DOE O 5480.21, Unreviewed Safety Questions

12-24-91 UNREVIEWED SAFETY QUESTIONS 1. PURPOSE. To set forth the definition and basis for determining the existence of an Unreviewed Safety Question (USQ). 2. CANCELLATION. DOE 5480.5, SAFETY OF NUCLEAR FACILITIES, of 9-23-86, paragraphs 5s and DOE 5480.6, SAFETY OF DOE-OWNED NUCLEAR REACTORS, of 9-23-86, paragraphs 5x and DOE 5480.1B, ENVIRONMENT, SAFETY, AND HEALTH PROGRAM FOR DEPARTMENT OF ENERGY OPERATIONS, of 9-23-86, paragraph 5o. 3. SCOPE. The provisions of this Order apply to all Departmental Elements and to covered contractors to the extent implemented under a contract or other agreement. A covered contractor is a seller of supplies or services, involving a DOE-owned or -leased nuclear facility, under a contract or subcontract containing one of four contract clauses as follows: (1) Safety and Health (Government-owned or -leased facility) [DEAR 970.5204-2], (2) Nuclear Facility Safety [DEAR 970.5204-26], (3) Radiation Protection and Nuclear Criticality [DEAR 952.223-72], or (4) another clause whereby DOE elects to require compliance with DOE nuclear safety requirements. The provisions of this Order will be applied to DOE-owned nuclear facilities and operations exempt from Nuclear Regulatory Commission (NRC) licensing. This Order does not apply to those facilities and activities conducted under Executive Order 12344 and Public Law 98-525, paragraph 1634, 98 stat 2649 (paragraph 9f). 4. EXCLUSIONS. a. This Order does not apply to the Naval Nuclear Propulsion Program (paragraph 9f). b. This Order does not apply to sites that consist entirely of space controlled and maintained by the General Services Administration (GSA) or property leased by DOE or DOE contractor(s) for which maintenance is contractually the responsibility of the lessor. c. This Order does not apply to activities with nuclear explosives, nuclear explosives components, or nuclear explosive-like assemblies which are covered under DOE 5610.1, PACKAGING AND TRANSPORTING OF NUCLEAR EXPLOSIVES, NUCLEAR COMPONENTS, AND SPECIAL ASSEMBLIES, of 911-79, or DOE 5610.3, PROGRAM TO PREVENT ACCIDENTAL OR UNAUTHORIZED NUCLEAR EXPLOSIVE DETONATIONS, of 12-18-80. All Departmental Elements Office of Nuclear Energy 2 DOE 5480.21 12-24-91 d. In accordance with Section 302 of the Department of Energy Organization Act (PL 95-91), the Secretary operates and maintains the Power Marketing Administration (PMA) electric power transmission systems by and through the PMA Administrators. The PMA has management programs in place that are geared to the special needs of utility operations, that respond to coordinated multi-utility system requirements, and that conform with prudent utility practice. In view of the unique nature of the Administrators’ obligations to meet their statutory and public utility responsibilities for the safety, security, and reliability of electric power transmission and of their legal and contractual obligation, the Administrators shall determine the appropriate Unreviewed Safety Question procedures for their facilities, which will include consideration of appropriate parts of the criteria set forth by this Order. 5. REFERENCES. a. DOE 5480.5, establishes b. DOE 5480.6, c. d. e. f. SAFETY OF NUCLEAR FACILITIES, of 9-23-86, which DOE’s nonreactor nuclear facilities safety programs. SAFETY OF DEPARTMENT OF ENERGY-OWNED NUCLEAR REACTORS, of 9-23-86, which establishes DOE’S nuclear reactor safety program.

DOE 5480.1B, ENVIRONMENT, SAFETY, AND HEALTH PROGRAM FOR DEPARTMENT OF ENERGY OPERATIONS, of 9-23-86, which establishes the Environment, Safety, and Health program for DOE operations. Title 10 CFR 50.59, which establishes the basis for Unreviewed Safety Questions within the commercial nuclear industry. Title 10 CFR 50.71(e), which establishes requirements for Safety Analysis Report Updates within the commercial nuclear industry. NSAC-125, Guidelines for 10 CFR 50.59 Safety Evaluations, of June 1989, which establishes guidance for the implementation of Title 10 CFR 50.59. Regulatory Guide 1.70, Revision 3, which establishes the standard format and content for Safety Analysis Reports (SARs) for power reactors within the commercial nuclear industry. 6. DEFINITIONS. a. Accident Analyses. For the purposes of properly implementing the USQ Order, the term accident analyses refers to those bounding analyses selected for inclusion in the SAR. These analyses refer to design basis accidents only. b. Authorization Basis. Those aspects of the facility design basis and operational requirements relied upon by DOE to authorize operation. These aspects are considered to be important to the safety of facility DOE 5480.21 3 12-24-91 operations. The authorization basis is described in documents such as the facility Safety Analysis Report and other safety analyses; Hazard Classification Documents, the Technical Safety Requirements, DOE- issued safety evaluation reports, and facility-specific commitments made in order to comply with DOE Orders or policies. c. d. e. f. g. h. i. Design Basis. The set of requirements that bound the design of systems, structures, and components within the facility. These design requirements include consideration of safety, plant availability, efficiency, reliability, and maintainability. Some aspects of the design basis are important to safety, although others are not. Design Basis Accidents. Those accidents that are considered credible enough to be postulated for the purpose of establishing design and performance requirements for systems, structures, and components important to safety. Contractor. Any person under contract with the Department of Energy with responsibility to perform activities in connection with a nuclear facility. Important to Safety. For the purposes of this Order, equipment important to safety is intended to include any equipment whose function can impact safety either directly or indirectly. This includes safety-related equipment, equipment relied upon for safe shutdown, and in some instances, balance-of-plant equipment. Line Organization. See DOE 5480.1B, ENVIRONMENT, SAFETY, AND HEALTH PROGRAM FOR DEPARTMENT OF ENERGY OPERATIONS. Margin of Safety. That margin built into the safety analyses of the facility as set forth in the authorization basis acceptance limits. Nonreactor Nuclear Facility. Those activities or operations that involve radioactive and/or fissionable materials in such form and quantity that a nuclear hazard potentially exists to the employees or the general public. Included are activities or operations that: (1) produce, process, or store radioactive liquid or solid waste, fissionable materials, or tritium; (2) conduct separations operations; (3) conduct irradiated materials inspection, fuel fabrication, decontamination, or recovery operations; (4) conduct fuel enrichment operations; or (5) perform environmental remediation or waste management activities involving radioactive materials. Incidental use and generation of radioactive materials in a facility operation (e.g., check and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and X-ray machines) would not ordinarily require the facility to be included in this definition. Accelerators and reactors and their operations are not included. The application of any rule/Order to a nonreactor nuclear facility shall be applied using a graded approach.

4 5480.21 12-24-91 j. k. l. m. n. o. p. q. Nuclear Facility. All reactor and nonreactor nuclear facilities. Program Manager. See DOE 5000.3A, OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS INFORMATION, of 5-30-90. Program Secretarial Officer (PSO). A senior outlay program manager, including the Assistant Secretaries for Conservation and Renewable Energy (CE), Defense Programs (DP), Fossil Energy (FE), Nuclear Energy (NE), and Environmental Restoration and Waste Management and the Directors of Energy Research (ER), Civilian Radioactive Waste Management (RW), and New Production Reactors (NP). Reactor means, unless it is modified by words such as containment, vessel, or core, the entire nuclear reactor facility, including the housing, equipment, and associated areas devoted to the operation and maintenance of one or more reactor cores. Any apparatus that is designed or used to sustain nuclear chain reactions in a controlled manner, including critical and pulsed assemblies and research, test, and power reactors, is defined as a reactor. All assemblies designed to perform subcritical experiments that could potentially reach criticality are also to be considered reactors. Critical assemblies are special nuclear devices designed and used to sustain nuclear reactions. Critical assemblies may be subject to frequent core and lattice configuration change and may be used frequently as mockups of reactor configurations. Safety Analysis. See DOE 5480.5, SAFETY OF NUCLEAR FACILITIES. Safety Analysis Report (SAR). See DOE 5480.6, SAFETY OF DEPARTMENT OF ENERGY-OWNED NUCLEAR REACTORS. Safety Evaluation. A safety evaluation is that record required by this Order to document the review of a “change.” This document records the scope of the evaluation and the logic for determining whether or not an Unreviewed Safety Question exists. Technical Safety Requirements (TSR). Those requirements that define the bounding conditions for safe operation, and bases thereof, and the management or administrative controls required to ensure the safe operation of a nuclear facility. (Formerly known as Operational Safety Requirements for nonreactor nuclear facilities and Technical Specifications for nuclear reactor facilities.) 7. BACKGROUND. a. The concept of the Unreviewed Safety Question was established to allow contractors to make physical and procedural changes and to conduct test and experiments without prior DOE approval, as long as these changes do not explicitly or implicitly affect the authorization basis of the facility or result in a Technical Safety Requirement change. The intent of this Order is to provide contractors with the DOE 5480.21 12-24-91 5 flexibility needed to conduct day-to-day operations and to require that those issues with a potential impact on the authorization basis, and therefore the safety of the facility, be brought to the attention of DOE--thus maintaining the proper safety focus. The authorization basis is described in documents such as the facility Safety Analysis Report, other safety analyses, Hazard Classification Documents, the Technical Safety Requirements, D0E-issued safety evaluation reports, and facility-specific commitments made in compliance with DOE Orders or policies.

