DOE G 424.1-1B Admin Chg 1, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements

ADMINISTRATIVE CHANGES TO DOE G 424.1‐1B, IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS Page Section Changed To ii Forward HS-21/GTN HS-30/GTN 10 3.3 Four criteria define a USQ (Section 830.3 of 10 CFR 830). Four criteria define a USQ (Section 830.3). A-4 A.1.5 An accident or malfunction that involves an initiator or failure not considered in the nuclear facility’s existing safety analyses is potentially an accident or malfunction of a different type. An accident or malfunction that involves an initiating event or failure not considered in the nuclear facility’s existing safety analyses is potentially an accident or malfunction of a different type. B-4 B.7 Once these classifications are established, they are used to indicate how much effort should be applied. Once these classifications are established, they are used to indicate how much effort should be applied in answering the seven USQD questions. B-7 B.12.2 Whatever the case, it would be prudent to investigate to see if there had been a valid safety reason for the non conforming condition that had not been properly reflected in a change to the DSA. Whatever the case, it would be prudent to investigate to see if there had been a valid safety reason for the non-conforming condition that had not been properly reflected in a change to the DSA. B-7 B.12.3 Discernable Increase (in Frequency or Consequence). ... what is a discernable increase ... Discernible Increase (in Frequency or Consequence). ... what is a discernible increase ... B-8 B.12.6 Non-routine transfers (see TSD Chapter IX) must all undergo the USQ process. Non-routine transfers, as discussed in the applicable Transportation Safety Document (TSD) chapter, must all undergo the USQ process. B-8 B.12.6 (fourth para.) Changes that potentially expose transfers to new hazards or increased likelihood of accidents would be expected to result in positive USQDs. Sentence deleted DOE G 424.1-B Chg 1 04-12-2013     � C‐2  C.4  The current DOE reporting system  (DOE O 231.1A and the associated  Manual, DOE M 231.1 2) requires  that a potential inadequacy of the  safety basis be reported as a  Significance Category 3 situation.  The current DOE reporting system  (DOE O 232.2, Occurrence Reporting  and Processing of Operations  Information) requires that a potential  inadequacy of the documented safety  analysis be reported as a Significance  Category 3 situation.          C‐2  C.5  In the event that the USQ  determination is positive, the DOE  reporting Manual (DOE M 231.1‐2)  requires that this condition be  categorized.  In the event that the USQ  determination is positive, DOE O  232.2 requires that this condition be  categorized.  C‐5  C.7   (last  sentence  in para.  5)  A JCO cannot change a TSR in the  non‐conservative direction but may  alter it into a more conservative  direction. Additional analysis could  be performed later, in order to justify  the relaxation of any identified  controls.  Sentence deleted  C‐6  C.7  A JCO should not used in place of an  exemption to 10 CFR 830  requirements.  A JCO should not be used in place of  an exemption to 10 CFR 830  requirements.  C‐9  Figure 1    Updated page 1 and 2 of table to  reflect new flowchart generation in  Word.  Updated language to remove  abbreviations from chart.  Both pages  entire table was rekeyed into  document.

C‐10  Figure 1    Included in the figure a new ‘square’  containing the words “Notify DOE by  updating the ORPS with USQD results  or by submitting a letter to DOE.”  DOE G 424.1-1B 4-8-2010 Chg 1: 4-12-2013 IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS [This Guide describes suggested nonmandatory approaches for meeting requirements. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with the parent Policy, Order, Notice, or Manual.] U.S. Department of Energy Office of Health, Safety and Security Office of Nuclear Safety Policy and Assistance NOT MEASUREMENT SENSITIVE DOE G 424.1-1B i (and ii) 4-8-2010 FOREWORD This Department of Energy (DOE) Implementation Guide is available for use by all DOE components and contractors. Beneficial comments (recommendations, additions, deletions, and any pertinent data) that may improve this document should be sent to— James O’Brien HS-30/GTN U.S. Department of Energy Washington, D.C. 20585 Phone (301) 903-1408 Facsimile (301) 903-6172 DOE Guides are part of the DOE Directives System and are issued to provide supplemental information regarding the Department’s requirements as contained in rules, Orders, Notices, and regulatory standards. Guides also provide acceptable methods for implementing these requirements. This Guide may be used by all contractors for DOE Hazard Category 1, 2, or 3 nuclear facilities, including contractors for National Nuclear Security Administration (NNSA) Hazard Category 1, 2, or 3 nuclear facilities. Throughout this document, references to a contractor or a DOE contractor apply to a contractor for NNSA as well. This Guide was developed in support of Title 10 Code of Federal Regulations (CFR) Part 830, “Nuclear Safety Management.” It provides guidance for the requirements defined in 10 CFR 830.203, “Unreviewed Safety Question Process.” This Guide imposes no requirements. DOE G 424.1-1B iii (and iv) 4-8-2010 CONTENTS FOREWORD.................................................................................................................................. i  1.  INTRODUCTION..............................................................................................................1  2.  APPLICATION..................................................................................................................2  2.1  Temporary or Permanent Changes in a Facility ......................................................3  2.2  Temporary or Permanent Changes in the Procedures ..............................................4  2.3  Tests or Experiments Not Described in Existing Documented Safety Analyses .....5  2.4  Discovery of Potential Inadequacies in the Existing Safety Analyses ...................5  3.  IMPLEMENTATION GUIDANCE .................................................................................6  3.1  Integrated Unreviewed Safety Question Process .....................................................8  3.2  Screening..................................................................................................................8  3.3  Unreviewed Safety Question Determinations ........................................................10  3.4  Documentation and Retention ................................................................................13  3.5  Training and Qualifications ...................................................................................13

ATTACHMENT A. UNREVIEWED SAFETY QUESTION DETERMINATION .......... A-1  ATTACHMENT B. UNREVIEWED SAFETY QUESTIONS LESSONS LEARNED ......B-1  ATTACHMENT C. GUIDANCE ON PROCESSING POTENTIAL INADEQUACIES IN THE EXISTING SAFETY ANALYSES ....... C-1  DOE G 424.1-1B 1 4-8-2010 1. INTRODUCTION This Guide, including its attachments, provides information to assist in the implementation of Title 10 Code of Federal Regulations (CFR) Section 830.203, “Unreviewed Safety Question Process,” of the Nuclear Safety Management Rules for Category 1, 2, and 3 nuclear facilities owned or operated by the Department of Energy (DOE), including the National Nuclear Security Administration (NNSA). Section 830.203, “Unreviewed Safety Question Process,” allows contractors to make physical and procedural changes and to conduct tests and experiments without prior DOE approval if the proposed change can be accommodated within the existing safety basis. The contractor must evaluate any proposed change to ensure that it will not affect the safety basis of the facility either explicitly or implicitly. The unreviewed safety question (USQ) process is primarily applicable to the documented safety analysis (DSA). The rule references only the DSA, and includes conditions of approval in safety evaluation reports and facility-specific commitments made in compliance with DOE rules, Orders, or Policies. Because application of the USQ process depends on facility-specific information, results of an unreviewed safety question determination (USQD) in one facility generally cannot be extrapolated to other facilities. DOE approves procedures to implement the USQ process as required by 10 CFR 830.203. Where site level and facility level procedures are used, both site and facility level procedures are approved by DOE. Section 830.203 is implemented using contractor procedures for ensuring that proposed changes to physical characteristics or technical procedures (e.g., operating, test, surveillance, maintenance, and emergency procedures) are evaluated relative to the approved safety basis and that those proposed changes determined to involve USQs are brought to the attention of DOE for review and approval before changes are made. A proposed change or test involves a USQ if—  the probability of the occurrence or the consequences of an accident or the malfunction of equipment important to safety previously evaluated in the documented safety analysis could be increased,  the possibility of an accident or malfunction of a different type than any evaluated previously in the documented safety analysis could be created, or  a margin of safety could be reduced. For the purposes of this Guide, equipment important to safety should be understood to include any equipment whose function, malfunction, or failure can affect safety either directly or indirectly. This includes safety class and safety significant structures, systems, 2 DOE G 424.1-1B 4-8-2010 and components (SSCs), and other systems that perform an important defense-in-depth function, equipment relied on for safe shutdown, and in some cases, process equipment. Support systems to safety systems that are required for the safety function are also safety systems, and should be included. The USQ criteria apply as they affect both workers and the public. In the case of workers, both those in the immediate proximity of the hazard and collocated workers are included.

In accordance with 10 CFR 830.203(g), when a potential inadequacy in the documented safety analysis is identified; i.e., the DSA may not be bounding or may be otherwise inadequate, actions must be followed to ensure the safety of the facility. This could be because of an error in the current safety analysis or because the facility configuration is not what was analyzed. The existence of a USQ does not mean that a facility or operation is unsafe. The purpose of the USQ process is to alert DOE of events, conditions, or actions that affect the DOE- approved safety basis of the facility or operation and ensure appropriate DOE line management action. If a change is proposed or a condition is discovered that could increase the risk of operating a facility beyond that established in the current safety basis, DOE, including NNSA, line management reviews and determines the acceptability of the change through the process of approving a revised safety basis that would be developed and submitted by the contractor. 2. APPLICATION Title 10 CFR 830.203 applies to all Category 1, 2 and 3 nuclear facilities. The USQ process applies to all temporary or permanent changes to such nuclear facilities unless a decision to request DOE approval already has been made, and to potential inadequacies of safety analyses. Some changes may be such that they can be screened out from a detailed USQD. The applicability of 10 CFR 830.203 is broad. Non-safety-related SSCs are not excluded by the scope of Section 830.203 if they could affect the proper operation of equipment important to safety that is relied on in the safety basis or create the possibility of an accident or malfunction of a different type than previously evaluated in the documented safety analysis. For example, losses of certain non-safety-related systems may represent critical operational occurrences identified as initiators in the accident analysis. Therefore, changes to non-safety-related SSCs are evaluated and may be determined to involve a USQ. Physical interactions may also fall under the purview of Section 830.203. For example, the installation of a non-seismically supported piece of equipment above a seismically qualified component designed to perform a safety function explicitly or implicitly assumed in the existing safety analyses may constitute a USQ and need to be evaluated. The following paragraphs define types of changes, tests, and experiments and potential inadequacies that the USQ process needs to address to comply with Section 830.203. DOE G 424.1-1B 3 4-8-2010 These discussions should not be used as bases for screening changes from the USQ process (or so-called prescreening). Screening should be done in accordance with the guidance in Sections 3.2, B.9 and B.12.1 of this Guide. 2.1 Temporary or Permanent Changes in a Facility USQDs should be performed on changes in nuclear facilities as described in the existing safety analysis text, drawing, or other information that is part of the facility safety basis. An SSC would be considered changed if any of the following were to be altered: (1) its function(s), (2) the method of performing those functions, or (3) its design configuration. Although safety analyses include descriptions of many SSCs, a nuclear facility also contains many SSCs not explicitly described in the safety analyses. These can be components, subcomponents of larger components, or even entire systems.

