DOE G 424.1-1, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements

DISTRIBUTION: INITIATED BY: All Departmental Elements Office of Nuclear and Facility Safety Policy Approved: 10-24-01 Sunset Review: 10-24-03 IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS [This Guide describes suggested nonmandatory approaches for meeting requirements. Guides are not requirements documents and are not construed as requirements in any audit or appraisal for compliance with the parent Rule, 10 CFR 830.] U.S. DEPARTMENT OF ENERGY Office of Nuclear and Facility Safety Policy DOE G 424.1-1 CANCELE D DOE G 424.1-1 i 10-24-01 FOREWORD This Department of Energy (DOE) Implementation Guide is approved by the Office of Nuclear and Facility Safety Policy and is available for use by all DOE components and contractors. Beneficial comments (recommendations, additions, deletions, and any pertinent data) that may improve this document should be sent to— Richard Stark EH-53/270/GTN U.S. Department of Energy Washington, D.C. 20585 Phone (301) 903-4407 Facsimile (301) 903-6172 DOE Guides are part of the DOE directives system and are issued to provide supplemental information regarding the Department’s requirements as contained in rules, Orders, Notices, and regulatory standards. Guides also provide acceptable methods for implementing these requirements. This Guide may be used by all contractors for DOE Hazard Category 1, 2, or 3 nuclear facilities, including contractors for National Nuclear Security Administration (NNSA) Hazard Category 1, 2, or 3 nuclear facilities. Throughout this document, wherever it references a contractor or a DOE contractor, the statement applies to a contractor for NNSA as well. This Guide was developed in support of Title 10 Code of Federal Regulations (CFR) Part 830, “Nuclear Safety Management.” It provides guidance for the requirements defined in 10 CFR 830.203, “Unreviewed Safety Question Process.” In an effort to further improve the implementation of Subpart B of 10 CFR 830, “Safety Basis Requirements,” DOE is updating three Standards: • DOE-STD-1104-96, Review and Approval of Nonreactor Nuclear Facility Safety Analysis Reports; • DOE-STD-3009-94, Change Notice No. 1, Preparation Guide for U.S. DOE Nonreactor Nuclear Facility Safety Analysis Reports; and • DOE-STD-3011-94, Guidance for Preparation of DOE 5480.22 (TSR) and DOE 5480.23 (SAR) Implementation Plans. The successors to these documents should be consulted and used as soon as they become available. This Guide imposes no requirements. CANCELE D ii DOE G 424.1-1 10-24-01 This page intentionally left blank. CANCELE D DOE G 424.1-1 iii 10-24-01 CONTENTS Page FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i 1. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2. APPLICATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.1 Temporary or Permanent Changes in the Facility . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.2 Temporary or Permanent Changes in the Procedures . . . . . . . . . . . . . . . . . . . . . . 4 2.3 Tests or Experiments Not Described in the Existing DSAs . . . . . . . . . . . . . . . . . 4 2.4 Discovery of Potential Inadequacies in the Existing Safety Analyses . . . . . . . . . . 5

3. IMPLEMENTATION GUIDANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.1 Integrated USQ Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3.2 Screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 3.3 Unreviewed Safety Question Determinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.4 Documentation and Retention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.5 Training and Qualifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 APPENDIX A. UNREVIEWED SAFETY QUESTION DETERMINATION . . . . . . . . . A-1 APPENDIX B. UNREVIEWED SAFETY QUESTIONS LESSONS LEARNED . . . . . . B-1 CANCELE D iv DOE G 424.1-1 10-24-01 This page intentionally left blank. CANCELE D DOE G 424.1-1 1 10-24-01 1. INTRODUCTION This Guide provides information to assist in the implementation and interpretation of Title 10 Code of Federal Regulations (CFR) Part 830.203, “Unreviewed Safety Question Process,” of the Nuclear Safety Management Rules for applicable nuclear facilities owned or operated by the Department of Energy (DOE), including the National Nuclear Security Administration (NNSA). Section 830.203, “Unreviewed Safety Question Process,” allows contractors to make physical and procedural changes and to conduct tests and experiments without prior DOE approval if the proposed change can be accommodated within the existing safety basis. The contractor must carefully evaluate any proposed change to ensure that it will not explicitly or implicitly affect the safety basis of the facility. The unreviewed safety question (USQ) process is primarily applicable to the documented safety analysis (DSA). Although the rule references only the DSA, the DSA must include conditions of approval in safety evaluation reports and facility-specific commitments made in compliance with DOE rules, Orders, or Policies. Because application of the USQ process depends on facility-specific information, results of a USQ determination in one facility generally cannot be extrapolated to other facilities. DOE approval of the procedure to implement the USQ process is required by 10 CFR 830.203. Section 830.203 is expected to be implemented using contractor procedures that ensure that proposed changes to physical characteristics or operating procedures are adequately evaluated relative to the approved safety basis and that those proposed changes determined to involve USQs are brought to the attention of DOE for review and approval before changes are made. A proposed change or test involves a USQ if— • the probability or consequences of an accident or malfunction of equipment important to safety could be increased, • the possibility of a different type of accident than previously evaluated in the DSA could be introduced, or • margins of safety could be reduced.

For the purposes of this Guide, equipment important to safety should be understood to include any equipment whose function can affect safety either directly or indirectly. This includes safety class and safety significant structures, systems, and components (SSCs), and other systems that perform an important defense-in-depth function, equipment relied on for safe shutdown, and in some cases, process equipment. These considerations apply to both workers and the public. In the case of workers, these considerations apply to all workers, those in immediate proximity to the hazard as well as collocated workers. In addition to proposed changes, 10 CFR 830.203(g) of the USQ rule requires notification of DOE and USQ determinations when a potential inadequacy in the safety analysis is identified. In this case, situations of concern are those wherein it is found that the current safety analysis may not be bounding or the current safety basis may be otherwise CANCELE D 2 DOE G 424.1-1 10-24-01 inadequate. This could be because of an error in the current safety analysis or because the facility configuration is not what was analyzed. The existence of a USQ does not mean that the facility or operation is unsafe. The purpose of the USQ process is to alert DOE of events, conditions, or actions that affect the DOE-approved safety basis of the facility or operation and ensure appropriate DOE line management action. If a change is proposed or a condition is discovered that could increase the risk of operating a facility beyond that established in the current safety basis, DOE line management, including, where applicable, the NNSA, must review and determine the acceptability of that risk through the process of approving a revised safety basis that would be developed and submitted by the contractor. 2. APPLICATION Section 830.203 applies to all Category 1, 2 and 3 nuclear facilities. All changes to a nuclear facility, whether temporary or permanent, require application of the USQ process unless a decision to request DOE approval already has been made. Some changes may be such that they can be screened out from a detailed USQ determination. The applicability of Section 830.203 is broad. Nonsafety-related systems are not excluded by the scope of Section 830.203 if they could affect the proper operation of equipment important to safety that is relied on in the safety basis. For example, losses of certain nonsafety-related systems may represent critical operational occurrences identified as initiators in the accident analysis. Therefore, changes to nonsafety-related systems must be evaluated and may be determined to involve a USQ. Physical interactions may also fall under the purview of Section 830.203. For example, the installation of a nonseismically supported piece of equipment above a seismically qualified component designed to perform a safety function explicitly or implicitly assumed in the existing safety analyses may constitute a USQ and must be evaluated. The following sections discuss the types of changes, tests, and experiments, as well as potential inadequacies that the USQ process needs to address to comply with Section 830.203. 2.1 Temporary or Permanent Changes in the Facility Section 830.203 requires USQ determinations for changes to a nuclear facility that alter an SSC’s design, function, or method of performance as described in the existing safety analyses by text, drawing, or other information relied on as the safety basis. The safety analyses include descriptions of many SSCs, but a nuclear facility also contains many SSCs not explicitly described in the safety analyses. These can be components, subcomponents of larger components, or even entire systems.

