Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements <AUTHOR> Richard Stark <AUTHOR_EMAIL> richard.stark@hq.doe.gov <ORG> EH <SUMMARY> The Guide was developed specifically to support the new safety basis requirements in DOE rule 10 CFR Part 830, Nuclear Safety Management. <DATE_ISSUE> 10/16/2000 <DATE_CLOSE> <DATE_REVIEW> <TEXT> DATE: OCTOBER 16, 2000 FROM: JAMES G. POWERS DIRECTOR, OFFICE OF MANAGEMENT AND OPERATIONS SUPPORT, MA-4 TO: DIRECTIVES POINTS OF CONTACT SUBJECT: DOE G 424.X-X, IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS DOE G 424.X-X, IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS is attached for your comment and use. The Guide was developed specifically to support the new safety basis requirements in DOE rule 10 CFR Part 830, Nuclear Safety Management. Comments on the revisions are due by December 18, 2000. Comments on Guides should not be designated "major" or "suggested", as in the past. From this point on, comments on Guides should be simply labeled as "comments" . Guides now have a separate coordination process in the directives system. Please refer to the memo from James G. Powers, dated March 31, 2000, subject: Management of DOE Guides. The following procedures should be followed for the submission of comments: Directives Points of Contact at Headquarters Elements: Submit one set of consolidated comments to the originator of the Guide by December 18, 2000: Richard Stark, EH-31, Germantown; facsimile (301) 903-6172; or INTERNET address: richard.stark@hq.doe.gov. Send an additional copy of comments to Craig Wisooker, MA-4, Room 4B-222, Forrestal, fax: 202-586-1972, or to craig.wisooker@hq.doe.gov. Directives Points of Contact at Field Elements: Submit consolidated comments to the Guide writer as well as a copy to MA-4. The package submitted by Field Elements shall include as an attachment the comments provided by contractors. Contractors will submit comments directly to their appropriate Field Elements. Questions concerning the content of the draft chapter to the Guide should be directed to Richard Stark, (301) 903-4407; questions on the directives system should be directed to Craig Wisooker, 202-586- 6343. Attachment DOE G 424.X-X, IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS Approved: XX-XX-00 Sunset Review: XX-XX-02 Expires: XX-XX-04 Implementation Guide for Use in Addressing Unreviewed Safety Question (USQ) Requirements U.S. Department of Energy Office of Nuclear and Facility Safety Policy FOREWORD This Department of Energy (DOE) Implementation Guide is approved by the Office of Facility and Nuclear Safety Policy and is available for use and comment by all DOE components and contractors. Beneficial comments (recommendations, additions, deletions, and any pertinent data) that may improve this document should be sent to: Richard Stark EH-53/270/GTN U.S. Department of Energy Washington, D.C. 20585 Phone (301) 903-4407 Facsimile (301) 903-6172 DOE implementation guides are part of the DOE directives system and are issued to provide supplemental information regarding the Department's expectations of its requirements as contained in rules, Orders, notices, and regulatory standards. Implementation guides also provide acceptable methods for implementing these requirements. This implementation guide may be used by all contractors for DOE hazard category 1, 2, or 3 nuclear facilities, including contractors for NNSA hazard category 1, 2, or 3 nuclear facilities. Throughout this document, wherever it references a contractor or a DOE contractor, the statement applies to a contractor for NNSA as well. This implementation guide has been developed in support of Section 830.203, “Unreviewed Safety Question Process” of 10 CFR 830, “Nuclear Safety Management.” This document provides guidance for the requirements defined in 10 CFR 830.203. This Guide imposes no requirements. CONTENTS Paragraph Page FOREWORD i I. INTRODUCTION 1 II. APPLICATION 1 1.TEMPORARY OR PERMANENT CHANGES IN THE FACILITY 2 2.TEMPORARY OR PERMANENT CHANGES IN THE PROCEDURES 3 3.TESTS OR EXPERIMENTS NOT DESCRIBED IN THE EXISTING DOCUMENTED SAFETY ANALYSES 4 4.DISCOVERY OF POTENTIAL INADEQUACIES IN THE EXISTING SAFETY ANALYSES 4 III IMPLEMENTATION GUIDANCE 5 III.A. Integrated USQ Process 6 III.B. Screening 7 III.C Unreviewed Safety Question Determinations 9 III.D. Documentation and Retention 10 III.E. Training and Qualifications 11 APPENDIX A: UNREVIEWED SAFETY QUESTION DETERMINATION 1 A.1 USQ Process 1 A.2 Performing USQ Determinations 7 A.3 Example USQ Determination Worksheet 8 APPENDIX B: USQ LESSONS LEARNED 1 B.1. Title 1 B.2 Identifying Inadequate Safety Analyses 1 B.3 Reporting Potential Inadequacies In Safety Analyses 1 B.4. Control Of Hazards During Installation. 2 B.5 "Declaring" A USQ To Exist. 2 B.6 Submittals to DOE 2 B.7 Need for USQDs for TSR changes 3 B.8 Tenant/Landlord Relationships 3 B.9 Graded Approach 4 B.10 Unified and Consolidated Procedures 4 B.11 USQ Screening 4 B.12 DOE Involvement in the USQD 5 I. INTRODUCTION This implementation guide provides information to assist in the implementation and interpretation of Section 830.203, “Unreviewed Safety Question Process,” of the Nuclear Safety Management Rules for applicable nuclear facilities owned or operated by the U.S. Department of Energy (DOE), including the NNSA. Section 830.203, “Unreviewed Safety Question Process,” was established to allow contractors to make physical and procedural changes and to conduct tests and experiments without prior DOE approval. It must be established however that these changes do not explicitly or implicitly impact the safety basis of the facility. For the purposes of the Unreviewed Safety Question (USQ) process, the safety basis includes the Documented Safety Analysis (DSA), the Technical Safety Requirements (TSRs), DOE-issued safety evaluation reports (SERs), and facility-specific commitments made in compliance with DOE rules, Orders, or policies. The intent of Section 830.203 is to provide contractors with the flexibility needed to conduct day-to-day operations and to require that only those changes with a potential impact on the safety basis, and therefore the safety of the facility, be brought to the attention of DOE for approval, prior to making the change. DOE approval of the USQ process is required by 830.203. The implementation of Section 830.203 is expected to be accomplished through contractor procedures that assure that proposed changes to physical characteristics or operating procedures are adequately evaluated, and assure that those determined to involve Unreviewed Safety Questions (USQs) are brought to the attention of DOE for review and approval prior to making changes. A proposed change or test involves a USQ if the probability or consequences of an accident or malfunction of safety structures, systems, or components (SSCs) could be increased, the possibility of a different type of accident than previously evaluated could be introduced or margins of safety as defined in TSR bases could be reduced. It is important to recognize that these considerations apply to both workers and public impacts. In addition to proposed changes, paragraph (e)(2) of the USQ Rule provides for notification of DOE and USQ determinations when a potential inadequacy in the safety analysis is identified. In this case, situations of concern are those wherein it is found that the current safety analysis may not be bounding or the current safety basis may be otherwise inadequate. This could be because of an error in the current safety analysis or because the facility configuration is not what was analyzed. The existence of an Unreviewed Safety Question (USQ) does not mean that the facility/operation is unsafe. The purpose of the USQ process is to alert DOE of events, conditions, or actions which affect the DOE approved safety basis of the facility/operation and assure appropriate DOE line management action. The purpose of the USQ process is not to determine the safety of the situation. If, however, a change is proposed or a condition is discovered that could involve an increase in the risk of operating a facility beyond that established in the current safety basis, DOE line management, including where applicable the NNSA, must review and determine the acceptability of that risk through the process of approving a revised safety basis. II. APPLICATION Section 830.203, “Unreviewed Safety Question Process,” applies to all Category 1, 2 and 3 nuclear facilities. All changes, whether temporary or permanent, to a nuclear facility require application of a USQ process. The applicability of Section 830.203 is broad. Nonsafety-related systems are not excluded by the scope of Section 830.203 if they could affect the proper operation of safety SSCs relied on in the safety basis. For example, losses of certain nonsafety-related systems may represent critical operational occurrences identified as initiators in the accident analysis. Therefore, changes to nonsafety-related systems must be evaluated and may be determined to involve an Unreviewed Safety Question (USQ). Physical interactions may also fall under the purview of Section 830.203. For example, the installation of a nonseismically supported piece of equipment above a seismically qualified component designed to perform a safety function explicitly or implicitly assumed in the existing safety analyses may constitute a USQ and must be evaluated. The following sections discuss the types of changes, tests, and experiments, as well as potential inadequacies that the USQ process needs to address to comply with Section 830.203. 1. TEMPORARY OR PERMANENT CHANGES IN THE FACILITY Section 830.203 requires USQ determinations (USQDs) for changes to a nuclear facility that alter an SSCs design, function, or method of performance as described in the existing safety analyses by text, drawing, or other information relied on as the safety basis. The safety analyses include descriptions of many SSCs, but a nuclear facility also contains many SSCs not explicitly described in the safety analyses. These can be components, subcomponents of larger components, or even entire systems. Changes to SSCs that are not explicitly discussed in the safety analyses should not be excluded from the USQ process, since changes to these SSCs may affect the ability of a safety SSC to perform its intended function. The recommended approach for deciding whether a modification involves a change to the nuclear facility, as described in the safety analyses, is to consider the effect of the change on the safety SSCs of which the SSC being modified may be a part or which the SSC being modified may support. If the change alters the design, function, or method of performing the function of the safety SSC, as described in the safety analyses, a USQD is required. Also, a change to a SSC that is not a safety SSC may affect the potential initiation of an accident or the course of an accident, so virtually no change can be ignored. The necessity to distinguish between changes and routine maintenance activities is an important consideration. Routine maintenance activities (except those that are not enveloped by current analyses or that might violate a TSR) do not require review under Section 830.203. Examples of routine maintenance activities include calibration, refurbishment, replacement with an equivalent component and housekeeping. However, there are some maintenance activities that may constitute changes, such as plant heat exchanger tube plugging where limits are not specified. Systems or components removed from service for maintenance should be covered by the TSR for allowable outage times, permissible mode conditions, and permitted reduction in redundancy. A USQD, therefore, need not be performed for these activities. However, for safety systems or components that are included in safety analyses for the nuclear facility, and for which allowed outage times are not included in the TSRs, a USQD should be completed. Understanding the term "change" as it applies to modes of operation or facility processes is also important. For example, when a facility is designed to accommodate several nuclear processes but must modify equipment lineup to accommodate another process, this change does not constitute a change under Section 830.203 if it is performed in accordance with approved procedures and was considered within the safety basis of the facility. Temporary changes to the nuclear facility should be evaluated to determine whether a USQ exists. Examples of temporary modifications include jumpers and lifted leads, temporary lead shielding on pipes and equipment, temporary blocks and bypasses, temporary supports, and equipment used on a temporary basis. The conservative approach is to provide a written USQD for any change to the nuclear facility, whether discussed in existing safety analyses or not. However, it is possible that some changes can be justified as not requiring evaluations under Section 830.203, as long as screening criteria are developed that will ensure that there are no indirect or secondary effects of the change. In this case, the screening criteria are relied on to ensure that the change does not introduce a USQ. The actual modification implementation process (e.g., work authorization system) used in the field should be reviewed for possible development of USQs. Changing plant configurations while work is in progress may involve a USQ even though the modification, when completed, may not. 2. TEMPORARY OR PERMANENT CHANGES IN THE PROCEDURES Changes to procedures that are identified in the facility Documented Safety Analysis may need to have a USQD prepared. However, as discussed below in section III.B., regarding USQ screening, some procedure changes may not require a USQD. The identification of procedures may be explicit or implicit in the facility documented safety analysis. If the procedure is implied directly by the nature of a topic in the safety basis (including the OSRs/TSRs), that change should be considered to be to a procedure described in the documented safety analysis, so that a USQD is done when appropriate. Such implicitly described procedures include: (1) the procedures that implement a Safety Management Program (SMP) described in the safety basis, and (2) operating/ maintenance procedures for safety equipment when that equipment is identified in the documented safety analysis. If the characteristics of the SMP described in the safety basis remain correct, complete, and valid, then the result of the USQD would be expected to be negative, signifying that DOE approval is not required. Procedures are not limited to those items specifically identified as procedure types (e.g., operating, chemistry, system, test, surveillance, and emergency plan) but could include anything described in the documented safety analyses that defines or describes activities or controls over the conduct of work. Changes to these activities or controls qualify as changes to procedures as described in the documented safety analyses, and therefore must be evaluated as a potential USQ. Changes to procedures include both revising an existing procedure and creating a new procedure. For the case of a new procedure, which could not be described already, the question becomes, if the Documented Safety Analysis were to be prepared (or updated) after the new procedure had been approved, is the new procedure of a type that would be identified in the Documented Safety Analysis. If so, the new procedure should have a USQD prepared. 3. TESTS OR EXPERIMENTS NOT DESCRIBED IN THE EXISTING DOCUMENTED SAFETY ANALYSES Written USQ determinations are required for tests or experiments not described in the existing safety analyses. The intent of the criteria of Section 830.203 is to require USQDs of tests and experiments that are not described in the existing safety analyses that might affect safe operations. By definition, these are tests and experiments that could degrade the margins of safety during normal operations or anticipated transients or degrade the ability of safety SSCs to prevent accidents or mitigate accident conditions. Thus, previously evaluated tests do not require written USQDs under Section 830.203. For example, for preoperational tests, surveillance tests, functional tests, and startup tests that are performed regularly, USQDs are not required every time a test is performed. However, one-of-a-kind tests used to measure the effectiveness of new techniques or a new system configuration that might affect safety SSCs will require evaluation before they can be conducted. Postmodification testing should be considered and included in the USQD for the modification. 