Changes to SSCs that are not explicitly discussed in the safety analyses should not be excluded from the USQ process because changes to these SSCs may have potential to alter the function of an SSC explicitly described in the safety analysis. Also, a change to an SSC that does not involve equipment important to safety could initiate an accident or affect the course of an accident, so virtually no change can be ignored. It is important to distinguish between changes and routine maintenance activities. Routine maintenance activities—except those that are not enveloped by current safety analyses or that might violate a technical safety requirement (TSR)—do not require review under 10 CFR 830.203. A TSR limitation on maintenance activities might require limiting the number of systems or components that can be taken out of service at one time, or allowable outage times. Changes to maintenance procedures would constitute changes that should be reviewed under USQ requirements as discussed in Section 2.2 of this Guide. Routine maintenance activities include calibration, refurbishment, replacement with an equivalent component, and housekeeping. However, some maintenance activities may constitute changes, such as plant heat exchanger tube plugging where limits are not specified. A TSR should specify allowable outage times, permissible mode conditions, and permitted reduction in redundancy for systems or components removed from service for maintenance. A USQD need not be performed for these activities. A USQD should be completed for changes to systems or components that are included in safety analyses for a nuclear facility and for which allowed outage times are not included in the TSRs. “Change” as it applies to modes of operation or facility processes is important when, for example, a facility designed to accommodate several nuclear processes will modify equipment lineups to accommodate shifting from one process to another. Changes performed in accordance with approved procedures and considered within the safety basis of the facility are not considered changes in the facility procedures for the purposes of 10 CFR 830.203(d) (2). 4 DOE G 424.1-1B 4-8-2010 Temporary changes such as jumpers and lifted leads, temporary lead shielding on pipes and equipment, temporary blocks and bypasses, temporary supports, and equipment used on a temporary basis in a nuclear facility should be evaluated to determine whether a USQ exists unless such changes are specifically described in existing approved procedures. The conservative approach is to provide a written USQD for any change to a nuclear facility, whether discussed in existing safety analyses or not. The actual modification implementation process (for example, work authorization system) used in the field should be reviewed for possible development of USQs. Changes to plant configuration while work is in progress may involve a USQ relating to facility operations independent of the safety of the specific work on a modification. For example, if work involves interrupting a water supply that a fire protection system depends on, that is not covered by a TSR, that interruption should be examined through the USQ process. Modifications that are performed in separate, distinct stages (usually for cost, schedule, or operational considerations) may leave affected SSCs in conditions not addressed by a USQD that addresses only the final modification configuration but not the interim times between stages. The work authorization system should include a step to consider these types of possibilities.

2.2 Temporary or Permanent Changes in the Procedures A USQD may need to be prepared for changes to procedures that are identified in the facility DSA. However, as discussed in section 3.2 regarding USQ screening, it may not be necessary for some procedure changes such as non-technical administrative procedures. Procedures may be identified explicitly or implicitly in a facility DSA. If the procedure is implied directly by the nature of a topic in the safety basis (including the operational safety requirements or TSRs and their bases), that change should be considered to be to a procedure described in the DSA, so that a USQD is done when appropriate. Such implicitly described procedures include  the procedures that implement a safety management program described in the safety basis,  procedures for implementing a specific administrative control, and  operating, testing, surveillance, and maintenance procedures for equipment when that equipment is identified in the DSA. If characteristics of a safety management program described in the safety basis remain correct, complete, and valid, the result of the USQD would be expected to be negative, signifying that DOE approval is not needed. DOE G 424.1-1B 5 4-8-2010 Procedures are not limited to those specifically identified by type (for example, operating, chemistry, system, test, surveillance, and emergency planning) but could include anything described in the DSAs that defines or describes activities or controls over the conduct of work. Changes to these activities or controls qualify as changes to procedures as described in the DSA, and therefore need to be evaluated as potential USQs. Changes to procedures include revisions to existing procedures and developing a new procedure. For a new procedure that could not have already been described, the question is, if a DSA were to be prepared (or updated) after the new procedure had been approved, is the new procedure of a type that would be identified in the DSA. If so a USQD should be prepared. 2.3 Tests or Experiments Not Described in Existing Documented Safety Analyses Written USQDs are required for tests or experiments not described in the existing safety analyses. Tests and experiments should be broadly interpreted to include new activities or operations. These activities could degrade safety margins during normal operations or anticipated transients or could degrade the ability of SSCs to prevent accidents or mitigate accident conditions. A USQD should be performed to ascertain whether a DOE review and approval of a new process configuration is needed. For preoperational, surveillance, functional, and startup tests performed regularly, USQDs are not needed every time a test is performed if the procedures are not changed. However, one-of-a-kind tests that measure the effectiveness of new techniques or a new system configuration will need to be evaluated before the tests can be conducted. Post modification testing should be considered and included in the USQD for the modification. 2.4 Discovery of Potential Inadequacies in the Existing Safety Analyses Written USQDs are needed when a contractor identifies or is informed of a situation that indicates that the safety analyses that support the DOE-approved safety basis may not be bounding or may be otherwise inadequate. In general, potential for inadequate safety analysis arises from the following entry conditions:  a discrepant as-found condition,  an operational event or incident, or

 new information, including discovery of an error, sometimes from an external source. The main consideration is that the analysis does not match the current physical configuration, or the analysis is inappropriate or contains errors. The analysis might not match the facility configuration because of a discrepant as-found condition. Analytical errors might involve using incorrect input values, invalid assumptions, improper 6 DOE G 424.1-1B 4-8-2010 models, or calculation errors. The USQ process starts when facility management has information that gives reason to believe that there is a potential that the facility DSA might be inadequate. Because a safety analysis inadequacy has potential to call into question information on which authorization of operations is based, per 10 CFR 830.203(g) the contractor is to—  take action, as appropriate, to place or maintain the facility in a safe condition  until an evaluation of the safety of the situation is completed;  notify DOE of the situation;  perform a USQ determination and notify DOE promptly of the results; and  submit the evaluation of the safety of the situation to DOE prior to removing any operational restrictions that were initiated. Attachment C provides additional guidance on processing a Potential Inadequacy of the Safety Analysis (PISA) including guidance on the timing of processing multiple PISAs found during audits, and the development of Evaluations of the Safety of the Situation and Justifications for Continued Operation. The USQ process is not applicable when new requirements are being implemented or different analysis methods that are used result in changed accident consequences or probabilities. The USQ process is applicable when the project identifies situations where it is apparent that the existing safety basis may not be bounding or may be otherwise inadequate. A reconstitution project should have a process for prompt sorting and prioritizing of the questions and issues between those that can be addressed as a normal part of the reconstitution project and those that are to be handled promptly as PISAs. This process should be sufficiently timely to ensure that the expectations for PISAs can be met. The USQ process does not apply to DSA upgrades in response to new requirements or to the use of new or different analytical tools during the upgrade process. However, the USQ process does apply when there is reason to believe that the current safety basis may not be bounding or may be otherwise inadequate. 3. IMPLEMENTATION GUIDANCE The USQ review process should be integrated into all technical aspects of the contractor organization responsible for design, engineering, maintenance, inspection, operations, and assessment of the nuclear facility or activity and individuals involved in these aspects should be familiar with the requirements of Section 830.203 and should be able to identify activities that might need to enter the USQ process. Each facility should identify the methods for making facility changes (for example, whether changes are made under modification processes, nonconformance processes, or DOE G 424.1-1B 7 4-8-2010 maintenance processes). After methods have been identified, the contractor needs to maintain control of the facility change process and perform and document changes in accordance with approved procedures. Performing a modification under the guise of maintenance is not acceptable because the proper control processes to analyze the proposed change and document its outcome would probably be absent. All reasonable means for performing a change should be identified because each one provides direct input into the USQ process and should be integrated accordingly.

The USQ process is intended to be implemented along with a change control process that includes generalized steps for—  identifying and describing the temporary or permanent change,  technical reviews of the change,  management review and approval of the change,  implementation of the change, and  documenting the change. As part of the technical reviews of a change and separate from the USQ process, the contractor performs the appropriate type of safety analysis to ascertain whether the change is indeed safe. The USQ process is used subsequently to determine if final approval of the change by the contractor is sufficient or if DOE approval must be obtained. In performing USQ determinations of a proposed change, documented justification for the USQ determination should be developed. Consistent with the intent of Section 830.203, this documentation should be complete in the sense that a qualified independent reviewer could draw the same conclusion. Contractors should develop procedures that provide detailed guidance for the performance of the USQ process, including any screening and the USQDs. The procedures should—  define the purpose;  set forth applicability;  provide definitions of appropriate terms, screening criteria, and the bases for their application;  include detailed guidance on what is to be considered and evaluated when performing or reviewing a USQD; 8 DOE G 424.1-1B 4-8-2010  define the qualifications and responsibilities of personnel performing and reviewing USQDs; and  require documentation for each USQD. DOE relies on contractor implementation of the USQ process to preserve the integrity of the safety basis while allowing flexibility in operations. The contractor responsible for DOE Hazard Category 1, 2 or 3 nuclear facilities must submit the procedure that defines its USQ process to DOE for approval as required by 10 CFR 830.203. 3.1 Integrated Unreviewed Safety Question Process The USQ process should be integrated into the facility’s change control processes. The change processes should ensure that the USQ process is integrated into existing procedures or that new procedures are developed as necessary and that the need for completion of a USQD is not overlooked. Facility change flow processes for both temporary and permanent changes to SSCs and documents should be described by a governing policy, procedure, flowchart, or other description to define clear relationships between the USQ process and other change control procedures, including design change, configuration control, temporary change, and procedures governing the preparation, review, and approval of procedures. Facility procedures should provide that USQ documents (USQDs or screening) are prepared by one individual and are given independent technical review by a person that has not been involved in document preparation. That person need not be organizationally independent. Facility procedures should provide that facility line management approves action on the USQ documents. This ensures that line management is informed of the results of the USQ process and can take whatever follow-up actions are appropriate to enable prompt submission of changes to DOE for safety review and approval or cancellation of proposed changes. Facility operating committee review may be beneficial but should not replace line management approval. Excessive levels of approvals should be avoided when one internal approval and a second line management approval is sufficient.