Changes to SSCs that are not explicitly discussed in the safety analyses should not be excluded from the USQ process, since changes to these SSCs may have the potential for altering the CANCELE D DOE G 424.1-1 3 10-24-01 function of an SSC explicitly described in the safety analysis. The recommended approach for deciding whether a modification involves a change to the nuclear facility, as described in the safety analyses, is to consider the effect of the change on the SSC of which the SSC being modified may be a part or which the SSC being modified may support. If the change alters the design, function, or method of performing the function of the SSC, as described in the safety analyses, a USQ determination is required. Also, a change to an SSC that does not involve equipment important to safety could initiate an accident or affect the course of an accident, so virtually no change can be ignored. It is important to distinguish between changes and routine maintenance activities. Routine maintenance activities—except those that are not enveloped by current analyses or that might violate a technical safety requirement (TSR)—do not require review under Section 830.203. A TSR limitation on maintenance activities might require limiting the number of systems or components that can be taken out of service at one time or allowable outage times. Examples of routine maintenance activities include calibration, refurbishment, replacement with an equivalent component, and housekeeping. However, some maintenance activities may constitute changes, such as plant heat exchanger tube plugging where limits are not specified. The TSR should specify allowable outage times, permissible mode conditions, and permitted reduction in redundancy for systems or components removed from service for maintenance. A USQ determination, therefore, need not be performed for these activities. However, for systems or components that are included in safety analyses for the nuclear facility, and for which allowed outage times are not included in the TSRs, a USQ determination should be completed. Understanding the term “change” as it applies to modes of operation or facility processes is also important. For example, when a facility is designed to accommodate several nuclear processes but must modify equipment lineup to accommodate another process, the change does not constitute a change under Section 830.203 if it is performed in accordance with approved procedures and was considered within the safety basis of the facility. Temporary changes to the nuclear facility should be evaluated to determine whether a USQ exists. Examples of temporary modifications include jumpers and lifted leads, temporary lead shielding on pipes and equipment, temporary blocks and bypasses, temporary supports, and equipment used on a temporary basis. The conservative approach is to provide a written USQ determination for any change to the nuclear facility, whether discussed in existing safety analyses or not. However, it is possible that some changes can be justified as not requiring evaluations under Section 830.203, as long as screening criteria are developed that will ensure that no indirect or secondary effects will result from the change. In this case, the screening criteria are relied on to ensure that the change does not introduce a USQ. The actual modification implementation process (for example, work authorization system) used in the field should be reviewed for possible development of USQs. Changing plant configurations

CANCELE D 4 DOE G 424.1-1 10-24-01 while work is in progress may involve a USQ relating to facility operations, independent of the safety of the specific work on a modification. For example, if the work involves interrupting a water supply that a fire protection system (that is not covered by a TSR requirement) depends on, that interruption should be examined through the USQ process. The work authorization system should include a step to consider these types of possibilities. 2.2 Temporary or Permanent Changes in the Procedures A USQ determination may have to be prepared for changes to procedures that are identified in the facility DSA. However, as discussed in section 3.2, regarding USQ screening, some procedure changes may not require a USQ determination. The identification of procedures may be explicit or implicit in the facility DSA. If the procedure is implied directly by the nature of a topic in the safety basis (including the operational safety requirements or TSRs), that change should be considered to be to a procedure described in the DSA, so that a USQ determination is done when appropriate. Such implicitly described procedures include (1) the procedures that implement a safety management program described in the safety basis and (2) operating, testing, surveillance, and maintenance procedures for safety equipment when that equipment is identified in the DSA. If the characteristics of the safety management program described in the safety basis remain correct, complete, and valid, the result of the USQ determination would be expected to be negative, signifying that DOE approval is not required. Procedures are not limited to those items specifically identified as procedure types (for example, operating, chemistry, system, test, surveillance, and emergency plan) but could include anything described in the documented safety analyses that defines or describes activities or controls over the conduct of work. Changes to these activities or controls qualify as changes to procedures as described in the documented safety analyses, and therefore must be evaluated as a potential USQ. Changes to procedures include both revising an existing procedure and creating a new procedure. For the case of a new procedure, which could not be described already, the question becomes, if the DSA were to be prepared (or updated) after the new procedure had been approved, is the new procedure of a type that would be identified in the DSA. If so, a USQ determination should be prepared for the new procedure. 2.3 Tests or Experiments Not Described in the Existing DSAs Written USQ determinations are required for tests or experiments not described in the existing safety analyses. The intent of Section 830.203 is to require USQ determinations of tests and experiments that might affect safe operations but are not described in the existing safety analyses. Tests and experiments should be broadly interpreted to include new activities or operations. By definition, these are activities that could degrade the margins of safety during normal operations or anticipated transients or degrade the ability of SSCs to prevent accidents or mitigate accident conditions. New configurations that require a criticality safety evaluation should be considered CANCELE D DOE G 424.1-1 5 10-24-01

as a test or experiment. A USQ determination should be performed to ascertain whether a DOE review and approval of the new configuration is required. For preoperational tests, surveillance tests, functional tests, and startup tests that are performed regularly, USQ determinations are not required every time a test is performed. However, one-of-a-kind tests used to measure the effectiveness of new techniques or a new system configuration that might affect safety SSCs will require evaluation before they can be conducted. Postmodification testing should be considered and included in the USQ determination for the modification. 2.4 Discovery of Potential Inadequacies in the Existing Safety Analyses Written USQ determinations are required when a contractor identifies a potential inadequacy of the safety analyses that support the DOE-approved safety basis, which indicates the safety analysis is not bounding or may be otherwise inadequate. The intent is to ensure that the operations are conducted in a safe manner that is consistent with the safety basis. Because an inadequacy in the safety analyses has the potential to call into question information relied on for authorization of operations, DOE requires the contractor to— • take appropriate action to place or maintain the facility in a safe condition; • expeditiously notify DOE when the information is discovered; • perform a USQ determination and submit the results promptly; and • complete an evaluation of the safety of the situation and submit it to DOE before removing any operational restrictions implemented to compensate for the analytical discrepancy. Bullet item 3, above, means that the USQ determination should be prepared promptly and the results submitted promptly. This is also intended to mean that the time frame after initial notification of DOE until submittal of the USQ determination results should be on the order of hours or days, not weeks or months. If a USQ is determined to be present, the evaluation of the safety of the situation will require not only DOE’s review but also its approval of resulting changes before any operational restrictions are removed. The facility DSA, as part of the safety basis, is important to safety for a number of reasons. Among these, the DSA defines the safety risks that DOE has accepted when authorizing operation of the facility. Because of this feature, that analysis is the baseline reference for the USQ process. If that reference were to be inadequate, the USQ process would be compromised. Therefore, the USQ process includes special actions to be taken if it appears that the safety analyses might be inadequate. The DSA may be inadequate for any number of reasons. In general, it is possible for a potentially inadequate analysis to arise from three entry conditions: (1) a discrepant as-found CANCELE D 6 DOE G 424.1-1 10-24-01 condition, (2) an operational event or incident, or (3) new information, including discovery or an error, sometimes from an external source. The main consideration is that the analysis does not match the current physical configuration of the facility, or the analysis is inappropriate or contains errors. The analysis might not match the facility configuration because of a discrepant as-found condition. Analytical errors might involve using incorrect input values, using invalid assumptions, using an improper model, or calculational errors. The USQ process starts when the facility management has information that gives reason to believe that there is the potential that the facility DSA might be inadequate.

