DOE G 424.1-1A, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements

NOT MEASUREMENT SENSITIVE DOE G 424.1-1A 7-24-06 IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS [This Guide describes suggested nonmandatory approaches for meeting requirements. Guides are not requirements documents and are not construed as requirements in any audit or appraisal for compliance with the parent Policy, Order, Notice, or Manual.] U.S. Department of Energy Office of Environment, Safety and Health Office of Nuclear and Facility Safety Policy AVAILABLE ONLINE AT: INITIATED BY: www.directives.doe.gov Office of Environment, Safety and Health CANCELE D CANCELE D DOE G 424.1-1A i (and ii) 7-24-06 FOREWORD This Department of Energy (DOE) Implementation Guide is available for use by all DOE components and contractors. Beneficial comments (recommendations, additions, deletions, and any pertinent data) that may improve this document should be sent to— Richard Black EH-22/270/GTN U.S. Department of Energy Washington, D.C. 20585 Phone (301) 903-0078 Facsimile (301) 903-6172 DOE Guides are part of the DOE Directives System and are issued to provide supplemental information regarding the Department’s requirements as contained in rules, Orders, Notices, and regulatory standards. Guides also provide acceptable methods for implementing these requirements. This Guide may be used by all contractors for DOE Hazard Category 1, 2, or 3 nuclear facilities, including contractors for National Nuclear Security Administration (NNSA) Hazard Category 1, 2, or 3 nuclear facilities. Throughout this document, wherever it references a contractor or a DOE contractor, the statement applies to a contractor for NNSA as well. This Guide was developed in support of Title 10 Code of Federal Regulations (CFR) Part 830, “Nuclear Safety Management.” It provides guidance for the requirements defined in 10 CFR 830.203, “Unreviewed Safety Question Process.” This Guide imposes no requirements. CANCELE D DOE G 424.1-1A iii (and iv) 7-24-06 CONTENTS FOREWORD.................................................................................................................................. i 1. INTRODUCTION............................................................................................................1 2. APPLICATION................................................................................................................2 2.1. Temporary or Permanent Changes in a Facility ......................................................3 2.2. Temporary or Permanent Changes in the Procedures..............................................4 2.3. Tests or Experiments Not Described in Existing DSAs ..........................................5 2.4. Discovery of Potential Inadequacies in the Existing Safety Analyses (PISAs).......5 3. IMPLEMENTATION GUIDANCE...............................................................................8 3.1. Integrated USQ Process ...........................................................................................9 3.2. Screening................................................................................................................10 3.3. Unreviewed Safety Question Determinations........................................................11 3.4. Documentation and Retention................................................................................14 3.5. Training and Qualifications .................................................................................155

ATTACHMENT A. UNREVIEWED SAFETY QUESTION DETERMINATION ATTACHMENT B. UNREVIEWED SAFETY QUESTIONS LESSONS LEARNED CANCELE D DOE G 424.1-1A 1 7-24-06 1. INTRODUCTION This Guide, including its attachments, provides information to assist in the implementation of Title 10 Code of Federal Regulations (CFR) Section 830.203, “Unreviewed Safety Question Process,” of the Nuclear Safety Management Rules for Category 1, 2, and 3 nuclear facilities owned or operated by the Department of Energy (DOE), including the National Nuclear Security Administration (NNSA). Section 830.203, “Unreviewed Safety Question Process,” allows contractors to make physical and procedural changes and to conduct tests and experiments without prior DOE approval if the proposed change can be accommodated within the existing safety basis. The contractor must evaluate any proposed change to ensure that it will not affect the safety basis of the facility either explicitly or implicitly. The unreviewed safety question (USQ) process is primarily applicable to the documented safety analysis (DSA). The rule references only the DSA, and includes conditions of approval in safety evaluation reports and facility-specific commitments made in compliance with DOE rules, Orders, or Policies. Because application of the USQ process depends on facility-specific information, results of an unreviewed safety question determination (USQD) in one facility generally cannot be extrapolated to other facilities. DOE approves procedures to implement the USQ process as required by 10 CFR 830.203. Where site level and facility level procedures are used, both site and facility level procedures are approved by DOE. Section 830.203 is implemented using contractor procedures for ensuring that proposed changes to physical characteristics or technical procedures (e.g., operating, test, surveillance, maintenance, and emergency procedures) are evaluated relative to the approved safety basis and that those proposed changes determined to involve USQs are brought to the attention of DOE for review and approval before changes are made. A proposed change or test involves a USQ if— the probability of the occurrence or the consequences of an accident or the malfunction of equipment important to safety previously evaluated in the documented safety analysis could be increased, the possibility of an accident or malfunction of a different type than any evaluated previously in the documented safety analysis could be created, or a margin of safety could be reduced. For the purposes of this Guide, equipment important to safety should be understood to include any equipment whose function, malfunction, or failure can affect safety either directly or indirectly. This includes safety class and safety significant structures, systems, and components (SSCs), and other systems that perform an important defense- in-depth function, equipment relied on for safe shutdown, and in some cases, process CANCELE D 2 DOE G 424.1-1A 7-24-06 equipment. Support systems to safety systems that are required for the safety function are also safety systems, and should be included. The USQ criteria apply as they affect both workers and the public. In the case of workers, both those in the immediate proximity of the hazard and collocated workers are included.

In accordance with 10 CFR 830.203(g) when a potential inadequacy in the safety analysis is identified; i.e., the DSA may not be bounding or may be otherwise inadequate, certain steps must be followed to deal with the situation. This could be because of an error in the current safety analysis or because the facility configuration is not what was analyzed. The existence of a USQ does not mean that a facility or operation is unsafe. The purpose of the USQ process is to alert DOE of events, conditions, or actions that affect the DOE- approved safety basis of the facility or operation and ensure appropriate DOE line management action. If a change is proposed or a condition is discovered that could increase the risk of operating a facility beyond that established in the current safety basis, DOE, including NNSA, line management reviews and determines the acceptability of that risk through the process of approving a revised safety basis that would be developed and submitted by the contractor. 2. APPLICATION Title 10 CFR 830.203 applies to all Category 1, 2 and 3 nuclear facilities. The USQ process applies to all temporary or permanent changes to nuclear facilities unless a decision to request DOE approval already has been made, and to potential inadequacies of safety analyses. Some changes may be such that they can be screened out from a detailed USQD. The applicability of 10 CFR 830.203 is broad. Non-safety-related SSCs are not excluded by the scope of Section 830.203 if they could affect the proper operation of equipment important to safety that is relied on in the safety basis or create the possibility of an accident or malfunction of a different type than previously evaluated in the documented safety analysis. For example, losses of certain non-safety-related systems may represent critical operational occurrences identified as initiators in the accident analysis. Therefore, changes to non-safety-related SSCs are evaluated and may be determined to involve a USQ. Physical interactions may also fall under the purview of Section 830.203. For example, the installation of a non-seismically supported piece of equipment above a seismically qualified component designed to perform a safety function explicitly or implicitly assumed in the existing safety analyses may constitute a USQ and need to be evaluated. The following paragraphs define types of changes, tests, and experiments and potential inadequacies that the USQ process needs to address to comply with Section 830.203. CANCELE D DOE G 424.1-1A 3 7-24-06 These discussions should not be used as bases for screening changes from the USQ process (or so-called prescreening). Screening should be done in accordance with the guidance in Sections 3.2 and B.14.1 of this Guide. 2.1 Temporary or Permanent Changes in a Facility USQDs should be performed on changes in nuclear facilities as described in the existing safety analysis text, drawing, or other information that is part of the facility safety basis. A structure, system, or component (SSC) would be considered changed if any of the following were to be altered: (1) the function(s), (2) the method of performing those functions, or (3) the design configuration. Although safety analyses include descriptions of many SSCs, a nuclear facility also contains many SSCs not explicitly described in the safety analyses. These can be components, subcomponents of larger components, or even entire systems.