3.2 Screening USQ screening is used to ascertain if it is necessary to expend the valuable time and resources necessary to perform a USQD, or whether there is reasonable technical justification for not performing a USQD. When screening eliminates an item, rationale should be well supported, documented and retained. Screening should be performed only by personnel qualified to perform USQDs. DOE G 424.1-1B 9 4-8-2010 Section 830.203 has no specific reference to screening. Conditions for entering the USQ process are listed in 10 CFR 830.203(d) and discussed in more detail in Sections 2.1 through 2.4 of this Guide. If these conditions are not factors in proposed changes, then screening out such changes may be appropriate. Screening is intended to be a simple go/no-go decision-making step without evaluative consideration. When appropriately streamlined, a screening decision can often be completed in a matter of minutes. As discussed in Section 2.1, changes to SSCs not explicitly described in a DSA have the potential to affect the course of an accident that is addressed in the DSA or create the possibility of an accident not addressed in the DSA. If evaluating whether an item can be screened out takes the character of answering the seven USQD questions listed in Section 3.3 the item should not be screened out unless there is a categorical exclusion. If an item has not been screened out, a USQD should be completed. Candidate items for screening out include situations wherein the USQ process may not be applicable as follows:  changes to or the addition of a new TSR;  changes that management has already decided will be submitted to DOE for safety review and approval (including TSR changes);  installation of an item with an exact replica (same manufacturer, model number, etc.);1  installation of an item that is on the facility list of “approved equivalent parts,” which a facility engineer has evaluated and determined that the replacement item meets all the requirements pertinent to the specific application, including the service conditions;  changes when common commercial practices would suffice and a formal nuclear- grade change control process is not warranted (for example, changing fixtures for fluorescent lighting in a control room); and  changes to documents that are purely editorial and make no technical change. Another manner in which screening criteria may be applied is through categorical exclusions. A categorical exclusion is an exclusion from the requirements that USQDs be performed on proposed changes to a category of SSCs or procedures as a result of a determination that the category cannot credibly have the capability of creating a USQ if changed. Documentation of proposed categorical exclusions should be submitted to DOE. Categorical exclusions are regarded as part of the contractor’s USQ procedure and require DOE approval. 1 Even for these activities, intermediate configurations which may occur during the activity must be considered separately under the USQ process. For example, erection of scaffolding in the vicinity of seismically qualified SSCs to complete these activities should be subject to the USQ process. 10 DOE G 424.1-1B 4-8-2010 A categorical exclusion is valid when answers to the seven questions listed in section 3.3 would be “no” for every credible variation within the category. Written justification for the answers would provide formal documentation of the rationale for the exclusion. The screening process should identify and document the categorical exclusion that is applicable to each proposed change being screened out under this provision.

Screening consideration also is given to the possibility that the matter being considered is fully covered by a previous USQD (even when location differences are considered). Such screenings should document the USQD being referenced and explain how the change being considered is adequately addressed by that USQD. When considering the resolution of a nonconformance, note that any disposition that involves a corrective action that does not fully meet all the existing requirements, including a use-as-is disposition, would constitute a design change; a resolution that restores the nonconforming SSC to the approved configuration or replacements with approved equivalent parts does not constitute a change. See Attachment B, sections B.9 and B.12.1 for additional discussions of screening and categorical exclusions. 3.3 Unreviewed Safety Question Determinations Contractors are expected to provide a detailed procedure on how to perform a USQD. Specific guidance on how to conduct a USQD is in Attachment A. Concepts used to develop this process are contained throughout this Guide. Four criteria define a USQ (Section 830.3). Three can be addressed by answering seven questions. The fourth PISA criterion also invokes the seven questions as described later in this section.  Could the proposed change increase the probability of an accident previously evaluated in the facility’s existing safety analyses?  Could the proposed change increase the consequences (to workers or the public) of an accident previously evaluated in the facility’s existing safety analyses?  Could the proposed change increase the probability of a malfunction of equipment important to safety previously described in the facility’s existing safety analyses?  Could the proposed change increase the consequences of a malfunction of equipment important to safety described in the facility’s existing safety analyses?  Could the proposed change create the possibility of an accident of a different type than any previously evaluated in the facility’s existing safety analyses? DOE G 424.1-1B 11 4-8-2010  Could the proposed change create the possibility of a malfunction of equipment important to safety of a different type than any previously evaluated in the facility’s existing safety analyses?  Could the proposed change reduce a margin of safety? If the answer to any of these questions is yes, the change is considered a USQ. The term “safety analyses” in these questions refers to those potential events and their controls considered in the DSA. These include not only the explicit description of the analyses in the DSA but also any analyses performed to support the summary descriptions of the analyses in the DSA. When a potential event is discovered that is not treated in the DSA, it should be considered as a possible new event (see question 5) or as an indicator of a potentially inadequate safety analysis issue. For the purposes of this Guide, equipment important to safety should be understood to include any equipment whose function can affect safety either directly or indirectly. This includes safety class and safety significant SSCs, including support systems to these systems that are necessary for the safety function, and other systems that perform an important defense-in-depth safety function, equipment relied on for safe shutdown, and, in some cases, process equipment.

In the case of a potentially inadequate safety analysis, the fact that there is reason to believe a safety analysis may be inadequate invokes paragraph 10 CFR 830.203(g), including performance of a formal USQD. When a potentially inadequate safety analysis finding arises from an as-found condition, the seven questions can be used in a backward- looking manner as if the current configuration were a proposed modification. If the USQD is found to be negative, the contractor could have approved the discrepant condition without DOE involvement. This would resolve the discrepancy and provide justification for the current configuration. The contractor’s USQ procedures should include documenting defensible technical explanations based on sound engineering judgment for each of the answers to the seven questions. It is inappropriate to perform extensive analyses or to set a numerical margin for increases in the probability or consequences within which a positive USQD would not be triggered. Such analyses and margins lend themselves to excessive efforts in calculations and abuse of the intent of the USQ process through manipulations of assumptions and accident parameters when accident analyses results are highly uncertain, and the possibility that the results might be a function of the calculation methods used, rather than of safety differences. Changes should be evaluated using a method that can determine the direction of change on frequency or consequence, or on margin of safety by comparing the situations before-during-and-after the change is made, isolating the effects of the 12 DOE G 424.1-1B 4-8-2010 change, and evaluating and comparing the situation with and without the change and during implementation. Except for a PISA based on analytic errors, a discernible direction of change refers to the effects of the actual change, not to a comparison of the results of a new analysis to the values cited in the DSA. It is the direction that the change has on probability, consequences, or margin of safety not the magnitude that is important. For example, if the wall thickness of a pressure vessel is going to be increased or the reaction time of a relay in a safety system is shortened, it is likely that the change is in the direction of increased safety. If changes are in the opposite direction, safety is likely to be decreased. Potential increases should be clearly discernible on a qualitative basis. It is important to recognize that the bounding accidents for workers may be (and probably are) different from bounding accidents for the public. If, as a result of a proposed change, additional protective measures (either administrative or hardware-related) are warranted during a postulated accident situation to ensure adequate protection of the public or to provide worker safety, the USQD should be found to be positive on the basis that the change will result in either an increase in probability or an increase in consequences of an accident absent additional protective measures. A proposed change should not be defined as including additional protective measures to reduce exposures such as those related to ALARA (as low as reasonably achievable) levels and not related to potential accidents. DOE wants to be involved for several reasons: First, to verify that the degree of protection is adequate; second, to ensure that the safety basis is properly revised to include the additional protective measures; and third, to verify that hardware involved is properly classified (for example, as a safety class or safety significant SSC) and will receive appropriate surveillance and maintenance.

When evaluating “increased potential consequences” of an accident, if the previously bounding case for that family of accidents is unchanged, then generally there is no increase in the consequences within the USQ process. It is important that the family of accidents be related (the same type, fires, for example) and uses the same set of preventative measures and mitigation. While this is appropriate for public safety, adequate protection of workers necessitates further evaluation. Each change is evaluated for increases in the consequences to workers. Further, when considering a new scenario within a family of accidents, the probability of an accident in that family would be expected to increase. The bases of hazard control documents (TSRs or other formats) should identify some relevant margins of safety. However, all safety basis documents should be reviewed to identify any relevant margins of safety. See Attachment A, section A.1.7 for a discussion of margin of safety. Specific responsibilities of those performing or reviewing USQDs should be clearly defined. Documentation should also be discussed in the implementing procedures. The procedures should identify the level of detail necessary to document performance of a DOE G 424.1-1B 13 4-8-2010 USQD and conclusions reached and include a list of references relied on to reach the conclusions as well as guidance for the retention of records. 3.4 Documentation and Retention The contractor needs to retain records of USQ actions taken pursuant to Section 830.203 for at least the full operational lifetime of the facility, including deactivation, long term surveillance and maintenance, and decommissioning until the facility is categorized as a below Category 3 nuclear facility. When the contractor operating a facility changes, the outgoing contractor needs to turn over all USQ records to the incoming contractor. At the end of each life cycle phase, the contractor should consider retaining the USQ records for the next phase of the facility life cycle. As a minimum, the facility documentation should be maintained consistent with DOE Records Schedules. The contractor maintains the facility DSA and updates it annually. All changes at the facility should be reflected in these updates at an appropriate level of detail, including those that were authorized through the USQ process. Previously it was specified that updates to safety analysis reports (now DSAs) should include all changes implemented 6 months or more before the submittal of the annual update. This has been changed to a commensurate schedule, to allow flexibility. It may be practical to include more current changes than prior to 6 months before submittal of the update. However, at least those implemented 6 months or more before the submittal of the annual update should be included. Some contractors have opted for the strategy of updating the DSA continuously through page changes. Although changes implemented through positive USQDs and DOE approvals of a request become part of the safety basis as soon as they are implemented, changes also result from revisions that the contractor implements through negative USQDs. The continuous page change process can be helpful in ensuring that the DSA always reflects the current facility configuration. All contractors responsible for nuclear facilities submit to DOE annual summary descriptions of all USQDs performed. Items that were screened out and a USQD was not necessary do not need to be included in the annual summary (although they should be retained in the records of USQ actions). This report should be submitted on a schedule commensurate with annual update of the DSA.