4. DISCOVERY OF POTENTIAL INADEQUACIES IN THE EXISTING SAFETY ANALYSES Written USQ determinations are required when a contractor identifies a Potential Inadequacy of the Safety Analyses (PISA) that supports the DOE approved safety basis which indicates the safety analysis is not bounding. The intent is to ensure that the operations are conducted in a safe manner that is consistent with the safety basis. Because an inadequacy as specified above has the potential to call into question information relied on for authorization of operations, DOE requires the contractor to: 1. Take appropriate action to place or maintain the facility in a safe condition; 2. Expeditiously notify DOE upon discovery of the information; 3. Perform a USQ determination and submit it promptly; and 4. Complete an evaluation of the safety of the situation and submit it to the DOE prior to removing any operational restrictions implemented to compensate for the analytical discrepancy. If a USQ is determined to be present, the safety evaluation will require not only DOE's review but also its approval of resulting changes, before any operational restrictions are removed. The facility Documented Safety Analysis, as part of the safety basis, is important to safety for a number of reasons. Among these, the Documented Safety Analysis defines the safety risks that DOE has accepted when authorizing operation of the facility. Because of this feature, that analysis is the baseline reference for the USQ process. If that reference were to be inadequate, the USQ process would be compromised. Therefore, the USQ process includes special actions to be taken if it appears that the safety analyses might be inadequate. The Documented Safety Analysis may be inadequate for any number of reasons. In general, it is possible for a potentially inadequate analysis to arise from three entry conditions: (1) a discrepant as-found condition, (2) an operational event or incident, or (3) new information, including discovery or an error, sometimes from an external source. The main consideration is that the analysis does not match the current physical configuration of the facility, or the analysis is inappropriate or contains errors. The analysis might not match the facility configuration because of a discrepant as-found condition. Analytical errors might involve using incorrect input values, using invalid assumptions, using an improper model, or calculational errors. The USQ process starts when the facility management has information that gives reason to believe that there is the potential that the facility Documented Safety Analysis might be inadequate. III. IMPLEMENTATION GUIDANCE The USQ review process should be integrated into all technical aspects of the contractor organization responsible for design, engineering, maintenance, inspection, operations, and assessment of the nuclear facility or activity. Individuals involved in these aspects of the organization should be familiar with the requirements of Section 830.203 and should be able to identify activities that might need to enter the USQ process, while carrying out their normal responsibilities. Each facility should identify the methods by which facility changes can be made (e.g., whether changes are made under modification processes, nonconformance processes, or maintenance processes). After these methods have been identified, each facility must determine what constitutes an acceptable means to make a change. That is, the contractor must clearly control the facility change process and must perform and document changes in accordance with approved procedures. Performing a modification under the guise of maintenance is not acceptable because the proper control processes to analyze the proposed change and document its outcome would probably be absent. Identification of all means for performing a change is necessary because each one provides a direct input into the USQ process and must be integrated accordingly. The USQ process is intended to be implemented as part of a change control process that includes generalized steps for: (1) Identifying and describing the temporary or permanent change, (2) Technical reviews of the change, (3) Management review and approval of the change, (4) Implementation of the change, and (5) Documenting the change. As part of the technical reviews of a change, the contractor should perform the appropriate type of safety analysis to ascertain if the change is indeed safe. This is accomplished separately from the USQ process. The USQ process is used subsequently to determine if final approval of the change by the contractor is sufficient or if DOE approval must be obtained. Contractors should develop procedures that provide detailed guidance for the performance of the USQ process, including any screening and the USQDs. The procedures should define the purpose of the procedure; set forth the procedure's applicability; provide definitions of appropriate terms, include screening criteria, as appropriate, and the basis for their application; include detailed guidance on what must be considered and evaluated when performing or reviewing a USQD; define the qualifications needed and responsibilities of personnel performing and reviewing USQDs; and include documentation requirements for each USQD. DOE relies on the contractor's USQ process to preserve the integrity of the safety basis while allowing flexibility in operations. The contractor responsible for a DOE hazard category 1, 2 or 3 nuclear facility must submit the procedure that defines its USQ process to DOE for approval. III.A. Integrated USQ Process The USQ process should be integrated into the facility's change control processes. The change processes should ensure that the USQ process is integrated into existing procedures or that new procedures are developed, as necessary and that the need for completion of a USQD is not overlooked. Each facility should develop its own change flow process for both temporary and permanent changes to SSCs and documents. This process and its integration should be described by a governing policy, procedure, flow chart, or other description. The purpose of the governing document is to define clear relationships between the USQ process and other change control procedures, including design change procedures, configuration control programs, temporary change procedures, and procedures governing the preparation, review, and approval of procedures. Its purpose is to describe how the USQ processes required by Section 830.203 are integrated into the facility's processes and not to implement the details of the rule independently. The facility USQ procedures should provide that the USQ documents (that is, any screening and the USQD) are prepared by one individual and then reviewed technically by a second person. That person should be independent in the sense that he/she has not been involved in the preparation of the USQ documents. That person does not need to be organizationally independent. The facility USQ procedure should provide also that facility management takes approval action on the USQ documents. This ensures that management is informed of the results of the USQ process and hence can take whatever follow-up actions are appropriate, such as submitting the change to DOE for safety review and approval or canceling the proposed change. The use of a facility operating review committee to review the USQ documents and provide advice to facility management may be beneficial, but review by such a committee should not be used in lieu of the management approval action. Care should be used to avoid excessive levels of approval. Typically, one approval is sufficient, with a second corporate-level approval for positive USQDs. III.B. Screening The purpose of USQ screening is to ascertain if it is necessary to expend the valuable time and resources necessary to perform a USQD, or if there is reasonable technical justification for not performing a USQD. DOE encourages the use of screening to limit the number of matters for which USQDs must be performed, provided the reasons for exclusion are documented and well supported. When properly defined and implemented, the screening criteria should assist in reducing the efforts expended for matters of minor significance and should focus efforts more on the more important matters for which Section 830.203 is intended. Candidate items for screening include: ? Changes that involve a change to a requirement in the TSRs, or the addition of a new TSR requirement. ? The installation of an item that is an exact replacement (i.e., same manufacturer, same model number, etc.). ? The installation of an item that is on the facility “Approved Equivalent Parts” list, for which a facility engineer has evaluated and concluded that the replacement item meets all the requirements pertinent to the specific application at the facility, including the service conditions. ? Changes for which common commercial practices would suffice, and a formal nuclear- grade change control process is not warranted (for example, changing fixtures for fluorescent lighting in an office area of the facility). ? Changes for which management has already decided will be submitted to DOE for safety review and approval. ? Changes to documents that are purely editorial and make no technical change. In some situations, the screening might determine that the matter does not require any further USQ consideration. In other situations, the pre-screening part may determine that the matter should proceed directly to a USQD without any further screening consideration. The case of a potentially inadequate safety analysis is an example of this situation. In other situations, the pre-screening might determine that the matter must be submitted to DOE and hence does not require the performance of a USQD to determine if a submittal is required. A change that involves a change to a requirement in the facility TSRs is an example of this situation. Screening criteria are to be applied to those items that, by broad definition, might enter into the Section 830.203 process but for which a detailed evaluation (USQD) is not necessary. For example, an operational procedure that is described in the Documented Safety Analysis may be changed to correct a typographical error or include an additional reference to an equipment list. Such a change is not of any safety significance and clearly does not involve a USQ. If the contractor applied a screening procedure that asks: "Is the change purely editorial and without any technical change?" (that is, a spelling or typographical correction, grammatical change, clarification or additional note or reference), the reviewer could document the change and thus avoid the need to answer the detailed questions of the USQD. A different manner in which screening criteria may be applied is through categorical exclusions (for example, different procedure types). For the purpose of illustration, maintenance procedures may be considered. A basic premise of performing maintenance is that the plant will be restored to the exact same condition it was in prior to maintenance. That is, the functional capability will continue to meet or exceed those performance requirements set forth in the safety basis. A change to a maintenance procedure would therefore not be governed under Section 830.203. However, it should be understood that, whenever screening criteria are applied in this manner, DOE would expect to find an evaluation of why a categorical exclusion (for example, of maintenance procedures) from the Section 830.203 process is acceptable. Another possible screening consideration is the possibility that the matter being considered is fully covered by a previous USQD, even when location differences are considered. When considering the resolution of a non-conformance situation, it should be recognized that any disposition that involves a corrective action that does not fully meet all the existing requirements would constitute a design change. This would include a “use-as-is” disposition. This would not include an exact “restoration modification” wherein the disposition of the non-conformance is simply to replace the item with an items that meets all the requirements. In the special case of a potentially inadequate safety analyses, no screening is appropriate. For such a serious situation, a USQD must be prepared. III.C Unreviewed Safety Question Determinations Contractors are expected to provide detailed guidance and instructions on how to perform a USQ determination. Specific guidance on how to conduct a USQD is contained in Appendix A. The concepts used to develop this process are contained throughout this guidance document. A USQ determination is that record required by Section 830.203 to document the review of a "change." It records the scope of the evaluation and the logic for determining whether or not a USQ exists. For the purpose of USQ procedures and performing USQDs, the three USQ criteria in Section 830.203 (b) should be broken down into their constituent seven questions: (1) Could the proposed change increase the probability of occurrence of an accident previously evaluated in the facility’s existing safety analyses? (2) Could the proposed change increase the consequences of an accident previously evaluated in the facility’s existing safety analyses? (3) Could the proposed change increase the probability of occurrence of a malfunction of safety SSCs required by the facility’s existing safety analyses? (4) Could the proposed change increase the consequences of a malfunction of safety SSCs previously evaluated in the facility’s existing safety analyses? (5) Could the proposed change create the possibility of an accident of a different type than any previously evaluated in the facility’s existing safety analyses? (6) Could the proposed change create the possibility of a malfunction of safety SSCs of a different type than any previously evaluated in the facility’s existing safety analyses? (7) Does the proposed change reduce the margin of safety as defined in the basis for any TSR? For the purposes of this guide “safety SSCs” means SSCs that the safety analyses have shown are important to safety. The USQ procedures should require that a defensible explanation be documented for the answers to each of the USQ criteria. The explanation is to capture the technical basis for each of the answers. It is inappropriate to set a numerical margin for increases in the probability or consequences within which a positive USQD would not be triggered. If additional protective measures (either administrative or hardware-related) are warranted during an postulated accident situation to ensure adequate protection of the public or to provide worker safety, the USQD should conclude that the USQD is positive, on the basis that either an increase in probability or an increase in consequences of an accident has occurred. One could view this situation as a change that has two distinct parts. The first part causes some increase in the probability or consequences of an accident. The second part provides additional protective measures that offset the increase(s) in probability or consequences. Consolidating these two offsetting parts of a change may be effective in reducing the net risk to an acceptable value, but does not eliminate the need for DOE review and approval action on the change. DOE wants to be involved for several reasons. First, to verify that the degree of protection is adequate. Second, to ensure that the safety basis is properly revised to include the additional protective measures. Third, to verify that any hardware involved is properly classified (for example, as a safety-class SSC) and hence will receive appropriate surveillance and maintenance. When evaluating for “increases in consequences” of an accident, if the previously bounding case for that family of accidents remains the bounding case, then generally there is no increase in the consequences within the USQ process. In this regard, it is important that the family of accidents be related, in addition to being of the same type (e.g., fires), but also utilize the same set of preventative and mitigative measures. While this is appropriate for public safety, adequate protection of workers requires further evaluation. Each change must be evaluated for increases in the consequences to workers. Specific responsibilities of those performing or reviewing USQ determinations should be clearly defined. Documentation requirements should also be discussed in the implementing procedures. They should identify the level of detail necessary to document performance of the USQD and conclusions reached and include a list of references relied upon to reach this conclusion as well as guidance for the retention of records. III.D. Documentation and Retention The contractor shall retain records of USQ actions taken pursuant to 830.203 for at least the full operational lifetime of the facility, until the facility is turned over to the decommissioning and decontamination (D&D) phase. In the event that there is a change in the contractor operating the facility, the outgoing contractor shall turn over all USQ records to the