b. This Order has been developed according to some of the same principles present in the commercial industry and enumerated in 10 CFR 50.59. The purpose of this Order is similar to that of 10 CFR 50.59. DOE has not simply copied what is contained in 10 CFR 50.59 and its guidance document, NSAC-125, “Guidelines for 10 CFR 50.59 Safety Evaluations,” but has adapted this Order to DOE facilities and to previous DOE operational experiences. One significant addition to this Order is its application in instances where a potential inadequacy of the currently accepted analysis, as documented in a facility’s Safety Analysis Report, or a possible reduction in the margin of safety, as defined by the Technical Safety Requirements, is discovered. When a potential inadequacy of any part of the authorization basis is discovered, the impact of this inadequacy may pose serious implications. For this case, it may be necessary to perform a safety analysis to determine conclusively whether a safety problem exists; however, DOE requires that a USQ determination be completed immediately, thus providing a benchmark of the relative safety significance, and that the facility be put in a safe condition. In these instances, the contractor is responsible for making an initial assessment of the potential impact of the analytic inadequacy and for determining what operational restrictions, if any, may be warranted. c. Requirements, beyond those employed in the design of a nuclear component or nuclear facility, have been established by DOE to protect the public health and safety from the risks of hazardous and radioactive materials. These requirements affect the design, operation, and maintenance of any DOE nuclear facility. These safety requirements, and how they are met, are reflected in the authorization basis. In order to perform an evaluation of a USQ, an understanding of the authorization basis of the facility, and of the specific requirements of the DOE Orders and policies, is necessary. d. The USQ review process should be integrated into all technical aspects of the contractor organization responsible for design, engineering, maintenance, inspection, operations, and assessment of the nuclear facility or activity. As such, all individuals involved in these aspects of the organization should be familiar with the requirements of this Order and should be able to identify potential USQs during the course of carrying out their normal responsibilities. 8. POLICY. It is the Department’s policy that: 6 5480.21 12-24-91 a. Each facility develop procedures to implement the Unreviewed Safety Question review process consistent with the provisions described in this Order. b. Any changes made to a facility that directly or indirectly affect the facility authorization basis, and therefore its safety, be reviewed in accordance with the provisions of this Order. c. Primary responsibility, authority, and accountability for the direction and management of the USQ process reside with the line management of the facility organization responsible for the design and safety analyses. 9. RESPONSIBILITIES AND AUTHORITIES. a. Program Secretarial Officers (PSO), shall perform the following functions for all nuclear facilities under their program responsibility: (1) (2) (3) (4) (5) (6) (7) (8) Ensure the preparation, review, and approval of contractor documentation implementing the requirements of this Order;

Actively monitor the USQ identification, review, and decisionmaking process of DOE Field Offices and contractors under their cognizance to determine whether an incident, analysis, or a proposed change/modification to systems, components, processes, operations, tests, or experiments involves a USQ; Provide direction to field organizations for implementation of the requirements of this Order; Declare the existence of a USQ, when discovered, and direct the Field Office Manager to curtail or suspend operations, tests, experiments, or actions to implement the proposed changes/modifications pending resolution of the USQ concerns, or take other actions as appropriate to reduce the risk; Assist the contractor or Field Office Manager, when requested, in determining whether an incident, analysis, or proposed change/modification to systems, components, processes, operations, tests, or experiments involves a USQ; Approve changes determined to involve a USQ prior to implementation, and approve operations when a USQ has been determined to exist; Ensure that Program Managers oversee the implementation of changes within the purview of this Order; and Establish the authorization level for each facility under their program responsibility. DOE 5480.21 7 12-24-91 (9) Designate an individual(s) to be responsible for bringing to the attention of the contracting officer each procurement falling within the scope of this Order. Unless another individual is designated, the responsibility is that of the procurement request originator (the individual responsible for initiating a requirement on DOE F 4200.33, “Procurement Request Authorization”). (a) (b) Procurement request originators (the individuals responsible for initiating a requirement on DOE F 4200.33) or such other individual(s) as designated by the cognizant PSO shall bring to the attention of the cognizant contracting officer the following: (1) each procurement requiring the application of this Order, (2) requirements for flowdown of provisions of this Order to any sub-contract or sub-award, and (3) identification of the paragraphs or other portions of this Directive with which the awardee, or, if different, a sub awardee, is to comply. Contracting officers, based on advice received from the procurement request originator or other designated individual, shall apply applicable provisions of this Order to awards falling within its scope. For awards, other than management and operating contracts, this shall be by incorporation or reference using explicit language in a contractual action, usually bilateral. All paragraphs of this Order shall be applied to contractors, excluding paragraph 9. b. Assistant Secretary for Nuclear Energy (NE-1) , in addition to the requirements of paragraph 9a shall perform the following functions: (1) Develop, promulgate, and maintain guidance documents necessary to implement relevant training, policies, and procedures; (2) Assist line management in developing, implementing, and evaluating criteria, standards, and requirements associated with changes to nuclear facilities; (3) Provide guidance and technical assistance to the cognizant PSO and the field organization; and (4) Monitor reports relative to changes at DOE nuclear facilities to assess implementation of these requirements and modify or provide additional guidance as necessary. c. Director, Office of Nuclear Safety (NS-1), acting as the independent element for nuclear safety oversight of line management performance for the Department, shall perform the following functions:

8 5480.21 12-24-91 (1) Assess the level of safety and degree of compliante by Departmental Elements with the DOE requirements of this Order; (2) Monitor and audit activities of the cognizant PSO and the affected field organization to assure the requirements of this Order are consistently applied; (3) Monitor the USQ identification, review, and decision-making process of the line organization to assure compliance with the requirements of this Order; (4) Review USQ governing and implementing procedures to assure their consistency in application of the requirements of this Order; and (5) Declare the existence of a USQ, that has not been identified, analyzed, or adequately resolved by the line organization and ensure that the USQ is adequately addressed by the line organization. d. Assistant Secretary for Environment, Safety, and Health (EH-1), acting as the independent element responsible for environment, occupational safety, and health oversight of line management for the Department, shall perform the following functions: (1) (2) (3) (4) (5) Assess the level of safety and degree of compliance by Departmental Elements with the DOE requirements of this Order; Monitor and audit activities of the cognizant PSO and the affected field organization to assure that the requirements of this Order are consistently applied; Monitor the USQ identification, review, and decision-making process of the line organization to assure compliance with the requirements of this Order; Review USQ governing and implementing procedures to assure their consistency in application of the requirements of this Order; and Declare the existence of a USQ, that has not been identified, analyzed, or adequately resolved by the line organization and ensure that the USQ is adequately addressed by the line organization. e. Heads of Field Organizations, for facilities and operations under their jurisdiction shall perform the following functions: (1) Ensure that adequate contractor procedures are in place and assess the effectiveness of their implementation, consistent with the provisions of this Order; DOE 5480.21 12-24-91 9 (2) Approve documentation prepared by the contractor demonstrating compliance with this Order; (3) Actively monitor the USQ identification, review, and decisionmaking process of contractors under their cognizance to determine whether an incident, analysis, or proposed change/modification to systems, components, processes, operations, tests, or experiments involves a USQ; and (4) Declare the existence of a USQ, when discovered, and direct the contractor to curtail or suspend operations, tests, experiments, or actions to implement the proposed changes/modifications pending resolution of the USQ concern, or take other actions as appropriate to reduce the risk. (5) Assure that DOE contractors to whom this Order is made applicable implement the requirements of paragraph 10 of this Order. (6) Designate an individual(s) to be responsible for bringing to the attention of the contracting officer each procurement falling within the scope of this Order. Unless another individual is designated, the responsibility is that of the procurement request originator (the individual responsible for initiating a requirement on DOE F 4200.33 “Procurement Request Authorization”).