Changes to SSCs that are not explicitly discussed in the safety analyses should not be excluded from the USQ process because changes to these SSCs may have potential to alter the function of an SSC explicitly described in the safety analysis. Also, a change to an SSC that does not involve equipment important to safety could initiate an accident or affect the course of an accident, so virtually no change can be ignored. It is important to distinguish between changes and routine maintenance activities. Routine maintenance activities—except those that are not enveloped by current safety analyses or that might violate a technical safety requirement (TSR)—do not require review under 10 CFR 830.203. A TSR limitation on maintenance activities might require limiting the number of systems or components that can be taken out of service at one time, or allowable outage times. Changes to maintenance procedures would constitute changes that should be reviewed under USQ requirements as discussed in Section 2.2 of this Guide. Routine maintenance activities include calibration, refurbishment, replacement with an equivalent component, and housekeeping. However, some maintenance activities may constitute changes, such as plant heat exchanger tube plugging where limits are not specified. A TSR should specify allowable outage times, permissible mode conditions, and permitted reduction in redundancy for systems or components removed from service for maintenance. A USQD need not be performed for these activities. A USQD should be completed for changes to systems or components that are included in safety analyses for a nuclear facility and for which allowed outage times are not included in the TSRs. “Change” as it applies to modes of operation or facility processes is important when, for example, a facility designed to accommodate several nuclear processes will modify equipment lineup to accommodate shifting from one of process to another. Changes CANCELE D 4 DOE G 424.1-1A 7-24-06 performed in accordance with approved procedures and considered within the safety basis of the facility are not considered changes in the facility procedures for the purposes of 10 CFR 830.203(d)(2). Temporary changes such as jumpers and lifted leads, temporary lead shielding on pipes and equipment, temporary blocks and bypasses, temporary supports, and equipment used on a temporary basis in a nuclear facility should be evaluated to determine whether a USQ exists unless such changes are specifically described in existing approved procedures. The conservative approach is to provide a written USQD for any change to a nuclear facility, whether discussed in existing safety analyses or not. The actual modification implementation process (for example, work authorization system) used in the field should be reviewed for possible development of USQs. Changes to plant configuration while work is in progress may involve a USQ relating to facility operations independent of the safety of the specific work on a modification. For example, if work involves interrupting a water supply that a fire protection system depends on, that is not covered by a TSR, that interruption should be examined through the USQ process. Modifications that are performed in separate, distinct stages (usually for cost, schedule, or operational considerations) may leave affected SSCs in conditions not addressed by a USQD that addresses only the final modification configuration but not the interim times between stages. The work authorization system should include a step to consider these types of possibilities.

2.2 Temporary or Permanent Changes in the Procedures A USQD may need to be prepared for changes to procedures that are identified in the facility DSA. However, as discussed in section 3.2 regarding USQ screening, it may not be necessary for some procedure changes such as non-technical administrative procedures. Procedures may be identified explicitly or implicitly in a facility DSA. If the procedure is implied directly by the nature of a topic in the safety basis (including the operational safety requirements or TSRs and their bases), that change should be considered to be to a procedure described in the DSA, so that a USQD is done when appropriate. Such implicitly described procedures include— the procedures that implement a safety management program described in the safety basis, procedures for implementing a specific administrative control, and operating, testing, surveillance, and maintenance procedures for equipment when that equipment is identified in the DSA. CANCELE D DOE G 424.1-1A 5 7-24-06 If characteristics of a safety management program described in the safety basis remain correct, complete, and valid, the result of the USQD would be expected to be negative, signifying that DOE approval is not needed. Procedures are not limited to those specifically identified by type (for example, operating, chemistry, system, test, surveillance, and emergency planning) but could include anything described in the DSAs that defines or describes activities or controls over the conduct of work. Changes to these activities or controls qualify as changes to procedures as described in the DSA, and therefore need to be evaluated as potential USQs. Changes to procedures include revisions to existing procedures and developing a new procedure. For a new procedure that could not have already been described, the question is, if a DSA were to be prepared (or updated) after the new procedure had been approved, is the new procedure of a type that would be identified in the DSA. If so a USQD should be prepared. 2.3 Tests or Experiments Not Described in Existing DSAs Written USQDs are required for tests or experiments not described in the existing safety analyses. Tests and experiments should be broadly interpreted to include new activities or operations. These activities could degrade safety margins during normal operations or anticipated transients or could degrade the ability of SSCs to prevent accidents or mitigate accident conditions. A USQD should be performed to ascertain whether a DOE review and approval of a new process configuration is needed. For preoperational, surveillance, functional, and startup tests performed regularly, USQDs are not needed every time a test is performed if the procedures are not changed. However, one-of-a-kind tests that measure the effectiveness of new techniques or a new system configuration that might affect safety SSCs will need to be evaluated before the tests can be conducted. Post modification testing should be considered and included in the USQD for the modification. 2.4 Discovery of Potential Inadequacies in the Existing Safety Analyses (PISAs) Written USQDs are needed when a contractor identifies or is informed of a situation that indicates that the safety analyses that support the DOE-approved safety basis may not be bounding or may be otherwise inadequate. Because a safety analysis inadequacy has potential to call into question information on which authorization of operations is based, the contractor is to—

take appropriate action to place or maintain the facility in a safe condition, expeditiously notify DOE when the information is discovered, perform a USQD and notify DOE of the results promptly, and CANCELE D 6 DOE G 424.1-1A 7-24-06 complete evaluation of the safety of the situation and submit it to DOE before removing any operational restrictions implemented to compensate for the discrepancy. Notification (the second bullet) allows reasonable time (hours or days but not weeks) to confirm that a safety analysis is inadequate. The time frame after initial notification of DOE until submittal of the results of the USQD (the third bullet) should be on the order of hours or days, not weeks or months. If a USQ is determined to be present, the evaluation of the safety of the situation should receive not only DOE’s review, but also its approval before any operational restrictions are removed. The facility DSA and the PISA requirements of the rule are important because the DSA defines the safety risks that DOE has accepted when authorizing operation of the facility and the PISA process provides a means to resolve inadequacies in the safety analysis. Because that analysis is the baseline reference for the USQ process, if it were inadequate the USQ process would be compromised; that is, USQDs would be performed against a faulty baseline. The USQ process includes special actions to be taken if it appears that the safety analyses might be inadequate. In general, potential for inadequate analysis arises from the following entry conditions: a discrepant as-found condition, an operational event or incident, or new information, including discovery of an error, sometimes from an external source. The main consideration is that the analysis does not match the current physical configuration, or the analysis is inappropriate or contains errors. The analysis might not match the facility configuration because of a discrepant as-found condition. Analytical errors might involve using incorrect input values, invalid assumptions, improper models, or calculation errors. The USQ process starts when facility management has information that gives reason to believe that there is a potential that the facility DSA might be inadequate. A justification for continuing operations (JCO) offers an alternative to ceasing operations when an unplanned condition arises that would otherwise require shutting down the facility. A JCO is a mechanism by which a contractor may request that DOE review and approve a temporary amendment to the facility safety basis that would allow the facility to continue operating in view of a specific and unexpected situation, the safety significance of the situation, and the compensatory measures being applied during this period. When DOE approves such a JCO, the approval is in effect a temporary amendment of the safety basis that would permit operations to continue under specified CANCELE D DOE G 424.1-1A 7 7-24-06 conditions, including a defined termination point. The DOE-approved JCO becomes a part of the facility safety basis for a defined limited period. A JCO is expected to define an appropriate set of temporary hazard controls (that is, compensatory measures) to be in effect during the life of the JCO. In some cases, these hazard controls might involve temporary changes to the facility technical safety requirements (TSRs).

