY PREVENTION 3.1.1 EVAPORATION LEVEL AND SPECIFIC GRAVITY INSTRUMENTATION LCO: The evaporator LOW Level/Steam Flow Interlock shall be OPERABLE with a set point greater than or equal to XX. AND The evaporator High Specific Gravity/Steam Flow Interlock shall be OPERABLE with a set point less than or equal to YY.______________. MODE APPLICABILITY: OPERATION PROCESS AREA APPLICABILITY: Evaporators that handle fissile material. ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. The Evaporator Low Level/Steam Flow Interlock is inoperable. The FISSILE MATERIAL inventory limit for a glovebox is exceeded. A.1 Stop the steam supply to the evaporator. AND A.2 Place the evaporator in STANDBY. IMMEDIATELY 8 Hours B. The Evaporator High Specific Gravity/Steam Flow Interlock is inoperable. B.1 Stop the steam supply to the evaporator. AND B.2 Place the evaporator in STANDBY. IMMEDIATELY 8 Hours TSR 3/4.1-15 Rev. 0 9/13/01 Figure 18. Example of Criticality Prevention TSR. DOE G 423.1-1A 65 11-3-2010 3/4.1 CRITICALITY PREVENTION 3.1.1 EVAPORATOR LEVEL AND SPECIFIC GRAVITY INSTRUMENTATION (continued) SURVEILLANCE REQUIREMENTS SURVEILLANCE REQUIREMENT FREQUENCY SR 3.3.1.1 Perform a FUNCTIONAL TEST on each evaporator Low Level/Steam Flow Interlock. Semiannually SR 3.3.1.2 Perform a FUNCTIONAL TEST on each evaporator High Specific Gravity/Steam Flow Interlock. Semiannually SR 3.3.1.1 Perform a CALIBRATION on each evaporator Low Level/Steam Flow Interlock. Annually SR 3.3.1.2 Perform a CALIBRATION on each evaporator High Specific Gravity/Steam Flow Interlock. Annually TSR 3/4.1-16 Rev. 0 9/13/01 Figure 18. Example of Criticality Prevention TSR (continued). 66 DOE G 423.1-1A 11-3-2010 Confinement System Ventilation System LCO 3/4.2 CONFINEMENT SYSTEM 3.2.1 CONFINEMENT VENTILATION SYSTEM LCO: A. Two Confinement Ventilation Systems shall be OPERABLE with each system having the following components:  One supply fan  Two exhaust fans

 One supply-line charcoal filter  One supply-line HEPA filter  Two exhaust-line HEPA filters  Exhaust flow instrumentation:  One exhaust flow indicator, with alarm  One beta-gamma radiation monitor, with alarm  One gas temperature sensor downstream of the filter B. One Confinement Ventilation System shall be in operation. MODE APPLICABILITY: OPERATION, STANDBY, and PARTIAL SHUTDOWN PROCESS AREA APPLICABILITY: [process area(s)] ACTIONS: CONDITION REQUIRED ACTION COMPLETION TIME A. One Confinement Ventilation System train is inoperable. A.1 Restore Confinement Ventilation System train to OPERABLE status. 72 Hours B. The ACTION and associated Completion Time of Condition A are not met. B.1 Place the [processs area(s)] in FULL SHUTDOWN. 6 Hours C. Both Confinement Ventilation Systems trains are inoperable C.1 Place the [process area(s)] in PARTIAL SHUTDOWN. AND C.2 Restore one system to OPERABLE status. 1 Hour 2 Hours TSR 3/4.2-17 Rev. 0 9/13/01 Figure 19. Example of Confinement Ventilation System LCO. DOE G 423.1-1A 67 11-3-2010 Confinement System Ventilation System SRs 3/4.2 CONFINEMENT SYSTEM 3.2.1 CONFINEMENT VENTILATION SYSTEM SURVEILLANCE REQUIREMENTS Sheet 1 of 2 SURVEILLANCE REQUIREMENT FREQUENCY SR 4.2.1.1 Verify that each Confinement Ventilation System train in operation is taking suction on the confinement zone at a rate of [ ] scfm or more. 8 Hours SR 4.2.1.2 Verify that the Confinement Ventilation System train in standby is aligned to take suction on the confinement zone and that the fan control is in “AUTO” position. 8 Hours SR 4.2.1.3 Operate each Confinement Ventilation System train for [> 10 hours continuous with the heaters operating or (for systems without heaters) > 15 minutes]. Monthly SR 4.2.1.4 Perform the following on each confinement exhaust flow indicator and alarm.  CHANNEL CHECK  CHANNEL FUNCTIONAL TEST  CHANNEL CALIBRATION Daily Quarterly Annually SR 4.2.1.5 Perform the following on each exhaust flow beta-gamma radiation monitor and alarm.  CHANNEL CHECK  CHANNEL FUNCTIONAL TEST  CHANNEL CALIBRATION Daily Quarterly Annually SR 4.2.1.6 Perform the following on each exhaust flow gas temperature sensor.  CHANNEL CHECK  CHANNEL FUNCTIONAL TEST  CHANNEL CALIBRATION Daily Quarterly Annually TSR 3/4.2-18 Rev. 0 9/13/01 Figure 20. Example of Confinement Ventilation System Surveillance Requirements. 68 DOE G 423.1-1A 11-3-2010 Confinement System Ventilation System SRs 3/4.2 CONFINEMENT SYSTEM 3.2.1 CONFINEMENT VENTILATION SYSTEM (continued) SURVEILLANCE REQUIREMENTS (continued) Sheet 2 of 2 SURVEILLANCE REQUIREMENT FREQUENCY SR 4.2.1.7 For each Confinement Ventilation System train, verify that the filter cleanup system satisfies the in-place penetration and bypass leakage testing acceptance criteria of < [*]% and uses test procedure guidance in Regulatory Positions C.5.a, C.5.c, and C.5.d of Regulatory Guide 1.52, Revision 2, March 1978, and verify that the system flow rate is [ ] cfm + 10%. 18 Months OR After any structural maintenance on the HEPA filter or charcoal absorber housings OR Following painting, fire, or chemical release in any ventilation zone communicating with the system TSR 3/4.2-19 Rev. 0 9/13/01 Figure 20. Example of Confinement Ventilation System Surveillance Requirements (continued). DOE G 423.1-1A 69 (and 70) 11-3-2010 B3/4.5.10 PRESSURIZER SAFETY VALVES B3/4.5 PRESSURE LIMITS BASES:

LCOs: LCOs 3/4.5.1 through 3/4.5.9 establish the general requirements for pressure control. LCO 3/4.5.1 a. Background b. Applicable Safety Analysis LCO 3/4.5.1 establishes the limiting conditions for operation for the Pressurizer Safety Valves (PSV) based on the relief capacity requirements identified in Section 11.x.yy of the DSA. The single failure criterion requires that 2 PSVs be OPERABLE for operation and start-up modes. c. Safety and Operating Limits d. ACTION Statements e. Surveillance Requirements f. References LCO 3/4.5.2 establishes the limiting condition for. . . HFR TSR B3/4.5-12 Rev. 0 9/13/01 Figure 21. Example of Bases Appendix. DOE G 423.1-1 Appendix A 11-3-2010 A-1 APPENDIX A - TECHNICAL SAFETY REQUIREMENTS WRITER’S GUIDE A.1 Introduction Style in writing is the cumulative effect of the writer’s choice of words and phrases, sentence structure, emphasis, and arrangement of material. In any technical writing, the style should not intrude on the communication of facts. Good technical writing style is not apparent until it falters. Inconsistent or inappropriate wording, sentence structure, or punctuation distracts the user and distorts meaning. This section contains style guidelines for writing Technical Safety Requirements (TSRs). They apply to all sections of the requirements. Their consistent use will ensure the information in TSRs is as clear, concise, and usable as possible. A.2. Words and Phrases A.2.1 Use Familiar Words Brief, clear writing increases reading speed and comprehension. To make writing readable and understandable, use familiar words. Such words tend to be short and used often in conversation. There is rarely any meaning gained by using a longer, less familiar word. Less familiar Familiar approximately about utilize, employ use accumulation buildup prior to before however but proceed go on, go facilitate help, ease additionally too, also A.2.2 Use Words With Precise Meanings Words and phrases such as the following do not have precise meaning for the user and should be avoided:  approximately,  as soon as possible, and  initiate at once. When a word or phrase is to be used as the basis for a compliance requirement, be precise. Do not use words that cannot be precisely interpreted. Appendix A DOE G 423.1-1A A-2 11-3-2010 A.2.3 Verbs Use the standards in the following paragraphs as guidelines for the correct use of verbs and verb forms.  Strong Versus Weak Verbs. Do not smother strong verbs by turning them into objects of weaker verbs. Weak Strong make an inspection inspect perform a verification verify take the measurement measure  Short Versus Long Verbs. Use one-syllable verbs instead of two-syllable verbs. Use one-and two-syllable verbs instead of verbs with several syllables. Unless technical meaning demands the longer verb, there is no good reason to use it. Long Short function work accomplished done accumulate build up perform do, make, take, run prevent . . . from keep . . . from fabricated made A.2.4 Articles Articles are “a,” “an,” and “the.” Use articles in descriptive text only as needed for clarity and flow of thought. Do not use articles in the following.  Titles of documents, chapters, sections, paragraphs, figures, tables, appendices, or other document elements.  Table column headings.  Table entries and tabular instructions unless a passage cannot be clearly understood without articles.

 Procedural steps and instructions. Keep procedural information direct and concise by omitting articles unless a passage cannot be clearly understood without them. DOE G 423.1-1 Appendix A 11-3-2010 A-3 A.3 Sentence Structure A.3.1 General Rules  Arrange words in sentences and sentences in paragraphs so that the meaning is clear on first reading.  Make sentences concise by omitting useless words.  Rewrite sentences that may be confusing, awkward, illogical, or obscure to the reader.  Break up long, straggling, complex sentences into two or more short ones.  Do not include words, phrases, or clauses that do not relate directly to the main thought of the sentence. A.3.2 Sentence Length Short sentences and clauses make writing more readable and understandable. Not all long sentences are hard to understand, but length and difficulty tend to be related. Sentence length can be varied to avoid monotony; however, examine long sentences to see whether they can be shortened. Change long sentences to shorter ones by changing clauses to phrases, clauses or phrases to single adjectives or adverbs, and long phrases to shorter ones. These techniques are demonstrated in the following examples.  Long: During the performance of an ANALOG CHANNEL OPERATIONAL TEST, it is necessary to check the entire instrumentation loop (excluding sensor) including the function of an annunciator light; however, during performance of a CHANNEL CALIBRATION, it is not necessary to ensure that all annunciators function properly. Better: When performing an ANALOG CHANNEL OPERATIONAL TEST, the entire instrumentation loop (except sensor), including the annunciator light, should be checked. When performing a CHANNEL CALIBRATION, annunciators need not be checked.  Long: If, in the course of testing of valve stroke times, it is found that any valve exhibits a stroke time that is 25 percent greater than the stroke time measured during a previous test of the same valve, the test frequency of the valve shall be increased to once per month until corrective action is taken, at which time the original test frequency shall be resumed. Better: When testing valve stroke times, if any valve is found to have a stroke time 25 percent greater than when previously tested, increase its test frequency to once per month. When corrective action is taken, resume the original test frequency. Appendix A DOE G 423.1-1A A-4 11-3-2010 A.3.3 Positive Versus Negative Sentences Where possible, use positive sentences instead of negative sentences.  Negative: High steam pressure is not uncommon under such conditions. Positive: High steam pressure is common under such conditions.  Negative: If at least one pump cannot be put back into service, . . . Positive: If no pump can be put back into service, . . . A.3.4 Active Versus Passive Sentences Where possible, use sentences with active instead of passive verbs.  Passive: System pressure is relieved by PORVs when . . . Active: PORVs relieve steam pressure when . . .  Passive: This limitation provides assurance that . . . Active: This limitation ensures that . . . A.4 Brevity in Writing A.4.1 Unnecessary Words and Phrases Economy in writing is reached by omitting needless words and phrases and by phrasing information succinctly. Below are examples of ways to simplify sentences and phrases.  Wordy: Fire Detectors that are used to actuate Fire Suppression Systems represent a more critically important component of the facility’s Fire Protection Program than detectors that are installed solely for early fire warning and notification.