incoming contractor. At the end of this life cycle phase, the contractor should consider retaining the USQ records for the next phase of the facility life cycle. The Documented Safety Analysis of the facility is required to be maintained current by contractor-developed updates on an annual basis. All changes at the facility should be reflected in these updates at an appropriate level of detail, including those that were authorized through the USQ process and 830.203. All contractors responsible for a nuclear facility are required annually to submit to DOE a summary description of all USQDs performed. This report should be submitted on a schedule commensurate with annual update of the Documented Safety Analysis. III.E. Training and Qualifications Implementing procedures should establish the personnel training and qualifications needed to perform the USQ process. These include required educational background, years and/or types of work experience, knowledge of the facility, understanding of DOE requirements related to the facility safety basis (including the USQ process), and familiarity with the facility-specific safety basis. All personnel responsible for preparing, reviewing, or approving USQ documents should receive training on the application of Section 830.203, including any facility-specific procedures. The contractor should maintain a list of those personnel who are currently qualified to perform the USQ process. This page intentionally left blank. APPENDIX A: UNREVIEWED SAFETY QUESTION DETERMINATION A.1 USQ Process The USQ determination is not a substitute for a safety analysis; it merely serves as a benchmark for whether the safety basis is being preserved. A safety analysis may show that a proposed change is safe, yet the USQ determination may find that the change is a USQ and hence requires DOE approval prior to implementation. Contractor procedures should clearly establish the differences between the concepts supporting safety analyses for the Documented Safety Analysis and those used for a USQ determination. Once it has been determined that a Section 830.203 review is required, the USQ determination can be approached by providing an answer to each of the seven questions identified using the USQ determination process. If any of these questions is answered "yes," the change is considered a USQ. An appropriate justification for each answer should be recorded. The examples given in the following subsections are provided to help the reviewer identify potential USQs. They are not meant to be examples of USQs. That determination requires consideration of the Documented Safety Analysis for the nuclear facility or other DOE approved documentation that provides the safety basis for operations or other activities and the specific details of the activity. 1. Could the Proposed Change Increase the Probability of Occurrence of an Accident Previously Evaluated in the Existing Safety Analyses? To understand how the probability of occurrence of an accident could be increased, it is important to understand how the term "accident" is applied: the term "accident" refers to the anticipated operational transients and postulated accidents considered in the Documented Safety Analysis. In answering this question, the first step is to determine the accidents, which have been evaluated in the previously approved safety basis, that may be affected by the proposed change. By focusing on the initiators of the previously evaluated accidents, a determination is made as to whether there is an increased likelihood that a given accident would occur. The following questions may provide a useful approach in making this determination. (a) Will the proposed change meet the design, material, and construction standards applicable to the SSC being modified? If the answer is "yes," this aspect of the proposed change is judged not to increase the likelihood of the occurrence of an accident. If the answer is "no" to any of the items, either a justification for saying there is no increase in the likelihood of the occurrence of an accident will need to be developed or it is concluded that the likelihood of the occurrence of an accident is increased. (b) Could the proposed change affect overall SSC performance in a manner that could increase the probability of a previously analyzed accident? Possible questions to ask are: (1) Could the proposed change use instrumentation with accuracies or response characteristics that are different from those of existing instrumentation such that an accident is more likely to occur? (2) Could the proposed change cause SSCs to be operated outside their design or testing limits? Examples include the following: overloading electrical systems, over pressurizing a piping system, and operating a motor outside its rated voltage and amperage. (3) Could the proposed change cause system vibration, water hammer, fatigue, corrosion, thermal cycling, or degradation of the environment for SSCs that would exceed the design limits? (4) Could the proposed change cause a change to any SSC interface in a way that could increase the likelihood of an accident? 2. Could the Proposed Change Increase the Consequences of an Accident Previously Evaluated in the Existing Safety Analyses? In answering this question, the first step is to determine which accidents evaluated in the safety analyses may have their radiological and hazardous material consequences altered as a direct result of the change. The next step is to determine whether the change could, in fact, increase the consequences of any of the accidents evaluated in the existing safety analyses. It is important to note that consequences to workers (in-facility and outside, or collocated) as well as to the public must be considered. Examples of questions that assist in this determination are as follows: (a) Could the proposed change degrade or prevent safety functions described or assumed in the existing safety analyses? (b) Could the proposed change alter any assumptions previously made in evaluating the radiological and hazardous material consequences in the existing safety analyses? (c) Could the proposed change play a direct role in mitigating the radiological or hazardous material consequences assumed in the existing safety analyses? (d) Could the proposed change affect the integrity or function of any fission product barrier or any radioactive or hazardous material barriers? 3. Could the Proposed Change Increase the Probability of Occurrence of a Malfunction of Safety SSCs Previously Evaluated in the Existing Safety Analyses? The safety analyses for the facility assume the proper functioning of safety SSCs in demonstrating the adequacy of design. The proper functioning of other systems, including support systems, is generally assumed. The scope of the USQ determination should include these other systems. For example, a change that does either of the following is a change that increases the probability of occurrence of a malfunction of safety SSCs: • Degrades the performance of a safety SSC, assumed to function in the accident analysis, to below the performance level assumed in the existing safety analyses • Increases the challenge to safety SSCs assumed to function in the accident analysis (e.g., more rapid pressure rise) such that safety SSC performance is degraded below that assumed in the existing safety analyses In answering this question, the first step is to determine what SSCs could be impacted by the proposed change. Then the effects of this change on safety SSCs are evaluated, including both direct and indirect effects. Direct effects are those in which the change affects the equipment (e.g., a motor change on a pump). Indirect effects are those in which the change impacts one piece of equipment, which in turn can affect safety equipment. An example of indirect effects would be one piece of equipment falling on safety equipment. After the impact of the change on safety SSCs is identified, a determination is made whether an increase in the probability of a malfunction of the safety SSCs has occurred. The following are examples of questions that can be used in making this determination. (a) Will the proposed change meet the original design specifications for materials and construction practices when the following questions are considered: (1) Are the seismic specifications met (e.g., use of proper supports, proper lugging at terminals, and isolation of lifted leads)? (2) Are separation criteria met (e.g., minimum distance between circuits in separate divisions, channels in the same division, and jumpers run in conduit)? (3) Are the environmental criteria met (e.g., use of materials suitable for the radiation or thermal environment in which they will be used)? (b) Will the proposed change degrade safety SSC reliability by-- (1) Imposing additional loads not analyzed in the design? (2) Deleting or reducing system/equipment protection features? (3) Downgrading the support system performance necessary for reliable operation of the safety equipment? (4) Reducing safety system/equipment redundancy or independence? (5) Increasing the frequency of operation of safety systems/equipment? (6) Imposing increased or more severe testing requirements on safety systems/equipment? If the change adversely impacts the safety equipment, the likelihood of equipment malfunction may be increased. A “no” answer to any question in (a) above or a "yes" answer to any question in (b) above may not mean that there is a negative impact on safety. It would, however, indicate the existence of a USQ and the need for further analyses. 4. Could the Proposed Change Increase the Consequence of a Malfunction of Safety Equipment Previously Evaluated in the Existing Safety Analyses? This question asks whether, assuming a malfunction of safety equipment, the change would result in increased hazardous-material or radiological consequences. For example, consider a change such that a valve in a safety system fails in the closed position where previously it was assumed to fail in the open position. If this change results in an increase in consequences of an accident, it indicates the change involves a USQ. 5. Could the Proposed Change Create the Possibility of an Accident of a Different Type than any Previously Evaluated in the Existing Safety Analyses? An accident or malfunction that involves an initiator or failure not considered in the nuclear facility’s existing safety analyses is potentially an accident or malfunction of a different type. An example would be turbine missiles from a gas turbine added as an alternate power source. Certain accidents or malfunctions are not treated in the nuclear facility’s existing safety analyses because their effects are bounded by similar events that are analyzed. The possible malfunctions or accidents of a different type are limited to those considered to be as likely to happen as those considered in the existing safety analyses. For example, a seismic-induced failure of a component designed to appropriate seismic criteria will not cause a malfunction of a different type. However, a change that increases the probability of an accident previously thought to be beyond extremely unlikely, so that it is as likely as the accidents considered in the existing safety analyses, creates a possible accident of a different type. In answering this question, the first step is to determine the types of accidents evaluated in the existing safety analyses. The types of credible accidents that the change could create can then be identified and listed. Evaluating the differences between the two lists will determine the answer to the question. The accidents evaluated in the existing safety analyses are generally chosen to be bounding for a broad class of credible accidents. Thus, comparison of a new accident to the existing analyses may require referral to the underlying hazard analyses. 6. Could the Proposed Change Create the Possibility of a Malfunction of Safety SSCs of a Different Type than any Previously Evaluated in the Existing Safety Analyses? To answer this question, the types of failure modes of safety SSCs that have been previously evaluated in the existing safety analyses and that would be affected by the change are identified. Then the types of failure modes that the change could create need to be identified. Comparing the two lists can provide an answer to the question. A change that might create a malfunction of a different type could be the relocation of safety equipment so that it becomes susceptible to flooding. Another might be replacement of a mechanical control system for a safety SSC with a digital control system that could potentially fail in a different mode. 7. Does the Proposed Change Reduce the Margin of Safety as Defined in the Basis for any Technical Safety Requirement? TSRs set forth the minimum acceptable limits for operation under normal and specified failure conditions; they ensure that the available safety equipment and operating conditions meet the assumptions in the existing safety analyses. TSRs provide a distillation of those aspects of the safety analyses that are required in order to ensure the performance of safety SSCs and personnel as relied on and defined in the safety analyses. The bases for TSRs define the operating limits from which margins of safety may be determined. The bases for a TSR should define the margin of safety. If the bases do not address a specific margin of safety, the Documented Safety Analysis and other appropriate safety basis documents should be reviewed to determine whether the proposed change, test or experiment, or new information has or would result in a reduction in a margin of safety. The safety margin may be implicitly described in the TSRs rather than explicitly described. A margin of safety defined in the Bases section of a TSR document may depend on a parameter other than one of the process variables. Therefore, the precise determination of a numerical value associated with a change is not always required to comply with Section 830.203. Implicit margins are, for example, conditions for acceptance for a computer code, method, or industry-accepted practice. It may be sufficient to determine only the direction of the margin change (i.e., increasing or decreasing). For purposes of performing the USQ determination, the margin of safety is the range between the TSR limits and the acceptance limit reviewed and approved by DOE as part of the authorization process. In making the judgment on whether the margin is reduced, the judgement should be based on physical parameters or conditions that can be observed or calculated. Where a change in margin is so small or the uncertainties in determining whether a change in margin has occurred are such that it cannot be concluded reasonably that the margin actually has changed (i.e., there is no clear trend toward reducing the margin), the change need not be considered a reduction in margin. With regard to the margin of safety, the change, test or experiment, or new information should be evaluated with respect to safety limits, limiting control settings (LCSs), and limiting conditions of operation (LCOs), as well as design parameters for safety systems or components. These safety margins are based on, for example, assumptions of initial conditions, conservative assumptions in computer modeling and codes, allowance for instrument drift and system response time, redundancy and independence of components in safety trains, and plant response during operating transient and accident conditions. However, a change in the margin of safety above the acceptance limit is the focus of Section 830.203. A change in initial conditions, in a system response time, or in some other parameters affecting the course of an accident analysis supporting the bases of TSRs must be evaluated to determine whether the change causes the acceptance limit to be exceeded for that analysis. If the limit is exceeded, the change would involve a reduction in the margin of safety pursuant to Section 830.203. There are "margins" associated with existing safety analyses to account for uncertainties in the design, construction, and operation of a nuclear facility (e.g., conservatisms in computer modeling and codes and allowances for instrument drift and system response time). These "margins" may be reduced by contractors, provided specific acceptance conditions, criteria, and limits (e.g., models, tests, uncertainties, and methodology) are not invalidated. To develop the definition of "margin of safety," it is to define the relationship of operating points, acceptance limits, and actual failure points. To do this, one must determine the original safety analyses of the parameter in question. A margin of safety defined in the Bases section of the TSR may depend on a parameter other than one of the process variables. However, a change in the margin will depend only on an increase in the result beyond an established acceptance limit. To answer this question, it is first to determine whether a margin of safety for any Technical Safety Requirement (TSR) is involved. To do this, the basis for each TSR related to the proposed change should be identified. If a margin of safety is defined in the TSR, or if the safety basis or basis for interim operation defines a margin of safety that TSRs were derived from, a margin of safety is involved and the effects of the change on it should be assessed. A.2 Performing USQ Determinations In performing USQ determinations of a proposed change, documented justification for the USQ determination should be developed. Consistent with the intent of Section 830.203, this documentation should be complete in the sense that a qualified independent reviewer could draw the same conclusion. The importance of the documentation is emphasized by the fact that experience and engineering knowledge, rather than models and experimental data, are frequently relied on to make the USQ determination. Since an important goal of the USQ determination is demonstration that the safety basis is being maintained, the items considered by the evaluator must be clearly stated. Documentation of the effects considered will enable the independent reviewers to assess the adequacy of the USQ determination and its conclusions. To provide an example of appropriate documentation, a USQ determination worksheet is provided below. A.3 Example USQ Determination Worksheet USQD Number: Revision No. Facility Change Number: Revision No. Facility Change Title: INTRODUCTION 1. Description of the aspects of the change being evaluated and its expected effects. 