A JCO should have a predefined, limited life only as may be necessary to perform the safety analysis of the unexpected situation, to identify and implement corrective actions, and to update the safety basis documents on a permanent basis. The JCO should define the termination point of the life of the JCO. In most cases, this would take the form of a functional point, such as the completion of turnover of a physical modification for routine operations, which would occur after implementing the modification, post-modification testing, updating critical documentation, and training of the operations staff. A JCO is not an appropriate means to request a change of the safety basis for a planned operation. In that case, a request for a change to the facility safety basis should be prepared by the contractor and submitted to DOE for approval. Because the JCO is established in response to an unexpected condition, event, or new information, it is inappropriate to use it in planning new activities without specific DOE approval. A JCO amendment of the safety basis should not be used for performing a USQD for a proposed new activity. A special case regarding PISAs exists when dealing with external audit team multiple concerns, each of which may (or may not) indicate the possibility of a potential inadequacy in the safety analyses. It may be impractical for facility staff to assess the situation quickly and disposition multiple concerns in the time frame normally expected for deciding a concern indicates a PISA (hours to days) and performing a USQD for each finding that qualifies as a PISA. In the face of multiple issues, it might be concluded that the short-term response to assuring a safe condition is to shut down operations. This might not be appropriate in all cases. As an option in these cases, except where it is apparent that an imminent hazard exists, DOE should be consulted without delay, and a mutually agreed upon approach to handling the concerns, including an expeditious schedule should be developed. This approach should have a high priority for addressing the concerns, should prioritize the safety related concerns, and should disposition each as described for individual PISAs. Where it is apparent that an imminent hazard exists, the four steps for a potential inadequacy should be undertaken without delay. A similar situation exists for design basis reconstitution projects where the original design bases may be lost or outdated. In this case, it can be expected that a team of engineers may identify many questions or issues that may not have current documentation and which may or may not constitute PISAs. For the purposes of the USQ process, design reconstitution projects can be regarded as DSA upgrades; that is, for CANCELE D 8 DOE G 424.1-1A 7-24-06 DSA upgrades, USQs should not result from the use of new analytical tools or in response to new requirements. The USQ process is not applicable when new requirements are being implemented or different analysis methods that are used result in changed accident consequences or probabilities. The USQ process is applicable when the project identifies situations where it is apparent that the existing safety basis may not be bounding or may be otherwise inadequate. A reconstitution project should have a process for prompt sorting and prioritizing of the questions and issues between those that can be addressed as a normal part of the reconstitution project and those that are to be handled promptly as PISAs. This process should be sufficiently timely to ensure that the expectations for PISAs can be met.

The USQ process does not apply to DSA upgrades in response to new requirements or to the use of new or different analytical tools during the upgrade process. However, the USQ process does apply when there is reason to believe that the current safety basis might be in error or otherwise inadequate. 3. IMPLEMENTATION GUIDANCE The USQ review process should be integrated into all technical aspects of the contractor organization responsible for design, engineering, maintenance, inspection, operations, and assessment of the nuclear facility or activity and individuals involved in these aspects should be familiar with the requirements of Section 830.203 and should be able to identify activities that might need to enter the USQ process. Each facility should identify the methods for making facility changes (for example, whether changes are made under modification processes, nonconformance processes, or maintenance processes). After methods have been identified, the contractor needs to maintain control of the facility change process and perform and document changes in accordance with approved procedures. Performing a modification under the guise of maintenance is not acceptable because the proper control processes to analyze the proposed change and document its outcome would probably be absent. All reasonable means for performing a change should be identified because each one provides direct input into the USQ process and should be integrated accordingly. The USQ process is intended to be implemented along with a change control process that includes generalized steps for— identifying and describing the temporary or permanent change, technical reviews of the change, management review and approval of the change, implementation of the change, and documenting the change. CANCELE D DOE G 424.1-1A 9 7-24-06 As part of the technical reviews of a change and separate from the USQ process, the contractor performs the appropriate type of safety analysis to ascertain whether the change is indeed safe. The USQ process is used subsequently to determine if final approval of the change by the contractor is sufficient or if DOE approval must be obtained. In performing USQ determinations of a proposed change, documented justification for the USQ determination should be developed. Consistent with the intent of Section 830.203, this documentation should be complete in the sense that a qualified independent reviewer could draw the same conclusion. Contractors should develop procedures that provide detailed guidance for the performance of the USQ process, including any screening and the USQDs. The procedures should— define the purpose; set forth applicability; provide definitions of appropriate terms, screening criteria, and the bases for their application; include detailed guidance on what is to be considered and evaluated when performing or reviewing a USQD; define the qualifications and responsibilities of personnel performing and reviewing USQDs; and require documentation for each USQD. DOE relies on contractor implementation of the USQ process to preserve the integrity of the safety basis while allowing flexibility in operations. The contractor responsible for DOE Hazard Category 1, 2 or 3 nuclear facilities must submit the procedure that defines its USQ process to DOE for approval as required by 10 CFR 830.203. 3.1 Integrated USQ Process

The USQ process should be integrated into the facility’s change control processes. The change processes should ensure that the USQ process is integrated into existing procedures or that new procedures are developed as necessary and that the need for completion of a USQD is not overlooked. Facility change flow processes for both temporary and permanent changes to SSCs and documents should be described by a governing policy, procedure, flowchart, or other description to define clear relationships between the USQ process and other change control procedures, including design change, configuration control, temporary change, and procedures governing the preparation, review, and approval of procedures. CANCELE D 10 DOE G 424.1-1A 7-24-06 Facility procedures should provide that USQ documents (USQDs or screening) are prepared by one individual and are given independent technical review by a person that has not been involved in document preparation. That person need not be organizationally independent. Facility procedures should provide that facility line management take approval action on the USQ documents. This ensures that line management is informed of the results of the USQ process and can take whatever follow-up actions are appropriate to enable prompt submission of changes to DOE for safety review and approval or cancellation of proposed changes. Facility operating committee review may be beneficial but should not replace line management approval. Excessive levels of approvals should be avoided when one internal approval and a second line management approval is sufficient. 3.2 Screening USQ screening is used to ascertain if it is necessary to expend the valuable time and resources necessary to perform a USQD, or whether there is reasonable technical justification for not performing a USQD. When screening eliminates an item, rationale should be well supported, documented and retained. Screening should be performed only by personnel qualified to perform USQDs. Section 830.203 has no specific reference to screening. Conditions for entering the USQ process are listed in 10 CFR 830.203(d) and discussed in more detail in Sections 2.1 through 2.4 of this Guide. If these conditions are not factors in proposed changes, then screening out such changes may be appropriate. Screening is intended to be a simple go/no-go decision-making step without evaluative consideration. When appropriately streamlined, a screening decision can often be completed in a matter of minutes. As discussed in Section 2.1, changes to SSCs not explicitly described in a DSA have the potential to affect the course of an accident that is addressed in the DSA or create the possibility of an accident not addressed in the DSA. If evaluating whether an item can be screened out takes the character of answering the seven USQD questions listed in Section 3.3 the item should not be screened out unless there is a categorical exclusion. If an item has not been screened out, a USQD should be completed. Candidate items for screening out include situations wherein the USQ process may not be applicable as follows: changes to or the addition of a new TSR; changes that management has already decided will be submitted to DOE for safety review and approval (including TSR changes); installation of an item with an exact replica (same manufacturer, model number, etc.); CANCELE D DOE G 424.1-1A 11 7-24-06

installation of an item that is on the facility list of “approved equivalent parts,” which a facility engineer has evaluated and determined that the replacement item meets all the requirements pertinent to the specific application, including the service conditions; changes when common commercial practices would suffice and a formal nuclear- grade change control process is not warranted (for example, changing fixtures for fluorescent lighting in a control room); and changes to documents that are purely editorial and make no technical change. Another manner in which screening criteria may be applied is through categorical exclusions. A categorical exclusion is an exclusion from the requirements that USQDs be performed on proposed changes to a category of SSCs or procedures as a result of a determination that the category cannot credibly have the capability of creating a USQ if changed. Documentation of proposed categorical exclusions should be submitted to DOE. Categorical exclusions are regarded as part of the contractor’s USQ procedure and require DOE approval. A categorical exclusion is valid when answers to the seven questions listed in section 3.3 would be “no” for every credible variation within the category. Written justification for the answers would provide formal documentation of the rationale for the exclusion. The screening process should identify and document the categorical exclusion that is applicable to each proposed change being screened out under this provision. Screening consideration also is given to the possibility that the matter being considered is fully covered by a previous USQD (even when location differences are considered). Such screenings should document the USQD being referenced and explain how the change being considered is adequately addressed by that USQD. When considering the resolution of a nonconformance, note that any disposition that involves a corrective action that does not fully meet all the existing requirements, including a use-as-is disposition, would constitute a design change; a resolution that restores the nonconforming SSC to the approved configuration or replacements with approved equivalent parts does not constitute a change. See Attachment B, sections B.11 and B.14.1 for additional discussions of screening and categorical exclusions. 3.3 Unreviewed Safety Question Determinations Contractors are expected to provide a detailed procedure on how to perform a USQD. Specific guidance on how to conduct a USQD is in Attachment A. Concepts used to develop this process are contained throughout this Guide. CANCELE D 12 DOE G 424.1-1A 7-24-06 Four criteria define a USQ (Section 830.3 of 10 CFR 830). Three can be addressed by answering seven questions. The fourth PISA criterion also invokes the seven questions as described later in this section. Could the proposed change increase the probability of an accident previously evaluated in the facility’s existing safety analyses? Could the proposed change increase the consequences (to workers or the public) of an accident previously evaluated in the facility’s existing safety analyses? Could the proposed change increase the probability of a malfunction of equipment important to safety previously described in the facility’s existing safety analyses? Could the proposed change increase the consequences of a malfunction of equipment important to safety described in the facility’s existing safety analyses?