(a) Procurement request originators (the individuals responsible for initiating a requirement on DOE F 4200.33) or such other individual(s) as designated by the cognizant heads of field organizations shall bring to the attention of the cognizant contracting officer the following: (1) each procurement requiring the application of this Order, (2) requirements for flowdown of provisions of this Order to any subcontract or sub-award, and (3) identification of the paragraphs or other portions of this Order with which the awardee, or, if different, a sub-awardee, is to comply. (b) Contracting officers, based on advice received from the procurement request originator or other designated individual, shall apply applicable provisions of this Order to awards falling within its scope. For awards, other than management and operating contracts, this shall be by incorporation or reference using explicit language in a contractual action, usually bilateral. All paragraphs of this Order shall be applied to contractors excluding paragraph 9. f. Director, Naval Nuclear Propulsion Program. Executive Order 12344, statutorily prescribed by PL 98-525 (42 USC 7158 note) establishes the 10 5480.21 12-24-91 responsibilities and authority of the Director, Naval Nuclear Propulsion Program (who is also the Deputy Assistant Secretary for Naval Reactors within the Department) over all facilities and activities which comprise the Program, a joint Navy-DOE organization. These executive and legislative actions establish the responsibilities of the Director as including the safety of reactors and associated naval nuclear propulsion plants, the control of radiation and radioactivity associated with naval nuclear propulsion plants, and the operating practices and procedures applicable to naval nuclear propulsion plants. Accordingly, the provisions of this Order do not apply to the Naval Nuclear Propulsion Program. The Director shall establish the unreviewed safety question determination requirements implemented within the program. 10. PROGRAM REQUIREMENTS. a. A contractor authorized to operate DOE nuclear facilities shall: (1) Perform all safety evaluations required by paragraph (b) of this section to determine whether a situation involves USQ; (2) Prior to implementation of a proposed action, obtain PSO approval for situations determined to involve a USQ or a Technical Safety Requirements (TSR) change; and (3) Develop and implement procedures to govern the need for, and the performance of, safety evaluations under this section. b. A safety evaluation shall be performed for: (1) Temporary or permanent changes in the facility as described in the existing safety analyses; (2) Temporary or permanent changes in the procedures as described in existing safety analyses; or (3) Test or experiments not described in existing safety analyses. c. A situation involves a USQ if: (1) The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the facility safety analyses could be increased; (2) The possibility for an accident or malfunction of a different type than any evaluated previously in the facility safety analyses could be created; or DOE 5480.21 11 12-24-91 (3) Any margin of safety, as defined in the bases of the TSRs, could be reduced. d. When a contractor identifies information that indicates a potential inadequacy of previous safety analyses or a possible reduction margin of safety as defined in the TSRs, the contractor shall:

(1) Notify the PSO of the situation upon discovery of the information; (2) Make an evaluation in accordance with paragraphs 10a and (3) Take action to place the facility in a safe condition until safety evaluation is completed; and in the 10c; the (4) Submit the completed safety evaluation prior to removing any operational restrictions initiated pursuant to paragraph 10d(2). e. For all safety evaluations required under this section, a contractor shall: (1) Document the basis for the USQ determination, utilizing the procedures provided for in paragraph l0a(3) of this section and the criteria of paragraph l0c; (2) Maintain documentation required by paragraph lOe(1) for the authorized operating period of the nuclear facility and ensure the complete transfer of all documentation to any subsequent contractor prior to termination of its contract; (3) Incorporate in the existing SAR, any changes that are needed as a result of the safety evaluation or any action taken; and 12 5480.21 12-24-91 (4) Submit to the PSO, on a schedule corresponding to the periodic updates of the SAR, a report summarizing all situations for which a safety evaluation was required by this section and indicating all “changes” considered in a safety evaluation and implemented 6 months or more before the submittal date of the report. BY ORDER OF THE SECRETARY OF ENERGY: JOHN J. NETTLES, JR. Director of Administration and Human Resource Management DOE 5480.21 12-24-91 i TABLE OF CONTENTS CHAPTER I: GENERAL INTRODUCTION I-1 1. Background . . . . . . . . . . . . . . . . . . . 2. Purpose. . . . . . . . . . . . . . . . . . . . . CHAPTER II: APPLICABILITY . . . . . . . . . . . . . 1. 2. 3. 4. 5. Background Changes in the Nuclear Facility as Described in Safety Analyses. . . . . . . . . . . . . . . . . Changes in the Procedures as Described in Safety Analyses Conduct of Tests of Experiments Not Described Safety Analyses . . . . . . . . . . . . Discovery of Analytic Errors, Omission, Inadequacies . . . . . . . . . . . . . CHAPTER III: IMPLEMENTATION GUIDANCE 1. 2. 3. 4. 5. 6. 7. 8. 9. Introduction . . . . . . . . . . . . . Governing Process . . . . . . . . . . . Understanding the Authorization Process Screening Criteria and Procedures . . . Implementing Procedures . . . . . . . . Safety Evaluations (USQ Determination) Periodic Reports . . . . . . . . . . . Training . . . . . . . . . . . . . . . Implementation Schedule . . . . . . . . CHAPTER IV: INTERPRETATIONS 1. Purpose. . . . . . . . . . . . . . . . 2. Unreviewed Safety Question . . . . . . or 3. Increase in the Probability of Occurrence Acciedent--Question (1) of 4. Increase in Probability of Occurrence of a Malfunction of Equipment Important to Safety--Question (3) . . . . . . . . . . 5. Increase in Consequences of Accidents or Malfunctions of Equipment Important to Safety--Questions (2) and (4) . . . . . in I-1 I-1 II-1 II-1 II-1 II-3 II-5 II-6 III-1 III-1 III-3 III-3 III-4 III-5 III-6 III-6 III-6 IV-1 IV-1 IV-2 IV-3 IV-4 6. Possible Malfunction or Accident of a Different ii DOE 5480.21 12-24-91 Type--Questions (5) and (6) . . . . . . . . . . . . . . . . . . IV-5 7. Margin of Safety as Defined in the Bases of any Technical Safety Requirement--Question (7) . . . . . . . . . . . . . . . . . IV-5 FIGURES FIGURE II-1 What Constitutes a Change? . . . . . . . . . . . . . II-4 FIGURE III-1 USQ Flow Process Input/Output . . . . . . . . . . . III-2

FIGURE IV-1 Example of Margin of Safety . . . . . . . . . . . . . IV-8 ATTACHMENTS Attachment IV-I. . . . . . . . . . . . . . . . . . . . . . . .Page IV-9 DOE 5480.21 12-24-91 1-1 (and I- CHAPTER I GENERAL INTRODUCTION 1. Background. The Unreviewed Safety Question Order has a primary role of preserving the DOE authorization basis for each nuclear facility while allowing for “operational” flexibility. The concept of the Unreviewed Safety Question was established to allow contractors to make physical and procedural changes and to conduct tests and experiments without prior DOE approval, as long as these changes do not explicitly or implicitly affect the authorization basis of the facility or result in a Technical Safety Requirement change. 2. Purpose. The purpose of the following Chapters and Attachment IV-I is to assist facilities in the proper implementation of the Order and to present a method by which contractors can achieve compliance. The guidelines presented in Chapters I-IV set forth minimum standards for contractor compliance. While it is expected that methods of compliance may vary, the level of compliance should not. Attachment I to this Order is not considered to be a requirement of this Order but has been provided as an example for the implementation of the Unreviewed Safety Question review process. DOE 5480.21 12-24-91 II-1 1. 2. CHAPTER II APPLICABILITY Background. a. This Order is applicable to all aspects of safety relied upon for facility authorization. This includes both hazardous material and radiological consequences at the applicable nuclear facilities. b. All changes to a nuclear facility require analysis, but those that may affect the authorization basis require completion of a safety evaluation in accordance with this Order. Despite this qualification, the applicability of this Order is broad. It covers most nuclear and nonnuclear equipment and supporting systems (e.g., a change to a cable tray that may affect the redundancy or separation of systems assumed redundant in the safety analyses falls under this Order). Nonsafety- related systems are not excluded from the scope of this Order if they could affect the proper operation of safety systems, structures, or components relied upon for facility authorization (e.g., losses of certain nonsafety-related systems may represent critical operational occurrences identified as initiators in the accident analysis). Therefore, changes to nonsafety-related systems must be evaluated and may be determined to involve a USQ. Physical interactions may also fall under the purview of this Order. For example, the installation of a nonseismically supported piece of equipment above a seismically qualified component designed to perform a safety function explicitly or implicitly assumed in the safety analyses may constitute a USQ. Changes invalidating the environmental qualification of components assumed to function in safety analyses may also be considered a USQ. That is, any change that has the potential to alter the ability of a structure, system, or component to meet its expected performance based on the accident analyses may involve a USQ. Changes include previously undiscovered conditions, operational incidents, or results of new analyses or reanalyses that deviate from those described in the safety analyses or that could reduce existing margins of safety. The following sections discuss the types of changes, tests, and experiments as well as discoveries and inadequacies that are within the purview of this Order.