2. Identification of parameters and SSCs affected by the change. 3. Identification of the SSC failure modes associated with the change. 4. References to location of information used for the USQ determination. PART I: IMPACT ON THE ACCIDENTS EVALUATED AS THE SAFETY BASIS 1. Identify the design basis accidents reviewed for potential impact by the change. 2. Discuss how the parameters and safety SSCs affected by the change impact the consequences of these accidents. 3. Identify the design basis accidents, if any, for which failure modes associated with the change can be an initiating event. 4. Discuss the impact of the change on the probability of occurrence of the design basis accidents identified in item 3 of this Part above. 5. Identify the safety SSCs affected by the change. 6. Discuss the impact of the change or the failure modes or both associated with the change on the probability of failure of the safety SSCs identified. 7. Discuss the impact of the change on the performance of the safety SSCs. SUMMARY: PART I Yes No • Based on 2 above, could the change increase the consequences of a design basis accident? • Based on 4 above, could the change increase the probability of a design basis accident? • Based on 6 above, could the change increase the probability of a failure of a safety SSC? • Based on 7 above, could the change degrade the performance of a safety SSC below that assumed in the design basis analysis? If the answer to any of the above questions is "yes," the change represents an Unreviewed Safety Question. PART II: POTENTIAL FOR CREATION OF A NEW TYPE OF UNANALYZED EVENT 1. Based on Part I, assess the impact of the change or the failure modes or both associated with the change to determine whether the impact has modified the facility response to the point where the change can be considered a new type of event. Discuss the basis for this determination. 2. Determine whether the failure modes of safety equipment associated with the change represent a new unanalyzed type of malfunction. Discuss the basis for this determination. SUMMARY: PART II Yes No • Based on 1 and 2 above, could the change create the potential for a new type of unanalyzed event or a new type of malfunction? If the answer is "yes," the change represents an Unreviewed Safety Question. PART III: IMPACT ON THE MARGIN OF SAFETY 1. Based on the results identified in Part I, discuss the impact of the consequences on the protective boundaries. 2. Identify how the protective boundaries, if any, are directly affected by the change or a failure mode of the change. 3. Discuss the impact of the change on the design limits for the protective boundaries identified above. 4. Identify the margins of safety related to this change that are defined in the bases of Technical Safety Requirements. SUMMARY: PART III Yes No • Based on 1 above, could the consequences of the design basis accidents increase? • Based on 2, 3, and 4 above, could the change reduce the margin of safety provided for the protective boundaries? • Based on 4 above, could the change reduce other margins of safety in the bases for the Technical Safety Requirements that are not related to the boundaries? PART IV: USQ DETERMINATION CONCLUSION Based on the evaluation in Parts I, II, and III, the change-- Does not constitute an Unreviewed Safety Question. Does constitute an Unreviewed Safety Question. Preparer's Signature Date Independent Reviewer Signature Date Approval Signature Date (Use as many as appropriate) APPENDIX B: USQ LESSONS LEARNED The following list of lessons learned has been developed from experience in applying the USQ Process. B.1. Title The title of the process “Unreviewed Safety Questions” may suggest that the process determines the safety of changes. However, the USQ process is intended to determine the final approval authority for a change (that is, the contractor or DOE). The USQ process is not intended to replace or to serve instead of a safety analysis of the change. The safety implications of a change should be reviewed, analyzed, understood, addressed, determined to be acceptable, and documented by the contractor separately from the USQ process. Using the USQ process instead of the safety analysis complicates the USQ process. Further, such a usage is inappropriate because the seven questions to be answered in the USQD are not geared toward understanding whether the change is safe, but rather if any of the probability or consequence risk factors may have increased beyond what has been accepted previously by DOE, and hence if the existing safety controls remain adequate. The change should already be known to be safe before it enters the USQ process. The USQ process determines if final approval by the contractor is sufficient or DOE review and approval are required. DOE wants to review and approve those changes that involve a USQ (that is, the USQD is positive) to verify that the safety controls are adequate to provide an acceptable level of safety to the public and workers. The existence of a positive USQD does not mean that the change is unsafe, but only that DOE must take the final approval action. B.2 Identifying Inadequate Safety Analyses When an employee identifies a potentially inadequate safety analyses, the facility management is allowed a reasonable time to confirm the reasonableness of the potential for having an inadequate safety analysis. This time should be on the order of hours, up to several days, but not a matter of weeks, or months. B.3 Reporting Potential Inadequacies In Safety Analyses After the potential for having inadequate safety analyses has been confirmed, 830.203 requires four special actions to be taken. One of those actions is to notify DOE of the situation. The current DOE reporting system (DOE O 232.1A and the associated manual DOE M 232.1-1A) require that a potential degradation of the safety basis be categorized and reported as an “Off- Normal” condition. The Occurrence Reporting and Processing System (ORPS) may be used for this notification provided that such a report explicitly states that the situation involves a “potential USQ involving a potentially inadequate safety analysis.” Another action required for a potentially inadequate safety analysis is the preparation of a USQD on the situation. In the event that the USQD is positive, the current DOE reporting system requires that this condition be categorized and reported as an “Unusual Occurrence.” B.4. Control Of Hazards During Installation. Hazards that may be involved during the installation of a modification should be addressed by appropriate safety management programs (such as work planning and control, that includes job hazard analysis or a similar process). DOE relies on the contractor's commitment to various safety management programs to address the hazards involved in the actual installation of a modification for worker protection, not the USQ process. These programs include radiation protection, hazardous material protection, work planning and control, OSHA, ALARA, and lockout/tagout. One basic tenet of the USQ process is to assess the potential change in probability and consequences risk factors that might be involved when facility operations are resumed after the modification is implemented. However, sometimes a modification might be only partially implemented because it is interrupted by unforeseen circumstances. In such cases, the USQ documentation would need to be revisited to ensure that it adequately addresses operation with the partially-implemented configuration. B.5 "Declaring" A USQ To Exist. Part 830.203 gives the contractor the basic responsibility to evaluate changes and determine if a USQ exists, or is involved. If the result of the contractor’s USQD is positive, a USQ exists. DOE can make a declaration that a USQ exists as part of its oversight responsibility of the USQ process. Such a declaration might result from a disagreement with a contractor's negative USQD or might result from a condition for which the contractor has not done a USQD. When DOE declares a USQ, it is because DOE believes it should be involved in the review and approval of the situation to fulfill its responsibilities. B.6. Submittals to DOE At some sites, the completed USQ determination form is submitted routinely to DOE for approval. This practice should be reconsidered because it is not required and can shift the focus of the DOE review from the safety characteristics of the change to how well the USQD was prepared. For a potentially inadequate safety analysis, PISA, the rule requires that an evaluation of the safety of the situation (not the USQD) be submitted prior to removing any restrictions. The USQ process does not encompass all situations for which the contractor may need to request an amendment to the safety basis of a facility. For example, a change to the hazard categorization level for a facility requires DOE approval, but should not be addressed by the USQ process. Some contractors have developed a formalized process for requesting amendments to the safety basis. At some facilities, the USQ process is being used virtually every time there is need to request an amendment to the safety basis, regardless of whether or not a change to the facility or procedures is involved. In some situations, the USQ process is inappropriate. A formalized procedure that defines the content of the submittal to DOE requesting an amendment to the facility safety basis could supplement the USQ process (regarding positive USQDs). Such a procedure would also support other situations that do not involve the USQ process. Such a procedure might outline the expected content as including items such as: (1) an introductory summary of the purpose of the letter and its contents, (2) a description of the situation that generated the need for action, (3) alternative actions considered, (4) a description of the selected action, (5) engineering technical considerations, (6) safety implications of the action, including the results of the USQ process when applicable, (7) programmatic implications, (8) budgetary considerations, (9) schedule considerations, and (10) basis upon which the contractor believes that DOE should approve the action. B.7 Need for USQDs for TSR changes 10 CFR 830.205 requires that changes to the TSRs be submitted to DOE for review and approval. Changes to the TSRs could involve the need either to modify an existing TSR or to add a new TSR. If it is known that a proposed change only involves a TSR change, it is not required to go through the USQ determination to determine if DOE approval is also required by 830.203. Similarly, if a change involves a TSR change, calling the change a positive USQD just because it requires DOE approval would be inappropriate. However, while performing a USQ determination for TSR changes is not required, it may be desirable. When the TSR change is submitted to DOE for review and approval, the contractor should include appropriate information to support the contractor's position that the change should be approved (i.e., the contractor should include the basis for the proposed change). Such supporting information might include some of the same considerations that would be addressed in a USQD. B.8 Tenant/Landlord Relationships In some cases a “tenant/landlord” relationship exists, such as for research and development activities or other operations being performed by one organizational unit at a nuclear facility that is operated or managed by a different organizational unit. In these cases, the recommended approach to allow flexibility for the tenant’s activities and still protect the safety basis via the USQ process is to: (1) ensure that a hazards analysis (or other appropriate safety analysis) exists for each tenant activity such that the collective hazards analyses for all tenant activities are encompassed by the facility safety basis, (2) require that the tenant review any changes in the activities being considered against the corresponding hazards analysis (this step might be identified as a USQ “pre-screen”), and then (3) if the current hazards analysis does not envelope the change, require that the USQ process be entered more formally. There is a potential conflict between requiring that all changes within a facility be considered within a formal change control process and allowing sufficient flexibility that researchers and other tenants may conduct their activities without undue restrictions that might stifle the desired creativity. In addition, at some facilities the activities or operations conducted within the facility are considered quite separately from the facility that houses those activities. In both cases, the objective should be to impose the formality necessary to ensure that all activities are conducted safely within the DOE approved safety basis for the facility without applying any unnecessary restrictions on the activities. Having the tenant take an active role in the development of an appropriate envelope for the activities within the hazards analysis can promote ownership. This participation can also enhance safety responsibility without limiting the activities. B.9 Graded Approach The Graded Approach is applied to the USQ process only indirectly. During the hazards analysis and safety analysis processes, equipment is classified as Safety-Class, Safety-Significant, “Other” Safety, or non-safety. Once these classifications are established, they are used to indicate how much effort should be applied. However, no steps of the USQ process can be eliminated based on such grading. In some situations, attempts to apply the graded approach to the USQ process have resulted in inadequate USQDs. For example, some contractors have applied the graded approach to the change control processes in a manner that does not require the application of formal change controls unless the change involves equipment, procedures, or operations important to safety. Caution needs to be applied in such a situation to ensure that this approach does not prevent changes from being considered by the USQ process, which is a subset of change control. The only application of the graded approach to the USQ process is indirect. The graded approach may give a rough indication of how much justification or basis information should be provided when explaining the answers to each of the seven USQD criteria. More elaborate and thorough basis information would be expected for changes to safety equipment than for non-safety equipment. In any case, the justification for the answers to the USQD criteria needs to be defensible. B.10 Unified and Consolidated Procedures Contractors should consider the desirability of requiring that each nuclear facility at the site adhere to a single site-wide USQ procedure and site-wide USQ training/qualification requirements. Facility-specific considerations, such as identifying the safety basis documents, could be addressed by appendices to the site-wide procedure. At some sites, each nuclear facility uses a different USQ procedure, leading to inconsistencies and misapplications. One DOE field office assessment found that a root cause of USQ problems was the lack of a common procedure and common USQ training. A single site-wide USQ procedure could improve the quality of the USQ process by taking