Could the proposed change create the possibility of an accident of a different type than any previously evaluated in the facility’s existing safety analyses? Could the proposed change create the possibility of a malfunction of equipment important to safety of a different type than any previously evaluated in the facility’s existing safety analyses? Could the proposed change reduce a margin of safety? If the answer to any of these questions is yes, the change is considered a USQ. The term “safety analyses” in these questions refers to those potential events and their controls considered in the DSA. These include not only the explicit description of the analyses in the DSA but also any analyses performed to support the summary descriptions of the analyses in the DSA. When a potential event is discovered that is not treated in the DSA, it should be considered as a possible new event (see question 5) or as an indicator of a potentially inadequate safety analysis issue. For the purposes of this Guide, equipment important to safety should be understood to include any equipment whose function can affect safety either directly or indirectly. This includes safety class and safety significant SSCs, including support systems to these systems that are necessary for the safety function, which should have the same classification, and other systems that perform an important defense-in-depth safety function, equipment relied on for safe shutdown, and, in some cases, process equipment. In the case of a potentially inadequate safety analysis, the fact that there is reason to believe a safety analysis may be inadequate makes it a USQ and invokes paragraph 10 CFR 830.203(g), including performance of a formal USQD for confirmation. When a potentially inadequate safety analysis finding arises from an as-found condition, the seven questions can be used in a backward-looking manner as if the current configuration were a proposed modification. If the USQD is found to be negative, the contractor could CANCELE D DOE G 424.1-1A 13 7-24-06 have approved the discrepant condition without DOE involvement. This would resolve the discrepancy and provide justification for the current configuration. The contractor’s USQ procedures should include documenting defensible technical explanations based on sound engineering judgment for each of the answers to the seven questions. It is inappropriate to perform extensive analyses or to set a numerical margin for increases in the probability or consequences within which a positive USQD would not be triggered. Such analyses and margins lend themselves to excessive efforts in calculations and abuse of the intent of the USQ process through manipulations of assumptions and accident parameters when accident analyses results are highly uncertain, and the possibility that the results might be a function of the calculation methods used, rather than of safety differences. Changes should be evaluated using a method that can determine the direction of change on frequency or consequence, or on margin of safety by comparing the situations before- during-and-after the change is made, isolating the effects of the change, and evaluating and comparing the situation with and without the change and during implementation. Except for a PISA based on analytic errors, a discernible direction of change refers to the effects of the actual change, not to a comparison of the results of a new analysis to the values cited in the DSA. It is the direction that the change has on probability, consequences, or margin of safety not the magnitude that is important.

For example, if the wall thickness of a pressure vessel is going to be increased or the reaction time of a relay in a safety system is shortened, it is likely that the change is in the direction of increased safety. If changes are in the opposite direction, safety is likely to be decreased. Potential increases should be clearly discernible on a qualitative basis. It is important to recognize that the bounding accidents for workers may be (and probably are) different from bounding accidents for the public. If, as a result of a proposed change, additional protective measures (either administrative or hardware-related) are warranted during a postulated accident situation to ensure adequate protection of the public or to provide worker safety, the USQD should be found to be positive on the basis that the change will result in either an increase in probability or an increase in consequences of an accident absent additional protective measures. A proposed change should not be defined as including additional protective measures to reduce exposures such as those related to ALARA (as low as reasonably achievable) levels and not related to potential accidents. DOE wants to be involved for several reasons. First, to verify that the degree of protection is adequate. Second, to ensure that the safety basis is properly revised to include the additional protective measures. Third, to verify that hardware involved is properly classified (for example, as a safety class or safety significant SSC) and will receive appropriate surveillance and maintenance. When evaluating “increased potential consequences” of an accident, if the previously bounding case for that family of accidents is unchanged, then generally there is no CANCELE D 14 DOE G 424.1-1A 7-24-06 increase in the consequences within the USQ process. It is important that the family of accidents be related (the same type, fires, for example) and uses the same set of preventative measures and mitigation. While this is appropriate for public safety, adequate protection of workers necessitates further evaluation. Each change is evaluated for increases in the consequences to workers. Further, when considering a new scenario within a family of accidents, the probability of an accident in that family would be expected to increase. The bases of hazard control documents (TSRs or other formats) should identify some relevant margins of safety. However, all safety basis documents should be reviewed to identify any relevant margins of safety. See Attachment A, section A.1, sub-item 7 for a discussion of margin of safety. Specific responsibilities of those performing or reviewing USQDs should be clearly defined. Documentation should also be discussed in the implementing procedures. The procedures should identify the level of detail necessary to document performance of a USQD and conclusions reached and include a list of references relied on to reach the conclusions as well as guidance for the retention of records. 3.4 Documentation and Retention The contractor needs to retain records of USQ actions taken pursuant to Section 830.203 for at least the full operational lifetime of the facility, including deactivation, long term surveillance and maintenance, and decommissioning until the facility is categorized as a below Category 3 nuclear facility. When the contractor operating a facility changes, the outgoing contractor needs to turn over all USQ records to the incoming contractor. At the end of each life cycle phase, the contractor should consider retaining the USQ records for the next phase of the facility life cycle.

The contractor maintains the facility DSA and updates it annually. All changes at the facility should be reflected in these updates at an appropriate level of detail, including those that were authorized through the USQ process. Previously it was specified that updates to safety analysis reports (now DSAs) should include all changes implemented 6 months or more before the submittal of the annual update. This has been changed to a commensurate schedule, to allow flexibility. It may be practical to include more current changes than prior to 6 months before submittal of the update. However, at least those implemented 6 months or more before the submittal of the annual update should be included. Some contractors have opted for the strategy of updating the DSA continuously through page changes. Although changes implemented through positive USQDs and DOE approvals of a request become part of the safety basis as soon as they are implemented, changes also result from revisions that the contractor implements through negative USQDs. The continuous page change process can be helpful in ensuring that the DSA always reflects the current facility configuration. CANCELE D DOE G 424.1-1A 15 (and 16) 7-24-06 All contractors responsible for nuclear facilities submit to DOE annual summary descriptions of all USQDs performed. Items that were screened out and a USQD was not necessary do not need to be included in the annual summary (although they should be retained in the records of USQ actions). This report should be submitted on a schedule commensurate with annual update of the DSA. 3.5 Training and Qualifications Implementing procedures should establish the training and qualifications for personnel performing the USQ process such as educational background, years and/or types of work experience and knowledge of the facility, understanding of DOE facility safety basis requirements (including the USQ process), and familiarity with the facility-specific safety basis. All personnel responsible for preparing, reviewing, or approving USQ documents should receive training on the application of Section 830.203, including any facility-specific procedures. The recommended interval for retraining is every 2 years. The contractor should maintain a list of those personnel who are currently qualified to perform the USQ process. CANCELE D DOE G 424.1-1A Attachment A 7-24-06 Page A-1 UNREVIEWED SAFETY QUESTION DETERMINATION A.1 USQ PROCESS The unreviewed safety question (USQ) determination is not a substitute for a safety analysis; it merely serves as a benchmark for whether the safety basis is being preserved. A safety analysis may show that a proposed change is safe, yet the USQ determination may find that the change creates a USQ and therefore requires Department of Energy (DOE) approval prior to implementation. Contractor procedures should clearly establish the differences between the concepts supporting safety analyses for the documented safety analysis (DSA) and those used for a USQ determination. Once it has been determined that a USQ determination is required, it can be approached by providing an answer to each of the seven questions identified using the USQ determination process. If any of these questions is answered “yes,” the change is considered a USQ. An appropriate justification for each answer should be recorded. The examples given in the following subsections are provided to help the reviewer identify potential USQs. They are not meant to be examples of USQs. That determination requires consideration of the DSA for the nuclear facility or other DOE-approved documentation that provides the safety basis for operations or other activities and the specific details of the activity.