The USQ process does not apply to the process of upgrading DSAs in response to new requirements or to the use of new or different analytical tools during the upgrade process. However, the USQ process does apply when there is reason to believe that the current safety basis might be in error or otherwise inadequate, as discussed in the preceding paragraph. 3. IMPLEMENTATION GUIDANCE The USQ review process should be integrated into all technical aspects of the contractor organization responsible for design, engineering, maintenance, inspection, operations, and assessment of the nuclear facility or activity. Individuals involved in these aspects of the organization should be familiar with the requirements of Section 830.203 and should be able to identify activities that might need to enter the USQ process, while carrying out their normal responsibilities. Each facility should identify the methods by which facility changes can be made (for example, whether changes are made under modification processes, nonconformance processes, or maintenance processes). After these methods have been identified, each facility must determine what constitutes an acceptable means to make a change; that is, the contractor must clearly control the facility change process and must perform and document changes in accordance with approved procedures. Performing a modification under the guise of maintenance is not acceptable because the proper control processes to analyze the proposed change and document its outcome would probably be absent. It is necessary to identify all means for performing a change because each one provides a direct input into the USQ process and must be integrated accordingly. The USQ process is intended to be implemented along with a change control process that includes generalized steps for (1) identifying and describing the temporary or permanent change, (2) technical reviews of the change, (3) management review and approval of the change, (4) implementation of the change, and (5) documenting the change. As part of the technical reviews of a change, the contractor should perform the appropriate type of safety analysis to ascertain whether the change is indeed safe. This is accomplished separately from the USQ process. The USQ process is used subsequently to determine if final approval of the change by the contractor is sufficient or if DOE approval must be obtained. CANCELE D DOE G 424.1-1 7 10-24-01 Contractors should develop procedures that provide detailed guidance for the performance of the USQ process, including any screening and the USQ determinations. The procedures should— • define the purpose of the procedure; • set forth the procedure’s applicability; • provide definitions of appropriate terms, include screening criteria, as appropriate, and the basis for their application; • include detailed guidance on what must be considered and evaluated when performing or reviewing a USQ determination; • define the qualifications needed and responsibilities of personnel performing and reviewing USQ determinations; and • include documentation requirements for each USQ determination. DOE relies on the contractor’s implementation of the USQ process to preserve the integrity of the safety basis while allowing flexibility in operations. The contractor responsible for a DOE Hazard Category 1, 2 or 3 nuclear facility must submit the procedure that defines its USQ process to DOE for approval. 3.1 Integrated USQ Process

The USQ process should be integrated into the facility’s change control processes. The change processes should ensure that the USQ process is integrated into existing procedures or that new procedures are developed, as necessary and that the need for completion of a USQ determination is not overlooked. Each facility should develop its own change flow process for both temporary and permanent changes to SSCs and documents. This process and its integration should be described by a governing policy, procedure, flowchart, or other description. The purpose of the governing document is to define clear relationships between the USQ process and other change control procedures, including design change procedures, configuration control programs, temporary change procedures, and procedures governing the preparation, review, and approval of procedures. Its purpose is to describe how the USQ processes required by Section 830.203 are integrated into the facility's processes and not to implement the details of the rule itself. The facility USQ procedures should provide that the USQ documents (that is, any screening and the USQ determination) are prepared by one individual and then reviewed technically by a second person. That person should be independent in the sense that he/she has not been involved in the preparation of the USQ documents. That person does not need to be organizationally independent. CANCELE D 8 DOE G 424.1-1 10-24-01 The facility USQ procedure should provide also that facility line management takes approval action on the USQ documents. This ensures that line management is informed of the results of the USQ process and can take whatever followup actions are appropriate, such as submitting the change to DOE for safety review and approval or canceling the proposed change. The use of a facility operating review committee to review the USQ documents and provide advice to facility line management may be beneficial, but review by such a committee should not be used in lieu of the line management approval action. Care should be used to avoid excessive levels of approval. Typically, one approval is sufficient, with a second corporate-level approval for positive USQ determinations. 3.2 Screening The purpose of USQ screening is to ascertain if it is necessary to expend the valuable time and resources necessary to perform a USQ determination, or if there is reasonable technical justification for not performing a USQ determination. DOE encourages the use of screening to limit the number of matters for which USQ determinations must be performed, provided the reasons for exclusion are documented and well supported. When properly defined and implemented, the screening criteria should assist in reducing the efforts expended for matters of minor significance and should focus efforts more on the more important matters for which Section 830.203 is intended. When an item is screened out from further consideration, the rationale for the screening should be documented and retained with records of USQ actions. Candidate items for screening include situations wherein the USQ process may not be applicable: • changes to a requirement in the TSRs, or the addition of a new TSR requirement; • changes that management has already decided will be submitted to DOE for safety review and approval (including TSR changes, above); • the installation of an item that is an exact replacement (that is, same manufacturer, same model number, etc.);

• the installation of an item that is on the facility “Approved Equivalent Parts” list, for which a facility engineer has evaluated and concluded that the replacement item meets all the requirements pertinent to the specific application at the facility, including the service conditions; • changes for which common commercial practices would suffice, and a formal nuclear- grade change control process is not warranted (for example, changing fixtures for fluorescent lighting in a control room of the facility); and • changes to documents that are purely editorial and make no technical change. CANCELE D DOE G 424.1-1 9 10-24-01 In some situations, the screening might determine that the matter does not require any further USQ consideration. In other situations, the screening may determine that the matter should proceed directly to a USQ determination. The case of a potentially inadequate safety analysis is an example of this situation. In other situations, the screening might determine that the matter must be submitted to DOE and therefore the performance of a USQ determination is not necessary. A change to a requirement in the facility TSRs is an example of this situation. Screening criteria are to be applied to those items that, by broad definition, might enter into the Section 830.203 process but for which a detailed evaluation (USQ determination) is not necessary. For example, an operational procedure that is described in the DSA may be changed to correct a typographical error or include an additional reference to an equipment list. Such a change is not of any safety significance and clearly does not involve a USQ. If the contractor applied a screening procedure that asks: “Is the change purely editorial and without any technical change?” (that is, a spelling or typographical correction, grammatical change, clarification, or additional note or reference), the reviewer could document the change and thus avoid the need to answer the detailed questions of the USQ determination. Another manner in which screening criteria may be applied is through categorical exclusions (for example, different procedure types). For the purpose of illustration, maintenance procedures may be considered. A basic premise of performing maintenance is that the plant will be restored to the exact same condition it was in prior to maintenance. That is, the functional capability will continue to meet or exceed those performance requirements set forth in the safety basis. A change to a maintenance procedure would therefore not be governed under Section 830.203. However, whenever screening criteria are applied in this manner, a submittal to DOE should be made, including an evaluation of why a categorical exclusion (for example, of maintenance procedures) from the Section 830.203 process is acceptable. Such categorical exclusions are regarded as part of the contractor’s USQ procedure, requiring DOE approval. Another screening consideration is the possibility that the matter being considered is fully covered by a previous USQ determination, even when location differences are considered. When considering the resolution of a nonconformance situation, it should be recognized that any disposition that involves a corrective action that does not fully meet all the existing requirements would constitute a design change. This would include a “use-as-is” disposition; it would not include an exact “restoration modification” wherein the disposition of the nonconformance is simply to replace the item with an item that meets all the requirements.