3.5 Training and Qualifications Implementing procedures should establish the training and qualifications for personnel performing the USQ process such as educational background, years and/or types of work experience and knowledge of the facility, understanding of DOE facility safety basis requirements (including the USQ process), and familiarity with the facility-specific safety basis. 14 DOE G 424.1-1B 4-8-2010 All personnel responsible for preparing, reviewing, or approving USQ documents should receive training on the application of Section 830.203, including any facility-specific procedures. The recommended interval for retraining is every 2 years. The contractor should maintain a list of those personnel who are currently qualified to perform the USQ process. DOE G 424.1-1B Attachment A 4-8-2010 Page A-1 UNREVIEWED SAFETY QUESTION DETERMINATION A.1 USQ PROCESS The unreviewed safety question (USQ) determination is not a substitute for a safety analysis; it merely serves as a benchmark for whether the safety basis is being preserved. A safety analysis may show that a proposed change is safe, yet the USQ determination may find that the change creates a USQ and therefore requires Department of Energy (DOE) approval prior to implementation. Contractor procedures should clearly establish the differences between the concepts supporting safety analyses for the documented safety analysis (DSA) and those used for a USQ determination. Once it has been determined that a USQ determination is required, it can be approached by providing an answer to each of the seven questions identified using the USQ determination process. If any of these questions is answered “yes,” the change is considered a USQ. An appropriate justification for each answer should be recorded. The examples given in the following subsections are provided to help the reviewer identify potential USQs. They are not meant to be examples of USQs. That determination requires consideration of the DSA for the nuclear facility or other DOE-approved documentation that provides the safety basis for operations or other activities and the specific details of the activity. A.1.1 Could the proposed change 2 increase the probability of an accident previously evaluated in the facility’s existing safety analyses? To understand how the probability of an accident occurring could be increased, it is important to understand how the term “accident” is applied: the term “accident” refers to the anticipated operational transients and postulated accident scenarios considered in the DSA. In answering this question, the first step is to determine the accident scenarios, which have been evaluated in the previously approved safety analysis that may be affected by the proposed change. By focusing on the initiators of the previously evaluated accident scenarios, it can be determined whether there is increased likelihood that a given accident would occur. The following questions may provide a useful approach in making this determination. a. Will the proposed change meet the design (including safety functional requirements as described in the DSA), material, and construction standards applicable to the structures, systems, and components (SSCs) being modified? If the answer is “yes,” this aspect of the proposed change might be considered not to increase the likelihood of the occurrence of an accident, but the aspects of 2 For the purposes of this attachment, “change” will mean any change to procedures or equipment (including prior

undocumented changes), any new tests or experiments, or any new information that has the potential to invalidate the safety basis. Attachment A DOE G 424.1-1B Page A-2 4-8-2010 question b, following, are also considered. If the answer is “no” to any of the items, either a justification for saying there is no increase in the likelihood of the occurrence of an accident will need to be developed or it is concluded that the likelihood of the occurrence of an accident is increased. b. Could the proposed change affect overall SSC performance in a manner that could increase the probability of a previously analyzed accident? Possible questions to ask are— (1) Could the proposed change use instrumentation with accuracies or response characteristics that are different from those of existing instrumentation and could make an accident more likely to occur? (2) Could the proposed change cause SSCs to be operated outside their design or testing limits? Examples include the following: overloading electrical systems, over pressurizing a piping system, or operating a motor outside its rated voltage and amperage. (3) Could the proposed change cause system vibration, water hammer, fatigue, corrosion, thermal cycling, or degradation of the environment for SSCs that would exceed the design limits? (4) Could the proposed change cause a change to any SSC interface in a way that could increase the likelihood of an accident? A.1.2 Could the proposed change increase the consequences of an accident previously evaluated in the facility’s existing safety analyses? In answering this question, the first step is to determine which accidents evaluated in the safety analyses may have their radiological and hazardous material consequences altered as a direct result of the change. The next step is to determine whether the change could in fact increase the consequences of any of the accidents evaluated in the existing safety analyses. Consequences to workers (in-facility, outside, or collocated) and the public is to be considered. Examples of questions that assist in this determination are as follows: a. Could the proposed change degrade or prevent safety functions described or assumed in the existing safety analyses? b. Could the proposed change alter any assumptions previously made in evaluating the radiological and hazardous material consequences in the existing safety analyses? c. Could the proposed change play a direct role in mitigating the radiological or hazardous material consequences assumed in the existing safety analyses? d. Could the proposed change affect the integrity or function of any fission product barrier or any radioactive or hazardous material barriers? DOE G 424.1-1B Attachment A 4-8-2010 Page A-3 A.1.3 Could the proposed change increase the probability of a malfunction of equipment important to safety previously evaluated in the facility’s existing safety analyses? The safety analyses for the facility assume the proper functioning of equipment important to safety in demonstrating the adequacy of design. The proper functioning of other systems, including support systems, is generally assumed. The scope of the USQ determination should include these other systems. For example, a change that does either of the following is a change that increases the probability of a malfunction of equipment important to safety:  degrades the performance of equipment important to safety, assumed to function in the accident analysis, to below the performance level assumed in the existing safety analyses; or

 increases the challenge to equipment important to safety assumed to function in the accident analysis (for example, more rapid pressure rise), degrading performance to a level below that assumed in the existing safety analyses. In answering this question, the first step is to determine what SSCs could be affected by the proposed change. Then the effects of this change on equipment important to safety are evaluated, including both direct and indirect effects. Direct effects are those in which the change affects the equipment (for example, a motor change on a pump). Indirect effects are those in which the change affects one piece of equipment, which in turn can affect equipment important to safety. An example of indirect effects would be one piece of equipment falling on safety equipment. After the impact of the change on equipment important to safety is identified, a determination is made whether an increase in the probability of a malfunction of the SSCs has occurred. The following are examples of questions that can be used in making this determination. a. Will the proposed change meet the original design specifications for materials and construction practices when the following questions are considered: (1) Are the seismic specifications met (for example, use of proper supports, proper lugging at terminals, and isolation of lifted leads)? (2) Are separation criteria met (for example, minimum distance between circuits in separate divisions, channels in the same division, and jumpers run in conduit)? (3) Are the environmental criteria met (for example, use of materials suitable for the radiation or thermal environment in which they will be used)? b. Will the proposed change degrade equipment important to safety reliability by— (1) imposing additional loads not analyzed in the design? Attachment A DOE G 424.1-1B Page A-4 4-8-2010 (2) deleting or reducing system or equipment protection features? (3) downgrading the support system performance necessary for reliable operation of the equipment? (4) reducing system or equipment redundancy or independence? (5) increasing the frequency of operation of systems/equipment? (6) imposing increased or more severe testing requirements on systems or equipment? If the change adversely affects the equipment important to safety, the likelihood of equipment malfunction may be increased. A “no” answer to any question in paragraph 3a or a “yes” answer to any question in paragraph 3b in the immediately preceding examples may not mean that there is a negative impact on safety. It would indicate, however, the existence of a USQ and the need for further analyses. A.1.4 Could the proposed change increase the consequence of a malfunction of equipment important to safety previously evaluated in the facility’s existing safety analyses? This question asks whether, assuming a malfunction of equipment important to safety, the change would result in increased hazardous-material or radiological consequences. For example, consider a change that caused a valve in a safety system to fail in the closed position where previously it was assumed to fail in the open position. If this change results in an increase in consequences of an accident, it indicates the change involves a USQ. In some situations, such as a loss of a preferred failure mode, the change might not lead to an increase in the calculated consequences but should be considered within the context of a possible reduction in a margin of safety as discussed in paragraph A.1.7.

A.1.5 Could the proposed change create the possibility of an accident of a different type than any previously evaluated in the facility’s existing safety analyses? An accident or malfunction that involves an initiating event or failure not considered in the nuclear facility’s existing safety analyses is potentially an accident or malfunction of a different type. An example would be turbine missiles from a gas turbine added as an alternate power source. Certain accidents or malfunctions are not treated in the nuclear facility’s existing safety analyses because their effects are bounded by similar events with the same control set that are analyzed. A seismic-induced failure of a component designed to appropriate seismic criteria will not cause a malfunction of a different type. However, a change that increases the probability of an accident previously thought to be beyond extremely unlikely, so that it is in the credible range, creates a possible accident of a different type. In answering this question, the first step is to determine the types of accidents evaluated in the existing safety analyses. The types of credible accidents that the change could create can then be identified and listed. Evaluating the differences between the two lists DOE G 424.1-1B Attachment A 4-8-2010 Page A-5 will determine the answer to the question. The accidents evaluated in the existing safety analyses are generally chosen to be bounding for a broad class of credible accidents. Thus, comparison of a new accident to the existing analyses may require referral to the underlying hazard analyses. A.1.6 Could the proposed change create the possibility of a malfunction of equipment important to safety of a different type than any previously evaluated in the facility’s existing safety analyses? To answer this question, the types of failure modes of equipment important to safety that have been previously evaluated in the existing safety analyses and that would be affected by the change are identified. Then the types of failure modes that the change could create need to be identified. Comparing the two lists can provide an answer to the question. An example of a change that might create a malfunction of a different type is the relocation of equipment so that it becomes susceptible to flooding; another example is the replacement of a mechanical control system with a digital control system that could fail in a different mode. A.1.7 Could the proposed change reduce a margin of safety? This section deals with margins of safety related to DOE-approved hazard control documents. These controls may be technical safety requirements (TSRs), or they may be in another form, as permitted in Section 830.205 for certain environmental restoration activities. For purposes of performing the USQ determination, a margin of safety is defined by the range between two conditions. The first is the most adverse condition estimated or calculated in safety analyses to occur from an operational upset or family of related upsets. The second condition is the worst-case value known to be safe, from an engineering perspective. This value would be expected to be related to the condition at which some accident prevention or mitigation action is taken in response to the upset or accident, not the actual predicted failure point of some component.