Better: Fire Detectors that actuate Fire Suppression Systems are more important to the facility’s Fire Protection Program than detectors used solely for early fire warning.  Wordy: In-service inspection of heat exchangers is essential in order to maintain surveillance of the conditions of the tubes in the event that there is evidence of mechanical damage or progressive degradation due to design, manufacturing errors, or in-service conditions that lead to corrosion. Better: In-service inspection of heat exchangers is required to ensure there is no damage or progressive degradation of the tubes caused by design or manufacturing errors or corrosion. DOE G 423.1-1 Appendix A 11-3-2010 A-5 Wordy Better along with, as well as . . . and in the event . . . if . . . in order to . . . to . . . for the purpose of . . . for, to . . . it is dependent upon . . . it depends on . . . Each of the curves shows . . . Each curve shows . . . give consideration to . . . consider . . . initiated immediately started at once more frequent intervals more frequently In the following examples, the underlined words can be left out of the sentences with no loss in meaning but with a gain in economy of expression. The underlined words add nothing to the sense of the sentences.  The purpose of the drains is to remove water from the turbine.  Two alarm signals serve to indicate that the pump is not working.  The thermocouples are designed to sense metal temperature variations.  The phase relationship between the generator output and the applied load is very critical.  A pressure switch located on the seal oil supply unit . . .  Do not remove any tools from the work area without proper authorization. A.4.2 Abbreviations, Acronyms, and Symbols Use only those abbreviations, acronyms, and symbols that are clearly recognized by the user. Avoid abbreviations of words, phrases, or names unless the system or component is frequently and commonly abbreviated. Following are common symbols that should be used in TSRs. Except for o F and o C, symbols should be avoided in narrative text. When space is limited, such as in tables or figures, symbols should be used for brevity and to save space. Symbol Meaning = Equal to % Percent o F Degrees Fahrenheit Appendix A DOE G 423.1-1A A-6 11-3-2010 Symbol Meaning o C Degrees Celsius + Plus - Minus < Less Than > Greater Than <= Less Than or Equal To >= Greater Than or Equal To A.4.3 Capitalization In general, standard American English rules for capitalization should be used. The following guidelines apply to writing TSRs.  Use of Uppercase Letters. Write the following in uppercase letters: - defined terms; - requirement titles and systems when used as page or LCO headings; - acronyms; - the word NOTE when used as a heading; - logic terms used as connectors, e.g., AND, OR, EITHER, etc.; - table column headings; and - headings in the LCOs and bases (see Figures 10a and 14 of this Guide).  Use of Initial Uppercase Letters (First Letter in Each Word). Capitalize the first letter in the following: - each word in system titles, - each word in component nomenclature, - each word in a system or component reference, - proper nouns, - each word in major system names, and - each word in figure and table titles. A.4.4 Punctuation In general, use standard American English rules for punctuation. Do not use contractions of words. For example, use “cannot” rather than “can’t” or “is not” rather than “isn’t.”

DOE G 423.1-1A Appendix A 11-3-2010 A-7 (and A-8) A.4.5 Units of Measure Use the following guidelines for units of measure.  Use the units that appear on instruments or gauges whenever possible.  Use units familiar to the operators.  Use Arabic numerals unless specific equipment dictates otherwise. A.4.6 Tolerances Use the following guidelines when writing tolerances.  Provide acceptable tolerances for given values whenever possible.  Give tolerances in easily understood terms.  Do not use the plus symbol (+) to express tolerances. When possible, state the value as an acceptable range (i.e., “between xx and yy”). The + symbol may be used as a heading where a list of values is to be entered, as in the following example. Pressure (+ 10%) psig psig In this application, the + symbol is used as an acceptable tolerance for calculating actual values, which should then be written as acceptable ranges in the table. A.4.7 Formulas and Calculations Formulas and calculations should be avoided in TSRs when possible. Unless the formula or calculation is part of an instruction or procedure that must be performed by the user, formulas or calculations can usually be avoided. DOE G 423.1-1A Appendix B 11-3-2010 B-1 APPENDIX B - CONVERSION OF TECHNICAL SPECIFICATIONS/OPERATIONAL SAFETY REQUIREMENTS TO TECHNICAL SAFETY REQUIREMENTS This Appendix gives contractors guidance on conversion of Department of Energy- (DOE-) approved technical specifications (TSs) and operational safety requirements (OSRs) into Technical Safety Requirements (TSRs). B.1 Conversion of Existing Technical Specifications For reactor facilities with existing TSs that have not been formatted as TSRs, the conversion can be assisted with the use of a screening form such as that in Figure B.1. This form would be used for each existing requirement. Any requirement that generated a positive response to any of the seven criteria would be included in the TSR. Specifications being added to the TSR could be categorized as Safety Limit (SL), Limiting Control Setting (LCS), or Limiting Condition for Operation (LCO) according to the guidance in Section 4.10.1 of this Guide. B.2 Conversion of Existing Operational Safety Requirements For nuclear facilities with existing OSRs that have not been formatted as TSRs, the conversion can be assisted with the use of a screening form such as that in Figure B.2. This form would be used for each existing requirement. Any requirement that generated a positive response to any of the seven criteria would be included in the TSR. Requirements being transferred to the TSR could be categorized as SL, LCS, or LCO according to the guidance in Section 4.10.1 of this Guide. B.3 Additions to Existing Technical Specifications and Operational Safety Requirements After the Documented Safety Analysis (DSA) has been developed according to requirements of the DSA rule, the section on TSR derivation should be used to ensure all of the necessary TSRs have been developed in the conversion process. As in the conversion process, Section 4.10.1 of this Guide should be used to help categorize the requirements as SLs, LCSs, LCOs or SRs. Appendix B DOE G 423.1-1A B-2 11-3-2010 TECHNICAL SPECIFICATION LIMITING CONDITION FOR OPERATION (LCO) SCREENING FORM TECHNICAL SPECIFICATION NUMBER: Page ___of ___ EVALUATION Is the technical specification applicable to— YES NO