A.1.1 Could the proposed change 1 increase the probability of an accident previously evaluated in the facility’s existing safety analyses? To understand how the probability of an accident occurring could be increased, it is important to understand how the term “accident” is applied: the term “accident” refers to the anticipated operational transients and postulated accident scenarios considered in the DSA. In answering this question, the first step is to determine the accident scenarios, which have been evaluated in the previously approved safety analysis that may be affected by the proposed change. By focusing on the initiators of the previously evaluated accident scenarios, it can be determined whether there is increased likelihood that a given accident would occur. The following questions may provide a useful approach in making this determination. a. Will the proposed change meet the design (including safety functional requirements as described in the DSA), material, and construction standards applicable to the structures, systems, and components (SSCs) being modified? If the answer is “yes,” this aspect of the proposed change might be considered not to increase the likelihood of the occurrence of an accident, but the aspects of 1 For the purposes of this attachment, “change” will mean any change to procedures or equipment (including prior undocumented changes), any new tests or experiments, or any new information that has the potential to invalidate the safety basis. CANCELE D Attachment A DOE G 424.1-1A Page A-2 7-24-06 question b, following, are also considered. If the answer is “no” to any of the items, either a justification for saying there is no increase in the likelihood of the occurrence of an accident will need to be developed or it is concluded that the likelihood of the occurrence of an accident is increased. b. Could the proposed change affect overall SSC performance in a manner that could increase the probability of a previously analyzed accident? Possible questions to ask are— (1) Could the proposed change use instrumentation with accuracies or response characteristics that are different from those of existing instrumentation and could make an accident more likely to occur? (2) Could the proposed change cause SSCs to be operated outside their design or testing limits? Examples include the following: overloading electrical systems, over pressurizing a piping system, or operating a motor outside its rated voltage and amperage. (3) Could the proposed change cause system vibration, water hammer, fatigue, corrosion, thermal cycling, or degradation of the environment for SSCs that would exceed the design limits? (4) Could the proposed change cause a change to any SSC interface in a way that could increase the likelihood of an accident? A.1.2 Could the proposed change increase the consequences of an accident previously evaluated in the facility’s existing safety analyses? In answering this question, the first step is to determine which accidents evaluated in the safety analyses may have their radiological and hazardous material consequences altered as a direct result of the change. The next step is to determine whether the change could in fact increase the consequences of any of the accidents evaluated in the existing safety analyses. Consequences to workers (in-facility, outside, or collocated) and the public is to be considered. Examples of questions that assist in this determination are as follows:

a. Could the proposed change degrade or prevent safety functions described or assumed in the existing safety analyses? b. Could the proposed change alter any assumptions previously made in evaluating the radiological and hazardous material consequences in the existing safety analyses? c. Could the proposed change play a direct role in mitigating the radiological or hazardous material consequences assumed in the existing safety analyses? d. Could the proposed change affect the integrity or function of any fission product barrier or any radioactive or hazardous material barriers? CANCELE D DOE G 424.1-1A Attachment A 7-24-06 Page A-3 A.1.3 Could the proposed change increase the probability of a malfunction of equipment important to safety previously evaluated in the facility’s existing safety analyses? The safety analyses for the facility assume the proper functioning of equipment important to safety in demonstrating the adequacy of design. The proper functioning of other systems, including support systems, is generally assumed. The scope of the USQ determination should include these other systems. For example, a change that does either of the following is a change that increases the probability of a malfunction of equipment important to safety: degrades the performance of equipment important to safety, assumed to function in the accident analysis, to below the performance level assumed in the existing safety analyses; or increases the challenge to equipment important to safety assumed to function in the accident analysis (for example, more rapid pressure rise), degrading performance to a level below that assumed in the existing safety analyses. In answering this question, the first step is to determine what SSCs could be affected by the proposed change. Then the effects of this change on equipment important to safety are evaluated, including both direct and indirect effects. Direct effects are those in which the change affects the equipment (for example, a motor change on a pump). Indirect effects are those in which the change affects one piece of equipment, which in turn can affect equipment important to safety. An example of indirect effects would be one piece of equipment falling on safety equipment. After the impact of the change on equipment important to safety is identified, a determination is made whether an increase in the probability of a malfunction of the SSCs has occurred. The following are examples of questions that can be used in making this determination. a. Will the proposed change meet the original design specifications for materials and construction practices when the following questions are considered? b. Are the seismic specifications met (for example, use of proper supports, proper lugging at terminals, and isolation of lifted leads)? c. Are separation criteria met (for example, minimum distance between circuits in separate divisions, channels in the same division, and jumpers run in conduit)? d. Are the environmental criteria met (for example, use of materials suitable for the radiation or thermal environment in which they will be used)? e. Will the proposed change degrade equipment important to safety reliability by— (1) imposing additional loads not analyzed in the design? CANCELE D Attachment A DOE G 424.1-1A Page A-4 7-24-06 (2) deleting or reducing system or equipment protection features? (3) downgrading the support system performance necessary for reliable operation of the equipment?

(4) reducing system or equipment redundancy or independence? (5) increasing the frequency of operation of systems/equipment? (6) imposing increased or more severe testing requirements on systems or equipment? If the change adversely affects the equipment important to safety, the likelihood of equipment malfunction may be increased. A “no” answer to any question in paragraph 3a or a “yes” answer to any question in paragraph 3b in the immediately preceding examples may not mean that there is a negative impact on safety. It would indicate, however, the existence of a USQ and the need for further analyses. A.1.4 Could the proposed change increase the consequence of a malfunction of equipment important to safety previously evaluated in the facility’s existing safety analyses? This question asks whether, assuming a malfunction of equipment important to safety, the change would result in increased hazardous-material or radiological consequences. For example, consider a change that caused a valve in a safety system to fail in the closed position where previously it was assumed to fail in the open position. If this change results in an increase in consequences of an accident, it indicates the change involves a USQ. In some situations, such as a loss of a preferred failure mode, the change might not lead to an increase in the calculated consequences but should be considered within the context of a possible reduction in a margin of safety as discussed in paragraph A.1.7. A.1.5 Could the proposed change create the possibility of an accident of a different type than any previously evaluated in the facility’s existing safety analyses? An accident or malfunction that involves an initiator or failure not considered in the nuclear facility’s existing safety analyses is potentially an accident or malfunction of a different type. An example would be turbine missiles from a gas turbine added as an alternate power source. Certain accidents or malfunctions are not treated in the nuclear facility’s existing safety analyses because their effects are bounded by similar events with the same control set that are analyzed. A seismic-induced failure of a component designed to appropriate seismic criteria will not cause a malfunction of a different type. However, a change that increases the probability of an accident previously thought to be beyond extremely unlikely, so that it is in the credible range, creates a possible accident of a different type. In answering this question, the first step is to determine the types of accidents evaluated in the existing safety analyses. The types of credible accidents that the change could create can then be identified and listed. Evaluating the differences between the two lists CANCELE D DOE G 424.1-1A Attachment A 7-24-06 Page A-5 will determine the answer to the question. The accidents evaluated in the existing safety analyses are generally chosen to be bounding for a broad class of credible accidents. Thus, comparison of a new accident to the existing analyses may require referral to the underlying hazard analyses. A.1.6 Could the proposed change create the possibility of a malfunction of equipment important to safety of a different type than any previously evaluated in the facility’s existing safety analyses?

To answer this question, the types of failure modes of equipment important to safety that have been previously evaluated in the existing safety analyses and that would be affected by the change are identified. Then the types of failure modes that the change could create need to be identified. Comparing the two lists can provide an answer to the question. An example of a change that might create a malfunction of a different type is the relocation of equipment so that it becomes susceptible to flooding; another example is the replacement of a mechanical control system with a digital control system that could fail in a different mode. A.1.7 Could the proposed change reduce a margin of safety? This section deals with margins of safety related to DOE-approved hazard control documents. These controls may be technical safety requirements (TSRs), or they may be in another form, as permitted in Section 830.205 for certain environmental restoration activities. For purposes of performing the USQ determination, a margin of safety is defined by the range between two conditions. The first is the most adverse condition estimated or calculated in safety analyses to occur from an operational upset or family of related upsets. The second condition is the worst-case value known to be safe, from an engineering perspective. This value would be expected to be related to the condition at which some accident prevention or mitigation action is taken in response to the upset or accident, not the actual predicted failure point of some component. Hazard control documents set forth the minimum acceptable limits for operation under normal and specified failure conditions; they ensure that the available safety equipment and operating conditions meet the assumptions in the existing safety analyses. They distill those aspects of the safety analyses that are required to ensure the performance of safety SSCs and personnel as relied on and defined in the safety analyses. The bases for a hazard control should define the margin of safety. If the bases of a hazard control do not specifically identify a margin of safety, the DSA and other appropriate safety basis documents should be reviewed to determine whether the proposed change, test or experiment, or new information has or would result in a reduction in a margin of safety. The judgment on whether the margin is reduced should be based on physical parameters or conditions that can be observed or calculated. CANCELE D Attachment A DOE G 424.1-1A Page A-6 7-24-06 The safety margin is sometimes implicitly described. A margin of safety can depend on a parameter other than one of the process variables. Therefore, the precise determination of a numerical value associated with a change is not always possible. Implicit margins are, for example, conditions for acceptance for a computer code, method, or industry- accepted practice. It may be sufficient to determine only the direction of the margin change (that is, increasing or decreasing) due to the proposed change. Safety margins generally include worst-case assumptions of initial conditions, conservative assumptions in computer modeling and codes, allowance for instrument drift and system response time, redundancy and independence of components in safety trains, and plant response during operating transient and accident conditions. A change that affects initial conditions, a system response time, or some other parameter that can affect the course of an accident analysis supporting the bases of hazard controls is evaluated to determine whether the change would reduce a margin of safety.