Hazard control documents set forth the minimum acceptable limits for operation under normal and specified failure conditions; they ensure that the available safety equipment and operating conditions meet the assumptions in the existing safety analyses. They distill those aspects of the safety analyses that are required to ensure the performance of safety SSCs and personnel as relied on and defined in the safety analyses. The bases for a hazard control should define the margin of safety. If the bases of a hazard control do not specifically identify a margin of safety, the DSA and other appropriate safety basis documents should be reviewed to determine whether the proposed change, test or experiment, or new information has or would result in a reduction in a margin of safety. The judgment on whether the margin is reduced should be based on physical parameters or conditions that can be observed or calculated. Attachment A DOE G 424.1-1B Page A-6 4-8-2010 The safety margin is sometimes implicitly described. A margin of safety can depend on a parameter other than one of the process variables. Therefore, the precise determination of a numerical value associated with a change is not always possible. Implicit margins are, for example, conditions for acceptance for a computer code, method, or industry-accepted practice. It may be sufficient to determine only the direction of the margin change (that is, increasing or decreasing) due to the proposed change. Safety margins generally include worst-case assumptions of initial conditions, conservative assumptions in computer modeling and codes, allowance for instrument drift and system response time, redundancy and independence of components in safety trains, and plant response during operating transient and accident conditions. A change that affects initial conditions, a system response time, or some other parameter that can affect the course of an accident analysis supporting the bases of hazard controls is evaluated to determine whether the change would reduce a margin of safety. A.2 PERFORMING USQ DETERMINATIONS In performing USQ determinations of a proposed change, documented justification for the USQ determination should be developed. Consistent with the intent of Section 830.203, this documentation should be complete in the sense that a qualified independent reviewer could draw the same conclusion. The importance of the documentation is emphasized by the fact that experience and engineering knowledge, rather than models and experimental data, are frequently relied on to make the USQ determination. Since an important goal of the USQ determination is to demonstrate that the safety basis is being maintained, the items considered by the evaluator should be clearly stated. Documentation of the effects considered will enable the independent reviewers to assess the adequacy of the USQ determination and its conclusions. DOE G 424.1-1B Attachment B 4-8-2010 Page B-1 UNREVIEWED SAFETY QUESTIONS LESSONS LEARNED The following list of lessons learned has been developed from experience in applying the unreviewed safety question (USQ) process. B.1 TITLE The title of the process, “unreviewed safety questions,” may suggest that the process determines the safety of changes. However, the USQ process is intended to determine the final approval authority for a change [that is, the contractor or Department of Energy (DOE)].

The USQ process is not intended to replace or to serve instead of a safety analysis of the change. The safety implications of a change should be reviewed, analyzed, understood, addressed, determined whether it is acceptable, and documented by the contractor separately from the USQ process. Using the USQ process instead of the safety analysis complicates the USQ process. Further, such a usage is inappropriate because the seven questions to be answered in the USQ determination are not geared toward understanding whether the change is safe but rather if any of the probability or consequence risk factors may have increased beyond what has been accepted previously by DOE and hence if the existing safety controls remain adequate. The change should already be known to be safe before it enters the USQ process. The USQ process determines if final approval by the contractor is sufficient or DOE review and approval are required. DOE wants to review and approve those changes that involve a USQ (that is, when the USQ determination is positive) to verify that the safety controls are adequate to provide an acceptable level of safety to the public and workers. The existence of a positive USQ determination does not mean that the change is unsafe but only that DOE is to be responsible for the final approval action. B.2 CONTROL OF HAZARDS DURING INSTALLATION Hazards that may be involved during the installation of a modification should be addressed by appropriate safety management programs (such as work planning and control that includes job hazard analysis or a similar process). As discussed in Section 2.1 of the Guide, the work authorization system should include a step for consideration of possible USQ situations on the facility safety basis, beyond the planned work. DOE relies on the contractor’s normal work control procedures to address worker hazards involved in the actual installation of a modification, not on the USQ process. These procedures are in programs including radiation protection, hazardous material protection, work planning and control, Occupational Safety and Health Administration, ALARA (as low as reasonably achievable), and lockout/tagout. However, the conduct of the work may involve the introduction of hazards that can constitute a threat to the facility safety basis such as the use of a crane that could fall on equipment important to safety. So the USQ process is exercised in considering potential facility safety impacts of modification work. One basic tenet of the USQ process is to assess the potential change in probability and consequences risk factors that might be involved when facility operations are Attachment B DOE G 424.1-1B Page B-2 4-8-2010 resumed after the modification is implemented. However, sometimes a modification might be only partially implemented because it is interrupted by unforeseen circumstances. In such cases, the USQ documentation would need to be revisited to ensure that it adequately addresses operation with the partially implemented configuration. B.3 DECLARING A USQ TO EXIST Section 830.203 assigns the contractor the basic responsibility to evaluate changes and determine if a USQ exists, or is involved. If the result of the contractor’s USQ determination is positive, a USQ exists. DOE can declare that a USQ exists as part of its oversight responsibility of the USQ process. Such a declaration might result from a disagreement with a contractor’s negative USQ determination or might result from a condition for which the contractor has not done a USQ determination. When DOE declares a USQ, it is because DOE believes it should be involved in the review and approval of the situation to fulfill its responsibilities.

B.4 SUBMITTALS TO DOE At some sites, the completed USQ determination form is submitted routinely to DOE for approval. This practice should be reconsidered because it is not required and can shift the focus of the DOE review from the safety characteristics of the change to how well the USQ determination was prepared. For a potentially inadequate safety analysis, the rule requires that an evaluation of the safety of the situation (not the USQ determination) be submitted prior to removing any restrictions. The USQ process does not encompass all situations for which the contractor may need to request an amendment to the safety basis of a facility. For example, a change to the hazard categorization level for a facility requires DOE approval, but should not be addressed by the USQ process. Some contractors have developed a formalized process for requesting amendments to the safety basis. At some facilities, the USQ process is being used virtually every time there is need to request an amendment to the safety basis, regardless of whether or not a change to the facility or procedures is involved. In some situations, the USQ process is inappropriate. A formalized procedure that defines the content of the submittal to DOE requesting an amendment to the facility safety basis could supplement the USQ process (regarding positive USQ determinations). Such a procedure would also support other situations that do not involve the USQ process. Such a procedure might outline the expected content as including items such as (1) an introductory summary of the purpose of the letter and its contents, (2) a description of the situation that generated the need for action, (3) alternative actions considered, (4) a description of the selected action, (5) engineering technical considerations, (6) safety implications of the action, including the results of the USQ process when applicable, (7) programmatic implications, (8) budgetary DOE G 424.1-1B Attachment B 4-8-2010 Page B-3 considerations, (9) schedule considerations, and (10) basis on which the contractor believes that DOE should approve the action. B.5 NEED FOR USQ DETERMINATIONS FOR TSR CHANGES Section 830.205 requires that changes to the technical safety requirements (TSRs) be submitted to DOE for review and approval. Changes to the TSRs could involve the need either to modify an existing TSR or to add a new TSR. If it is known that a proposed change only involves a TSR change, it is not required to go through the USQ determination to determine if DOE approval is also required by 830.203. Similarly, if a change involves a TSR change, calling the change a positive USQ determination just because it requires DOE approval would be inappropriate. However, while performing a USQ determination for TSR changes is not required, it may be desirable. When the TSR change is submitted to DOE for review and approval, the contractor should include appropriate information to support the contractor's position that the change should be approved (that is, the contractor should include the basis for the proposed change). Such supporting information might include some of the same considerations that would be addressed in a USQ determination. B.6 TENANT/LANDLORD RELATIONSHIPS

Although not intended as literal, the terms “landlord” and “tenant” are used here to describe situations where one contractor conducts operations in a facility and has overall responsibility for a facility safety basis but another contractor also conducts operations in the facility. In these situations the operations of both the first and the second contractor must be fully described and analyzed in the facility safety basis in order to comply with 10 CFR 830 Subpart B. However, usually the landlord contractor is fully responsible for maintaining the integrity of the safety basis. Whether or not a contractual relationship exists between the contractors, it is important that a practical operational means exist to ensure disciplined and coordinated implementation of the USQ process for all operations within the facility. In these cases, the recommended approach to allow flexibility for the tenant’s activities and still protect the facility safety basis via the USQ process is to (1) ensure that a hazards analysis (or other appropriate safety analysis) exists for each tenant activity such that the collective hazards analyses for all tenant activities are encompassed by the facility safety basis, (2) procedurally require that the tenant review any changes in its activities that are being considered against the corresponding hazards analysis, and then (3) in conjunction with the landlord, perform a USQD against the overall facility safety basis. There is a potential conflict between requiring that all changes within a facility be considered within a formal change control process and allowing researchers and other tenants’ flexibility to conduct their activities without undue restrictions that might stifle the desired creativity. The objective should be to impose the formality necessary to ensure that all activities are conducted safely within the DOE-approved Attachment B DOE G 424.1-1B Page B-4 4-8-2010 safety basis for the facility without applying any unnecessary restrictions on the activities. Having the tenant take an active role in development of an appropriate activity level safety envelope for the activities within the facility safety basis can promote ownership. This participation can also enhance safety responsibility without limiting the activities. B.7 GRADED APPROACH During the hazards analysis and safety analysis processes, equipment is classified as safety class, safety significant, other safety, or non-safety. Once these classifications are established, they are used to indicate how much effort should be applied in answering the seven USQD questions. However, no steps of the USQ process can be eliminated based on such grading. In some situations, attempts to apply the graded approach to the USQ process have resulted in inadequate USQ determinations. For example, some contractors have applied the graded approach to the change control processes in a manner that does not require the application of formal change controls unless the change involves equipment, procedures, or operations important to safety. Caution needs to be applied in such a situation to ensure that this approach does not prevent changes from being considered by the USQ process, which is a subset of change control. The only application of the graded approach to the USQ process is indirect. The graded approach may give a rough indication of how much justification or basis information should be provided when explaining the answers to each of the seven USQ determination criteria. More elaborate and thorough basis information would be expected for changes to safety equipment than for non-safety equipment. In any case, the justification for the answers to the USQ determination criteria needs to be defensible.