Changes in the Nuclear Facility as Described in Safety Analyses. a. This Order only requires safety evaluations for changes to a nuclear facility that alter the design, function, or method of performing the function of a structure, system, or component (SSC) described in the safety analyses either by text, drawing, or other information relied upon as the authorization basis. The safety analyses include descriptions of many SSCs, but a nuclear facility also contains many II-2 DOE 5480.21 12-24-91 SSCs not explicitly described in the safety analyses. These can be components, subcomponents of larger components, or even entire systems. A common question is whether written safety evaluations should be performed only for changes to SSCs explicitly described in the safety analyses. The answer is “no” because changes to SSCs that are not explicitly described in the safety analyses can have the potential for altering the function of SSCs explicitly described in the safety analyses. An example would be the replacement of a relay in the overspeed trip circuit of an emergency diesel generator (EDG) with a nonequivalent relay. The relay is not described in the safety analyses, but the overspeed trip circuit and the EDG should be. The replacement of the relay might change the performance or design of the overspeed trip circuit as described in the safety analyses. If so, a safety evaluation would be required. In such cases, the recommended approach for deciding whether a modification involves a change to the nuclear facility as described in the safety analyses is to consider the larger SSCs of which the SSC being modified may be a part. If the SSC is part of a larger SSC described in the safety analyses, and if the change alters the design, function, or method of performing the function of the larger SSC as described in the safety analyses, then a safety evaluation is required. b. The necessity to distinguish between changes and routine maintenance activities is an important consideration. Routine maintenance activities do not require review under this Order, except for those activities that are not enveloped by current analyses or might violate a Technical Safety Requirement (TSR). Examples of routine maintenance activities include calibration, refurbishment, replacement with an equivalent component, and housekeeping. (An equivalent component may be identical, meet all design and seismic specifications and quality class, or have been demonstrated and documented to be equivalent. ) However, there are some plant activities that may not clearly be maintenance. Plant heat exchanger tube plugging where limits are not specified provides an example. It may be necessary to do a safety evaluation to assure that normal and accident heat removal capability is preserved and pumps continue to deliver adequate flow with some tubes plugged. Systems or components removed from service for maintenance should be covered by the TSRs for allowable outage times, permissible mode conditions, and permitted reduction in redundancy. A safety evaluation therefore need not be performed for these activities. However, for systems or components that are included in safety analyses for the nuclear facility, and for which allowed outage times are not included in the TSRs, a safety evaluation should be completed.

c. Understanding the term “change” as it applies to modes of operation or facility processes is also important. For example, when a facility is designed to accommodate several nuclear processes but must modify equipment line-up to accommodate another process, this change in the equipment line-up does not constitute a change under this Order if the DOE 5480.21 II-3 12-24-91 change is performed in accordance with approved procedures and was considered within the authorization basis of the facility. d. Temporary changes to the nuclear facility should be evaluated to determine whether an Unreviewed Safety Question exists. Examples of temporary modifications include jumpers and lifted leads, temporary lead shielding on pipes and equipment, temporary blocks and bypasses, temporary supports, and equipment used on a temporary basis. The fact that a change to nonsafety-related equipment not described in the safety analyses can indirectly affect whether equipment important to safety can perform its intended function makes evaluation of temporary modifications an important consideration. For example, if nonsafety- related equipment is mounted above a safety-related component in such a manner that it could fall and damage the safety-related component during an earthquake, the seismic evaluation of the safety-related component is changed. This would be a change to the nuclear facility as described in the safety analyses and would require a written safety evaluation. Seismic qualification, missile protection, flooding protection, fire protection, environmental qualification, high-energy line breaks, and masonry block walls are some of the areas where changes to nonsafety-related equipment can result in changes to safety-related equipment through indirect or secondary effects. The conservative approach is to provide a written safety evaluation for any change to the nuclear facility, whether discussed in safety analyses or not. However, it is possible that some changes can be justified as not requiring evaluations under this Order, provided screening criteria are developed that will ensure that there are no indirect or secondary effects of the change. In this case, the screening criteria are relied upon to ensure that the change does not introduce an Unreviewed Safety Question. e. The actual modification implementation process (e.g., work authorization system) used in the field should be reviewed for possible development of Unreviewed Safety Questions. Changing plant configurations while work is in progress may involve an Unreviewed Safety Question even though the modification, when completed, may not. f. To determine whether the proposed change alters the design, function, or method of performing the function of the SSC, an engineering evaluation and a thorough understanding of the design basis of the system involved are essential. Examples of questions that could be considered are shown in Figure II-l. g. For any nuclear facility in which the design basis had to be changed to make it agree with the as-built condition, the change could constitute a change to the facility as described in the safety analyses and may therefore require a safety evaluation, even though no physical change took place in the facility. II-4 DOE 5480.21 Changes (a) Does the change add, delete, or convert an automatic or manual feature of the SSC? (b) Does the change introduce new system interactions? (c) Does the change alter the seismic qualification, environmental qualification, or quality group classification of SSC?

(d) Does the change replace a component with equipment equivalent to that of the old component? For example, are the instrument response times, ranges, and design pressures and temperatures equivalent to those of the old instrument? Are the pump flow/head characteristics, design temperature and pressure, motor size, and controls equivalent to those of the old pump? Are the valve operating times, failure positions, sizes, design temperatures and pressures, valve operators, and controls equivalent to those of the old valves? Are the piping materials, design temperatures and pressures, supports, insulation, and routing equivalent to those of the old piping? Are the fuel fission product barriers and operating characteristics enveloped by previous analyses? Will the new electrical loads effect the diesel generator loading sequence or the design capability? 12-24-91 Procedures (1) If, in the description of waste system in the safety analysis, the contractor states that the Shift Supervisor will authorize all liquid releases, a safety evaluation to meet the requirements of 5480.USQ would be required before assigning this function to another individual. However, if the safety analysis states that liquid releases will be authorized as detailed by plant procedures, redesignation of the authorization function would not require a safety evaluation. (2) If the nuclear facility startup procedure, as described in the safety analysis, contains eight fundamental sequences, a decision to eliminate one of the sequences would require a safety evaluation. However, consolidation of the eight fundamental sequences, which did not alter the basic functions performed, would not require a safety evaluation. Figure II-1 What Constitutes a Change? DOE 5480.21 12-24-91 II-5 3. Changes in the Procedures as Described in Safety Analyses. a. b. c. There are three types of procedure changes to be considered. First, if a procedure is not contained or described in the safety analyses, it would not require a USQ evaluation to be performed before a change an be implemented. Second, changes to procedures simply listed, and not outlined, summarized, or described in the safety analyses, do not require evaluation in accordance with this Order. Finally, changes to procedures that are outlined, summarized, or described must be evaluated in accordance with this Order if the outline, summary, or description in the safety analyses are impacted. Procedures are not limited to those items specifically identified as procedure types (e.g., operating, chemistry, system, test, surveillance, and emergency plan) but could include anything described in the safety analyses that defines or describes activities or controls over the conduct of work. If changes to these activities or controls are made, such changes qualify as changes to procedures as described in the safety analyses, and the changes must be evaluated. In instances when procedural modifications are implementing operational changes, such as setpoint changes, while the procedure itself may not meet the requirement for evaluation, in accordance with this Order, the operational change should be evaluated to assure it does not impact-authorization basis limits or supporting safety analyses. Contrasting examples of safety analyses procedures, as described above, are shown in Figure II-1.

4. Conduct of Tests or Experiments Not Described in Safety Analyses. Written safety evaluations are required for tests or experiments not described in safety analyses or other approved documentation that provide the authorization basis of the nuclear facility. The intent of the criterion of this Order is to require safety evaluations of tests and experiments that are not described in the safety analyses that might affect safe operations. By definition, these are tests and experiments that could degrade the margins of safety during normal operations or anticipated transients or degrade the adequacy of structures, systems, or components to prevent accidents or mitigate accident conditions. Thus, previously evaluated tests do not require written safety evaluations under this Order. For example, for preoperational tests, surveillance tests, functional tests, and startup tests that are performed regularly, safety evaluations are not required every time a test is performed. However, one-of-a-kind tests used to measure the effectiveness of new techniques or a new system configuration that might affect systems important to safety will require evaluation before they can be conducted. Post-modification testing should be considered and included in the safety evaluation for the modification. II-6 DOE 5480.21 12-24-91 5. Discovery of Analytic Errors, Omission, or Inadequacies. a. Written safety evaluations are required for instances where discovery of an analytic error, omission, or inadequacy present the potential for an Unreviewed Safety Question. These analytic errors, omissions, or inadequacies must have the potential for impacting the authorization basis, thereby calling into question information explicitly or implicitly relied upon in the facility safety analyses or by reducing the margins of safety as defined in the Technical Safety Requirements. The intent here is to assure that the operations are conducted in a safe manner that is consistent with the authorization basis. b. Because an analytical error, omission, or inadequacy as specified above has the potential for calling into question information relied upon for authorization of operations, DOE requires the following: (1) the contractor shall immediately notify the PSO; (2) shall take steps assuring that operation is conducted in a mode or manner within the authorization basis, despite the analytic discrepancy; and (3) the contractor shall complete a safety evaluation and submit it to the PSO prior to removing any operational restrictions implemented to compensate for the analytical discrepancy. c. Implementation of this Order in these instances will provide a measure of the safety significance of discovered analytic discrepancies. If a USQ is determined to be present, this safety evaluation will require not only DOE review but DOE approval, prior to removing any operational restrictions. DOE 5480.21 12-24-91 III-1 CHAPTER III 1. Introduction. IMPLEMENTATION GUIDANCE a. Since it has been established that this order is intended to allow for facility changes as long as these changes do not impact the authorization basis of the facility, two basic elements must be defined in order to properly implement a USQ program.