A.2 PERFORMING USQ DETERMINATIONS In performing USQ determinations of a proposed change, documented justification for the USQ determination should be developed. Consistent with the intent of Section 830.203, this documentation should be complete in the sense that a qualified independent reviewer could draw the same conclusion. The importance of the documentation is emphasized by the fact that experience and engineering knowledge, rather than models and experimental data, are frequently relied on to make the USQ determination. Since an important goal of the USQ determination is to demonstrate that the safety basis is being maintained, the items considered by the evaluator should be clearly stated. Documentation of the effects considered will enable the independent reviewers to assess the adequacy of the USQ determination and its conclusions. CANCELE D DOE G 424.1-1A Attachment B 7-24-06 Page B-1 UNREVIEWED SAFETY QUESTIONS LESSONS LEARNED The following list of lessons learned has been developed from experience in applying the unreviewed safety question (USQ) process. B.1 TITLE The title of the process, “unreviewed safety questions,” may suggest that the process determines the safety of changes. However, the USQ process is intended to determine the final approval authority for a change [that is, the contractor or Department of Energy (DOE)]. The USQ process is not intended to replace or to serve instead of a safety analysis of the change. The safety implications of a change should be reviewed, analyzed, understood, addressed, determined whether it is acceptable, and documented by the contractor separately from the USQ process. Using the USQ process instead of the safety analysis complicates the USQ process. Further, such a usage is inappropriate because the seven questions to be answered in the USQ determination are not geared toward understanding whether the change is safe but rather if any of the probability or consequence risk factors may have increased beyond what has been accepted previously by DOE and hence if the existing safety controls remain adequate. The change should already be known to be safe before it enters the USQ process. The USQ process determines if final approval by the contractor is sufficient or DOE review and approval are required. DOE wants to review and approve those changes that involve a USQ (that is, when the USQ determination is positive) to verify that the safety controls are adequate to provide an acceptable level of safety to the public and workers. The existence of a positive USQ determination does not mean that the change is unsafe but only that DOE is to be responsible for the final approval action. B.2 IDENTIFYING POTENTIALLY INADEQUATE SAFETY ANALYSES When an employee identifies a potentially inadequate safety analysis, the facility management is allowed a reasonable time prior to notifying DOE to confirm the reasonableness of the potential for having an inadequate safety analysis. This time should be on the order of hours, up to several days, but not a matter of weeks, or months. B.3 REPORTING POTENTIAL INADEQUACIES IN SAFETY ANALYSES After the potential for having inadequate safety analyses has been confirmed, 10 CFR 830.203 requires four special actions to be taken. One of those actions is to notify DOE of the situation. The current DOE reporting system (DOE O 231.1A and the associated Manual, DOE M 231.1-2) require that a potential degradation of the safety basis be reported as a Safety Significance Category 3 situation. The Occurrence Reporting and Processing System (ORPS) may be used for this notification if the report explicitly states that the situation involves a “potential USQ involving a potentially inadequate safety analysis.”

CANCELE D Attachment B DOE G 424.1-1A Page B-2 7-24-06 Another action required for a potentially inadequate safety analysis is the preparation of a USQ determination on the situation. In the event that the USQ determination is positive, the current DOE reporting system requires that this condition be categorized as the “determination of a positive USQD that reveals that a currently existing actual inadequacy in the documented safety analysis.” B.4 CONTROL OF HAZARDS DURING INSTALLATION Hazards that may be involved during the installation of a modification should be addressed by appropriate safety management programs (such as work planning and control that includes job hazard analysis or a similar process). As discussed in Section 2.1 of the Guide, the work authorization system should include a step for consideration of possible USQ situations on the facility safety basis, beyond the planned work. DOE relies on the contractor’s normal work control procedures to address worker hazards involved in the actual installation of a modification, not on the USQ process. These procedures are in programs including radiation protection, hazardous material protection, work planning and control, Occupational Safety and Health Administration, ALARA (as low as reasonably achievable), and lockout/tagout. However, the conduct of the work may involve the introduction of hazards that can constitute a threat to the facility safety basis such as the use of a crane that could fall on equipment important to safety. So the USQ process is exercised in considering potential facility safety impacts of modification work. One basic tenet of the USQ process is to assess the potential change in probability and consequences risk factors that might be involved when facility operations are resumed after the modification is implemented. However, sometimes a modification might be only partially implemented because it is interrupted by unforeseen circumstances. In such cases, the USQ documentation would need to be revisited to ensure that it adequately addresses operation with the partially implemented configuration. B.5 DECLARING A USQ TO EXIST Section 830.203 assigns the contractor the basic responsibility to evaluate changes and determine if a USQ exists, or is involved. If the result of the contractor’s USQ determination is positive, a USQ exists. DOE can declare that a USQ exists as part of its oversight responsibility of the USQ process. Such a declaration might result from a disagreement with a contractor’s negative USQ determination or might result from a condition for which the contractor has not done a USQ determination. When DOE declares a USQ, it is because DOE believes it should be involved in the review and approval of the situation to fulfill its responsibilities. B.6 SUBMITTALS TO DOE At some sites, the completed USQ determination form is submitted routinely to DOE for approval. This practice should be reconsidered because it is not required and can shift the CANCELE D DOE G 424.1-1A Attachment B 7-24-06 Page B-3 focus of the DOE review from the safety characteristics of the change to how well the USQ determination was prepared. For a potentially inadequate safety analysis, the rule requires that an evaluation of the safety of the situation (not the USQ determination) be submitted prior to removing any restrictions.

The USQ process does not encompass all situations for which the contractor may need to request an amendment to the safety basis of a facility. For example, a change to the hazard categorization level for a facility requires DOE approval, but should not be addressed by the USQ process. Some contractors have developed a formalized process for requesting amendments to the safety basis. At some facilities, the USQ process is being used virtually every time there is need to request an amendment to the safety basis, regardless of whether or not a change to the facility or procedures is involved. In some situations, the USQ process is inappropriate. A formalized procedure that defines the content of the submittal to DOE requesting an amendment to the facility safety basis could supplement the USQ process (regarding positive USQ determinations). Such a procedure would also support other situations that do not involve the USQ process. Such a procedure might outline the expected content as including items such as (1) an introductory summary of the purpose of the letter and its contents, (2) a description of the situation that generated the need for action, (3) alternative actions considered, (4) a description of the selected action, (5) engineering technical considerations, (6) safety implications of the action, including the results of the USQ process when applicable, (7) programmatic implications, (8) budgetary considerations, (9) schedule considerations, and (10) basis on which the contractor believes that DOE should approve the action. B.7 NEED FOR USQ DETERMINATIONS FOR TSR CHANGES Section 830.205 requires that changes to the technical safety requirements (TSRs) be submitted to DOE for review and approval. Changes to the TSRs could involve the need either to modify an existing TSR or to add a new TSR. If it is known that a proposed change only involves a TSR change, it is not required to go through the USQ determination to determine if DOE approval is also required by 830.203. Similarly, if a change involves a TSR change, calling the change a positive USQ determination just because it requires DOE approval would be inappropriate. However, while performing a USQ determination for TSR changes is not required, it may be desirable. When the TSR change is submitted to DOE for review and approval, the contractor should include appropriate information to support the contractor's position that the change should be approved (that is, the contractor should include the basis for the proposed change). Such supporting information might include some of the same considerations that would be addressed in a USQ determination. B.8 TENANT/LANDLORD RELATIONSHIPS Although not intended as literal, the terms “landlord” and “tenant” are used here to describe situations where one contractor conducts operations in a facility and has overall CANCELE D Attachment B DOE G 424.1-1A Page B-4 7-24-06 responsibility for a facility safety basis but another contractor also conducts operations in the facility. In these situations the operations of both the first and the second contractor must be fully described and analyzed in the facility safety basis in order to comply with 10 CFR 830 Subpart B. However, usually the landlord contractor is fully responsible for maintaining the integrity of the safety basis. Whether or not a contractual relationship exists between the contractors, it is important that a practical operational means exist to ensure disciplined and coordinated implementation of the USQ process for all operations within the facility.