B.8 UNIFIED AND CONSOLIDATED PROCEDURES Contractors should consider the desirability of requiring that each nuclear facility at the site adhere to a single sitewide USQ procedure and sitewide USQ training/qualification requirements. Facility-specific considerations, such as identifying the safety basis documents, could be addressed by appendices to the sitewide procedure. At some sites, each nuclear facility uses a different USQ procedure, leading to inconsistencies and misapplications. One DOE field office assessment found that a root cause of USQ problems was the lack of a common procedure and common USQ training. A single sitewide USQ procedure could improve the quality of the USQ process by taking advantage of the best aspects of each of the different facility procedures. Using the same USQ forms for screens and USQ determinations and using the same training and qualification requirements can help develop a high-quality USQ process across the site. B.9 USQ SCREENING USQ screening is intended to be a simple go/no-go decision-making step, without evaluative consideration. When appropriately streamlined, this step in the USQ process DOE G 424.1-1B Attachment B 4-8-2010 Page B-5 can often be completed in a matter of minutes. Screening to determine whether an SSC is described in the safety analyses (safety basis) should consider only whether the equipment is identified anywhere in the safety basis. Screening criteria should not be based on whether the SSC is formally classified as a safety SSC (that is safety class or safety significant), is taken credit for in the safety analysis (or accident analysis) chapter of the safety basis document, nor whether the particular characteristic(s) of the SSC to be changed are taken credit for. The basic intent of screening is to eliminate unnecessary time and effort being spent performing a USQ determination if there is no possible way that the change could impact the safety basis and involve a USQ. Conversely, screening criteria make certain that changes which could possibly involve a USQ are “screened in” and hence a USQ determination is performed. The USQ screening criteria center on the question of whether the item to be changed is described in the safety basis. An example of an inappropriate, highly evaluative, screening criterion is: “Does this change significantly adversely impact the ability of an SSC described in the safety basis to perform its safety functions?” Such a criterion encompasses four separate considerations: (1) determining if the SSC is identified in the safety basis, (2) finding out what the safety functions are for the SSC, which might not be stated very clearly or completely, (3) evaluating if the impact of this change could adversely affect the capability to perform a safety function, and (4) evaluating if the impact could be significant. All but the first consideration are evaluative considerations that depend strongly on which individual does the USQ screen. These types of evaluative considerations should be in the domain of the USQ determination, not part of the simple screening step. If someone were to subdivide the safety basis documents into those parts that are “descriptive” and those parts that are important to safety, the results would be highly subjective. Limiting the performance of USQ determinations to only those SSCs taken credit for in the safety analysis chapter, or even further to only those characteristics of SSCs taken credit for can lead to serious problems, including bypassing the USQ determination and thereby, unknowingly exceeding the bounds of the safety basis. Similarly, limiting screening to safety SSCs (that is, those identified as safety class or safety significant) before a USQ determination is done is inappropriate due to the potential for unrecognized direct or indirect interactions.

B.10 DOE INVOLVEMENT IN THE USQ DETERMINATION The contractor should make every effort to complete its USQ determinations without DOE involvement. DOE has charged the contractor with performing the USQ process to determine if contractor approval is sufficient. At times, there will be borderline cases or “gray areas” where engineering judgment will play a large role in the determination. The contractor should complete the determination with sufficient justification to defend the conclusion, despite whether the final determination is positive or negative. Attachment B DOE G 424.1-1B Page B-6 4-8-2010 B.11 USQS AND CRITICALITY SAFETY EVALUATIONS All proposed new or changed processes involving criticality safety that necessitate a new or revised Criticality Safety Evaluation, including those in an experimental facility, undergo a USQ review by the Nuclear Safety Management rule. When the USQ determination is positive indicating the need for DOE review and approval of the change, the safety analyses and controls associated with the approved action become part of the safety basis for the facility. Any changes necessary to the DSA and TSR documents because of the change should be incorporated at the next annual update. The results of the USQ determination define the need for DOE approvals of the supporting criticality safety evaluations and explicit updates of the DSA and TSRs. B.12 EFCOG ISSUES Representatives of DOE and Energy Facilities Contractor Operating Group (EFCOG) met to discuss issues and request clarifications on several USQ implementation issues that had arisen since 10 CFR 830 Subpart B had been made effective. This section provides guidance relating to the more significant of these issues. B.12.1 Screening It has been argued that the definition of a USQ in 10 CFR 830.3 and the conditions for entering the USQ process in 10CFR830.203(d), which refer to the existing documented safety analysis, allow screening out of proposed changes to a facility if the change does not involve anything in the existing safety analysis. For example, the definition of a USQ includes the situation where “the probability or the consequences of an accident or the malfunction of equipment important to safety previously evaluated in the documented safety analysis could be increased.” Also, for example, the USQ process must be entered in situations where there is a “temporary or permanent change in the facility as described in the existing documented safety analysis.” This has been described as the “as versus is” controversy. That is, it is argued that the arbiter of a USQ situation is the existing documented safety analysis, rather than the potential for increased risks, whether or not described in the DSA. The argument for exclusion of some changes from the USQ process by screening out, because the involved systems or components are not described in the existing DSA presumes that the existing DSA is complete in all respects with regard to descriptions, hazard identification, and controls. While the quality and completeness of safety basis documents is increasing, there is still a wide disparity in those attributes of approved safety bases throughout the DOE complex. It is inappropriate to screen out a change that involves systems or hazards that are not described in the existing safety analysis. There are several reasons why this is so. The change itself could constitute a new test or experiment. Introduction of a new hazard could cause a new type of accident or malfunction, or increase the likelihood of an accident or malfunction. Any of these could result in a USQ, so a USQ determination is needed.

DOE G 424.1-1B Attachment B 4-8-2010 Page B-7 The allowance of a limited amount of time for management-level evaluation of possible safety issues relating to discovery, or new information, prior to invoking the PISA provisions of the USQ requirements is appropriate to the screening process. That is, a limited amount of technical judgment relative to a safety nexus can be exercised. However, when such considerations take the nature of answering the seven USQ criteria questions, the item should not be screened out. Instead, a USQD should be completed. Further, if the screening process involves examination of whether or not the issue is dealt with in the DSA, the process should include consideration, as described above, of whether another entry into the USQ process (PISA, test or experiment not described in the DSA, or the possibility of an accident or failure of a different type) should be invoked. B.12.2 Nonconforming SSCs Clarification was requested for the proper handling of situations where it is found that an SSC does not conform with the documented design description and specifications (discrepant as-found state), under the USQ requirements. If the corrective action is to bring the item into conformance (see discussion in section 3.2), then it may be reportable under ORPS requirements, but it would not require a USQD. However, if the resolution would be another approach (e.g., use-as-is, or alternatively, replace with another unapproved component), then the provisions of 10 CFR 830.203(d) (temporary or permanent change in the facility as described in the existing documented safety analysis) must be invoked. Formally, this would invoke PISA provisions, for which the ORPS report would constitute notification of DOE. Prior action of assuring a safe condition upon discovery should already have been taken. So, if the decision is to “use-as-is,” for example, the next step would be to perform a formal USQD. Whatever the case, it would be prudent to investigate to see if there had been a valid safety reason for the non-conforming condition that had not been properly reflected in a change to the DSA. B.12.3 Discernible Increase (in Frequency or Consequence) The answer to what is a discernible increase is in the rationale provided in the USQD first four of seven questions. The rule (see 10 CFR 830.3 USQ definition) does not permit a numerical margin before which an increase constitutes a USQ. The rationales for the USQ answers should be convincing to an independent reviewer that the change could result (or not result) in an increase. Site-specific quantitative guidance that allows for a numerical margin is implicitly acknowledging that they have a USQ, when that margin is used to dismiss the question. A rationale against having such margins (independent of the fact that they are not compliant with the rule) is that with them a contractor could make many changes that individually would not violate the margins, but taken together over years could result in a Attachment B DOE G 424.1-1B Page B-8 4-8-2010 massive increase in operational risk that DOE did not consciously accept and which never got documented in the safety basis. Further, it would seem that if a contractor were to go to the extent of quantifying an increase in consequences or frequency, the contractor would have done all that would be required to prepare a USQD, and more. Therefore the contractor is not saving anything (and is likely expending more than appropriate) by invoking a margin.

B.12.4 DOE Approval of Revisions to a USQ Procedure The 10 CFR 830 rule requires that the USQ procedure be reviewed and approved by DOE. This Guide does not address approval of revisions except in the context of changes of procedures. B.12.5 Major Modifications The possibility exists that a major modification to a facility could be broken down into a series of changes that, individually, would not be considered major. Avoidance of a USQ issue by breaking a modification down into many “minor modifications” could be considered an intentional failure to implement 10 CFR 830 requirements in good faith. 10 CFR 830.3 defines a major modification as one that “substantially changes the existing safety basis for the facility.” This includes the content of the safety basis, not just consideration of bounding accidents. Guidance on when a proposed change to a facility is a major modification (requiring a preliminary documented safety analysis) versus a change provided in DOE Standard 1189, Integrating Safety into the Design Process B.12.6 Transportation Activities under 10 CFR 830.203 USQ Requirements Transportation activities are regulated under 10 CFR 830, except for those activities regulated by the Department of Transportation. This guidance can be applied directly to transportation activities. Non-routine transfers, as discussed in the applicable Transportation Safety Document (TSD) chapter, must all undergo the USQ process. Proposed changes in transportation activities that do not lead to using packaging in conditions that may lead to exceeding its performance envelope should not result in a positive USQD, in most cases. B.13 OPERABILITY DETERMINATIONS It is necessary to determine the proper handling of situations expeditiously under the USQ requirements where it is found that an SSC does not conform to the safety basis description and requirements (discrepant as-found state). The SSC may be degraded such that there is a loss of quality or functional capability or a nonconforming condition may exist with the SSC or its documentation. DOE G 424.1-1B Attachment B 4-8-2010 Page B-9 When a degraded or nonconforming SSC is identified as a PISA, the contractor must first “take action, as appropriate, to place or maintain the facility in a safe condition” (10 CFR 830.203(g)(1)). A safe condition may include continued facility operation if, although a degraded or nonconforming SSC is not fully qualified, the impact on safe facility operations is judged to be acceptable, possibly aided by operational restrictions and the TSRs are still being met in terms of required operable equipment for the given MODE of operations and associated ACTIONS. If a SSC identified in a TSR is determined to be inoperable, then in accordance with the facility TSR, the action statement(s) in the TSR must be implemented. The TSR action statement may direct the facility operator to go to a MODE in which the piece of equipment is not required or the facility operator may choose to take this action even though the TSRs do not explicitly direct it. There may be situations where an SSC has been degraded such that there is a loss of quality or functional capability or a nonconforming condition may exist with the SSC or its documentation but the SSC has not been determined to be inoperable. These situations may constitute a PISA. When a degraded or nonconforming SSC is identified as a PISA, the contractor must first “take action, as appropriate, to place or maintain the facility in a safe condition” (10 CFR 830.203(g) (1)). A safe condition may include continued facility operation if, although a degraded or nonconforming SSC is not fully qualified, the impact on safe facility operations is judged to be acceptable, possibly aided by operational restrictions and the TSRs are still being met in terms of required operable equipment for the given MODE of operations.