3.3 Unreviewed Safety Question Determinations Contractors are expected to provide detailed guidance and instructions in the form of a procedure on how to perform a USQ determination. Specific guidance on how to conduct a USQ determination is contained in Appendix A. Concepts used to develop this process are contained throughout this Guide. A USQ determination is that record required by Section 830.203 to document the review of a “change” or a situation where there is reason to believe that the CANCELE D 10 DOE G 424.1-1 10-24-01 facility’s existing safety analysis may be in error or otherwise inadequate. It records the scope of the determination and an explanation of the technical basis for the conclusions reached. For the purpose of USQ procedures and performing USQ determinations, the three USQ criteria should be broken down into their constituent seven questions: (1) Could the proposed change increase the probability of an accident previously evaluated in the facility’s existing safety analyses? (2) Could the proposed change increase the consequences (to workers or the public) of an accident previously evaluated in the facility’s existing safety analyses? (3) Could the proposed change increase the probability of a malfunction of equipment important to safety previously described in the facility’s existing safety analyses? (4) Could the proposed change increase the consequences of a malfunction of equipment important to safety described in the facility’s existing safety analyses? (5) Could the proposed change create the possibility of an accident of a different type than any previously evaluated in the facility’s existing safety analyses? (6) Could the proposed change create the possibility of a malfunction of equipment important to safety of a different type than any previously evaluated in the facility’s existing safety analyses? (7) Does the proposed change reduce the margin of safety? The term “safety analyses” in these questions refers to those potential events and their controls considered in the hazard analysis in the DSA. These include not only the explicit description of the analyses in the DSA but also any analyses performed to support the summary descriptions of the analyses in the DSA. When a potential event is discovered that is not treated in the DSA, it should be considered as a possible new event (see question 5) or as an indicator of a potentially inadequate safety analysis issue. For the purposes of this Guide, equipment important to safety should be understood to include any equipment whose function can affect safety either directly or indirectly. This includes safety class and safety significant SSCs, and other systems that perform an important defense-in-depth safety function, equipment relied on for safe shutdown, and, in some cases, process equipment. In the case of a potentially inadequate safety analysis, the fact that there is reason to believe the safety analysis may be inadequate makes it a USQ. When the potentially inadequate safety analysis arises from a discrepant as-found condition, the seven listed questions can be used in a backward-looking manner. That is, the current physical configuration can be looked at as if it were a proposed modification. If the USQ determination is found to be negative, the contractor CANCELE D DOE G 424.1-1 11 10-24-01 could have approved the discrepant condition without DOE involvement. This would resolve the discrepancy and provide justification for the current configuration.

The contractor’s USQ procedures should require that a defensible explanation be documented for the answers to each of the USQ criteria. The explanation should provide a good technical basis, based on sound engineering judgment, for each of the answers. It is inappropriate to set a numerical margin for increases in the probability or consequences within which a positive USQ determination would not be triggered. Such margins lend themselves to excessive efforts in calculations when accident parameters are highly uncertain, and the possibility that the results might be a function of the calculation methods used, rather than of safety differences. It is the direction that the change has on probability or consequences that is important, not the magnitude that is important. For example, if the wall thickness of a pressure vessel is going to be increased, or the reaction time of a relay in a safety system is shortened, it is likely the change is in the direction of increased safety. If the changes are in the opposite direction, safety is likely to be decreased. However, potential increases should be clearly discernible, at least on a qualitative basis. In the examples described, one might look at the pressure vessel codes and standards or the required response times for the relay action relative to the safety function and assess whether there would still be a comfortable margin of safety. If so, a case could probably be argued that there would be no discernible increase in probability of an accident. When considering these issues in the context of bounding accidents, it is important to recognize that the bounding accidents for workers may be (and probably are, especially for immediately involved workers) different than bounding accidents for the public. If, as a result of a proposed change, additional protective measures (either administrative or hardware-related) are warranted during a postulated accident situation to ensure adequate protection of the public or to provide worker safety, the USQ determination should conclude that the USQ determination is positive, on the basis that the change will result in either an increase in probability or an increase in consequences of an accident. Additional protective measures that are provided to reduce exposures, such as those related to ALARA (as low as reasonably achievable) levels, and not related to potential accidents, are not included. DOE wants to be involved for several reasons. First, to verify that the degree of protection is adequate. Second, to ensure that the safety basis is properly revised to include the additional protective measures. Third, to verify that any hardware involved is properly classified (for example, as a safety class or safety significant SSC) and hence will receive appropriate surveillance and maintenance. When evaluating for “increases in consequences” of an accident, if the previously bounding case for that family of accidents remains the bounding case, then generally there is no increase in the consequences within the USQ process. In this regard, it is important that the family of accidents be related, in addition to being of the same type (for example, fires), but also utilizes the same set of preventative and mitigative measures. While this is appropriate for public safety, adequate protection of workers requires further evaluation. Each change must be evaluated for increases in the consequences to workers. Further, when considering a new scenario within a family of accidents, it is important to assess whether the criterion of discernibly increasing the probability of an accident type may be triggered.

CANCELE D 12 DOE G 424.1-1 10-24-01 The bases of hazard control documents (TSRs or other formats) should identify any relevant margins of safety. However, all safety basis documents should be reviewed to identify any relevant margins of safety. See Appendix A.1, subitem 7 for a discussion of margin of safety. Specific responsibilities of those performing or reviewing USQ determinations should be clearly defined. Documentation requirements should also be discussed in the implementing procedures. They should identify the level of detail necessary to document performance of the USQ determination and conclusions reached and include a list of references relied on to reach this conclusion as well as guidance for the retention of records. 3.4 Documentation and Retention The contractor must retain records of USQ actions taken pursuant to Section 830.203 for at least the full operational lifetime of the facility, until the facility is turned over to the decommissioning and decontamination phase. If there is a change in the contractor operating the facility, the outgoing contractor must turn over all USQ records to the incoming contractor. At the end of this life cycle phase, the contractor should consider retaining the USQ records for the next phase of the facility life cycle. The contractor must keep the facility DSA current by updating it annually. All changes at the facility should be reflected in these updates at an appropriate level of detail, including those that were authorized through the USQ process. Previously it was specified that updates to safety analysis reports (DSAs) should include all changes implemented 6 months or more before the submittal of the annual update. This has been changed to a commensurate schedule, to allow flexibility. It may be practical to include more current changes than prior to 6 months before submittal of the update. However, at least those implemented 6 months or more before the submittal of the annual update should be included. All contractors responsible for a nuclear facility are required to submit to DOE an annual summary description of all USQ determinations performed. Items that were screened out and a USQ determination was not necessary do not need to be included in the annual summary (although they are still required to be retained in the records of USQ actions). This report should be submitted on a schedule commensurate with annual update of the DSA. 3.5 Training and Qualifications Implementing procedures should establish the personnel training and qualifications needed to perform the USQ process. These include required educational background, years and/or types of work experience, knowledge of the facility, understanding of DOE requirements related to the facility safety basis (including the USQ process), and familiarity with the facility-specific safety basis. CANCELE D DOE G 424.1-1 13 10-24-01 All personnel responsible for preparing, reviewing, or approving USQ documents should receive training on the application of Section 830.203, including any facility-specific procedures. The recommended interval for retraining is every 2 years. The contractor should maintain a list of those personnel who are currently qualified to perform the USQ process. CANCELE D 14 DOE G 424.1-1 10-24-01 This page intentionally left blank. CANCELE D DOE G 424.1-1 Appendix A 10-24-01 Page A-1