In these cases, the recommended approach to allow flexibility for the tenant’s activities and still protect the facility safety basis via the USQ process is to (1) ensure that a hazards analysis (or other appropriate safety analysis) exists for each tenant activity such that the collective hazards analyses for all tenant activities are encompassed by the facility safety basis, (2) procedurally require that the tenant review any changes in its activities that are being considered against the corresponding hazards analysis, and then (3) in conjunction with the landlord, perform a USQD against the overall facility safety basis. There is a potential conflict between requiring that all changes within a facility be considered within a formal change control process and allowing researchers and other tenants flexibility to conduct their activities without undue restrictions that might stifle the desired creativity. The objective should be to impose the formality necessary to ensure that all activities are conducted safely within the DOE-approved safety basis for the facility without applying any unnecessary restrictions on the activities. Having the tenant take an active role in development of an appropriate activity level safety envelope for the activities within the facility safety basis can promote ownership. This participation can also enhance safety responsibility without limiting the activities. B.9 GRADED APPROACH During the hazards analysis and safety analysis processes, equipment is classified as safety class, safety significant, other safety, or non-safety. Once these classifications are established, they are used to indicate how much effort should be applied. However, no steps of the USQ process can be eliminated based on such grading. In some situations, attempts to apply the graded approach to the USQ process have resulted in inadequate USQ determinations. For example, some contractors have applied the graded approach to the change control processes in a manner that does not require the application of formal change controls unless the change involves equipment, procedures, or operations important to safety. Caution needs to be applied in such a situation to ensure that this approach does not prevent changes from being considered by the USQ process, which is a subset of change control. The only application of the graded approach to the USQ process is indirect. The graded approach may give a rough indication of how much justification or basis information should be provided when explaining the answers to each of the seven USQ determination criteria. More elaborate CANCELE D DOE G 424.1-1A Attachment B 7-24-06 Page B-5 and thorough basis information would be expected for changes to safety equipment than for non-safety equipment. In any case, the justification for the answers to the USQ determination criteria needs to be defensible. B.10 UNIFIED AND CONSOLIDATED PROCEDURES Contractors should consider the desirability of requiring that each nuclear facility at the site adhere to a single sitewide USQ procedure and sitewide USQ training/qualification requirements. Facility-specific considerations, such as identifying the safety basis documents, could be addressed by appendices to the sitewide procedure. At some sites, each nuclear facility uses a different USQ procedure, leading to inconsistencies and misapplications. One DOE field office assessment found that a root cause of USQ problems was the lack of a common procedure and common USQ training. A single sitewide USQ procedure could improve the quality of the USQ process by taking advantage of the best aspects of each of the different facility procedures. Using the same USQ forms for screens and USQ determinations and using the same training and qualification requirements can help develop a high-quality USQ process across the site.

B.11 USQ SCREENING USQ screening is intended to be a simple go/no-go decision-making step, without evaluative consideration. When appropriately streamlined, this step in the USQ process can often be completed in a matter of minutes. Screening to determine whether an SSC is described in the safety analyses (safety basis) should consider only whether the equipment is identified anywhere in the safety basis. Screening criteria should not be based on whether the SSC is formally classified as a safety SSC (that is safety class or safety significant), is taken credit for in the safety analysis (or accident analysis) chapter of the safety basis document, nor whether the particular characteristic(s) of the SSC to be changed are taken credit for. The basic intent of screening is to eliminate unnecessary time and effort being spent performing a USQ determination if there is no possible way that the change could impact the safety basis and involve a USQ. Conversely, screening criteria make certain that changes which could possibly involve a USQ are “screened in” and hence a USQ determination is performed. The USQ screening criteria center on the question of whether the item to be changed is described in the safety basis. An example of an inappropriate, highly evaluative, screening criterion is: “Does this change significantly adversely impact the ability of an SSC described in the safety basis to perform its safety functions?” Such a criterion encompasses four separate considerations: (1) determining if the SSC is identified in the safety basis, (2) finding out what the safety functions are for the SSC, which might not be stated very clearly or completely, (3) evaluating if the impact of this change could adversely affect the capability to perform a safety function, and (4) evaluating if the impact could be significant. All but the first consideration are evaluative considerations that depend strongly on which individual does the USQ screen. These types of evaluative CANCELE D Attachment B DOE G 424.1-1A Page B-6 7-24-06 considerations should be in the domain of the USQ determination, not part of the simple screening step. If someone were to subdivide the safety basis documents into those parts that are “descriptive” and those parts that are important to safety, the results would be highly subjective. Limiting the performance of USQ determinations to only those SSCs taken credit for in the safety analysis chapter, or even further to only those characteristics of SSCs taken credit for can lead to serious problems, including bypassing the USQ determination and thereby, unknowingly exceeding the bounds of the safety basis. Similarly, limiting screening to safety SSCs (that is, those identified as safety class or safety significant) before a USQ determination is done is inappropriate due to the potential for unrecognized direct or indirect interactions. B.12 DOE INVOLVEMENT IN THE USQ DETERMINATION The contractor should make every effort to complete its USQ determinations without DOE involvement. DOE has charged the contractor with performing the USQ process to determine if contractor approval is sufficient. At times, there will be borderline cases or “gray areas” where engineering judgment will play a large role in the determination. The contractor should complete the determination with sufficient justification to defend the conclusion, despite whether the final determination is positive or negative. B.13 USQS AND CRITICALITY SAFETY EVALUATIONS

All proposed new or changed processes involving criticality safety that necessitate a new or revised Criticality Safety Evaluation, including those in an experimental facility, undergo a USQ review by the Nuclear Safety Management rule. When the USQ determination is positive indicating the need for DOE review and approval of the change, the safety analyses and controls associated with the approved action become part of the safety basis for the facility. Any changes necessary to the DSA and TSR documents because of the change should be incorporated at the next annual update. The results of the USQ determination define the need for DOE approvals of the supporting criticality safety evaluations and explicit updates of the DSA and TSRs. B.14 EFCOG ISSUES Representatives of EH, OA, and EFCOG met to discuss issues and request clarifications on several USQ implementation issues that had arisen since 10 CFR 830 Subpart B had been made effective. This section provides guidance relating to the more significant of these issues. B.14.1 Screening It has been argued that the definition of a USQ in 10 CFR 830.3 and the conditions for entering the USQ process in 10CFR830.203(d), which refer to the existing documented safety analysis, allow screening out of proposed changes to a facility if the change does not involve anything in the existing safety analysis. For example, the definition of a USQ CANCELE D DOE G 424.1-1A Attachment B 7-24-06 Page B-7 includes the situation where “the probability or the consequences of an accident or the malfunction of equipment important to safety previously evaluated in the documented safety analysis could be increased.” Also, for example, the USQ process must be entered in situations where there is a “temporary or permanent change in the facility as described in the existing documented safety analysis.” This has been described as the “as versus is” controversy. That is, it is argued that the arbiter of a USQ situation is the existing documented safety analysis, rather than the potential for increased risks, whether or not described in the DSA. The argument for exclusion of some changes from the USQ process by screening out, because the involved systems or components are not described in the existing DSA presumes that the existing DSA is complete in all respects with regard to descriptions, hazard identification, and controls. While the quality and completeness of safety basis documents is increasing, there is still a wide disparity in those attributes of approved safety bases throughout the DOE complex. It is inappropriate to screen out a change that involves systems or hazards that are not described in the existing safety analysis. There are several reasons why this is so. The change itself could constitute a new test or experiment. Introduction of a new hazard could cause a new type of accident or malfunction, or increase the likelihood of an accident or malfunction. Any of these could result in a USQ, so a USQ determination is needed. The allowance of a limited amount of time for management-level evaluation of possible safety issues relating to discovery, or new information, prior to invoking the PISA provisions of the USQ requirements is appropriate to the screening process. That is, a limited amount of technical judgment relative to a safety nexus can be exercised. However, when such considerations take the nature of answering the seven USQ criteria questions, the item should not be screened out. Instead, a USQD should be completed. Further, if the screening process involves examination of whether or not the issue is dealt with in the DSA, the process should include consideration, as described above, of whether another entry into the USQ process (PISA, test or experiment not described in the DSA, or the possibility of an accident or failure of a different type) should be invoked.