b. First, each facility must identify the methods by which facility changes can be made (i.e., are changes made under a modification process, nonconformance processes, maintenance processes, etc.). After these methods have been identified, each facility must determine what constitutes an acceptable means to make a change. That is, the contractor must clearly control the facility change process and must perform and document changes in accordance with approved procedures. Performing a modification under the guise of maintenance is not acceptable because the proper control processes to analyze the proposed change and document its outcome would probably be absent. Identification of all means for performing a change is necessary because each one provides a direct input into the USQ process and must be integrated accordingly. c. Second, in order to determine what constitutes a USQ, an understanding of what constitutes the facility’s authorization basis must be defined; it is this basis that ultimately provides the acceptable bounds of operation without requiring prior DOE approval. 2. Governing Process. Once the contractor organization has determined the various sources of a change, it must then determine the process by which these sources of changes should be integrated into the USQ review process. This process should ensure that the need for completion of a safety evaluation is not overlooked and that this process is integrated into existing procedures or that new procedures are developed, as necessary. Figure III-l illustrates a method for integrating the requirements of this Order within a hypothetical change process. It is recommended that each facility develop its own change flow process and that this process and its integration be controlled by a USQ governing procedure. This procedure is termed a governing procedure because its purpose is to define clear relationships with the requirements of this Order and other change procedures, including design procedures and configuration control programs. Its purpose is to govern the USQ process and not to implement the specifics of the Order itself. III-2 DOE 5480.21 12-24-91 Figure III-1 USQ Flow Process Input/Output DOE 5480.21 III-3 12-24-91 3. 4. Understanding the Authorization Basis. Although the term authorization basis has been defined, it is important to understand how this concept relates to the language and terms used in the Order. a. The Order consistently refers to the safety analyses. These safety analyses are intended to define those aspects of design and operations that are important to safety and therefore those aspects that DOE relies upon to allow initial and continued operations. Although ideally all changes made to a facility would be analyzed, documented, and incorporated into the Safety Analysis Report, thus providing a complete authorization basis, such thoroughness has rarely occurred in the past. In addition, often times when facility operations require the completion of different processes (campaigns) the safety analysis supporting individual processes may or may not be incorporated into the Safety Analysis Report.

b. When DOE facilities were first authorized to operate, it was not anticipated that the need for facility modifications would be implemented with the frequency that has proven to be necessary. As a result, the need for elaborate configuration and modification controls were not clearly understood. Because of this, many changes have taken place at facilities and the supporting documents and analyses have not always been integrated into a single facility SAR. Hence, the authorization basis of the facility may not be reflected in total in the current facility SAR. For this reason, the language in this Order referring to safety analyses is intended to mean the facility authorization basis. This basis, depending upon the facility, may reside in several different types of documents. These may include not only the facility SAR, but historical commitments made by contractors to support modifications and the imposition of new DOE requirements or administrative changes. These may also include DOE safety evaluation reports that modify contractor-proposed changes or analyses. The intent of this Order is to preserve the authorization basis, and, if this basis is not reflected in total in the SAR, the contractor must define that population of documents comprising the various elements of the authorization basis and must use this defined population of documents as the basis for performing safety evaluations under the requirements of this Order. c. It is expected that, as an initial step toward developing a USQ process, each contractor will define for their facility those aspects and documents that constitute the authorization basis and identify these documents within the facility USQ procedures. Screening Criteria and Procedures. a. DOE finds that it is acceptable to use screening criteria to limit the number of proposed actions for which written safety evaluations must be performed, provided the reasons for exclusion are documented and well supported. In fact, DOE encourages the use of screening criteria III-4 DOE 5480.21 12-24-91 because, when properly defined and implemented, the screening criteria should. assist in reducing the efforts expended for issues of minor significance and should focus efforts more fully on the aspects of safety for which this requirement is intended. b. Screening criteria are intended to be applied to those items that, by broad definition, enter into the USQ process but for which a detailed safety evaluation is not necessary. For example, an operational procedure which is described in the SAR may require a change to correct a typographical error or include an additional reference to an equipment list. This change, although by definition within the bounds of this Order, is not of any safety significance. If the contractor applied a screening procedure that asks: “Is the change inconsequential”? (i.e., a spelling or typographical correction, grammatical change, clarification, or additional note or reference), the reviewer could document the change and thus avoid the need to answer the detailed questions of the safety evaluation process.

c. A different manner in which screening criteria may be applied is through categorical exclusions (e.g., different procedure, types). For the purpose of illustration, maintenance procedures may be considered. If it is true that no modifications or changes are performed under maintenance procedures, then a basic premise of performing maintenance is that the plant will be returned to the exact same “condition” it was in prior to maintenance. That is, the functional condition will continue to meet or exceed those performance capabilities set forth in the authorization basis. A change to a maintenance procedure would therefore not be governed under this Order. Other requirements, such as the DOE 4330.4A, may draw some bounds upon the subject and content of these procedures, but this Order need not be considered. However, it should be understood that, by applying screening criteria in this manner, DOE would expect to find a detailed evaluation of why, for example, a one-time categorical exclusion of maintenance procedures from the USQ process is acceptable. d. For physical modifications to the facility, DOE does not believe that screening criteria would be appropriate. The application of screening criteria for administrative changes may prove useful, but contractors must ensure that the use of these criteria do not inappropriately screen out changes that require safety evaluations. 5. Implementing Procedures. a. Contractors are required to develop procedures that provide detailed guidance for the performance and review of USQ determinations. At a minimum, the procedures shall define the purpose of the procedure; set forth the procedure’s applicability; provide definitions of appropriate terms, including those set forth in this Order; include screening criteria, as appropriate, and the basis for their application; include detailed guidance on what must be considered and DOE 5480.21 III-5 12-24-91 evaluated when performing or reviewing a safety evaluation; define the qualifications needed and responsibilities of personnel performing and reviewing safety evaluations; and include documentation requirements for each USQ determination. b. The purpose of the procedure should reflect the purpose of the Order and its implementation as defined herein. The applicability of the procedure should set forth the facility(s) to which it applies and the types of change processes to which it applies (e.g., use-as-is nonconformances, corrective actions for violations, procedural changes, and facility changes). If desired, the contractor may elect to develop separate implementing procedures for procedural changes versus facility and administrative changes. If this option is selected, each procedure should provide enough guidance to permit its independent use. c. Contractors are expected to provide detailed guidance and instructions on how to perform a safety evaluation. This guidance should include, at a minimum, the information provided in Chapter IV of this guidance document, refined to include the specifics of the applicable facility. Instructions and a worksheet similar to that provided in Attachment I to this Order are recommended. Again, this information should be adapted to each facility’s specific circumstances and needs. d. The implementing procedures should address the personnel qualifications needed in order to perform or review a safety evaluation. This includes required educational background, years and/or types of work experience, knowledge of the facility, understanding of DOE requirements, and familiarity with the facility authorization basis. Specific responsibilities of those performing or reviewing safety evaluations should be clearly defined.

e. Documentation requirements should also be discussed in the USQ implementing procedures. They should identify the level of detail necessary to document performance of the safety evaluation and conclusions reached; a list of references relied upon to reach this conclusion as well as guidance for the retention of records should also be included. Other items cited for inclusion in the implementing procedures are self-explanatory. 6. Safety Evaluations (USQ Determination). Specific guidance on how to conduct a safety evaluation is contained in Attachment I to this Order. The concepts used to develop this process are contained throughout this document. The intent of this section is not to reiterate these points but to explain more clearly the scope of a safety evaluation and thereby clarify its practical uses. a. A safety evaluation, unlike a safety analysis, is somewhat limited in scope. When reading this Order, it should be noted that the definitions of a USQ are based on consequences and probabilities of III-6 DOE 5480.21 12-24-91 7. 8. accidents. These accidents, their assumed initiators, and their consequences focus on the performance capabilities of systems, structure, and components under presumed conditions. These performance capabilities are related to facility operations and design inasmuch as the design and/or specific operations are relied upon to meet performance requirements set forth in the authorization basis of the systems, structures, and components in question. When reviewing or evaluating a change in this manner, those aspects of design that support the particular performance of systems, structures, and components relevant to the change will be reviewed, although others may not be. b. A contractor may decide to replace an existing gate valve with another valve type. Under this Order, he/she will evaluate this change to assure that the new valve meets or exceeds its intended performance requirements as set forth in the authorization basis. This evaluation may discuss such issues as closure times, valve leakage, and suitability of the new valve materials for its particular environment. This evaluation may conclude that a USQ will not be created. It may also be true that this new valve contains materials that-have different corrosive properties than the previous valve, which in turn requires different maintenance practices. If properly maintained, this aspect of the design of the new valve may in no way inhibit performance and would therefore be unlikely to be considered in the safety evaluation. This aspect of the new valves design should not and will not be overlooked if a proper safety analysis is conducted. When making a change, the safety analysis process requires that all aspects of both design and performance be considered. c. A safety evaluation is not a substitute for a safety analysis; it merely serves as a benchmark for whether the authorization basis is being preserved. Contrary to the above-cited example, a safety analysis may show that a proposed change is safe, yet the safety evaluation may determine that this change is an Unreviewed Safety Question and hence requires DOE approval prior to implementation. Contractor procedures should clearly establish the differences between the concepts supporting a safety analysis and those used for a safety evaluation. The procedures governing the safety analysis process and the safety evaluation process, although similar in many respects, should be treated separately.