1 For the purposes of this appendix, “change” will mean any change to procedures or equipment (including prior undocumented changes), any new tests or experiments, or any new information that has the potential to invalidate the safety basis. UNREVIEWED SAFETY QUESTION DETERMINATION A.1 USQ PROCESS The unreviewed safety question (USQ) determination is not a substitute for a safety analysis; it merely serves as a benchmark for whether the safety basis is being preserved. A safety analysis may show that a proposed change is safe, yet the USQ determination may find that the change creates a USQ and therefore requires Department of Energy (DOE) approval prior to implementation. Contractor procedures should clearly establish the differences between the concepts supporting safety analyses for the documented safety analysis (DSA) and those used for a USQ determination. Once it has been determined that a USQ determination is required, it can be approached by providing an answer to each of the seven questions identified using the USQ determination process. If any of these questions is answered “yes,” the change is considered a USQ. An appropriate justification for each answer should be recorded. The examples given in the following subsections are provided to help the reviewer identify potential USQs. They are not meant to be examples of USQs. That determination requires consideration of the DSA for the nuclear facility or other DOE-approved documentation that provides the safety basis for operations or other activities and the specific details of the activity. 1. Could the proposed change1 increase the probability of an accident previously evaluated in the facility’s existing safety analyses? To understand how the probability of an accident occurring could be increased, it is important to understand how the term “accident” is applied: the term “accident” refers to the anticipated operational transients and postulated accidents considered in the DSA. In answering this question, the first step is to determine the accidents, which have been evaluated in the previously approved safety basis, that may be affected by the proposed change. By focusing on the initiators of the previously evaluated accidents, a determination is made as to whether there is an increased likelihood that a given accident would occur. The following questions may provide a useful approach in making this determination. (a) Will the proposed change meet the design, material, and construction standards applicable to the structures, systems, and components (SSCs) being modified? If the answer is “yes,” this aspect of the proposed change is judged not to increase the likelihood of the occurrence of an accident. If the answer is “no” to any of the items, either a justification for saying there is no increase in the likelihood of the CANCELE D Appendix A DOE G 424.1-1 Page A-2 10-24-01 occurrence of an accident will need to be developed or it is concluded that the likelihood of the occurrence of an accident is increased. (b) Could the proposed change affect overall SSC performance in a manner that could increase the probability of a previously analyzed accident? Possible questions to ask are— (1) Could the proposed change use instrumentation with accuracies or response characteristics that are different from those of existing instrumentation and could make an accident more likely to occur?

(2) Could the proposed change cause SSCs to be operated outside their design or testing limits? Examples include the following: overloading electrical systems, overpressurizing a piping system, or operating a motor outside its rated voltage and amperage. (3) Could the proposed change cause system vibration, water hammer, fatigue, corrosion, thermal cycling, or degradation of the environment for SSCs that would exceed the design limits? (4) Could the proposed change cause a change to any SSC interface in a way that could increase the likelihood of an accident? 2. Could the proposed change increase the consequences of an accident previously evaluated in the facility’s existing safety analyses? In answering this question, the first step is to determine which accidents evaluated in the safety analyses may have their radiological and hazardous material consequences altered as a direct result of the change. The next step is to determine whether the change could, in fact, increase the consequences of any of the accidents evaluated in the existing safety analyses. Consequences to workers (in-facility, outside, or collocated) and the public must be considered. Examples of questions that assist in this determination are as follows: (a) Could the proposed change degrade or prevent safety functions described or assumed in the existing safety analyses? (b) Could the proposed change alter any assumptions previously made in evaluating the radiological and hazardous material consequences in the existing safety analyses? (c) Could the proposed change play a direct role in mitigating the radiological or hazardous material consequences assumed in the existing safety analyses? (d) Could the proposed change affect the integrity or function of any fission product barrier or any radioactive or hazardous material barriers? CANCELE D DOE G 424.1-1 Appendix A 10-24-01 Page A-3 3. Could the proposed change increase the probability of a malfunction of equipment important to safety previously evaluated in the facility’s existing safety analyses? The safety analyses for the facility assume the proper functioning of equipment important to safety in demonstrating the adequacy of design. The proper functioning of other systems, including support systems, is generally assumed. The scope of the USQ determination should include these other systems. For example, a change that does either of the following is a change that increases the probability of a malfunction of equipment important to safety: • degrades the performance of equipment important to safety, assumed to function in the accident analysis, to below the performance level assumed in the existing safety analyses; or • increases the challenge to equipment important to safety assumed to function in the accident analysis (for example, more rapid pressure rise), degrading performance to a level below that assumed in the existing safety analyses. In answering this question, the first step is to determine what SSCs could be affected by the proposed change. Then the effects of this change on equipment important to safety are evaluated, including both direct and indirect effects. Direct effects are those in which the change affects the equipment (for example, a motor change on a pump). Indirect effects are those in which the change affects one piece of equipment, which in turn can affect equipment important to safety. An example of indirect effects would be one piece of equipment falling on safety equipment.

After the impact of the change on equipment important to safety is identified, a determination is made whether an increase in the probability of a malfunction of the SSCs has occurred. The following are examples of questions that can be used in making this determination. a. Will the proposed change meet the original design specifications for materials and construction practices when the following questions are considered: (1) Are the seismic specifications met (for example, use of proper supports, proper lugging at terminals, and isolation of lifted leads)? (2) Are separation criteria met (for example, minimum distance between circuits in separate divisions, channels in the same division, and jumpers run in conduit)? (3) Are the environmental criteria met (for example, use of materials suitable for the radiation or thermal environment in which they will be used)? CANCELE D Appendix A DOE G 424.1-1 Page A-4 10-24-01 b. Will the proposed change degrade equipment important to safety reliability by— (1) imposing additional loads not analyzed in the design? (2) deleting or reducing system or equipment protection features? (3) downgrading the support system performance necessary for reliable operation of the equipment? (4) reducing system or equipment redundancy or independence? (5) increasing the frequency of operation of systems/equipment? (6) imposing increased or more severe testing requirements on systems or equipment? If the change adversely affects the equipment important to safety, the likelihood of equipment malfunction may be increased. A “no” answer to any question in paragraph 3a or a “yes” answer to any question in paragraph 3b may not mean that there is a negative impact on safety. It would, however, indicate the existence of a USQ and the need for further analyses. 4. Could the proposed change increase the consequence of a malfunction of equipment important to safety previously evaluated in the facility’s existing safety analyses? This question asks whether, assuming a malfunction of equipment important to safety, the change would result in increased hazardous-material or radiological consequences. For example, consider a change that caused a valve in a safety system to fail in the closed position where previously it was assumed to fail in the open position. If this change results in an increase in consequences of an accident, it indicates the change involves a USQ. In some situations, such as a loss of a preferred failure mode, the change might not lead to an increase in the calculated consequences but should be considered within the context of a possible reduction in a margin of safety. 5. Could the proposed change create the possibility of an accident of a different type than any previously evaluated in the facility’s existing safety analyses? An accident or malfunction that involves an initiator or failure not considered in the nuclear facility’s existing safety analyses is potentially an accident or malfunction of a different type. An example would be turbine missiles from a gas turbine added as an alternate power source. Certain accidents or malfunctions are not treated in the nuclear facility’s existing safety analyses because their effects are bounded by similar events that are analyzed. CANCELE D DOE G 424.1-1 Appendix A 10-24-01 Page A-5