An operability determination is a forward-looking evaluation by the operating contractor of whether there is a reasonable expectation that continued operation of the facility is safe even when a degraded or nonconforming condition exists. An immediate operability determination should be made based on the best available information and operational restrictions imposed, if necessary, upon confirmation of the condition. Subsequently, a final determination should be made and documented following a thorough engineering evaluation. The elements of the final operability determination should include  description of the degraded or nonconforming condition of the SSC  description of the relationships on safe operations of the SSC functions  evaluation of the operability of the SSC given its condition— o using analysis, tests, operating experience, and/or engineering judgment o considering availability of other equipment, conservatisms and margins, and cumulative effects of other outstanding degraded or nonconforming conditions  specification of additional operating restrictions if necessary (e.g., compensatory measures, additional engineering analysis by a certain date)  specification of restoration actions (may be added later). Attachment B DOE G 424.1-1B Page B-10 4-8-2010 Restoration actions for the degraded or nonconforming condition are to be developed by the contractor and scheduled at the first available opportunity commensurate with the safety significance and extent of restoration actions in an integrated manner with other facility commitments and resources. The final operability determination may be included as part of the evaluation of the safety of the situation required to be submitted to DOE before removal of any operational restrictions. DOE G 424.1-1B Attachment C 4-8-2010 Page C-1 GUIDANCE ON PROCESSING POTENTIAL INADEQUACIES IN THE EXISTING SAFETY ANALYSES C.1 INTRODUCTION This attachment provides guidance on the performance of each of the four steps required per 10 CFR 830.203(g) upon discovery of a Potentially Inadequate Safety Analysis (PISA). In addition, this attachment discusses an acceptable method for evaluating new information to determine whether a PISA exists, and discusses the use of Justifications for Continued Operation (JCO). This attachment also discusses situations involving multiple PISAs. Figure 1 provides a schematic of the PISA process. C.2 PROCESSING INFORMATION TO DETERMINE WHETHER A PISA EXISTS 10 CFR 830. 203(g) requires certain actions for a PISA. A PISA may result from situations that indicate that the safety basis may not be bounding or may be otherwise inadequate; for example, discrepant as-found conditions, operational events, or the discovery of new information. It is appropriate to allow a short period of time (hours or days but not weeks) to investigate the conditions to confirm that a safety analysis is potentially inadequate before declaring a PISA. The main consideration is that the safety analysis does not match the current physical configuration, or the safety analysis is inappropriate or contains errors. If it is immediately clear that a PISA exists, then the PISA should be declared immediately. DOE Sites should consider including this initial confirmatory process as part of their USQ procedures. C.3 PLACING OR MAINTAINING THE FACILITY IN A SAFE CONDITION

Upon identification of a PISA, 10 CFR 830.203(g) requires the contractor to place or maintain the facility in a safe condition. The determination of what constitutes a safe condition is the responsibility of the contractor. The contractor should take conservative action to impose operational restrictions to ensure the facility is safe. Operational restrictions may include restrictions on work activities for the affected part of the facility, imposition of additional controls (e.g., fire watches if the adequacy of a fire protection control is in question), or placing the facility into a different TSR mode. In addition, per 10 CFR 830, Subpart B, Appendix A, Section G (3), the contractor must evaluate the operability of impacted safety systems and components and enter any applicable TSR action statements. Further, the rationale (for the determination that the facility is in a safe condition) should be documented. This should not involve an extensive/detailed analysis as the evaluation of the safety of situation will occur at a later stage of processing the PISA, e.g., after the USQ determination. Attachment C DOE G 424.1-1B Page C-2 4-8-2010 C.4 EXPEDITIOUSLY NOTIFYING DOE WHEN THE INFORMATION IS DISCOVERED After the potentially inadequate safety analysis has been confirmed, 10 CFR 830.203(g) requires contractors to take four specific actions. One of those actions is to notify DOE of the situation. The current DOE reporting system (DOE O 232.2, Occurrence Reporting and Processing of Operations Information) requires that a potential inadequacy of the documented safety analysis be reported as a Significance Category 3 situation. The Occurrence Reporting and Processing System (ORPS) may be used for this notification if the report explicitly states that the situation involves a “potential USQ involving a potentially inadequate safety analysis.” The ORPS reporting designation used for this notification is Group 3 B (2), “Declaration of a potential inadequacy of the documented safety analysis.” The DOE Facility Representative and/or other DOE management responsible for the facility should be notified immediately. The DOE notification should clearly identify any operational restrictions that were invoked to ensure the facility is in a safe condition. No DOE approval of the operational restrictions is needed; however, DOE should review them and can direct other restrictions be implemented if needed. C.5 PERFORMING A USQD AND NOTIFYING DOE OF THE RESULTS Another action required for a potentially inadequate safety analysis is the preparation of a USQ determination for the situation. This should be performed in a short period of time (hours or days, not weeks) following confirmation of the PISA. In the event that the USQ determination is positive, DOE O 232.2 requires that this condition be categorized and reported as a Significance Category 2 under ORPS Group 3 B (1), “Determination of a positive Unreviewed Safety Question (USQ) that reveals a currently existing inadequacy in the documented safety analysis.” The contractor must notify DOE of the results of whether the USQD was positive or negative. Examples of notification methods may include: updating the ORPS report or submitting a separate letter to DOE. As part of performing the USQD, new information may arise that results in the contractor identifying additional operational restrictions that should be imposed and modifying its operability determination. No DOE approval of any new operational restrictions is needed; however, DOE should review them and can direct other restrictions be implemented if needed.

C.6 COMPLETING AN EVALUATION OF THE SAFETY OF THE SITUATION (ESS) C.6.1 Processing of Evaluation of the Safety of the Situation 10 CFR 830.203(g) requires contractors to submit an ESS to DOE “prior to removing any operational restrictions.” The contractor should develop an ESS following completion of the PISA USQD, since input from the USQD analysis is useful in developing the ESS3. 3 10 CFR 830.203(g) lists 4 actions that contractors must perform when a PISA is discovered. Although nothing in 10 CFR 830.203(g) requires these actions be performed in order, it is logical and recommended that they be performed in this manner. DOE G 424.1-1B Attachment C 4-8-2010 Page C-3 The timing of the ESS is a function of whether the USQD is positive or negative. The ESS associated with positive USQDs should be developed within a short period of time following completion of the USQD (as soon as practicable and should not take more than a month) taking into account the safety risk presented by the situation and the effectiveness of operational restrictions imposed. However, if the facility is placed in a TSR safe MODE (i.e., a MODE where the PISA condition no longer represents a hazard), there is no specific time limit for submittal of the ESS in this situation. Also, there is no specific time limit for submittal of an ESS for a negative PISA USQD because the condition of the facility is such that DOE approval would not have been needed (per the USQ requirements) if the facility was intentionally put in this condition. However, in accordance with 10 CFR 830.203(g), the ESS must be submitted prior to lifting any operational restrictions. Further, it is a good practice to address the cause of the PISA (e.g., correct discrepant conditions and/or update safety basis) and return the facility to normal operations (i.e., lift operational restrictions) as soon as practicable. No DOE approval of the ESS is needed for the negative PISA USQD. The ESS should be reviewed by DOE to determine whether the facility (with any remaining operational restrictions in place) is in a safe condition. Furthermore, DOE should formally approve ESSs for PISAs that result in a positive USQD. DOE review of the ESS should focus on the adequacy of the contractor’s analysis of the impact of the PISA on the safety of the facility and the capability of the operational restrictions/controls to mitigate the hazards and to compensate for any potential decreases in the facility safety caused by the PISA. The approval authority for the DOE should be at the same level as the Safety Basis Approval Authority level for the facility. In situations of a positive USQD and if operations are to continue for an extended period of time (i.e., greater than a month) under the restricted conditions of other than a TSR safe MODE, then the contractor should evaluate whether further (more detailed) analysis may be appropriate to justify that continuance. This may take the form of a Justification for Continued Operation (JCO) (see Section C.7). Alternatively, it is appropriate for the contractor to update the ESS to include a more detailed analysis utilizing the outline described in Section C.6.2 taking into consideration the JCO content described in Section C.7 and to submit the updated ESS to DOE. As needed, the contractor should incorporate changes to resolve the USQ into the next annual DSA/TSR update if not submitted earlier or as may be specified in the JCO. C.6.2 Content of Evaluation of the Safety of the Situation

If the PISA USQD is negative, the ESS should document the assessment of the safety of the situation, and provide evidence that the immediate controls placed on the facility or activity to ensure a safe condition are not required and can be removed. If the PISA USQD is positive, the ESS should document the assessment of the safety of the situation, and provides the basis for how the actions taken (including implementation of operational restrictions), and/or planned actions, ensure safety. Attachment C DOE G 424.1-1B Page C-4 4-8-2010 If a DSA modification is made as part of the resolution of the PISA or the Justification for Continued Operation, then in accordance with 10 CFR 830.207, a Safety Evaluation Report (SER) is needed. If not done earlier, then any needed changes to the safety basis should be made at the next annual update. The following is a recommended format and content for an ESS:  Title  Description of occurrence or discovery and any immediate compensatory actions taken (i.e., operational restrictions). Date PISA was discovered and ORPS report number.  Results of immediate safety assessment (including discussion of probability and consequence risk factors) and of USQD (positive/negative). Reference relevant documents.  Results of any subsequent safety analysis developed to further support conclusions as to safety of the facility with and/or without operational restrictions/compensatory measures.  Path forward. Discuss if additional work is to be performed to resolve the issue, and anticipated completion date. Additional appropriate content for an ESS in the case of a positive USQD could include:  Current operational status of the facility.  Clear identification of all operational restrictions needed to maintain the facility in a safe condition.  Analysis that addresses the safety impact of the PISA with the operational restrictions removed (or with the operational restrictions in place if their removal is not proposed).  Path forward for restoring the facility into compliance with the DSA (e.g., by revising the DSA or by correcting the discrepant condition).  Summary of recommendations and conclusions. The safety analysis should be bounding and the level of detail sufficient to provide confidence that the facility is being maintained in a safe condition. C.7 JUSTIFICATION FOR CONTINUED OPERATION (JCO) A JCO is a mechanism by which a contractor may request that DOE review and approve a temporary change to the facility safety basis that would allow the facility to continue operating in view of a specific and unexpected situation, considering the safety DOE G 424.1-1B Attachment C 4-8-2010 Page C-5 significance of the situation and any compensatory measures being applied during this period. A JCO is associated only with situations where the PISA USQD is positive. However, as discussed in Section C.6.1, it is also appropriate to update the ESS in lieu of developing a JCO.