Periodic Reports. At a minimum, all contractors should submit to DOE a report summarizing all “changes” made under this Order. This requirement is noted in paragraph 10. Training. All personnel responsible for performing, reviewing, or approving USQ determinations should receive initial training on the application of the Order and of facility-specific procedures. R e t r a i n i n g is recommended on an interval of every 2 years or as may be proposed by the contractor. DOE 5480.21 III-7 (and III- 12-24-91 9. Implementation Schedule. Because the concepts set forth in this Order are not new to DOE and its contractors, but merely clarify and consolidate requirements previously implemented within the DOE Order system, compliance with this Order is expected immediately upon its promulgation. However, since DOE understands that the manner and rigor with which this Order is implemented departs somewhat from previous interpretations of these requirements, implementation of a program in the manner described herein shall be established based on the schedule set forth below. a. b. c. Development of USQ Governing Procedures. The manner in which changes are made at a facility and the formal integration and documentation of these change processes with the requirements of this Order should be completed within 9 months of the promulgation of this Order. Development of Facility-Specific Safety Evaluation Procedures. These procedures shall be completed within 9 months of the promulgation of this Order. Implementation of Initial Training. Initial training should be completed within 1 year of the promulgation of this Order. DOE 5480.21 12-24-91 IV-1 CHAPTER IV EXPLANATION OF TERMS 1. Purpose. This section further defines the terms used in this Order. a. At the design stage, protection of health and safety is ensured through the design of the engineered protection of physical barriers to guard against radioactive and hazardous material releases. These barriers are designed to fulfill their operational function reliably by meeting all applicable criteria and standards. The defense-in-depth philosophy includes reliable design, provisions to safely terminate accidents, and provisions to mitigate the consequences of accidents. The health and safety protection functions are considered in the authorization basis and in the physical design as documented in safety analyses. b. This protection philosophy pervades the accident analyses and DOE safety requirements. To understand and apply the defense-in-depth philosophy, it is necessary to understand this perspective of maintaining the integrity of the physical barriers designed to contain hazardous and radioactive materials. This reflects the fact that accidents and malfunctions are analyzed in terms of their effect on physical barriers and that “consequences” are related to acceptance dose and hazardous-material release limits, depending on the event frequency. The other terms of the USQ process, such as “probabilities” and “margin of safety,” have a specific meaning in this Order and are discussed in detail later.

c. The safety analyses for each nuclear facility establish the set of limiting analyses important to safe operation. The limiting analyses are utilized to confirm the adequacy of the systems and equipment design and performance, to identify critical setpoints and operator actions, and to support the establishment of the Technical Safety Requirements. The final results of these limiting analyses (accident analyses) assume that the equipment functions as specified in the authorization basis under predetermined conditions. The SAR considers analyses of potential accidents and demonstrates that, under the assumed accident conditions, the consequences of accidents challenging the integrity of the barriers will not exceed the criteria established by DOE in authorizing operation of any particular nuclear facility. Changes impacting this portion of nuclear facility design and performance may affect the probability and consequences of accidents, create new accidents, and reduce margins of safety as defined in the bases of Technical Safety Requirements. IV-2 DOE 5480.21 12-24-91 2. Unreviewed Safety Question. a. b. This Order requires that a proposed change, test, or experiment or the identification of an analytic inadequacy shall be deemed to involve an Unreviewed Safety Question under any of the following circumstances: (1) If the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated by safety analyses could be increased; (2) If the possibility for an accident or malfunction of a different type than any evaluated previously by safety analyses could be created; or (3) If any margin of safety, as defined in the basis for any Technical Safety Requirement, could be reduced. For the purpose of performing safety evaluations, the three criteria 2a(1) through 2a(3) above can be broken down into seven separate questions: (1) Could the proposed activity increase the probability of occurrence of an accident previously evaluated in the safety analyses? (2) Could the proposed activity increase the consequences of an accident previously evaluated in the safety analyses? (3) Could the proposed activity increase the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the safety analyses? (4) Could the proposed activity increase the consequences of a malfunction of equipment important to safety previously evaluated in the safety analyses? (5) Could the proposed activity create the possibility of an accident of a different type than any previously evaluated in the safety analyses? (6) Could the proposed activity create the possibility of a malfunction of equipment important to safety of a different type than any previously evaluated in the safety analyses? (7) Does the proposed activity reduce the margin of safety as defined in the basis for any technical safety requirement? 3. Increase in the Probability of Occurrence of Accident--Question (1). a. To understand how the probability of occurrence of an accident could be increased, one must first understand how the term “accident” is DOE 5480.21 IV-3 12-24-91 b. c. d. e. applied: the term “accidents” refers to the anticipated operational transients and postulated design basis accidents considered credible enough to warrant inclusion in the Safety Analysis Report. These accidents and events define the design features necessary such that the resultant accident consequences are within the specified DOE safety limits intended to protect the public health and safety.

For each nuclear facility, a group of credible accidents will be identified. These accidents will then be screened to include in the safety analyses those accidents that are limiting. For example, for a particular scenario, several different accidents may be identified, yet the consequences of one may envelope several others. As a result, and at a minimum, the limiting (worst-case) accident scenario will be included in the Safety Analysis Report. In addition to considering the severity of the consequences of different accident scenarios, the Safety Analysis Report also considers the likelihood and frequency of occurrence. This information provides insight into developing the necessary design features for mitigation. Although DOE’s facilities categorize and define frequency groups in different manners, for the purpose of illustration, we have provided the example below. For later vintage commercial nuclear power plants, the qualitative assessment of event frequencies has resulted in the categorization of four frequency categories: (1) Normal Operations. Expected frequently or regularly in the course of operation, modification, maintenance or maneuvering. (2) Incidents of Moderate Frequency. Any one incident expected per nuclear facility during a calendar year. (3) Infrequent Incidents. Any one incident expected per nuclear facility during the plant lifetime. (4) Limiting Faults. Not expected to occur but could release significant amounts of hazardous material, thus requiring protection by design. Changes that result in a change from one frequency class to a more frequent class are examples of changes that increase the probability of occurrence. However, this is not to say that changes within a category may not also result in an increase in the probability of occurrence of an accident if there is a clearly discernible increase in trend. Such compensating effects as changes in the administrative controls may be used to offset an increase in trend in the probability of accidents of moderate frequency. Normally, the determination of a probability increase is based on a qualitative assessment that uses engineering evaluations consistent with the original safety analysis IV-4 DOE 5480.21 12-24-91 assumptions. However, if a nuclear facility-specific probability calculation can be used to evaluate a change in a quantitative sense, it should be used. Probabilistic Risk Assessments (PRAs) constitute just one tool used to evaluate safety, and PRA use iS not necessarily needed to perform safety evaluations. 4. Increase in Probability of Occurrence of a Malfunction of Equipment Important to Safety--Question (3). a. The accident analysis assumes the proper functioning of some portion of safety systems in demonstrating the adequacy of design. The proper functioning of other systems, although not specifically identified in the accident analysis, is credited in an indirect sense. The bounds of the accident analysis are extended to include these systems. For example, a change that does either of the following is a change that increases the probability of occurrence of a malfunction of equipment important to safety: (1) Degrades the performance of a safety system assumed to function in the accident analysis below the authorization and/or design basis. (2) Increases challenges to safety systems assumed to function in the accident analysis such that safety system performance is degraded below the authorization and/or the design basis without compensating effects.

b. Whether there is an increase in the probability of occurrence of a malfunction is normally determined by using a qualitative engineering evaluation. As noted in the previous section, a probability calculation can be used to demonstrate the change in probability in a quantitative sense, if available and practical. 5. Increase in Consequences of Accidents or Malfunctions of Equipment Important to Safety--Questions (2) and (4). a. Safety analyses of a nuclear facility provide acceptance criteria and frequency relationships for “conditions for design.” By defining what changes represent an “increase in consequences” pursuant to this Order, it must be recognized that the objective of this requirement is the protection of health and safety. Therefore, an increase in consequences must involve an increase in hazardous material releases and/or radioactive doses above the worst-case limiting consequences in the authorization basis that serves as the established acceptance limit. Changes in barrier performance that do not result in increased consequences are appropriately addressed in this document under “Margin of Safety. ” For nuclear facilities, DOE may require by reference, compliance with the requirements of 10 CFR 20, Standards for Protection Against Radiation, and 10 CFR 100, Reactor Site Criteria. On-site consequences that may involve a USQ are those that restrict access to vital areas or otherwise impede actions to mitigate DOE 5480.21 12-24-91 IV-5 the consequences of nuclear facility accidents. For example, 10 CFR 20 provides the requirements for determining maximum acceptable levels of radioactivity (airborne or liquid pathway) in restricted and unrestricted areas during normal operations. For accidents (e.g., radwaste system component failures) that affect a boundary for which a 10 CFR 20 limit has been established, the threshold for an increase in consequences would be the 10 CFR 20 limit, unless a separate limit in the authorization basis is more restrictive, in which case it would serve as the acceptance limit. b. An increase in the calculated off-site consequences resulting from a change, test, or experiment does not represent an increase in consequences as long as the established acceptance limits for the accident continues to be met. For example, if a change affects the consequences of a ventilation system failure and the new off-site dose or hazardous material consequence releases remain within the criterion, and the authorization limit is still met, there is no increase in consequences. 6. Possible Malfunction or Accident of a Different Type--Questions (5) and (6). a. An accident or malfunction that involves an initiator or failure not considered in the nuclear facility safety analyses is potentially an accident or malfunction of a different type. An example would be turbine missiles from a gas turbine added as an alternate power source. Certain accidents or malfunctions are not treated in the nuclear facility safety analyses because their effects are bounded by other related events that are analyzed. For example, a postulated pipe break in a small line may not be evaluated within the safety analyses of the nuclear facility because it has been evaluated to be less limiting than a pipe break in a larger line within the same area. Therefore, if a proposed design change would introduce a small, high-energy line break into an area that already had a pipe break from a larger high-energy line analyzed for energy release, pipe whip, etc., postulated breaks in the smaller line should not be considered an accident or malfunction of a different type.