A. Installed instrumentation used to detect and indicate in the control room or other control location a significant degradation of physical barriers that prevent the uncontrolled release of radioactive or other hazardous materials; or B. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate an accident or transient that involves the assumed failure of, or presents a challenge to, the integrity of a radioactive or other hazardous material barrier; or C. A process variable that is an initial condition to a design basis accident or transient that involves the assumed failure of, or presents a challenge to, the integrity of a radioactive or other hazardous material barrier; or D. Experiments or experimental facilities that could provide a path for the uncontrolled release of radioactive or other hazardous material or that could affect criticality; or E. Systems and equipment used to handle fissile material outside the reactor core; or F. Systems and equipment needed for Defense-in-Depth per DOE-STD-3009 to prevent a challenge to safety class systems or a significant challenge to physical barriers that protect against an uncontrolled release of radioactivity; or G. Systems and equipment needed for worker protection per DOE-STD-3009 to prevent serious injury or life threatening hospitalization to workers. If the answer to any of the above is “yes,” and the item is needed to keep off-site dose below the Evaluation Guideline of 25 rem CEDE, then the technical specification should be included in the LCOs unless justified otherwise. For items marked “yes” for Defense-in-Depth or worker safety, although most items should become LCOs in the TSR, some may be identified as only administrative controls. Figure B.1. Example Technical Specification LCO Screening Form. DOE G 423.1-1A Appendix B 11-3-2010 B-3 TECHNICAL SPECIFICATION LIMITING CONDITION FOR OPERATION (LCO) SCREENING FORM (continued) TECHNICAL SPECIFICATION NUMBER: Page ___of ___ DISCUSSION Explain why the specification does or does not meet the criteria and note any special considerations why a particular specification should or should not be included in the TSR (attach additional pages if necessary). This part should also include the following specific information. If the specification is found to meet criterion “B” or “C” above, provide examples of the accidents or transients for which the specification represents an initial condition or that it is assumed to mitigate. Where a component, structure, or system has more than one purpose or function that is addressed in technical specifications, reference the other specifications for the other functions. If the specification does not meet any of the criteria, a short description of the requirements should be provided. CONCLUSION: This technical specification is included in the Technical Safety Requirements. YES NO Figure B.1. Example Technical Specification LCO Screening Form (continued). Appendix B DOE G 423.1-1A B-4 11-3-2010 OPERATIONAL SAFETY REQUIREMENTS LIMITING CONDITION FOR OPERATION (LCO) SCREENING FORM OPERATIONAL SAFETY REQUIREMENTS NUMBER: Page ___of ___ EVALUATION Is the operational safety requirement applicable to— YES NO A. Installed instrumentation that is used to detect and indicate in the control room or other control location a significant degradation of the physical barriers that prevent the uncontrolled release of radioactive or other hazardous materials; or

B. A structure, system, or component that functions or actuates to mitigate an accident or transient that involves the assumed failure of, or presents a challenge to, the integrity of a physical barrier that prevents the uncontrolled release of radioactive or other hazardous materials; or C. A process variable that is an initial condition for those design basis accidents or transient analyses that involve the assumed failure of, or presents a challenge to, the integrity of a radioactive or other hazardous material barrier; or D. Experiments and experimental facilities that could provide a path for the uncontrolled release of radioactive or other hazardous materials or that could affect criticality; or E. Systems and equipment used to handle fissile materials; or F. Systems and equipment needed for Defense-in-Depth per DOE-STD-3009 to prevent a challenge to safety class systems or a significant challenge to physical barriers that protect against an uncontrolled release of radioactivity; or G. Systems and equipment needed for worker protection per DOE-STD-3009 to prevent a serious injury or life threatening hospitalization to workers. If the answer to any of the above is “yes,” and the item is needed to keep off-site dose below the Evaluation Guideline of 25 rem CEDE, then the operational safety requirement should be included in the LCOs unless justified otherwise. For items marked “yes” for Defense-in-Depth or worker safety, although most items should become LCOs in the TSR, some may be identified as only administrative controls. Figure B.2. Example Operational Safety Requirements LCO Screening Form. DOE G 423.1-1 Appendix B 10-24-01 B-5 (and B-6) OPERATIONAL SAFETY REQUIREMENTS LIMITING CONDITION FOR OPERATION (LCO) SCREENING FORM (continued) OPERATIONAL SAFETY REQUIREMENTS NUMBER: Page ___of ___ DISCUSSION Explain why the requirement does or does not meet the criteria and note any special considerations why a particular requirement should or should not be included in the TSR (attach additional pages if necessary). This part should also include the following specific information. If the requirement is found to meet criterion “B” or “C” above, provide examples of the accidents or transients for which the specification represents an initial condition or that it is assumed to mitigate. Where a component, structure, or system has more than one purpose or function that is addressed in operational safety requirements, reference the other requirements for the other functions. If the requirement does not meet any of the criteria, a short description of the requirements should be provided. CONCLUSION: This operational safety requirement is included in the Technical Safety Requirements. YES NO Figure B.2. Example Operational Safety Requirements LCO Screening Form (continued). DOE G 423.1-1A Appendix C 11-3-2010 C-1 APPENDIX C - TECHNICAL SAFETY REQUIREMENT CONSIDERATIONS FOR NUCLEAR EXPLOSIVE OPERATIONS, INCLUDING TRANSPORTATION Technical Safety Requirements (TSRs) for nuclear explosive operations (NEOs) are derived in the hazard analysis report (HAR) (referred to as HAR-TSRs) in the same manner that TSRs for facilities are derived in the Documented Safety Analysis (DSA). Thus, TSRs for NEOs include safety limits (SLs), limiting control settings (LCSs), limiting conditions for operation (LCOs), administrative controls (ACs), and design features.