advantage of the best aspects of each of the different facility procedures. Using the same USQ forms for screens and USQDs and using the same training and qualification requirements can help develop a high-quality USQ process across the site. B.11 USQ Screening USQ screening is intended to be a simple Go/No-Go decision-making step, without evaluative consideration. When appropriately streamlined, this step in the USQ process can often be completed in a matter of minutes. Screening to determine whether an SSC is described in the safety analyses (safety basis) should consider only whether the equipment is identified anywhere in the safety basis. Screening criteria should not be based on whether the SSC is formally classified as a safety SSC (that is safety class or safety significant), is taken credit for in the safety analysis (or accident analysis) chapter of the safety basis document, nor whether the particular characteristic(s) of the SSC to be changed are taken credit for. The basic intent of screening is to eliminate unnecessary time and effort being spent performing a USQD if there is no possible way that the change could impact the safety basis and involve a USQ. Conversely, screening criteria must make certain that changes which could possibly involve a USQ are “screened in” and hence a USQD is performed. The USQ screening criteria center on the question of whether the item to be changed is described in the safety basis. An example of an inappropriate, highly evaluative, screening criterion is: “Does this change significantly adversely impact the capability of the ability of an SSC described in the safety basis to perform its safety functions?” Such a criterion encompasses four separate considerations: (1) determining if the SSC is identified in the safety basis, (2) finding out what the safety functions are for the SSC, which might not be stated very clearly or completely, (3) evaluating if the impact of this change could adversely affect the capability to perform a safety function, and (4) evaluating if the impact could be significant. All but the first consideration are evaluative considerations that depend strongly on which individual does the USQ Screen. These types of evaluative considerations should be in the domain of the USQD, not part of the simple screening step. If someone were to subdivide the safety basis documents into those parts that are “descriptive” and those parts that are important to safety, the results would be highly subjective. Limiting the performance of USQDs to only those SSCs taken credit for in the safety analysis chapter, or even further to only those characteristics of SSCs taken credit for can lead to serious problems, including bypassing the USQD and thereby, unknowingly exceeding the bounds of the safety basis. Similarly, limiting screening to safety SSCs (that is, those identified as Safety-Class or Safety-Significant) before a USQD is done is inappropriate due to the potential for unrecognized direct or indirect interactions. B.12 DOE Involvement in the USQD The contractor should make every effort to complete its USQDs without DOE involvement. DOE has charged the contractor with performing the USQ process to determine if contractor approval is sufficient. At times, there will be borderline cases or “gray areas” where engineering judgement will play a large role in the determination. The contractor should complete the determination with sufficient justification to defend the conclusion, despite whether the final determination is positive or negative. While DOE and the contractor are “partners” in many senses, when it comes to its nuclear safety regulatory and oversight responsibilities, DOE must maintain an appropriate degree of independence from the contractor’s activities. For the purposes of this appendix, "change" will mean any change to procedures or equipment (including prior undocumented changes), any new tests or experiments, or any new information which has the potential to invalidate the safety basis. 2 DOE G 424.X DRAFT XX-XX-XX DISTRIBUTION: INITIATED BY: All Departmental Elements Office of Nuclear and Facility Safety Policy DOE G 424.X iii DRAFT XX-XX-XX DOE G 424.X 11 DRAFT XX-XX-XX DOE G 424.X 1 DRAFT XX-XX-XX Appendix A DOE G 424.X Page A-8 DRAFT XX-XX-XX DOE G 424.X Appendix A DRAFT XX-XX-XX Page A-9 DOE G 424.X Appendix A DRAFT XX-XX-XX Page A-12 A-5 Appendix B DOE G 424.X Page B-4 DRAFT XX-XX-XX DOE G 424.X Appendix B DRAFT XX-XX-XX Page B-5 DOE G 424.X Appendix B DRAFT XX-XX-XX Page B-1

DOE G 424.X-X Draft 424.X-X Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements <AUTHOR> Richard Stark <AUTHOR_EMAIL> richard.stark@hq.doe.gov <ORG> EH <SUMMARY> The Guide was developed specifically to support the new safety basis requirements in DOE rule 10 CFR Part 830, Nuclear Safety Management. <DATE_ISSUE> 10/16/2000 <DATE_CLOSE> <DATE_REVIEW> <TEXT> DATE: OCTOBER 16, 2000 FROM: JAMES G. POWERS DIRECTOR, OFFICE OF MANAGEMENT AND OPERATIONS SUPPORT, MA-4 TO: DIRECTIVES POINTS OF CONTACT SUBJECT: DOE G 424.X-X, IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS DOE G 424.X-X, IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS is attached for your comment and use. The Guide was developed specifically to support the new safety basis requirements in DOE rule 10 CFR Part 830, Nuclear Safety Management. Comments on the revisions are due by December 18, 2000. Comments on Guides should not be designated "major" or "suggested", as in the past. From this point on, comments on Guides should be simply labeled as "comments" . Guides now have a separate coordination process in the directives system. Please refer to the memo from James G. Powers, dated March 31, 2000, subject: Management of DOE Guides. The following procedures should be followed for the submission of comments: Directives Points of Contact at Headquarters Elements: Submit one set of consolidated comments to the originator of the Guide by December 18, 2000: Richard Stark, EH-31, Germantown; facsimile (301) 903-6172; or INTERNET address: richard.stark@hq.doe.gov. Send an additional copy of comments to Craig Wisooker, MA-4, Room 4B-222, Forrestal, fax: 202-586-1972, or to craig.wisooker@hq.doe.gov. Directives Points of Contact at Field Elements: Submit consolidated comments to the Guide writer as well as a copy to MA-4. The package submitted by Field Elements shall include as an attachment the comments provided by contractors. Contractors will submit comments directly to their appropriate Field Elements. Questions concerning the content of the draft chapter to the Guide should be directed to Richard Stark, (301) 903-4407; questions on the directives system should be directed to Craig Wisooker, 202-586- 6343. Attachment DOE G 424.X-X, IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS Approved: XX-XX-00 Sunset Review: XX-XX-02 Expires: XX-XX-04 Implementation Guide for Use in Addressing Unreviewed Safety Question (USQ) Requirements U.S. Department of Energy Office of Nuclear and Facility Safety Policy FOREWORD This Department of Energy (DOE) Implementation Guide is approved by the Office of Facility and Nuclear Safety Policy and is available for use and comment by all DOE components and contractors. Beneficial comments (recommendations, additions, deletions, and any pertinent data) that may improve this document should be sent to: Richard Stark EH-53/270/GTN U.S. Department of Energy Washington, D.C. 20585 Phone (301) 903-4407 Facsimile (301) 903-6172 DOE implementation guides are part of the DOE directives system and are issued to provide supplemental information regarding the Department's expectations of its requirements as contained in rules, Orders, notices, and regulatory standards. Implementation guides also provide acceptable methods for implementing these requirements. This implementation guide may be used by all contractors for DOE hazard category 1, 2, or 3 nuclear facilities, including contractors for NNSA hazard category 1, 2, or 3 nuclear facilities. Throughout this document, wherever it references a contractor or a DOE contractor, the statement applies to a contractor for NNSA as well. This implementation guide has been developed in support of Section 830.203, “Unreviewed Safety Question Process” of 10 CFR 830, “Nuclear Safety Management.” This document provides guidance for the requirements defined in 10 CFR 830.203. This Guide imposes no requirements. CONTENTS Paragraph Page FOREWORD i I. INTRODUCTION 1 II. APPLICATION 1 1.TEMPORARY OR PERMANENT CHANGES IN THE FACILITY 2 2.TEMPORARY OR PERMANENT CHANGES IN THE PROCEDURES 3 3.TESTS OR EXPERIMENTS NOT DESCRIBED IN THE EXISTING DOCUMENTED SAFETY ANALYSES 4 4.DISCOVERY OF POTENTIAL INADEQUACIES IN THE EXISTING SAFETY ANALYSES 4 III IMPLEMENTATION GUIDANCE 5 III.A. Integrated USQ Process 6 III.B. Screening 7 III.C Unreviewed Safety Question Determinations 9 III.D. Documentation and Retention 10 III.E. Training and Qualifications 11 APPENDIX A: UNREVIEWED SAFETY QUESTION DETERMINATION 1 A.1 USQ Process 1 A.2 Performing USQ Determinations 7 A.3 Example USQ Determination Worksheet 8 APPENDIX B: USQ LESSONS LEARNED 1 B.1. Title 1 B.2 Identifying Inadequate Safety Analyses 1 B.3 Reporting Potential Inadequacies In Safety Analyses 1 B.4. Control Of Hazards During Installation. 2 B.5 "Declaring" A USQ To Exist. 2 B.6 Submittals to DOE 2 B.7 Need for USQDs for TSR changes 3 B.8 Tenant/Landlord Relationships 3 B.9 Graded Approach 4 B.10 Unified and Consolidated Procedures 4 B.11 USQ Screening 4 B.12 DOE Involvement in the USQD 5 I. INTRODUCTION This implementation guide provides information to assist in the implementation and interpretation of Section 830.203, “Unreviewed Safety Question Process,” of the Nuclear Safety Management Rules for applicable nuclear facilities owned or operated by the U.S. Department of Energy (DOE), including the NNSA. Section 830.203, “Unreviewed Safety Question Process,” was established to allow contractors to make physical and procedural changes and to conduct tests and experiments without prior DOE approval. It must be established however that these changes do not explicitly or implicitly impact the safety basis of the facility. For the purposes of the Unreviewed Safety Question (USQ) process, the safety basis includes the Documented Safety Analysis (DSA), the Technical Safety Requirements (TSRs), DOE-issued safety evaluation reports (SERs), and facility-specific commitments made in compliance with DOE rules, Orders, or policies. The intent of Section 830.203 is to provide contractors with the flexibility needed to conduct day-to-day operations and to require that only those changes with a potential impact on the safety basis, and therefore the safety of the facility, be brought to the attention of DOE for approval, prior to making the change. DOE approval of the USQ process is required by 830.203. The implementation of Section 830.203 is expected to be accomplished through contractor procedures that assure that proposed changes to physical characteristics or operating procedures are adequately evaluated, and assure that those determined to involve Unreviewed Safety Questions (USQs) are brought to the attention of DOE for review and approval prior to making changes. A proposed change or test involves a USQ if the probability or consequences of an accident or malfunction of safety structures, systems, or components (SSCs) could be increased, the possibility of a different type of accident than previously evaluated could be introduced or margins of safety as defined in TSR bases could be reduced. It is important to recognize that these considerations apply to both workers and public impacts. In addition to proposed changes, paragraph (e)(2) of the USQ Rule provides for notification of DOE and USQ determinations when a potential inadequacy in the safety analysis is identified. In this case, situations of concern are those wherein it is found that the current safety analysis may not be bounding or the current safety basis may be otherwise inadequate. This could be because of an error in the current safety analysis or because the facility configuration is not what was analyzed. The existence of an Unreviewed Safety Question (USQ) does not mean that the facility/operation is unsafe. The purpose of the USQ process is to alert DOE of events, conditions, or actions which affect the DOE approved safety basis of the facility/operation and assure appropriate DOE line management action. The purpose of the USQ process is not to determine the safety of the situation. If, however, a change is proposed or a condition is discovered that could involve an increase in the risk of operating a facility beyond that established in the current safety basis, DOE line management, including where applicable the NNSA, must review and determine the acceptability of that risk through the process of approving a revised safety basis. II. APPLICATION Section 830.203, “Unreviewed Safety Question Process,” applies to all Category 1, 2 and 3 nuclear facilities. All changes, whether temporary or permanent, to a nuclear facility require application of a USQ process. The applicability of Section 830.203 is broad. Nonsafety-related systems are not excluded by the scope of Section 830.203 if they could affect the proper operation of safety SSCs relied on in the safety basis. For example, losses of certain nonsafety-related systems may represent critical operational occurrences identified as initiators in the accident analysis. Therefore, changes to nonsafety-related systems must be evaluated and may be determined to involve an Unreviewed Safety Question (USQ). Physical interactions may also fall under the purview of Section 830.203. For example, the installation of a nonseismically supported piece of equipment above a seismically qualified component designed to perform a safety function explicitly or implicitly assumed in the existing safety analyses may constitute a USQ and must be evaluated. The following sections discuss the types of changes, tests, and experiments, as well as potential inadequacies that the USQ process needs to address to comply with Section 830.203. 1. TEMPORARY OR PERMANENT CHANGES IN THE FACILITY Section 830.203 requires USQ determinations (USQDs) for changes to a nuclear facility that alter an SSCs design, function, or method of performance as described in the existing safety analyses by text, drawing, or other information relied on as the safety basis. The safety analyses include descriptions of many SSCs, but a nuclear facility also contains many SSCs not explicitly described in the safety analyses. These can be components, subcomponents of larger components, or even entire systems. Changes to SSCs that are not explicitly discussed in the safety analyses should not be excluded from the USQ process, since changes to these SSCs may affect the ability of a safety SSC to perform its intended function. The recommended approach for deciding whether a modification involves a change to the nuclear facility, as described in the safety analyses, is to consider the effect of the change on the safety SSCs of which the SSC being modified may be a part or which the SSC being modified may support. If the change alters the design, function, or method of performing the function of the safety SSC, as described in the safety analyses, a USQD is required. Also, a change to a SSC that is not a safety SSC may affect the potential initiation of an accident or the course of an accident, so virtually no change can be ignored. The necessity to distinguish between changes and routine maintenance activities is an important consideration. Routine maintenance activities (except those that are not enveloped by current analyses or that might violate a TSR) do not require review under Section 830.203. Examples of routine maintenance activities include calibration, refurbishment, replacement with an equivalent component and housekeeping. However, there are some maintenance activities that may constitute changes, such as plant heat exchanger tube plugging where limits are not specified. Systems or components removed from service for maintenance should be covered by the TSR for allowable outage times, permissible mode conditions, and permitted reduction in redundancy. A USQD, therefore, need not be performed for these activities. However, for safety systems or components that are included in safety analyses for the nuclear facility, and for which allowed outage times are not included in the TSRs, a USQD should be completed. Understanding the term "change" as it applies to modes of operation or facility processes is also important. For example, when a facility is designed to accommodate several nuclear processes but must modify equipment lineup to accommodate another process, this change does not constitute a change under Section 830.203 if it is performed in accordance with approved procedures and was considered within the safety