The possible malfunctions or accidents of a different type are limited to those considered to be as likely to happen as those considered in the existing safety analyses. For example, a seismic-induced failure of a component designed to appropriate seismic criteria will not cause a malfunction of a different type. However, a change that increases the probability of an accident previously thought to be beyond extremely unlikely, so that it is as likely as the accidents considered in the existing safety analyses, creates a possible accident of a different type. In answering this question, the first step is to determine the types of accidents evaluated in the existing safety analyses. The types of credible accidents that the change could create can then be identified and listed. Evaluating the differences between the two lists will determine the answer to the question. The accidents evaluated in the existing safety analyses are generally chosen to be bounding for a broad class of credible accidents. Thus, comparison of a new accident to the existing analyses may require referral to the underlying hazard analyses. 6. Could the proposed change create the possibility of a malfunction of equipment important to safety of a different type than any previously evaluated in the facility’s existing safety analyses? To answer this question, the types of failure modes of equipment important to safety that have been previously evaluated in the existing safety analyses and that would be affected by the change are identified. Then the types of failure modes that the change could create need to be identified. Comparing the two lists can provide an answer to the question. An example of a change that might create a malfunction of a different type is the relocation of equipment so that it becomes susceptible to flooding; another example is the replacement of a mechanical control system with a digital control system that could fail in a different mode. 7. Does the proposed change reduce the margin of safety? This section deals with margins of safety related to DOE-approved hazard control documents. These controls may be technical safety requirements (TSRs), or they may be in another form, as permitted in Section 830.205 for certain environmental restoration activities. For purposes of performing the USQ determination, a margin of safety is defined by the range between two conditions. The first is the most adverse condition estimated or calculated in safety analyses to occur from an operational upset or family of related upsets. The second condition is the worst-case value known to be safe, from an engineering perspective. This value would be expected to be related to the condition at which some accident prevention or mitigation action must be taken in response to the upset or accident, as required by a DOE-approved TSR, not the actual predicted failure point of some component. CANCELE D Appendix A DOE G 424.1-1 Page A-6 10-24-01 Hazard control documents set forth the minimum acceptable limits for operation under normal and specified failure conditions; they ensure that the available safety equipment and operating conditions meet the assumptions in the existing safety analyses. They distill those aspects of the safety analyses that are required to ensure the performance of safety SSCs and personnel as relied on and defined in the safety analyses.

The bases for a hazard control should define the margin of safety. If the bases of a hazard control do not specifically identify a margin of safety, the DSA and other appropriate safety basis documents should be reviewed to determine whether the proposed change, test or experiment, or new information has or would result in a reduction in a margin of safety. The judgment on whether the margin is reduced should be based on physical parameters or conditions that can be observed or calculated. The safety margin is sometimes implicitly described. A margin of safety can depend on a parameter other than one of the process variables. Therefore, the precise determination of a numerical value associated with a change is not always possible. Implicit margins are, for example, conditions for acceptance for a computer code, method, or industry-accepted practice. It may be sufficient to determine only the direction of the margin change (that is, increasing or decreasing) due to the proposed change. Safety margins generally include worst-case assumptions of initial conditions, conservative assumptions in computer modeling and codes, allowance for instrument drift and system response time, redundancy and independence of components in safety trains, and plant response during operating transient and accident conditions. A change that affects initial conditions, a system response time, or some other parameter that can affect the course of an accident analysis supporting the bases of hazard controls must be evaluated to determine whether the change would reduce the margin of safety. A.2 PERFORMING USQ DETERMINATIONS In performing USQ determinations of a proposed change, documented justification for the USQ determination should be developed. Consistent with the intent of Section 830.203, this documentation should be complete in the sense that a qualified independent reviewer could draw the same conclusion. The importance of the documentation is emphasized by the fact that experience and engineering knowledge, rather than models and experimental data, are frequently relied on to make the USQ determination. Since an important goal of the USQ determination is to demonstrate that the safety basis is being maintained, the items considered by the evaluator must be clearly stated. Documentation of the effects considered will enable the independent reviewers to assess the adequacy of the USQ determination and its conclusions. To provide an example of appropriate documentation, a USQ determination worksheet is provided below. CANCELE D DOE G 424.1-1 Appendix A 10-24-01 Page A-7 A.3 EXAMPLE USQ DETERMINATION WORKSHEET USQ Determination Number: Revision No. Facility Change Number: Revision No. Facility Change Title: INTRODUCTION 1. Description of the aspects of the change being evaluated and its expected effects. 2. Identification of parameters and structures, systems, and components (SSCs) affected by the change. 3. Identification of the SSC failure modes associated with the change. 4. References to the location of information used for the USQ determination. PART I: IMPACT ON THE ACCIDENTS EVALUATED AS THE SAFETY BASIS 1. Identify the design basis or evaluation basis accidents reviewed for potential impact by the change. 2. Discuss how the parameters and SSCs affected by the change affect the consequences of these accidents.