b. The possible malfunctions or accidents of a different type are limited to those that are considered to be as likely to happen as those considered in the authorization basis. For example, a seismic-induced failure of a component that has been designed to the appropriate seismic criteria will not cause a malfunction of a different type. However, a change that increases the probability of an analyzed accident, or a newly discovered accident previously thought incredible to the point where it becomes as likely as the accidents considered in the authorization basis, creates a possible accident of a different type. For example, there are a number of scenarios, such as multiple tube ruptures in heat exchangers, that may have been analyzed extensively. However, these scenarios are of such low probability IV-6 DOE 5480.21 12-24-91 that they may not have been considered as part of the design basis. If a change is made so that a scenario such as multiple tube rupture becomes credible in heat exchangers, the change would be considered to create the possibility of an accident of a different type. A possible malfunction of a different type could be created by a change that adds a new single failure. It would have to be analyzed for meeting the criteria of the safety analyses of the nuclear facility. In some instances, these potential accidents are already in the design bases or are presented in the safety analyses of the nuclear facility. 7. Margin of Safety as Defined in the Bases of any Technical Safety Requirement--Question (7). a. b. c. Technical Safety Requirements (TSRs) set forth the minimum acceptable limits for operation under normal and specified failure conditions; they ensure that the available equipment and initial conditions meet the assumptions in the accident analysis. TSRs are a distillation of those aspects of the Safety Analysis Report that are required in order to assure the performance of systems, structures, components, and personnel as relied upon and defined in the SAR. The bases for TSRs define the acceptance limits from which margins of safety may be determined. To the maximum extent practicable, the bases for a TSR should explicitly define or address the margin of safety. If the bases do not specifically address a margin of safety, then the safety analyses and other appropriate authorization basis documents should be reviewed to determine whether the proposed change, test or experiment, or new information has or would result in a reduction in a margin of safety. The margin may be implicitly rather than explicitly expressed as a numerical value. A margin of safety defined in the Bases Section of a TSR document may depend on a parameter other than one of the process variables. Therefore, the precise determination of a numerical value associated with a change is not always required to comply with this Order. Implicit margins are, for example, conditions for acceptance for a computer code, method, or industry accepted practice. It may be sufficient to determine only the direction of the margin change (i.e., increasing or decreasing). For purposes of performing the safety evaluation, the margin of safety is the range above the acceptance limit reviewed and approved by the DOE as part of the authorization process. In making the judgment on whether the margin is reduced, the decision should be based on physical parameters or conditions that can be observed or calculated. Where a change in margin is so small or the uncertainties in determining whether a change in margin has occurred are such that it cannot be concluded reasonably that the margin actually has changed (i.e., there is no clear trend toward reducing the margin), the change need not be considered a reduction in margin.

DOE 5480.21 IV-7 12-24-91 d. With regard to the margin of safety, the change, test or experiment, or new information should be evaluated with respect to safety limits, limiting safety system settings (LSSS), limiting conditions of operation (LCO), as well as design parameters for systems and individual components. Various margins exist between strain or failure and a TSR safety limit, the TSR safety limit and design value, and the LSSS and the operating value or limit. These margins are based on, for example, assumptions of initial conditions, conservatism in computer modeling and codes, allowance for instrument drift and system response time, redundancy and independence of components in safety trains, and plant response during operating transient and accident conditions. Some modifications may affect these margins in opposite directions. However, a change in the margin of safety above the acceptance limit is the focus of this Order. e. A change in initial conditions, or in a system response time, or in some other parameters affecting the course of an accident analysis supporting the bases of TSRs must be evaluated to determine whether the change causes the acceptance limit to be exceeded for that analysis. If the limit is exceeded, the change would involve a reduction in the margin of safety pursuant to this Order. f. It is recognized that there are “margins” associated with safety analyses to account for uncertainties in the design, construction, and operation of a nuclear facility (e.g., conservatism in computer modeling and codes and allowances for instrument drift and for system response time). These “margins” may be reduced by contractors, provided specific acceptance conditions, criteria, and limits (e.g., models, tests, uncertainties, and methodology) are not invalidated. g. The determination of whether a reduction in margin is involved is based on the results of the analyses and not on the change itself. For example, an increase in initial conditions (not already limited by TSRs) in the nonconservative direction can be compensated for by lowering a setpoint or reallocating analyses conservatism. If the analyses results continue to be bounded by the acceptance limit, a reduction of margin is not involved. h. To develop the definition of “margin of safety,” it is necessary to define the relationship of operating points, acceptance limits, and actual failure points (see Figure IV-1). To do this, one must determine the original authorization basis of the parameter in question. A margin of safety defined in the Bases Section of the TSR may depend on a parameter other than one of the process variables. However, a change in the margin will depend only on an increase in the result beyond an established acceptance limit. IV-8 DOE 5480.21 12-24-91 Figure IV-1 Example of Margin of Safety Using Containment Overpressure Transient DOE 5480.21 12-24-91 Attachment IV-1 Page IV-9 ATTACHMENT IV-I 1. Safety Evaluation Process. If it has been determined that a USQ review is required, the safety evaluation can be approached by providing an answer to each of the seven questions identified using the interpretations given in Chapter IV. If any of these questions is answered “yes,” the change is considered to be an Unreviewed Safety Question. An appropriate justification for each answer should be recorded. The examples given in the following subsections are provided to help the reviewer identify potential Unreviewed Safety Questions. They are not meant to be examples of Unreviewed Safety Questions nor are they intended to be requirements. They are only intended as examples, Determination of an Unreviewed Safety Question requires consideration of the safety analyses of the nuclear facility or other approved documentation that provides the authorization basis for design or operations, and the specific details of the issue.

1.1 Could the Proposed Activity Increase the Probability of Occurrence of an Accident Previously Evaluated in the Safety Analyses? In answering this question, the first step is to determine what accidents, that have been evaluated in the previously approved safety analyses, may be affected by the proposed activity. A determination is made as to whether the likelihood of the accident occurring would be increased. The following examples may provide a useful approach in making this determination. (a) Will the proposed activity meet the design, material, and construction standards applicable to the system or equipment being modified? If the answer is “yes,” this aspect of the proposed change is judged not to increase the likelihood of an accident occurring. If the answer is “no” to any of the items, either a justification for saying there is no increase in the likelihood of the accident occurring will need to be developed or it is concluded that the likelihood of the accident occurring is increased. (b) Will the proposed activity affect overall system performance in a manner that could increase the probability of an accident? Examples of questions to ask are: (1) Will the proposed activity use instrumentation with accuracies or response characteristics that are different than existing instrumentation such that an accident is more likely to occur? Attachment IV-1 Page IV-10 (2) (3) (4) DOE 5480.21 12-24-91 Will the proposed activity cause systems to be operated outside their design or testing limits? Examples include the following: imposing additional loads on electrical systems, operating a piping system at higher than normal pressure, and operating a motor outside of its rated voltage and amperage. Will the proposed activity cause system vibration or water hammer, fatigue, corrosion,thermal cycling, or degradation of the environment for equipment important to safety that would exceed the design limits? Will the proposed activity cause a change to any system interface in a way that would increase the likelihood of an accident? If the proposed activity affects overall system performance in a manner that could lead to an accident or cause an accident previously evaluated to shift to a higher frequency category, then the issue would increase the probability of an accident previously evaluated in safety analyses. 1.2 Could the Proposed Activity Increase the Consequences of an Accident Previously Evaluated in Safety Analyses? In answering this question, the first step is to determine which accidents evaluated in the safety analyses may have their radiological and hazardous material consequences altered as a direct result of the issue. The next step is to determine whether the issue does, in fact, increase the consequences of any of the accidents evaluated in the safety analyses. Examples of questions that assist in this determination are as follows: (1) Will the proposed activity change, degrade, or prevent actions described or assumed in the accident analyses? (2) Will the proposed activity alter any assumptions previously made in evaluating the radiological and hazardous material consequences in the accident analyses? (3) Will the proposed activity play a direct role in mitigating the radiological or hazardous material consequences assumed in the accident analyses? (4) Will the proposed activity affect any fission product or any radioactive or hazardous material barriers?