The historical use of TSRs, including their reactor equivalent technical specifications, was primarily aimed at operability requirements for safety systems, structures, and components (SSCs) as LCOs. Hands-on activities and programmatic requirements were recognized collectively in the ACs section of the TSRs. The TSR ACs, such as training, staffing, review and audit, or programs and procedures, were implemented through various facility documents and activity controls. Generally, TSR violations related to implementation of ACs result from gross failure to implement a programmatic requirement in its entirety. By contrast, a single failure in violation of hardware-based TSR controls, such as LCOs, would constitute a TSR violation. This construct needs to be modified somewhat for NEOs, where significant unsafe conditions can readily be created by an operator error in a single step of an operation. TSRs for NEOs must reflect this significant shift for safety assurance from primary reliance on safety SSCs to manual operations and their associated ACs. This shift can be made transparent in the TSRs, but more importantly, it should also be accompanied with a higher emphasis on implementation of ACs on the operating floor through rigor of programmatic implementation and procedure attention. Methods that can be used may include required authorization levels, increased level of detail, step-by-step sign-off, two person execution, independent sign-off, preestablished alternative actions, and increased oversight and audit. Alternatively, some of the shift can be made explicit in the TSR ACs by uniquely identifying specific requirements in the ACs as cause for TSR violation if missed. An example could be failure to attach a restraining device that prevents drops of an exposed primary. On the other hand, the multitude of offenses and circumstances that could result in violation are too numerous for all to be identified specifically in the ACs, and a proper degree of balance must be struck. This approach is a departure from past practice for typical nuclear facilities where judgment of violation of ACs was always made on a case-by-case basis, taking into account specific circumstances and the degree of actual compromise to safety. TSR coverage of controls that address fire or explosive-driven dispersal of fissile material and higher consequence events are required regardless of the magnitude of the off-site consequences. This could be more conservative in certain instances than the application of evaluation guidelines for safety class designation as envisioned in DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, dated July 1994, Change Notice 3, dated March 2006, Appendix A. It is an acknowledgment that fire may progress to explosive dispersal of fissile material and that any explosive dispersal may progress to higher consequence events. It also accommodates the higher degree of uncertainty in the present level of understanding of these phenomena. Appendix C DOE G 423.1-1A Page C-2 11-3-2010 DOE O 452.2D, Nuclear Explosive Safety, dated 4-19-09, or successor documents, establishes nuclear explosive safety rules (NESRs) as the controls associated with the highest level of consequences, including explosive dispersal of fissile material and higher consequence events. DOE O 452.2D specifies five general NESRs and mandates allowance for including supplemental NESRs to be developed as needed in the HAR. HAR-derived NESRs address specific characteristics of an individual nuclear explosive operation.

The five general NESRs in DOE O 452.2D, or successor documents, are as follows. 1. A nuclear explosive safety study must be approved before operations. 2. Nevada Test Site is the only facility where operations with nuclear explosives not one- point safe are permitted. 3. No production operations are permitted until nuclear explosives are certified as one-point safe by the design laboratory. 4. Operations on collocated main charge and fissionable material must be done with procedures. 5. If a nuclear explosive no longer meets one-point safe, discontinue all production plant operations for off-site transportation, as appropriate, and conduct an approved NES study before restart. When addressing these NESRs, only the last two NESRs, which are implemented by the operator at the floor level, should be included in the HAR-TSRs. This is because the completion of the first three general NESRs above precedes in time any specific nuclear explosive operation. These three general NESRs are not consulted, implemented, or checked by the operators at the floor level during actual operations. In fact, they must all be met through design and weapons laboratory certification or Department of Energy (DOE) or contractor management authorization or approval long before operations for a specific nuclear explosive operation commence. For this reason, it is not appropriate for these controls to be implemented through TSRs. Instead, the TSRs are focused mainly at equipment operability after design, procurement, installation and initial testing, and approval authority for start-up and operation. It is the operability of equipment and ACs derived in the HAR, which operations personnel on the floor deal with on a daily basis, which must be checked periodically for operability or performance. That is the domain of the TSR. TSRs FOR TRANSPORTATION OF NUCLEAR EXPLOSIVES TSRs for transportation of nuclear explosives [and certain other sensitive components such as nuclear explosive-like assemblies (NELAs)] involve both on-site and off-site transport. Off-site transport of all other DOE fissile or radiological material is governed by Department of Transportation regulations. Generic on-site transportation of nuclear explosives is covered in the on-site transportation DSA, and operation-specific on-site transportation operations are covered in HARs. TSRs for on-site transportation may be affected by specific nuclear explosive considerations such as ramp transport; closeness of approach to loading docks, magazines, bays, DOE G 423.1-1A Appendix C 11-3-2010 C-3 (and C-4) and cells; and use of special intrazone transport devices such as flatbeds, forklifts, and jack motors. No SLs or LCSs are expected for transportation activities because there are no processes or activities in which the operator intentionally causes a process variable to be manipulated that, if left unchecked or uncontrolled, would result in catastrophic failure of a passive safety barrier. For example, there are no operator-initiated processes to increase temperature, pressure, electrical, or mechanical insult to the weapon that could lead to catastrophic failure.