3. Identify the design basis or evaluation basis accidents, if any, for which failure modes associated with the change can be an initiating event. 4. Discuss the impact of the change on the probability of occurrence of the design basis or evaluation basis accidents identified in item 3 of this part. 5. Identify the equipment important to safety affected by the change. 6. Discuss the impact of the change and/or the failure modes on the probability of failure of the SSCs identified. 7. Discuss the impact of the change on the performance of the SSCs. CANCELE D Appendix A DOE G 424.1-1 Page A-8 10-24-01 SUMMARY: PART I Yes No Based on item 2 above, could the change increase the consequences of a design basis or evaluation basis accident? Based on item 4 above, could the change increase the probability of a design basis or evaluation basis accident? Based on item 6 above, could the change increase the probability of a failure of equipment important to safety? Based on item 7 above, could the change degrade the performance of equipment important to safety below that assumed in the design basis or evaluation basis analysis? If the answer to any of the above questions is “yes,” the change represents a USQ. PART II: POTENTIAL FOR CREATION OF A NEW TYPE OF UNANALYZED EVENT 1. Based on Part I, assess the impact of the change or the failure modes or both associated with the change to determine whether the impact has modified the facility response to the point where the change can be considered a new type of event. Discuss the basis for this determination. 2. Determine whether the failure modes of equipment important to safety associated with the change represent a new unanalyzed type of malfunction. Discuss the basis for this determination. SUMMARY: PART II Yes No Based on 1 and 2 above, could the change create the potential for a new type of unanalyzed event or a new type of malfunction? If the answer is “yes,” the change represents a USQ. CANCELE D DOE G 424.1-1 Appendix A 10-24-01 Page A-9 PART III: IMPACT ON THE MARGIN OF SAFETY 1. Based on the results identified in Part I, discuss the impact of the consequences on the protective barriers against release. 2. Identify how the protective barriers against release, if any, are directly affected by the change or a failure mode of the change. 3. Discuss the impact of the change on the design limits for the protective barriers against release identified above. 4. Identify the margins of safety related to this change. SUMMARY: PART III Yes No Based on 1 above, could the consequences of the design or evaluation basis accidents increase? Based on 2, 3, and 4 above, could the change reduce the margin of safety provided for the protective barriers? Based on 4 above, could the change reduce other margins of that are not related to the barriers? PART IV: USQ DETERMINATION CONCLUSION Based on the evaluation in Parts I, II, and III, the change— Does not constitute an unreviewed safety question. Does constitute an unreviewed safety question. Preparer’s Signature Date Independent Reviewer’s Signature Date Approval Signature Date CANCELE D Appendix A DOE G 424.1-1 Page A-10 10-24-01 This page intentionally left blank. CANCELE D DOE G 424.1-1 Appendix B 10-24-01 Page B-1 UNREVIEWED SAFETY QUESTIONS LESSONS LEARNED The following list of lessons learned has been developed from experience in applying the unreviewed safety question (USQ) process. B.1 TITLE

The title of the process, “unreviewed safety questions,” may suggest that the process determines the safety of changes. However, the USQ process is intended to determine the final approval authority for a change [that is, the contractor or Department of Energy (DOE)]. The USQ process is not intended to replace or to serve instead of a safety analysis of the change. The safety implications of a change should be reviewed, analyzed, understood, addressed, determined to be acceptable, and documented by the contractor separately from the USQ process. Using the USQ process instead of the safety analysis complicates the USQ process. Further, such a usage is inappropriate because the seven questions to be answered in the USQ determination are not geared toward understanding whether the change is safe but rather if any of the probability or consequence risk factors may have increased beyond what has been accepted previously by DOE and hence if the existing safety controls remain adequate. The change should already be known to be safe before it enters the USQ process. The USQ process determines if final approval by the contractor is sufficient or DOE review and approval are required. DOE wants to review and approve those changes that involve a USQ (that is, when the USQ determination is positive) to verify that the safety controls are adequate to provide an acceptable level of safety to the public and workers. The existence of a positive USQ determination does not mean that the change is unsafe, but only that DOE must take the final approval action. B.2 IDENTIFYING POTENTIALLY INADEQUATE SAFETY ANALYSES When an employee identifies a potentially inadequate safety analyses, the facility management is allowed a reasonable time prior to notifying DOE to confirm the reasonableness of the potential for having an inadequate safety analysis. This time should be on the order of hours, up to several days, but not a matter of weeks, or months. B.3 REPORTING POTENTIAL INADEQUACIES IN SAFETY ANALYSES After the potential for having inadequate safety analyses has been confirmed, 10 CFR 830.203 requires four special actions to be taken. One of those actions is to notify DOE of the situation. The current DOE reporting system (DOE O 232.1A and the associated Manual, DOE M 232.1-1A) require that a potential degradation of the safety basis be categorized and reported as an “off-normal” condition. The Occurrence Reporting and Processing System (ORPS) may be used for this notification if the report explicitly states that the situation involves a “potential USQ involving a potentially inadequate safety analysis.” CANCELE D Appendix B DOE G 424.1-1 Page B-2 10-24-01 Another action required for a potentially inadequate safety analysis is the preparation of a USQ determination on the situation. In the event that the USQ determination is positive, the current DOE reporting system requires that this condition be categorized and reported as an “unusual occurrence.” B.4 CONTROL OF HAZARDS DURING INSTALLATION Hazards that may be involved during the installation of a modification should be addressed by appropriate safety management programs (such as work planning and control, that includes job hazard analysis or a similar process). As discussed in Section 2.1 of the Guide, the work authorization system should include a step for consideration of possible USQ situations on the facility safety basis, beyond the planned work.

DOE relies on the contractor’s commitment to various safety management programs to address the hazards involved in the actual installation of a modification for worker protection, not on the USQ process. These programs include radiation protection, hazardous material protection, work planning and control, Occupational Safety and Health Administration, ALARA (as low as reasonably achievable), and lockout/tagout. One basic tenet of the USQ process is to assess the potential change in probability and consequences risk factors that might be involved when facility operations are resumed after the modification is implemented. However, sometimes a modification might be only partially implemented because it is interrupted by unforeseen circumstances. In such cases, the USQ documentation would need to be revisited to ensure that it adequately addresses operation with the partially implemented configuration. B.5 “DECLARING” A USQ TO EXIST Section 830.203 assigns the contractor the basic responsibility to evaluate changes and determine if a USQ exists, or is involved. If the result of the contractor’s USQ determination is positive, a USQ exists. DOE can declare that a USQ exists as part of its oversight responsibility of the USQ process. Such a declaration might result from a disagreement with a contractor’s negative USQ determination or might result from a condition for which the contractor has not done a USQ determination. When DOE declares a USQ, it is because DOE believes it should be involved in the review and approval of the situation to fulfill its responsibilities. B.6 SUBMITTALS TO DOE At some sites, the completed USQ determination form is submitted routinely to DOE for approval. This practice should be reconsidered because it is not required and can shift the focus of the DOE review from the safety characteristics of the change to how well the USQ determination was prepared. For a potentially inadequate safety analysis, the rule requires that an evaluation of the safety of the situation (not the USQ determination) be submitted prior to removing any restrictions. CANCELE D DOE G 424.1-1 Appendix B 10-24-01 Page B-3 The USQ process does not encompass all situations for which the contractor may need to request an amendment to the safety basis of a facility. For example, a change to the hazard categorization level for a facility requires DOE approval, but should not be addressed by the USQ process. Some contractors have developed a formalized process for requesting amendments to the safety basis. At some facilities, the USQ process is being used virtually every time there is need to request an amendment to the safety basis, regardless of whether or not a change to the facility or procedures is involved. In some situations, the USQ process is inappropriate. A formalized procedure that defines the content of the submittal to DOE requesting an amendment to the facility safety basis could supplement the USQ process (regarding positive USQ determinations). Such a procedure would also support other situations that do not involve the USQ process. Such a procedure might outline the expected content as including items such as (1) an introductory summary of the purpose of the letter and its contents, (2) a description of the situation that generated the need for action, (3) alternative actions considered, (4) a description of the selected action, (5) engineering technical considerations, (6) safety implications of the action, including the results of the USQ process when applicable, (7) programmatic implications, (8) budgetary considerations, (9) schedule considerations, and (10) basis on which the contractor believes that DOE should approve the action.