B.14.2 Nonconforming SSCs Clarification was requested for the proper handling of situations where it is found that an SSC does not conform with the documented design description and specifications (discrepant as-found state), under the USQ requirements. If the corrective action is to bring the item into conformance (see discussion in section 3.2), then it may be reportable under ORPS requirements, but it would not require a USQD. However, if the resolution would be another approach (e.g., use-as-is, or alternatively, replace with another unapproved component), then the provisions of 10 CFR 830.203(d) (temporary or permanent change in the facility as described in the existing documented safety analysis) must be invoked. Formally, this would invoke PISA provisions, for which the ORPS report would constitute notification of DOE. Prior CANCELE D Attachment B DOE G 424.1-1A Page B-8 7-24-06 action of assuring a safe condition upon discovery should already have been taken. So, if the decision is to “use-as-is,” for example, the next step would be to perform a formal USQD. Whatever the case, it would be prudent to investigate to see if there had been a valid safety reason for the non conforming condition that had not been properly reflected in a change to the DSA. B.14.3 PISA Requirement for an Evaluation of the Safety of the Situation USQ requirements relating to PISAs include that in the event of a PISA, and after a formal USQ determination, that an evaluation of the safety of the situation be performed and the results submitted to DOE prior to removing any operational restrictions taken to maintain the facility in a safe condition. This terminology is in 10 CFR 830.203(g)(1) and (4), and refers to the actions to be taken in the event of a PISA. Basically, a safety evaluation is a safety analysis that demonstrates adequate safety with the existing situation so that any interim measures (operational restrictions) to maintain the facility in a safe condition can be removed. If that is not the case (adequate safety), then the analysis should be accompanied by, or followed with, a proposed resolution, also with a safety analysis that demonstrates adequate safety. There are no specific timing expectations for this step. The analyses take whatever time is required. There is no specific format required, but it should be recognized that the analyses can become part of the safety basis, and should be done with the appropriate degree of rigor. If the PISA USQD (see 10 CFR 830.203(g)(3)) is negative, then the evaluation of the safety of the situation is submitted to DOE prior to removing operational restrictions, but explicit DOE approval is not required, as with any negative USQD. DOE may, however, not agree with the analysis or think it is not adequate, in which case DOE may require further steps. If the USQD is positive, then DOE approval is required for any proposed resolution, including the interim restrictions. Often this is also the situation that a JCO is prepared. B.14.4 Discernable Increase (in frequency or consequence) The answer to what is a discernable increase is in the rationale provided in the USQD first four of seven questions. The rule (see 10 CFR 830.3 USQ definition) does not permit a numerical margin before which an increase constitutes a USQ. The rationales for the USQ answers should be convincing to an independent reviewer that the change could result (or not result) in an increase. Site-specific quantitative guidance that allows for a numerical margin are implicitly acknowledging that they have a USQ, when that margin is used to dismiss the question.

CANCELE D DOE G 424.1-1A Attachment B 7-24-06 Page B-9 A rationale against having such margins (independent of the fact that they are not compliant with the rule) is that with them a contractor could make many changes that individually would not violate the margins, but taken together over years could result in a massive increase in operational risk that DOE did not consciously accept and which never got documented in the safety basis. Further, it would seem that if a contractor were to go to the extent of quantifying an increase in consequences or frequency, the contractor would have done all that would be required to prepare a USQD, and more. Therefore the contractor is not saving anything (and is likely expending more than appropriate) by invoking a margin. B.14.5 DOE Approval of Revisions to a USQ Procedure The 10 CFR 830 rule requires that the USQ procedure be reviewed and approved by DOE. This Guide does not address approval of revisions except in the context of changes of procedures. B.14.6 Major Modifications The possibility exists that a major modification to a facility could be broken down into a series of changes that, individually, would not be considered major. Avoidance of a USQ issue by breaking a modification down into many “minor modifications” could be considered an intentional failure to implement 10 CFR 830 requirements in good faith. The question of when a proposed change to a facility is a major modification (requiring a preliminary documented safety analysis) versus a change that can be considered under the USQ requirements and a safety analysis approval has been intentionally left to local (DOE and contractor) determination. An important consideration involved is the importance of imposition of the nuclear safety design requirements of DOE O 420.1B (or successor document), and demonstration of how they will be met. However, also note that 10 CFR 830.3 defines a major modification as one that “substantially changes the existing safety basis for the facility.” This includes the content of the safety basis, not just consideration of bounding accidents. B.14.7 Transportation Activities under 10 CFR 830.203 USQ Requirements Transportation activities are regulated under 10 CFR 830, except for those activities regulated by the Department of Transportation. The requirements related to a DSA can be satisfied using the appropriate “safe harbors” described in Appendix A of the rule, including Transportation Safety Documents (TSDs under the Transportation Orders 460.1 or 461.1) or DOE-STD-3009, if desired. However, The TSR and USQ requirements also must be satisfied. This Guide provides general guidance for the USQ process. That guidance can be applied directly to transportation activities. Non-routine transfers (see TSD Chapter IX) must all undergo the USQ process. CANCELE D Attachment B DOE G 424.1-1A Page B-10 7-24-06 Proposed changes in transportation activities that do not lead to using packaging in conditions that may lead to exceeding its performance envelope should not result in a positive USQD, in most cases. Changes that potentially expose transfers to new hazards or increased likelihood of accidents would be expected to result in positive USQDs. B.15 OPERABILITY DETERMINATIONS It is necessary to determine the proper handling of situations expeditiously under the USQ requirements where it is found that an SSC does not conform to the safety basis description and requirements (discrepant as-found state). The SSC may be degraded such that there is a loss of quality or functional capability or a nonconforming condition may exist with the SSC or its documentation.

When a degraded or nonconforming SSC is identified as a PISA, the contractor must first “take action, as appropriate, to place or maintain the facility in a safe condition” (10 CFR 830.203(g)(1)). A safe condition may include continued facility operation if, although a degraded or nonconforming SSC is not be fully qualified, the impact on safe facility operations is judged to be acceptable, possibly aided by operational restrictions. An operability determination is a forward-looking evaluation by the operating contractor of whether there is a reasonable expectation that continued operation of the facility is safe even when a degraded or nonconforming condition (PISA) and USQ exists. An immediate operability determination should be made based on the best available information and operational restrictions imposed, if necessary, upon confirmation of the condition. Subsequently, a final determination should be made and documented following a thorough engineering evaluation. The elements of the final operability determination should include description of the degraded or nonconforming condition of the SSC description of the relationships on safe operations of the SSC functions evaluation of the operability of the SSC given its condition— o using analysis, tests, operating experience, and/or engineering judgment o considering availability of other equipment, conservatisms and margins, and cumulative effects of other outstanding degraded or nonconforming conditions specification of additional operating restrictions if necessary (e.g., compensatory measures, additional engineering analysis by a certain date) specification of restoration actions (may be added later). Restoration actions for the degraded or nonconforming condition are to be developed by the contractor and scheduled at the first available opportunity commensurate with the CANCELE D DOE G 424.1-1A Attachment B 7-24-06 Page B-11 (and B-12) safety significance and extent of restoration actions in an integrated manner with other facility commitments and resources. The final operability determination may be included as part of the evaluation of the safety of the situation required to be submitted to DOE before removal of any operational restrictions. CANCELE D FOREWORD CONTENTS INTRODUCTION APPLICATION Temporary or Permanent Changes in a Facility Temporary or Permanent Changes in the Procedures Tests or Experiments Not Described in Existing DSAs Discovery of Potential Inadequacies in the Existing Safety Analyses (PISAs) IMPLEMENTATION GUIDANCE Integrated USQ Process Screening Unreviewed Safety Question Determinations Documentation and Retention Training and Qualifications UNREVIEWED SAFETY QUESTION DETERMINATION UNREVIEWED SAFETY QUESTIONS LESSONS LEARNED