Most accidents, especially in off-site transportation, result from the types of events that are not subject to SLs and LCSs, such as collisions, rollovers, skids, and loss of control of the transport carrier itself. While these accidents are related to the operator carrying out a mission (transport from point A to point B), they are not directly under his control. Thus, only LCOs, design features, and ACs are envisioned for transportation activities. LCOs or design features are expected for the nuclear explosive, its container and tie downs, and only specially designed-in or added features of the over the road or air transport carriers whose purpose is to achieve a functional safety requirement credited in the accident analysis. DOE G 423.1-1A Appendix D 11-3-2010 D-1 APPENDIX D - PERFORMANCE OF IMPLEMENTATION VERIFICATION REVIEWS (IVRs) OF SAFETY BASIS CONTROLS 1. PURPOSE This Appendix describes approaches for performing independent implementation verification reviews of all controls designed to implement the Safety Basis, e.g., Technical Safety Requirements (TSRs) and Documented Safety Analysis (DSA) assumptions and commitments, including verification of their initial implementation, verification following changes to the Safety Basis, and periodic re-verification. The purpose of an IVR is to independently confirm the proper implementation of new or revised Safety Basis controls. Independence of the review adds an additional layer of defense in depth and is a common practice standard in the commercial nuclear power industry. IVRs support meeting the 10 CFR 830.201 requirement for operating contractors for Hazard Category 1, 2, or 3 nuclear facilities to “perform work in accordance with the facility Safety Basis” and 10 CFR 830 Subpart A, Quality Assurance Requirements, in particular the requirement to have quality processes that include the planning and conduct of independent assessments to measure item and service quality, to measure the adequacy of work performance, and to promote improvement. Independent implementation verification of new or revised Safety Basis controls is often accomplished as part of a nuclear facility startup or restart readiness review under DOE Order 425.1D, Verification of Readiness to Start Up or Restart Nuclear Facilities. This guidance is not intended to duplicate the verification process under DOE O 425.1D. This guidance is chiefly intended for application to new or revised Safety Basis controls being implemented in a nuclear facility with on-going operations where a startup or restart review under DOE O 425.1D is not invoked. However, if desired, the process can be used as a tool by line management to ensure proper implementation prior to declaring “readiness” for the startup or restart readiness review. This Appendix was developed based upon a distillation of best practices for conducting IVRs at DOE sites. 2. APPLICABILITY AND SCOPE OF APPENDIX This Appendix is intended for use by DOE and DOE contractor organizations responsible for Hazard Category 1, 2 and 3 nuclear facilities. This Appendix applies to all hazard controls identified in TSRs and DSA assumptions and commitments for the Hazard Category 1, 2, and 3 nuclear facilities including design features, safety systems, specific administrative controls and associated major input assumptions for the Safety Basis that are contained in the TSRs and DSA assumptions and commitments. However, as recommended in this Guide, the most important commitments and assumptions should already be captured in the TSRs. The scope of this Appendix includes initial verification of Safety Basis controls for new DSAs and DSA revisions (both major and minor) as well as periodic review of the continued effective implementation of Safety Basis controls.

Appendix D DOE G 423.1-1A Page D-2 11-3-2010 This Appendix is focused on IVRs performed by contractors responsible for the operation of DOE Hazard Category 1, 2, and 3 nuclear facilities, but also provides guidance for DOE oversight and performance of IVRs. The Appendix is limited to independent verification of the implementation of Safety Basis hazard controls. It does not address the review of the Safety Basis documentation itself that identified the hazard controls in the first place or their incorporation into TSRs as required by 10 CFR 830.207, DOE Approval of Safety Basis. DOE Guide 421.1-2, Implementation Guide for Use in Developing Documented Safety Analyses to Meet Subpart B of 10 CFR 830, provides guidance for the review of the Safety Basis documentation. If issues concerning the Safety Basis become evident during the verification process, they should be handled via the facility’s existing issues management processes for resolving such matters. The process for carrying out IVRs should be documented in individual site procedures. 3. TIMING OF IVR SAFETY BASIS HAZARD CONTROLS 3.1. Initial IVRs The initial contractor IVR should follow the initial implementation effort of the new Safety Basis and should be completed prior to the contractor declaring readiness to commence formal operation under the new Safety Basis controls. The DOE IVR (if performed) may be stand-alone or as part of its line-management oversight of the contractor readiness process. Prior to starting the IVR, contractor management should ensure that the Safety Basis has been fully implemented. The following are attributes of a fully implemented Safety Basis.  Safety Basis controls have been incorporated into implementing procedures and work control documents.  Implementing procedures are executable as written.  Operators and facility personnel are trained and knowledgeable on the new controls and their relationship to the Safety Basis.  Required surveillance activities and inspections are complete.  Surveillances correctly test or verify assumptions and requirements of the Safety Basis.  Physical changes associated with the Safety Basis change have been made and tested under a rigorous startup test process to verify operability in accordance with the design basis.  Configuration items have been updated to reflect Safety Basis changes.  Labeling of components identified in updated safety systems has been completed. DOE G 423.1-1A Appendix D 11-3-2010 D-3  Inventory control procedures have been evaluated for consistency with the new Safety Basis.  Process instruments, tools, and measuring and test equipment have been calibrated and tested. Contractors often create and utilize a Safety Basis flow down matrix to support ensuring proper implementation of the Safety Basis controls. 3.2 IVRs Following Safety Basis Changes Following a Safety Basis change, the contractor IVR should be performed prior to commencing formal operation under the revised Safety Basis The breadth of the IVR should encompass the entire Safety Basis change, i.e., Safety Basis controls that have been changed should be verified to have been implemented. However, the depth/level of detail and degree of formality of the review can be graded. The following are broad categories of Safety Basis modifications that can be used to support determining the depth/level of detail and degree of formality of the IVR.