basis of the facility. Temporary changes to the nuclear facility should be evaluated to determine whether a USQ exists. Examples of temporary modifications include jumpers and lifted leads, temporary lead shielding on pipes and equipment, temporary blocks and bypasses, temporary supports, and equipment used on a temporary basis. The conservative approach is to provide a written USQD for any change to the nuclear facility, whether discussed in existing safety analyses or not. However, it is possible that some changes can be justified as not requiring evaluations under Section 830.203, as long as screening criteria are developed that will ensure that there are no indirect or secondary effects of the change. In this case, the screening criteria are relied on to ensure that the change does not introduce a USQ. The actual modification implementation process (e.g., work authorization system) used in the field should be reviewed for possible development of USQs. Changing plant configurations while work is in progress may involve a USQ even though the modification, when completed, may not. 2. TEMPORARY OR PERMANENT CHANGES IN THE PROCEDURES Changes to procedures that are identified in the facility Documented Safety Analysis may need to have a USQD prepared. However, as discussed below in section III.B., regarding USQ screening, some procedure changes may not require a USQD. The identification of procedures may be explicit or implicit in the facility documented safety analysis. If the procedure is implied directly by the nature of a topic in the safety basis (including the OSRs/TSRs), that change should be considered to be to a procedure described in the documented safety analysis, so that a USQD is done when appropriate. Such implicitly described procedures include: (1) the procedures that implement a Safety Management Program (SMP) described in the safety basis, and (2) operating/ maintenance procedures for safety equipment when that equipment is identified in the documented safety analysis. If the characteristics of the SMP described in the safety basis remain correct, complete, and valid, then the result of the USQD would be expected to be negative, signifying that DOE approval is not required. Procedures are not limited to those items specifically identified as procedure types (e.g., operating, chemistry, system, test, surveillance, and emergency plan) but could include anything described in the documented safety analyses that defines or describes activities or controls over the conduct of work. Changes to these activities or controls qualify as changes to procedures as described in the documented safety analyses, and therefore must be evaluated as a potential USQ. Changes to procedures include both revising an existing procedure and creating a new procedure. For the case of a new procedure, which could not be described already, the question becomes, if the Documented Safety Analysis were to be prepared (or updated) after the new procedure had been approved, is the new procedure of a type that would be identified in the Documented Safety Analysis. If so, the new procedure should have a USQD prepared. 3. TESTS OR EXPERIMENTS NOT DESCRIBED IN THE EXISTING DOCUMENTED SAFETY ANALYSES Written USQ determinations are required for tests or experiments not described in the existing safety analyses. The intent of the criteria of Section 830.203 is to require USQDs of tests and experiments that are not described in the existing safety analyses that might affect safe operations. By definition, these are tests and experiments that could degrade the margins of safety during normal operations or anticipated transients or degrade the ability of safety SSCs to prevent accidents or mitigate accident conditions. Thus, previously evaluated tests do not require written USQDs under Section 830.203. For example, for preoperational tests, surveillance tests, functional tests, and startup tests that are performed regularly, USQDs are not required every time a test is performed. However, one-of-a-kind tests used to measure the effectiveness of new techniques or a new system configuration that might affect safety SSCs will require evaluation before they can be conducted. Postmodification testing should be considered and included in the USQD for the modification. 4. DISCOVERY OF POTENTIAL INADEQUACIES IN THE EXISTING SAFETY ANALYSES Written USQ determinations are required when a contractor identifies a Potential Inadequacy of the Safety Analyses (PISA) that supports the DOE approved safety basis which indicates the safety analysis is not bounding. The intent is to ensure that the operations are conducted in a safe manner that is consistent with the safety basis. Because an inadequacy as specified above has the potential to call into question information relied on for authorization of operations, DOE requires the contractor to: 1. Take appropriate action to place or maintain the facility in a safe condition; 2. Expeditiously notify DOE upon discovery of the information; 3. Perform a USQ determination and submit it promptly; and 4. Complete an evaluation of the safety of the situation and submit it to the DOE prior to removing any operational restrictions implemented to compensate for the analytical discrepancy. If a USQ is determined to be present, the safety evaluation will require not only DOE's review but also its approval of resulting changes, before any operational restrictions are removed. The facility Documented Safety Analysis, as part of the safety basis, is important to safety for a number of reasons. Among these, the Documented Safety Analysis defines the safety risks that DOE has accepted when authorizing operation of the facility. Because of this feature, that analysis is the baseline reference for the USQ process. If that reference were to be inadequate, the USQ process would be compromised. Therefore, the USQ process includes special actions to be taken if it appears that the safety analyses might be inadequate. The Documented Safety Analysis may be inadequate for any number of reasons. In general, it is possible for a potentially inadequate analysis to arise from three entry conditions: (1) a discrepant as-found condition, (2) an operational event or incident, or (3) new information, including discovery or an error, sometimes from an external source. The main consideration is that the analysis does not match the current physical configuration of the facility, or the analysis is inappropriate or contains errors. The analysis might not match the facility configuration because of a discrepant as-found condition. Analytical errors might involve using incorrect input values, using invalid assumptions, using an improper model, or calculational errors. The USQ process starts when the facility management has information that gives reason to believe that there is the potential that the facility Documented Safety Analysis might be inadequate. III. IMPLEMENTATION GUIDANCE The USQ review process should be integrated into all technical aspects of the contractor organization responsible for design, engineering, maintenance, inspection, operations, and assessment of the nuclear facility or activity. Individuals involved in these aspects of the organization should be familiar with the requirements of Section 830.203 and should be able to identify activities that might need to enter the USQ process, while carrying out their normal responsibilities. Each facility should identify the methods by which facility changes can be made (e.g., whether changes are made under modification processes, nonconformance processes, or maintenance processes). After these methods have been identified, each facility must determine what constitutes an acceptable means to make a change. That is, the contractor must clearly control the facility change process and must perform and document changes in accordance with approved procedures. Performing a modification under the guise of maintenance is not acceptable because the proper control processes to analyze the proposed change and document its outcome would probably be absent. Identification of all means for performing a change is necessary because each one provides a direct input into the USQ process and must be integrated accordingly. The USQ process is intended to be implemented as part of a change control process that includes generalized steps for: (1) Identifying and describing the temporary or permanent change, (2) Technical reviews of the change, (3) Management review and approval of the change, (4) Implementation of the change, and (5) Documenting the change. As part of the technical reviews of a change, the contractor should perform the appropriate type of safety analysis to ascertain if the change is indeed safe. This is accomplished separately from the USQ process. The USQ process is used subsequently to determine if final approval of the change by the contractor is sufficient or if DOE approval must be obtained. Contractors should develop procedures that provide detailed guidance for the performance of the USQ process, including any screening and the USQDs. The procedures should define the purpose of the procedure; set forth the procedure's applicability; provide definitions of appropriate terms, include screening criteria, as appropriate, and the basis for their application; include detailed guidance on what must be considered and evaluated when performing or reviewing a USQD; define the qualifications needed and responsibilities of personnel performing and reviewing USQDs; and include documentation requirements for each USQD. DOE relies on the contractor's USQ process to preserve the integrity of the safety basis while allowing flexibility in operations. The contractor responsible for a DOE hazard category 1, 2 or 3 nuclear facility must submit the procedure that defines its USQ process to DOE for approval. III.A. Integrated USQ Process The USQ process should be integrated into the facility's change control processes. The change processes should ensure that the USQ process is integrated into existing procedures or that new procedures are developed, as necessary and that the need for completion of a USQD is not overlooked. Each facility should develop its own change flow process for both temporary and permanent changes to SSCs and documents. This process and its integration should be described by a governing policy, procedure, flow chart, or other description. The purpose of the governing document is to define clear relationships between the USQ process and other change control procedures, including design change procedures, configuration control programs, temporary change procedures, and procedures governing the preparation, review, and approval of procedures. Its purpose is to describe how the USQ processes required by Section 830.203 are integrated into the facility's processes and not to implement the details of the rule independently. The facility USQ procedures should provide that the USQ documents (that is, any screening and the USQD) are prepared by one individual and then reviewed technically by a second person. That person should be independent in the sense that he/she has not been involved in the preparation of the USQ documents. That person does not need to be organizationally independent. The facility USQ procedure should provide also that facility management takes approval action on the USQ documents. This ensures that management is informed of the results of the USQ process and hence can take whatever follow-up actions are appropriate, such as submitting the change to DOE for safety review and approval or canceling the proposed change. The use of a facility operating review committee to review the USQ documents and provide advice to facility management may be beneficial, but review by such a committee should not be used in lieu of the management approval action. Care should be used to avoid excessive levels of approval. Typically, one approval is sufficient, with a second corporate-level approval for positive USQDs. III.B. Screening The purpose of USQ screening is to ascertain if it is necessary to expend the valuable time and resources necessary to perform a USQD, or if there is reasonable technical justification for not performing a USQD. DOE encourages the use of screening to limit the number of matters for which USQDs must be performed, provided the reasons for exclusion are documented and well supported. When properly defined and implemented, the screening criteria should assist in reducing the efforts expended for matters of minor significance and should focus efforts more on the more important matters for which Section 830.203 is intended. Candidate items for screening include: ? Changes that involve a change to a requirement in the TSRs, or the addition of a new TSR requirement. ? The installation of an item that is an exact replacement (i.e., same manufacturer, same model number, etc.). ? The installation of an item that is on the facility “Approved Equivalent Parts” list, for which a facility engineer has evaluated and concluded that the replacement item meets all the requirements pertinent to the specific application at the facility, including the service conditions. ? Changes for which common commercial practices would suffice, and a formal nuclear- grade change control process is not warranted (for example, changing fixtures for fluorescent lighting in an office area of the facility). ? Changes for which management has already decided will be submitted to DOE for safety review and approval. ? Changes to documents that are purely editorial and make no technical change. In some situations, the screening might determine that the matter does not require any further USQ consideration. In other situations, the pre-screening part may determine that the matter should proceed directly to a USQD without any further screening consideration. The case of a potentially inadequate safety analysis is an example of this situation. In other situations, the pre-screening might determine that the matter must be submitted to DOE and hence does not require the performance of a USQD to determine if a submittal is required. A change that involves a change to a requirement in the facility TSRs is an example of this situation. Screening criteria are to be applied to those items that, by broad definition, might enter into the Section 830.203 process but for which a detailed evaluation (USQD) is not necessary. For example, an operational procedure that is described in the Documented Safety Analysis may be changed to correct a typographical error or include an additional reference to an equipment list. Such a change is not of any safety significance and clearly does not involve a USQ. If the contractor applied a screening procedure that asks: "Is the change purely editorial and without any technical change?" (that is, a spelling or typographical correction, grammatical change, clarification or additional note or reference), the reviewer could document the change and thus avoid the need to answer the detailed questions of the USQD. A different manner in which screening criteria may be applied is through categorical exclusions (for example, different procedure types). For the purpose of illustration, maintenance procedures may be considered. A basic premise of performing maintenance is that the plant will be restored to the exact same condition it was in prior to maintenance. That is, the functional capability will continue to meet or exceed those performance requirements set forth in the safety basis. A change to a maintenance procedure would therefore not be governed under Section 830.203. However, it should be understood that, whenever screening criteria are applied in this manner, DOE would expect to find an evaluation of why a categorical exclusion (for example, of maintenance procedures) from the Section 830.203 process is acceptable. Another possible screening consideration is the possibility that the matter being considered is fully covered by a previous USQD, even when location differences are considered. When considering the resolution of a non-conformance situation, it should be recognized that any disposition that involves a corrective action that does not fully meet all the existing requirements would constitute a design change. This would include a “use-as-is” disposition. This would not include an exact “restoration modification” wherein the disposition of the non-conformance is simply to replace the item with an items that meets all the requirements. In the special case of a potentially inadequate safety analyses, no screening is appropriate. For such a serious situation, a USQD must be prepared. III.C Unreviewed Safety Question Determinations Contractors are expected to provide detailed guidance and instructions on how to perform a USQ determination. Specific guidance on how to conduct a USQD is contained in Appendix A. The concepts used to develop this process