If it is determined that the issue does have an effect on the consequences of any accident analysis previously described in safety analyses, then the contractor should either-- DOE 5480.21 Attachment IV-1 12-24-91 Page IV-11 (1) Demonstrate and document that the safety consequences of the accident described in the safety analyses are bounding for the proposed activity (e.g., by showing that the results of the previous analyses bound those that would be associated with the issue); or (2) Revise and document the analysis, taking into account the proposed activity and compare the consequences to the acceptance limits in the prior analyses. 1.3 Could the Proposed Activity Increase the Probability of Occurrence of a Malfunction of Equipment Important to Safety Previously Evaluated in Safety Analyses? In answering this question, the first step is to determine what important to safety (ITS) equipment could be impacted by the proposed activity. Then evaluate the effects of this activity on ITS equipment. This evaluation should include both direct and indirect effects. Direct effects are those where the issue affects the equipment (e.g, a motor change on a pump). Indirect effects are those in which the issue impacts one piece of equipment, and this piece of equipment affects the ITS equipment. After identifying the impact of the issue on the ITS equipment, a determination is made if an increase in the probability of a malfunction of the ITS equipment has occurred. The following are examples of questions that can be used in making the determination. (a) Will the proposed activity meet the original design specifications for materials and construction practices when the following questions are considered: (1) Are the seismic specifications met (e.g., use of proper supports, proper lugging at terminals, and isolation of lifted leads)? (2) Are separation criteria met (e.g., minimum distance between circuits in separate divisions, channels in the same division, and jumpers run in conduit)? (3) Are the environmental qualification criteria met (e.g., use of materials qualified for the radiation or thermal environment in which they will be used)? (b) Will the proposed activity degrade structure, system or component (SSC) reliability by-- (1) Imposing additional loads not analyzed in the original design? Attachment IV-1 Page IV-12 (2) (3) (4) (5) (6) DOE 5480.21 12-24-91 Deleting or modifying system/equipment protection features? Downgrading the support system performance necessary for reliable operation of the ITS equipment? Reducing system/equipment redundancy or independence? Increasing the frequency of operation of ITS system/equipment? Imposing increased or more severe testing requirements on ITS system/equipment? If the issue adversely impacts the ITS equipment, the likelihood of equipment malfunction may be increased. A “yes” answer to any question in (b) above does not mean that there is a negative impact on safety. However, it would indicate the existence of a USQ and the need for justification that the equipment can provide the intended safety function. 1.4 Could the Proposed Activity Increase the Consequence of a Malfunction of Equipment Important to Safety Previously Evaluated in Safety Analyses?

This question is asking whether, assuming a malfunction of ITS equipment, the issue would result in increased hazardous material or radiological consequences. For example, consider a change such that a safety-related valve now fails in the closed position where previously it failed in the open position. If failing the valve in the closed position results in an increase in consequences of an accident, then this is a change that increases the consequence of a malfunction of equipment important to safety. 1.5 Could the Proposed Activity Create the Possibility of an Accident of a Different Type than any Previously Evaluated in Safety Analyses? In answering this question, the first step is to determine the types of accidents that have been evaluated in the prior safety analyses. The types of credible accidents that the issue could create can then be identified. Comparing the two lists will determine the answer to the question. 1.6 Could the Proposed Activity Create the Possibility of a Malfunction of Equipment Important to Safety of a Different Type than any Previously Evaluated in Safety Analyses? This question asks whether the issue could lead to a failure mode of a different type than the types evaluated in previous safety analyses. In answering this question, the types of failure modes of ITS equipment that have previously been evaluated in safety analyses affected by the issue are identified. Then types of failure modes that the issue could create are identified. Comparing the two lists can provide an answer to DOE 5480.21 Attachment IV-1 12-24-91 Page IV-13 the question. An example that might create a malfunction of a different type could be the relocation of equipment so that it now becomes susceptible to flooding. Another might be replacement of a mechanical control system on equipment important to safety with a digital control system that can potentially fail in a different mode. 1.7 Does the Proposed Activity Reduce the Margin of Safety as Defined in the Basis for any Technical Safety Requirement? To answer this question, it is first necessary to determine whether a margin of safety as defined in the bases for any TSR is involved. To do this, the Bases Sections of all applicable TSR documents should be consulted. If a margin of safety is defined there, or if any authorization basis document defines a margin of safety that TSRs were derived from, then a margin of safety as defined is involved and the effects of the issue on the margin should be assessed. Safety Evaluation Performance In performing a safety evaluation of an issue, one must provide a comprehensive justification for the USQ determination. Consistent with the intent of this Order, these explanations should be complete in the sense that a qualified independent reviewer could draw the same conclusion. The importance of the documentation is emphasized by the fact that experience and engineering knowledge other than models and experimental data are frequently relied upon in performing the safety evaluation. Since an important goal of the safety evaluation is demonstration that the authorization basis is being maintained, the items considered by the evaluator must be clearly stated. By documenting the effects that were considered, the independent reviewers will be able to assess the adequacy of the review and its conclusions. To provide an example of appropriate documentation, an example safety evaluation worksheet follows. The format of the worksheet is not set forth as a requirement but is intended to assist the contractor-in development of facility specific procedures.

Attachment IV-1 Page IV-14 DOE 5480.21 12-24-91 EXAMPLE SAFETY EVALUATION WORKSHEET Safety Evaluation Number: Revision No. Facility Issue Number: Revision No. Facility Issue Title: 1. 2. 3. 4, 1. 2. 3. 4. 5. INTRODUCTION Description of the aspects of the issue being eva expected effects. Identification of parameters and systems affected luated and its by the issue. Identification of the credible failure modes associated with the issue. References to location of information used for the safety evaluation. PART I: IMPACT ON THE ACCIDENTS EVALUATED AS THE DESIGN BASIS Identify the design basis accidents reviewed for potential impact by the issue. Discuss how the parameters and systems, affected by the issue, impact the consequences of these accidents. Identify the design basis accidents, if any, for which failures modes associated with the issue can be an initiating event. Discuss the impact of the issue on the probability of occurrence of the design basis accidents identified in 3 above. Identify the safety systems and systems important to safety affected by the issue. 1 For the purposes of this Appendix, “issue” will mean any change, test or experiment, or new information identified. DOE 5480.21 Attachment IV-1 12-24-91 Page IV-15 6. Discuss the impact of the issue and/or the failure modes associated with the issue on the probability of failure of the systems identified. 7. Discuss the impact of the issue on the performance of the safety systems. SUMMARY Yes No Based on 2 above, does the issue increase the consequences of a design basis accident? Based on 4 above, does the issue increase the probability of a design basis accident? Based on 6 above, does the issue increase the probability of a malfunction of a safety system? Based on 7 above, does the issue degrade the performance of a safety system below that assumed in the design basis analysis? If any of the above is answered “yes,” the issue is an Unreviewed Safety Question. Attachment IV-1 DOE 5480.21 Page IV-16 12-24-91 PART II: POTENTIAL FOR CREATION OF A NEW TYPE OF UNANALYZED EVENT 1. Based on Part I, assess the impact of the issue and/or failure modes associated with the issue to determine whether the impact has modified the facility response to the point where it can be considered a new type of accident. Discuss the basis for this determination. 2. Determine whether the failure modes of equipment important to safety associated with the issue represent a new unanalyzed type of malfunction. Discuss the basis for this determination. 3. Determine whether the issue, or a failure mode associated with the issue. increases the probability of an accident to the point where it should be considered within the authorization/design basis. SUMMARY Yes No Based on 1, 2, and 3 above, does the issue create the potential for new type of unanalyzed accident or a new type of malfunction? If the answer is “yes,” the issue represents an Unreviewed Safety Question. DOE 5480.21 12-24-91 Attachment IV-1 Page IV-17 PART III: IMPACT ON THE MARGIN OF SAFETY 1. Based on the results identified in Part I, discuss the impact of the consequences on the protective boundaries. 2. Identify how the protective boundaries, if any, are directly affected by the issue or a failure mode of the issue. 3. Discuss the impact of the issue on the acceptance limits for the protective boundaries identified above. 4. Identify the margins of safety related to this issue that are defined in the bases of Technical Safety Requirements. SUMMARY Yes No 1. Based on 1 above, do the consequences of the design basis accidents exceed the limits for an acceptable issue? 2. Based on 2, 3, and 4 above, does the issue reduce the margin of safety provided for the protection boundaries? 3. Based on 4 above, does the issue reduce other margins of safety in the bases for the Technical Safety Requirements that are not related to the boundaries? 9Attachment IV-I Page IV-18 PART IV: SAFETY EVALUATION CONCLUSION Based on the evaluation in Parts I, II, and III, the issue-- Does not constitute an Unreviewed Safety Question. Does constitute an Unreviewed Safety Question. Preparer’s Signature Independent Review Signature Approval Signature (Use as many as appropriate) DOE 5480.21 12-24-91 Date Date Date