 Major Changes – Multiple changes, physical alterations of credited components, changes in methods used to demonstrate operability of TSR hazard controls. Major changes could potentially affect the ability to comply with the Safety Basis.  Moderate Changes – Safety Basis changes that may be judged to warrant review prior to their use when they are more complex than editorial changes or involve changes in multiple acceptance criteria for safety class or safety significant items.  Minor Changes – Editorial changes. For major changes, the IVR should utilize more formal tools such as a review plan and criteria and review approach documents (CRADs) (see Form 1 for an example of a CRAD). For moderate changes, review plans and CRADs may not be needed (i.e., a simple checklist may suffice) or they may be graded in the depth of the review. For minor changes, an IVR plan is likely not needed and a simple checklist (see Form 2) would suffice. The scope of a DOE IVR, if performed, can be determined based upon these same factors as well as considering past performance/effectiveness of contractor IVRs. 3.3 Ongoing IVRs to Re-verify Safety Basis Control Implementation The re-verification of Safety Basis controls is an important tool for contractors to ensure that they continue to operate the facility in accordance with the Safety Basis. Many of the hardware controls will have surveillance requirements that periodically ensure they are operable to perform as documented in the Safety Basis. In general, re-verification of Safety Basis controls should be performed every 3 to 5 years as part of the contractor’s ongoing assessment process. Safety controls that are susceptible to the effects of the degradation of human knowledge (e.g., procedural controls) typically should be re-verified at least every 3 Appendix D DOE G 423.1-1A Page D-4 11-3-2010 years, and controls dependent upon hardware functionality typically should be re-verified at least every 5 years. The following factors should be considered in determining the specific frequency, scope, and depth of re-verification of a Safety Basis control.  Safety significance of Safety Basis control  Type of Safety Basis control and susceptibility to degradation  Extent of Safety Basis control changes that have accumulated since the last IVR The basis for the periodicity of IVRs should be described and documented in individual site implementing procedures. The overall effectiveness of safety management programs referenced in TSRs (e.g., nuclear criticality safety and fire protection) is normally ensured by specific assessments already required for each of those programs. Re-verification of a facility’s Safety Basis controls can be approached in many forms, from a full review conducted by a team that re-verifies all the facility’s Safety Basis controls in one focused review to a phased re-verification review process (e.g., a fraction of the controls being reviewed each year) that ensures all of a facility’s Safety Basis controls are re-verified over a period of time. The benefit of the periodic team review is that it ensures all Safety Basis controls will be reviewed in an integrated fashion. The downside of a periodic review is that it is manpower- and cost-intensive. A phased IVR re-verification process, depending on how it is structured, might not be as effective in identifying cross-cutting Safety Basis control issues; however, it can be easily integrated into the facility’s existing contractor assessment and DOE oversight processes and may be more cost effective.

DOE may also choose to perform periodic re-verification of Safety Basis controls. This can be performed as part of DOE’s normal oversight efforts (e.g., reviews conducted by the Safety System Oversight staff, Facility Representatives, or through DOE shadowing of contractor IVR activities) and may not be as formal or detailed as the contractor re-verification. This should be determined as part of the DOE’s integrated oversight planning. 4. IVR PLANNING AND CONDUCT As discussed previously, for major, or in some cases moderate, changes in the Safety Basis, a formal IVR plan should be developed. A formal IVR plan is also useful for performing re- verification of Safety Basis controls. The following are useful elements to include in an IVR plan:  Scope of the implementation verification including clear identification of the breadth and depth of review based on a grading of the changes  Staffing DOE G 423.1-1A Appendix D 11-3-2010 D-5  Methods for performing the implementation verification (i.e., procedures, checklists or CRADs)  Schedule  Documentation of the results of the implementation verification IVR plans should be approved by the responsible manager(s) (e.g., Quality Assurance, Safety Basis and/or contractor facility manager). Form 3 provides an example outline of an IVR plan. The contractor IVR plan should be consistent with normal site practices for developing review plans and be an element of an overall contractor assurance system. Similarly, if used, the DOE plans should be consistent with contractor assessment plans and be part of the line integrated assessment program. If a phased approach is utilized for performing re-verification, it can be beneficial to develop a plan that covers the complete re-verification and which specifies items to be reviewed, the method of review, and schedule for each phase of the review. 4.1 Selection of IVR Team Leader and Support Staff The Implementation Verification Review Team Leader or individual assessors should have sufficient authority and freedom from line management responsible for the Safety Basis controls to be evaluated by the IVR. Assessors should not have been involved in implementing the controls to be verified. Team Leader experience in the conduct of readiness reviews is desired in a manner similar to that determined for leaders of readiness reviews under DOE O 425.1D. Implementation verification support staff that performs the verification of the Safety Basis control implementation should be experienced in the technical area being reviewed. For example, if the control is an instrumentation and control system, qualification in this subject matter is desired. Members should not review work in which they were involved. The size and makeup of the contractor team will depend upon the scope and depth/level of detail of the review. The DOE IVR team makeup should be determined based on a graded approach that considers the scope and complexity of the Safety Basis changes. Good candidates for the DOE team include personnel with Team Leader experience and operational readiness review experience, Facility Representatives (FRs), Safety System Oversight (SSO) engineers, senior operations and maintenance personnel from other similar facilities, and other subject matter experts. Not all IVRs will require the formation of teams. IVRs of a simple nature may be performed by individuals who have not been involved in the implementation of the Safety Basis documents being reviewed or do not have responsibility for the work affected by the Safety Basis changes reviewed by the IVR.