B.7 NEED FOR USQ DETERMINATIONS FOR TSR CHANGES Section 830.205 requires that changes to the technical safety requirements (TSRs) be submitted to DOE for review and approval. Changes to the TSRs could involve the need either to modify an existing TSR or to add a new TSR. If it is known that a proposed change only involves a TSR change, it is not required to go through the USQ determination to determine if DOE approval is also required by 830.203. Similarly, if a change involves a TSR change, calling the change a positive USQ determination just because it requires DOE approval would be inappropriate. However, while performing a USQ determination for TSR changes is not required, it may be desirable. When the TSR change is submitted to DOE for review and approval, the contractor should include appropriate information to support the contractor's position that the change should be approved (that is, the contractor should include the basis for the proposed change). Such supporting information might include some of the same considerations that would be addressed in a USQ determination. B.8 TENANT/LANDLORD RELATIONSHIPS In some cases a “tenant/landlord” relationship exists, such as for research and development activities or other operations being performed by one organizational unit at a nuclear facility that is operated or managed by a different organizational unit. In these cases, the recommended approach to allow flexibility for the tenant’s activities and still protect the safety basis via the USQ process is to: (1) ensure that a hazards analysis (or other appropriate safety analysis) exists for each tenant activity such that the collective hazards analyses for all tenant activities are encompassed by the facility safety basis, (2) require that the tenant review any changes in the CANCELE D Appendix B DOE G 424.1-1 Page B-4 10-24-01 activities being considered against the corresponding hazards analysis , and then (3) if the current hazards analysis does not envelope the change, require that the USQ process be entered more formally. There is a potential conflict between requiring that all changes within a facility be considered within a formal change control process and allowing sufficient flexibility that researchers and other tenants may conduct their activities without undue restrictions that might stifle the desired creativity. The objective should be to impose the formality necessary to ensure that all activities are conducted safely within the DOE-approved safety basis for the facility without applying any unnecessary restrictions on the activities. Having the tenant take an active role in development of an appropriate envelope for the activities within the hazards analysis can promote ownership. This participation can also enhance safety responsibility without limiting the activities. B.9 GRADED APPROACH The graded approach is applied to the USQ process only indirectly. During the hazards analysis and safety analysis processes, equipment is classified as safety class, safety significant, “other” safety, or nonsafety. Once these classifications are established, they are used to indicate how much effort should be applied. However, no steps of the USQ process can be eliminated based on such grading.

In some situations, attempts to apply the graded approach to the USQ process have resulted in inadequate USQ determinations. For example, some contractors have applied the graded approach to the change control processes in a manner that does not require the application of formal change controls unless the change involves equipment, procedures, or operations important to safety. Caution needs to be applied in such a situation to ensure that this approach does not prevent changes from being considered by the USQ process, which is a subset of change control. The only application of the graded approach to the USQ process is indirect. The graded approach may give a rough indication of how much justification or basis information should be provided when explaining the answers to each of the seven USQ determination criteria. More elaborate and thorough basis information would be expected for changes to safety equipment than for nonsafety equipment. In any case, the justification for the answers to the USQ determination criteria needs to be defensible. B.10 UNIFIED AND CONSOLIDATED PROCEDURES Contractors should consider the desirability of requiring that each nuclear facility at the site adhere to a single sitewide USQ procedure and sitewide USQ training/qualification requirements. Facility-specific considerations, such as identifying the safety basis documents, could be addressed by appendices to the sitewide procedure. At some sites, each nuclear facility uses a different USQ procedure, leading to inconsistencies and misapplications. One DOE field office assessment found that a root cause of USQ problems was the lack of a common procedure and common USQ training. A single sitewide USQ procedure could improve the quality of the USQ process by taking advantage of the best aspects of each of the different facility procedures. Using CANCELE D DOE G 424.1-1 Appendix B 10-24-01 Page B-5 the same USQ forms for screens and USQ determinations and using the same training and qualification requirements can help develop a high-quality USQ process across the site. B.11 USQ SCREENING USQ screening is intended to be a simple go/no-go decision-making step, without evaluative consideration. When appropriately streamlined, this step in the USQ process can often be completed in a matter of minutes. Screening to determine whether an SSC is described in the safety analyses (safety basis) should consider only whether the equipment is identified anywhere in the safety basis. Screening criteria should not be based on whether the SSC is formally classified as a safety SSC (that is safety class or safety significant), is taken credit for in the safety analysis (or accident analysis) chapter of the safety basis document, nor whether the particular characteristic(s) of the SSC to be changed are taken credit for. The basic intent of screening is to eliminate unnecessary time and effort being spent performing a USQ determination if there is no possible way that the change could impact the safety basis and involve a USQ. Conversely, screening criteria must make certain that changes which could possibly involve a USQ are “screened in” and hence a USQ determination is performed. The USQ screening criteria center on the question of whether the item to be changed is described in the safety basis.

An example of an inappropriate, highly evaluative, screening criterion is: “Does this change significantly adversely impact the ability of an SSC described in the safety basis to perform its safety functions?” Such a criterion encompasses four separate considerations: (1) determining if the SSC is identified in the safety basis, (2) finding out what the safety functions are for the SSC, which might not be stated very clearly or completely, (3) evaluating if the impact of this change could adversely affect the capability to perform a safety function, and (4) evaluating if the impact could be significant. All but the first consideration are evaluative considerations that depend strongly on which individual does the USQ screen. These types of evaluative considerations should be in the domain of the USQ determination, not part of the simple screening step. If someone were to subdivide the safety basis documents into those parts that are “descriptive” and those parts that are important to safety, the results would be highly subjective. Limiting the performance of USQ determinations to only those SSCs taken credit for in the safety analysis chapter, or even further to only those characteristics of SSCs taken credit for can lead to serious problems, including bypassing the USQ determination and thereby, unknowingly exceeding the bounds of the safety basis. Similarly, limiting screening to safety SSCs (that is, those identified as safety class or safety significant) before a USQ determination is done is inappropriate due to the potential for unrecognized direct or indirect interactions. B.12 DOE INVOLVEMENT IN THE USQ DETERMINATION The contractor should make every effort to complete its USQ determinations without DOE involvement. DOE has charged the contractor with performing the USQ process to determine if CANCELE D Appendix B DOE G 424.1-1 Page B-6 10-24-01 contractor approval is sufficient. At times, there will be borderline cases or “gray areas” where engineering judgment will play a large role in the determination. The contractor should complete the determination with sufficient justification to defend the conclusion, despite whether the final determination is positive or negative. While DOE and the contractor are “partners” in many senses, when it comes to its nuclear safety regulatory and oversight responsibilities, DOE must maintain an appropriate degree of independence from the contractor’s activities. B.13 USQS AND CRITICALITY SAFETY EVALUATIONS All proposed new or changed processes involving criticality safety, including those in an experimental facility, are required to undergo a USQ review by the Nuclear Safety Management rule. When the USQ determination is positive, indicating the need for DOE review and approval of the change, the safety analyses and controls associated with the approved action become part of the safety basis for the facility. Any changes necessary to the DSA and TSR documents as a result of the change should be incorporated at the next annual update. The results of the USQ determination define the need for DOE approvals of the supporting criticality safety evaluations and explicit updates of the DSA and TSRs. CANCELE D DOE G 424.1-1 Foreword Contents 1. Introduction 2. Application 3. Implementation Guidance Appendix A, Unreviewed Safety Question Determination Appendix B, Unreviewed Safety Questions Lessons Learned