If the PISA arises from the situation where analytical errors in the DSA are identified or the analysis is otherwise inappropriate, a proposed DSA change should be prepared and submitted to DOE. However, if the DSA change cannot be submitted in a timely manner (e.g., within a month) and a strong programmatic need exists to continue operations, a JCO that defines specific operational restrictions or other compensatory measures that will be maintained should be submitted to DOE for approval. A PISA could also arise from a discrepant as-found condition (e.g., installed equipment not meeting design specifications). In this case, the facility should be restored to meet the design conditions. However, there may arise situations where it may not be possible to align the facility configuration with the safety analysis in a timely manner (e.g., a month), and there may be a need to continue operations. In this situation, a JCO that defines specific operational restrictions or other compensatory measures that will be maintained should be submitted to DOE for approval. The JCO should analyze the hazards and identify controls, appropriate for the hazards associated with the PISA and the length of time the conditions which resulted in the PISA are expected to exist. This analysis should be consistent with the approach in 10 CFR 830 Subpart B, Appendix A, for developing a documented safety analysis. Given that a JCO is intended to address emergent conditions in a timely manner; the associated analysis and controls/compensatory measures can be more simplified and conservative/bounding than in a final DSA. By taking a more bounding approach, control effectiveness can be assured even though the analysis may not be as complete as would be in a final DSA. When DOE approves such a JCO, the JCO and any DOE imposed conditions of approval become temporary additions to the safety basis that would permit operations to continue under the conditions specified, including a defined termination point. DOE review of the JCO should follow a similar approach to approval review of the DSA and should be documented in a SER (e.g. using a graded approach consistent with DOE-STD-1104 (Review and Approval of Nuclear Facility Safety Basis and Safety Design Basis Documents). The approval authority for the DOE should be at the same level as the Safety Basis Approval Authority level for the facility. A JCO is expected to define an appropriate set of temporary hazard controls (that is, compensatory measures) to be in effect during the life of the JCO. In some cases, these hazard controls might involve temporary changes to the facility TSRs. If the JCO results in additional or modified controls, a review of the planned changes should be done prior to implementation to ensure the changes properly address the JCO. A JCO should have a predefined, limited life as necessary to perform the safety analysis of the unexpected situation, to identify and implement corrective actions, and to update the safety basis documents on a permanent basis. Attachment C DOE G 424.1-1B Page C-6 4-8-2010

The JCO should define the termination point of the life of the JCO. In most cases, this would take the form of a functional point, such as the completion of turnover of a physical modification for routine operations, which would occur after implementing the modification, post-modification testing, updating critical documentation, and training of the operations staff. The contractor should take actions to resolve the conditions that require the JCO or modify the safety basis during the next annual update to make the JCO no longer necessary. JCOs should not continue past a required annual DSA update unless the JCO was submitted within three months of the submittal date of the annual update. In some rare cases, it may not be practical to achieve this goal of being within three months of the submittal date of the annual update. It is recommended that those changes be handled as soon as practicable. If this cannot be accomplished, the contractor should formally notify DOE of the reasons. A JCO is not an appropriate means to request a change of the safety basis for a planned operation, a new experiment, a major modification, or new construction. In these cases, a request for a change to the facility safety basis should be prepared by the contractor and submitted to DOE for approval. Because the JCO is established in response to an unexpected condition, event, or new information, it is inappropriate to use it in planning new activities. A JCO should not be used in place of an exemption to 10 CFR 830 requirements. The JCO should be maintained as provided for in 10 CFR 830.202(c) for safety basis maintenance until the conditions that resulted in the PISA have been corrected and the JCO has been terminated. The following is a recommended format and content for the JCO.  Title  Executive Summary (Optional, depending on length of document)  Purpose of the Document (JCO): For example, to provide the rationale for the safety of operations while the PISA exists. May also include a brief discussion on how the JCO was developed in accordance with site processes for meeting 10 CFR 830 safety basis requirements.  Discussion of Background (What condition(s) led to need for JCO. Note: could cite the ESS which transmits the JCO, or precedes it, as this material is in the ESS). Include a discussion on the PISA, facility status, and the steps taken (including any operational restrictions put in place) to ensure the facility was in a safe condition. Also, discuss results of the USQ determination.  Description of what operations are authorized to occur during the time the PISA exists (given the compensatory measures are in place) along with rationale for why the operations need to continue. DOE G 424.1-1B Attachment C 4-8-2010 Page C-7  Compensatory Measures (Risk-reduction activities being applied immediately). Provide a detailed discussion of any established controls or existing or planned compensatory measures. Include a discussion of how the measures will be implemented.  Safety Assessment. Briefly discuss the results of the USQ determination and the impact on mitigated consequence and event frequency with any compensatory measures in place, and whether these risk factors are time dependent. This may be a qualitative assessment of the relative risk of operating the facility with the PISA and any compensatory measures in place as compared to operating the facility as analyzed in the DSA.

 Planned Corrective Actions (Actions that will be developed as the permanent solution). Include a discussion of actions to take place to resolve the PISA and to ensure that the facility can be safety operated in accordance with the approved safety basis. The JCO should include a summary of recommendations and conclusions, including the specific proposed path or action to terminate the JCO (e.g., DSA change, restoring the facility configuration to the analysis).  Termination of JCO (Those events/date that will define termination of JCO). Discuss the expected date or events (e.g., correction of deficiency) at which time the JCO will be terminated and the actions/approvals that will be necessary to terminate the JCO. C.8 Situations Involving Multiple PISAs A special case regarding PISAs exists when dealing with external audit team multiple concerns, each of which may (or may not) indicate the possibility of a potential inadequacy in the safety analyses. It may be impractical for facility staff to assess the situation quickly and disposition multiple concerns in the time frame normally expected for deciding whether a concern indicates a PISA (hours to days) and performing a USQD for each finding that qualifies as a PISA. In the face of multiple issues, it might be concluded that the short-term response to assuring a safe condition is to shut down operations. This might not be appropriate in all cases. As an option in these cases, except where it is apparent that an imminent hazard exists, DOE should be consulted without delay, and a mutually agreed upon approach to handling the concerns, including an expeditious schedule, should be developed. This approach should have a high priority for addressing the concerns, should prioritize the safety related concerns, and should disposition each as described for individual PISAs. Where it is apparent that an imminent hazard exists, the four steps for a potential inadequacy should be undertaken without delay. A similar situation exists for design basis reconstitution projects where documentation on the original design bases may be lost or outdated. In this case, it can be expected that a team of engineers may identify many questions or issues that may not have current documentation and which may or may not constitute PISAs. For the purposes of the USQ Attachment C DOE G 424.1-1B Page C-8 4-8-2010 process, design reconstitution projects can be regarded as DSA upgrades. For DSA upgrades, USQs should not result from the use of new analytical tools or in response to new requirements. A reconstitution project should have a process for prompt sorting and prioritizing of questions and issues between those that should be addressed as a normal part of the reconstitution project and those that should be handled promptly as PISAs. This process should be sufficiently timely to ensure that the expectations for PISAs can be met. DOE G 424.1-1B Attachment C 4-8-2010 Page C-9 Perform a USQ Determination Exit PISA process Place or maintain the facility in a safe c ondition ( C.3)* Usually involves conservative Op Restrictions Op Restriction may be a TSR safe mode May include an Operability Determination Notify DOE of the situation(C.4) Notification may be by ORPS Notification Report (timeliness specified by ORPS) Notification includes initial Operational Restriction No DOE approval required, but DOE can direct other Restrictions Notify DOE promptly of USQD results (C.5) Notification may be by update of ORPS with

USQD results No DOE approval required, but DOE can direct other Restrictions Submit ESS (C.6) A qualitative safety analysis of PISA No DOE approval required *The reference provided here (e.g., C.3) refers to the Section of this Guide that discusses this Step Yes No PISA? Positive USQD? A PISA is determined Problem identified Continue on Page 2 Notify DOE by updating the ORPS with USQD results or by submitting a letter to DOE Yes No Immediate No time requirement May include additional Op Restrictions and updated Operability Determination Submitted prior to removal of Operational Restrictions 830.203(g) Requirements (1) Place or maintain the facility in a safe condition (2) Notify DOE of the situation (3) Perform a USQD and notify DOE promptly of the results (4) Submit the evaluation of the safety of the situation ( ESS) to DOE Hours to DaysHours to Days FIGURE 1: TIME LINE AND PROCESS FOR PISAs Attachment C DOE G 424.1-1B Page C-10 4-8-2010 As specified by the JCO in the longer resolution path Submit JCO (C.7) or updated ESS Submit ESS (for longer resolution path) (C.6) Submit Revision to Safety Basis DOE approval before removal of Op Restrictions. SER if DSA revision A temporary DSA addition with justification of temporary controls Justification of adequacy of initial restrictions or proposed changes toRestrictions DOE approval required before removal of Op Restrictions Final Evaluation of the problem. Resolution specifics of how fac. has been/will be within the DSA May be addressed in or simultaneous with ESS DOE approval required Incorporated into the next annual update as needed Near Term (within a month) FIGURE 1: TIME LINE AND PROCESS FOR PISAs Can PISA USQ be promptly resolved (<1 month) or is facility. in TSR safe mode? Submit ESS Continued from Page 1 Yes No