are contained throughout this guidance document. A USQ determination is that record required by Section 830.203 to document the review of a "change." It records the scope of the evaluation and the logic for determining whether or not a USQ exists. For the purpose of USQ procedures and performing USQDs, the three USQ criteria in Section 830.203 (b) should be broken down into their constituent seven questions: (1) Could the proposed change increase the probability of occurrence of an accident previously evaluated in the facility’s existing safety analyses? (2) Could the proposed change increase the consequences of an accident previously evaluated in the facility’s existing safety analyses? (3) Could the proposed change increase the probability of occurrence of a malfunction of safety SSCs required by the facility’s existing safety analyses? (4) Could the proposed change increase the consequences of a malfunction of safety SSCs previously evaluated in the facility’s existing safety analyses? (5) Could the proposed change create the possibility of an accident of a different type than any previously evaluated in the facility’s existing safety analyses? (6) Could the proposed change create the possibility of a malfunction of safety SSCs of a different type than any previously evaluated in the facility’s existing safety analyses? (7) Does the proposed change reduce the margin of safety as defined in the basis for any TSR? For the purposes of this guide “safety SSCs” means SSCs that the safety analyses have shown are important to safety. The USQ procedures should require that a defensible explanation be documented for the answers to each of the USQ criteria. The explanation is to capture the technical basis for each of the answers. It is inappropriate to set a numerical margin for increases in the probability or consequences within which a positive USQD would not be triggered. If additional protective measures (either administrative or hardware-related) are warranted during an postulated accident situation to ensure adequate protection of the public or to provide worker safety, the USQD should conclude that the USQD is positive, on the basis that either an increase in probability or an increase in consequences of an accident has occurred. One could view this situation as a change that has two distinct parts. The first part causes some increase in the probability or consequences of an accident. The second part provides additional protective measures that offset the increase(s) in probability or consequences. Consolidating these two offsetting parts of a change may be effective in reducing the net risk to an acceptable value, but does not eliminate the need for DOE review and approval action on the change. DOE wants to be involved for several reasons. First, to verify that the degree of protection is adequate. Second, to ensure that the safety basis is properly revised to include the additional protective measures. Third, to verify that any hardware involved is properly classified (for example, as a safety-class SSC) and hence will receive appropriate surveillance and maintenance. When evaluating for “increases in consequences” of an accident, if the previously bounding case for that family of accidents remains the bounding case, then generally there is no increase in the consequences within the USQ process. In this regard, it is important that the family of accidents be related, in addition to being of the same type (e.g., fires), but also utilize the same set of preventative and mitigative measures. While this is appropriate for public safety, adequate protection of workers requires further evaluation. Each change must be evaluated for increases in the consequences to workers. Specific responsibilities of those performing or reviewing USQ determinations should be clearly defined. Documentation requirements should also be discussed in the implementing procedures. They should identify the level of detail necessary to document performance of the USQD and conclusions reached and include a list of references relied upon to reach this conclusion as well as guidance for the retention of records. III.D. Documentation and Retention The contractor shall retain records of USQ actions taken pursuant to 830.203 for at least the full operational lifetime of the facility, until the facility is turned over to the decommissioning and decontamination (D&D) phase. In the event that there is a change in the contractor operating the facility, the outgoing contractor shall turn over all USQ records to the incoming contractor. At the end of this life cycle phase, the contractor should consider retaining the USQ records for the next phase of the facility life cycle. The Documented Safety Analysis of the facility is required to be maintained current by contractor-developed updates on an annual basis. All changes at the facility should be reflected in these updates at an appropriate level of detail, including those that were authorized through the USQ process and 830.203. All contractors responsible for a nuclear facility are required annually to submit to DOE a summary description of all USQDs performed. This report should be submitted on a schedule commensurate with annual update of the Documented Safety Analysis. III.E. Training and Qualifications Implementing procedures should establish the personnel training and qualifications needed to perform the USQ process. These include required educational background, years and/or types of work experience, knowledge of the facility, understanding of DOE requirements related to the facility safety basis (including the USQ process), and familiarity with the facility-specific safety basis. All personnel responsible for preparing, reviewing, or approving USQ documents should receive training on the application of Section 830.203, including any facility-specific procedures. The contractor should maintain a list of those personnel who are currently qualified to perform the USQ process. This page intentionally left blank. APPENDIX A: UNREVIEWED SAFETY QUESTION DETERMINATION A.1 USQ Process The USQ determination is not a substitute for a safety analysis; it merely serves as a benchmark for whether the safety basis is being preserved. A safety analysis may show that a proposed change is safe, yet the USQ determination may find that the change is a USQ and hence requires DOE approval prior to implementation. Contractor procedures should clearly establish the differences between the concepts supporting safety analyses for the Documented Safety Analysis and those used for a USQ determination. Once it has been determined that a Section 830.203 review is required, the USQ determination can be approached by providing an answer to each of the seven questions identified using the USQ determination process. If any of these questions is answered "yes," the change is considered a USQ. An appropriate justification for each answer should be recorded. The examples given in the following subsections are provided to help the reviewer identify potential USQs. They are not meant to be examples of USQs. That determination requires consideration of the Documented Safety Analysis for the nuclear facility or other DOE approved documentation that provides the safety basis for operations or other activities and the specific details of the activity. 1. Could the Proposed Change Increase the Probability of Occurrence of an Accident Previously Evaluated in the Existing Safety Analyses? To understand how the probability of occurrence of an accident could be increased, it is important to understand how the term "accident" is applied: the term "accident" refers to the anticipated operational transients and postulated accidents considered in the Documented Safety Analysis. In answering this question, the first step is to determine the accidents, which have been evaluated in the previously approved safety basis, that may be affected by the proposed change. By focusing on the initiators of the previously evaluated accidents, a determination is made as to whether there is an increased likelihood that a given accident would occur. The following questions may provide a useful approach in making this determination. (a) Will the proposed change meet the design, material, and construction standards applicable to the SSC being modified? If the answer is "yes," this aspect of the proposed change is judged not to increase the likelihood of the occurrence of an accident. If the answer is "no" to any of the items, either a justification for saying there is no increase in the likelihood of the occurrence of an accident will need to be developed or it is concluded that the likelihood of the occurrence of an accident is increased. (b) Could the proposed change affect overall SSC performance in a manner that could increase the probability of a previously analyzed accident? Possible questions to ask are: (1) Could the proposed change use instrumentation with accuracies or response characteristics that are different from those of existing instrumentation such that an accident is more likely to occur? (2) Could the proposed change cause SSCs to be operated outside their design or testing limits? Examples include the following: overloading electrical systems, over pressurizing a piping system, and operating a motor outside its rated voltage and amperage. (3) Could the proposed change cause system vibration, water hammer, fatigue, corrosion, thermal cycling, or degradation of the environment for SSCs that would exceed the design limits? (4) Could the proposed change cause a change to any SSC interface in a way that could increase the likelihood of an accident? 2. Could the Proposed Change Increase the Consequences of an Accident Previously Evaluated in the Existing Safety Analyses? In answering this question, the first step is to determine which accidents evaluated in the safety analyses may have their radiological and hazardous material consequences altered as a direct result of the change. The next step is to determine whether the change could, in fact, increase the consequences of any of the accidents evaluated in the existing safety analyses. It is important to note that consequences to workers (in-facility and outside, or collocated) as well as to the public must be considered. Examples of questions that assist in this determination are as follows: (a) Could the proposed change degrade or prevent safety functions described or assumed in the existing safety analyses? (b) Could the proposed change alter any assumptions previously made in evaluating the radiological and hazardous material consequences in the existing safety analyses? (c) Could the proposed change play a direct role in mitigating the radiological or hazardous material consequences assumed in the existing safety analyses? (d) Could the proposed change affect the integrity or function of any fission product barrier or any radioactive or hazardous material barriers? 3. Could the Proposed Change Increase the Probability of Occurrence of a Malfunction of Safety SSCs Previously Evaluated in the Existing Safety Analyses? The safety analyses for the facility assume the proper functioning of safety SSCs in demonstrating the adequacy of design. The proper functioning of other systems, including support systems, is generally assumed. The scope of the USQ determination should include these other systems. For example, a change that does either of the following is a change that increases the probability of occurrence of a malfunction of safety SSCs: • Degrades the performance of a safety SSC, assumed to function in the accident analysis, to below the performance level assumed in the existing safety analyses • Increases the challenge to safety SSCs assumed to function in the accident analysis (e.g., more rapid pressure rise) such that safety SSC performance is degraded below that assumed in the existing safety analyses In answering this question, the first step is to determine what SSCs could be impacted by the proposed change. Then the effects of this change on safety SSCs are evaluated, including both direct and indirect effects. Direct effects are those in which the change affects the equipment (e.g., a motor change on a pump). Indirect effects are those in which the change impacts one piece of equipment, which in turn can affect safety equipment. An example of indirect effects would be one piece of equipment falling on safety equipment. After the impact of the change on safety SSCs is identified, a determination is made whether an increase in the probability of a malfunction of the safety SSCs has occurred. The following are examples of questions that can be used in making this determination. (a) Will the proposed change meet the original design specifications for materials and construction practices when the following questions are considered: (1) Are the seismic specifications met (e.g., use of proper supports, proper lugging at terminals, and isolation of lifted leads)? (2) Are separation criteria met (e.g., minimum distance between circuits in separate divisions, channels in the same division, and jumpers run in conduit)? (3) Are the environmental criteria met (e.g., use of materials suitable for the radiation or thermal environment in which they will be used)? (b) Will the proposed change degrade safety SSC reliability by-- (1) Imposing additional loads not analyzed in the design? (2) Deleting or reducing system/equipment protection features? (3) Downgrading the support system performance necessary for reliable operation of the safety equipment? (4) Reducing safety system/equipment redundancy or independence? (5) Increasing the frequency of operation of safety systems/equipment? (6) Imposing increased or more severe testing requirements on safety systems/equipment? If the change adversely impacts the safety equipment, the likelihood of equipment malfunction may be increased. A “no” answer to any question in (a) above or a "yes" answer to any question in (b) above may not mean that there is a negative impact on safety. It would, however, indicate the existence of a USQ and the need for further analyses. 4. Could the Proposed Change Increase the Consequence of a Malfunction of Safety Equipment Previously Evaluated in the Existing Safety Analyses? This question asks whether, assuming a malfunction of safety equipment, the change would result in increased hazardous-material or radiological consequences. For example, consider a change such that a valve in a safety system fails in the closed position where previously it was assumed to fail in the open position. If this change results in an increase in consequences of an accident, it indicates the change involves a USQ. 5. Could the Proposed Change Create the Possibility of an Accident of a Different Type than any Previously Evaluated in the Existing Safety Analyses? An accident or malfunction that involves an initiator or failure not considered in the nuclear facility’s existing safety analyses is potentially an accident or malfunction of a different type. An example would be turbine missiles from a gas turbine added as an alternate power source. Certain accidents or malfunctions are not treated in the nuclear facility’s existing safety analyses because their effects are bounded by similar events that are analyzed. The possible malfunctions or accidents of a different type are limited to those considered to be as likely to happen as those considered in the existing safety analyses. For example, a seismic-induced failure of a component designed to appropriate seismic criteria will not cause a malfunction of a different type. However, a change that increases the probability of an accident previously thought to be beyond extremely unlikely, so that it is as likely as the accidents considered in the existing safety analyses, creates a possible accident of a different type. In answering this question, the first step is to determine the types of accidents evaluated in the existing safety analyses. The types of credible accidents that the change could create can then be identified and listed. Evaluating the differences between the two lists will determine the answer to the question. The accidents evaluated in the existing safety analyses are generally chosen to be bounding for a broad class of credible accidents. Thus, comparison of a new accident to the existing analyses may require referral to the underlying hazard analyses. 