Appendix D DOE G 423.1-1A Page D-6 11-3-2010 4.2 Method for Performing Implementation Verification of Safety Basis Controls The method for verifying the control will vary depending on the type of the control. The following sections provide guidance for performing in depth implementation verification of the various Safety Basis controls. 4.2.1 Design Features and Safety Systems Implementation verification of design features and safety systems should include a review of documentation of the design and installation of the design feature/safety system and a walkdown of the design feature/safety system utilizing design documents (e.g., design drawings). The walkdown would verify that certain design features/safety systems (e.g., seismic restraints and fire barriers) are in place, and for safety-class and safety-significant items that the appropriate level of quality assurance guided procurement, construction and testing. Particular attention should be paid to any installed Temporary Modification. Implementation verification of safety systems may also include a review of startup testing to ensure that key system functions were properly tested. The extent (breadth and depth) of the review should be predicated on the complexity of the design feature and/or safety system and its importance. 4.2.2 Procedures Safety Basis controls may be implemented via numerous types of procedures including surveillance procedures, administrative control procedures, operating procedures, maintenance procedures, and inspection and testing procedures. Maintenance, inspection and testing, and surveillance procedures which implement Safety Basis controls should be reviewed to ensure that they include limits, precautions, prerequisite conditions, applicable TSRs, acceptance criteria, required data to be recorded, and personnel qualifications. These procedures should also be reviewed to determine whether they require the recording and timely notification of facility management of any discrepancies or unexpected conditions. Typically sites will utilize a checklist to support their review of TSR surveillances. An example of a TSR surveillance checklist is provided in Form 4. Depending upon the level of depth of review, the IVR can include a walkdown of the procedure with responsible facility personnel, observation of the procedure being performed, or review of procedure execution records. The review of surveillances should include an evaluation of the mechanism (e.g., schedule) used to ensure they are conducted when required, and whether they are consistently being performed on time. The verification of specific administrative controls (SACs) should include the review of SAC implementing procedures and the observation of in-facility execution of the procedure (or walkdown with contractor personnel responsible for executing the procedures) to ensure the procedures appropriately implement the SAC consistent with facility conditions, are understandable (contain clear and concise work instructions with necessary detail), are practical and usable, and are adequate for meeting the functional requirements and expectations of the SAC TSR. Form 5 provides some additional criteria to support this verification. DOE G 423.1-1A Appendix D 11-3-2010 D-7 4.2.3 Training Programs and Personnel Level of Knowledge

Operators, maintenance personnel, and technicians and engineers that implement and maintain Safety Basis controls are trained and qualified on the work and related sections of the Safety Basis that identify the controls. The IVR should evaluate: training on the need and functions of the controls; personnel ability to effectively verify that the controls can reliably perform their safety function; and that the operators can perform any required safety functions in relation to those controls. The level of knowledge of operations personnel of Safety Basis controls can be examined by interviews and cross–table scenarios. The verification that Safety Basis controls have been appropriately incorporated into training programs should include a review of documentation that a systematic approach to training was used as required by DOE O 426.2, Personnel Selection, Training, Qualification, and Certification Requirements for DOE Nuclear Facilities. 4.3 Documentation of the Results of the IVR The results of the IVR should be documented per normal site procedures for documentation of safety-related assessments, including identification of issues that require corrective actions to resolve the weakness. The attached forms are provided as examples for documenting the results of the IVR. They can be shortened or expanded as necessary. To ensure consistency of IVRs, IVR documentation forms should be included in the site specific implementing procedures. 5. REFERENCES  DOE-STD-3006-2010, Planning and Conducting Readiness Reviews  DOE-STD-1186-2004, Specific Administrative Controls  DOE O 425.1D, Verification of Readiness to Startup or Restart Nuclear Facilities  DOE O 226.1A, Implementation of Department of Energy Oversight Policy Appendix D DOE G 423.1-1A Page D-8 11-3-2010 Form 1 Example: Criteria Review and Approach Document (CRAD) to Support IVRs The following are example CRADs. The CRADs used for IVRs need to be tailored to the Safety Basis controls being verified. Some review approaches will be based on document review while others will be performed by interviews or physical inspections. Objective 1: Verify that the Safety Basis controls and requirements are incorporated in appropriate facility documents and work instructions. Criteria: 1.1 Administrative Controls, implementing processes, and supporting surveillance requirements are adequately documented in reviewed and approved work instructions. Review Approach  Are controlled, accurate, and current copies of the TSR available where needed?  Are there adequate and correct work instructions for implementing the Surveillance Requirements associated with Administrative Controls? Are accurate data sheets provided?  Describe the documented work processes used to control waste crate and container handling within the building. What control prevents the storage of TRU drums and crates outside the facility? Does the Safety Basis allow storage of low-level waste (LLW) crates outside the facility and what process is used to manage the configuration and locations of LLW crates stored outside the building?  How are limits established, implemented, and maintained for required sizing and spacing between each combustible package and other items of concern?  Combustibles may be stored for 15 minutes in previously approved corridors without meeting spacing requirements. What process controls this condition and how is the time material is stored recorded? What control prevents exceeding the allowed time?

 How is the storage of combustibles controlled to ensure that they are not stored in prohibited areas of the facility? What control or barrier exists that prevents the introduction of combustible material into the facility? Has a “Combustion-Free” zone been established in the facility?  What barrier or control exists to ensure that combustibles in gloveboxes (where they exist) do not exceed applicable weight limits? DOE G 423.1-1A Appendix D 11-3-2010 D-9 1.2 Limiting Conditions for Operations (LCOs) and supporting Surveillance Requirements and acceptance criteria are adequately documented in reviewed and approved work instructions that are consistent with the facility Safety Basis and applicable Safety Evaluation Reports (SERs). Review Approach  Are adequate and correct work instructions implementing the Surveillance Requirements established (prepared, reviewed, and approved)? How is the configuration of these documents controlled and maintained?  Do work instructions for Surveillance Requirements describe the “limitations” beyond which an “Out-of-Tolerance” condition would exist? How are “limitations” defined for “Planned Out-of-Tolerances”?  Are the acceptance