6. Could the Proposed Change Create the Possibility of a Malfunction of Safety SSCs of a Different Type than any Previously Evaluated in the Existing Safety Analyses? To answer this question, the types of failure modes of safety SSCs that have been previously evaluated in the existing safety analyses and that would be affected by the change are identified. Then the types of failure modes that the change could create need to be identified. Comparing the two lists can provide an answer to the question. A change that might create a malfunction of a different type could be the relocation of safety equipment so that it becomes susceptible to flooding. Another might be replacement of a mechanical control system for a safety SSC with a digital control system that could potentially fail in a different mode. 7. Does the Proposed Change Reduce the Margin of Safety as Defined in the Basis for any Technical Safety Requirement? TSRs set forth the minimum acceptable limits for operation under normal and specified failure conditions; they ensure that the available safety equipment and operating conditions meet the assumptions in the existing safety analyses. TSRs provide a distillation of those aspects of the safety analyses that are required in order to ensure the performance of safety SSCs and personnel as relied on and defined in the safety analyses. The bases for TSRs define the operating limits from which margins of safety may be determined. The bases for a TSR should define the margin of safety. If the bases do not address a specific margin of safety, the Documented Safety Analysis and other appropriate safety basis documents should be reviewed to determine whether the proposed change, test or experiment, or new information has or would result in a reduction in a margin of safety. The safety margin may be implicitly described in the TSRs rather than explicitly described. A margin of safety defined in the Bases section of a TSR document may depend on a parameter other than one of the process variables. Therefore, the precise determination of a numerical value associated with a change is not always required to comply with Section 830.203. Implicit margins are, for example, conditions for acceptance for a computer code, method, or industry-accepted practice. It may be sufficient to determine only the direction of the margin change (i.e., increasing or decreasing). For purposes of performing the USQ determination, the margin of safety is the range between the TSR limits and the acceptance limit reviewed and approved by DOE as part of the authorization process. In making the judgment on whether the margin is reduced, the judgement should be based on physical parameters or conditions that can be observed or calculated. Where a change in margin is so small or the uncertainties in determining whether a change in margin has occurred are such that it cannot be concluded reasonably that the margin actually has changed (i.e., there is no clear trend toward reducing the margin), the change need not be considered a reduction in margin. With regard to the margin of safety, the change, test or experiment, or new information should be evaluated with respect to safety limits, limiting control settings (LCSs), and limiting conditions of operation (LCOs), as well as design parameters for safety systems or components. These safety margins are based on, for example, assumptions of initial conditions, conservative assumptions in computer modeling and codes, allowance for instrument drift and system response time, redundancy and independence of components in safety trains, and plant response during operating transient and accident conditions. However, a change in the margin of safety above the acceptance limit is the focus of Section 830.203. A change in initial conditions, in a system response time, or in some other parameters affecting the course of an accident analysis supporting the bases of TSRs must be evaluated to determine whether the change causes the acceptance limit to be exceeded for that analysis. If the limit is exceeded, the change would involve a reduction in the margin of safety pursuant to Section 830.203. There are "margins" associated with existing safety analyses to account for uncertainties in the design, construction, and operation of a nuclear facility (e.g., conservatisms in computer modeling and codes and allowances for instrument drift and system response time). These "margins" may be reduced by contractors, provided specific acceptance conditions, criteria, and limits (e.g., models, tests, uncertainties, and methodology) are not invalidated. To develop the definition of "margin of safety," it is to define the relationship of operating points, acceptance limits, and actual failure points. To do this, one must determine the original safety analyses of the parameter in question. A margin of safety defined in the Bases section of the TSR may depend on a parameter other than one of the process variables. However, a change in the margin will depend only on an increase in the result beyond an established acceptance limit. To answer this question, it is first to determine whether a margin of safety for any Technical Safety Requirement (TSR) is involved. To do this, the basis for each TSR related to the proposed change should be identified. If a margin of safety is defined in the TSR, or if the safety basis or basis for interim operation defines a margin of safety that TSRs were derived from, a margin of safety is involved and the effects of the change on it should be assessed. A.2 Performing USQ Determinations In performing USQ determinations of a proposed change, documented justification for the USQ determination should be developed. Consistent with the intent of Section 830.203, this documentation should be complete in the sense that a qualified independent reviewer could draw the same conclusion. The importance of the documentation is emphasized by the fact that experience and engineering knowledge, rather than models and experimental data, are frequently relied on to make the USQ determination. Since an important goal of the USQ determination is demonstration that the safety basis is being maintained, the items considered by the evaluator must be clearly stated. Documentation of the effects considered will enable the independent reviewers to assess the adequacy of the USQ determination and its conclusions. To provide an example of appropriate documentation, a USQ determination worksheet is provided below. A.3 Example USQ Determination Worksheet USQD Number: Revision No. Facility Change Number: Revision No. Facility Change Title: INTRODUCTION 1. Description of the aspects of the change being evaluated and its expected effects. 2. Identification of parameters and SSCs affected by the change. 3. Identification of the SSC failure modes associated with the change. 4. References to location of information used for the USQ determination. PART I: IMPACT ON THE ACCIDENTS EVALUATED AS THE SAFETY BASIS 1. Identify the design basis accidents reviewed for potential impact by the change. 2. Discuss how the parameters and safety SSCs affected by the change impact the consequences of these accidents. 3. Identify the design basis accidents, if any, for which failure modes associated with the change can be an initiating event. 4. Discuss the impact of the change on the probability of occurrence of the design basis accidents identified in item 3 of this Part above. 5. Identify the safety SSCs affected by the change. 6. Discuss the impact of the change or the failure modes or both associated with the change on the probability of failure of the safety SSCs identified. 7. Discuss the impact of the change on the performance of the safety SSCs. SUMMARY: PART I Yes No • Based on 2 above, could the change increase the consequences of a design basis accident? • Based on 4 above, could the change increase the probability of a design basis accident? • Based on 6 above, could the change increase the probability of a failure of a safety SSC? • Based on 7 above, could the change degrade the performance of a safety SSC below that assumed in the design basis analysis? If the answer to any of the above questions is "yes," the change represents an Unreviewed Safety Question. PART II: POTENTIAL FOR CREATION OF A NEW TYPE OF UNANALYZED EVENT 1. Based on Part I, assess the impact of the change or the failure modes or both associated with the change to determine whether the impact has modified the facility response to the point where the change can be considered a new type of event. Discuss the basis for this determination. 2. Determine whether the failure modes of safety equipment associated with the change represent a new unanalyzed type of malfunction. Discuss the basis for this determination. SUMMARY: PART II Yes No • Based on 1 and 2 above, could the change create the potential for a new type of unanalyzed event or a new type of malfunction? If the answer is "yes," the change represents an Unreviewed Safety Question. PART III: IMPACT ON THE MARGIN OF SAFETY 1. Based on the results identified in Part I, discuss the impact of the consequences on the protective boundaries. 2. Identify how the protective boundaries, if any, are directly affected by the change or a failure mode of the change. 3. Discuss the impact of the change on the design limits for the protective boundaries identified above. 4. Identify the margins of safety related to this change that are defined in the bases of Technical Safety Requirements. SUMMARY: PART III Yes No • Based on 1 above, could the consequences of the design basis accidents increase? • Based on 2, 3, and 4 above, could the change reduce the margin of safety provided for the protective boundaries? • Based on 4 above, could the change reduce other margins of safety in the bases for the Technical Safety Requirements that are not related to the boundaries? PART IV: USQ DETERMINATION CONCLUSION Based on the evaluation in Parts I, II, and III, the change-- Does not constitute an Unreviewed Safety Question. Does constitute an Unreviewed Safety Question. Preparer's Signature Date Independent Reviewer Signature Date Approval Signature Date (Use as many as appropriate) APPENDIX B: USQ LESSONS LEARNED The following list of lessons learned has been developed from experience in applying the USQ Process. B.1. Title The title of the process “Unreviewed Safety Questions” may suggest that the process determines the safety of changes. However, the USQ process is intended to determine the final approval authority for a change (that is, the contractor or DOE). The USQ process is not intended to replace or to serve instead of a safety analysis of the change. The safety implications of a change should be reviewed, analyzed, understood, addressed, determined to be acceptable, and documented by the contractor separately from the USQ process. Using the USQ process instead of the safety analysis complicates the USQ process. Further, such a usage is inappropriate because the seven questions to be answered in the USQD are not geared toward understanding whether the change is safe, but rather if any of the probability or consequence risk factors may have increased beyond what has been accepted previously by DOE, and hence if the existing safety controls remain adequate. The change should already be known to be safe before it enters the USQ process. The USQ process determines if final approval by the contractor is sufficient or DOE review and approval are required. DOE wants to review and approve those changes that involve a USQ (that is, the USQD is positive) to verify that the safety controls are adequate to provide an acceptable level of safety to the public and workers. The existence of a positive USQD does not mean that the change is unsafe, but only that DOE must take the final approval action. B.2 Identifying Inadequate Safety Analyses When an employee identifies a potentially inadequate safety analyses, the facility management is allowed a reasonable time to confirm the reasonableness of the potential for having an inadequate safety analysis. This time should be on the order of hours, up to several days, but not a matter of weeks, or months. B.3 Reporting Potential Inadequacies In Safety Analyses After the potential for having inadequate safety analyses has been confirmed, 830.203 requires four special actions to be taken. One of those actions is to notify DOE of the situation. The current DOE reporting system (DOE O 232.1A and the associated manual DOE M 232.1-1A) require that a potential degradation of the safety basis be categorized and reported as an “Off- Normal” condition. The Occurrence Reporting and Processing System (ORPS) may be used for this notification provided that such a report explicitly states that the situation involves a “potential USQ involving a potentially inadequate safety analysis.” Another action required for a potentially inadequate safety analysis is the preparation of a USQD on the situation. In the event that the USQD is positive, the current DOE reporting system requires that this condition be categorized and reported as an “Unusual Occurrence.” B.4. Control Of Hazards During Installation. Hazards that may be involved during the installation of a modification should be addressed by appropriate safety management programs (such as work planning and control, that includes job hazard analysis or a similar process). DOE relies on the contractor's commitment to various safety management programs to address the hazards involved in the actual installation of a modification for worker protection, not the USQ process. These programs include radiation protection, hazardous material protection, work planning and control, OSHA, ALARA, and lockout/tagout. One basic tenet of the USQ process is to assess the potential change in probability and consequences risk factors that might be involved when facility operations are resumed after the modification is implemented. However, sometimes a modification might be only partially implemented because it is interrupted by unforeseen circumstances. In such cases, the USQ documentation would need to be revisited to ensure that it adequately addresses operation with the partially-implemented configuration. B.5 "Declaring" A USQ To Exist. Part 830.203 gives the contractor the basic responsibility to evaluate changes and determine if a USQ exists, or is involved. If the result of the contractor’s USQD is positive, a USQ exists. DOE can make a declaration that a USQ exists as part of its oversight responsibility of the USQ process. Such a declaration might result from a disagreement with a contractor's negative USQD or might result from a condition for which the contractor has not done a USQD. When DOE declares a USQ, it is because DOE believes it should be involved in the review and approval of the situation to fulfill its responsibilities. B.6. Submittals to DOE At some sites, the completed USQ determination form is submitted routinely to DOE for approval. This practice should be reconsidered because it is not required and can shift the focus of the DOE review from the safety characteristics of the change to how well the USQD was prepared. For a potentially inadequate safety analysis, PISA, the rule requires that an evaluation of the safety of the situation (not the USQD) be submitted prior to removing any restrictions. The USQ process does not encompass all situations for which the contractor may need to request an amendment to the safety basis of a facility. For example, a change to the hazard categorization level for a facility requires DOE approval, but should not be addressed by the USQ process. Some contractors have developed a formalized process for requesting amendments to the safety basis. At some facilities, the USQ process is being used virtually every time there is need to request an amendment to the safety basis, regardless of whether or not a change to the facility or procedures is involved. In some situations, the USQ process is inappropriate. A formalized procedure that defines the content of the submittal to DOE requesting an amendment to the facility safety basis could supplement the USQ process (regarding positive USQDs). Such a procedure would also support other situations that do not involve the USQ process. Such a procedure might outline the expected content as including items such as: (1) an introductory summary of the purpose of the letter and its contents, (2) a description of the situation that generated the need for action, (3) alternative actions considered, (4) a description of the selected action, (5) engineering technical considerations, (6) safety implications of the action, including the results of the USQ process when applicable, (7) programmatic implications, (8) budgetary considerations, (9) schedule considerations, and (10) basis upon which the contractor believes that DOE should approve the action. B.7 Need for USQDs for TSR changes 10 CFR 830.205 requires that changes to the TSRs be submitted to DOE for review and approval. Changes to the TSRs could involve the need either to modify an existing TSR or to add a new TSR. If it is known that a proposed change only involves a TSR change, it is not required to go through the USQ determination to determine if DOE approval is also required by 830.203. Similarly, if a change involves a TSR change, calling the change a positive USQD just because it requires DOE approval would be inappropriate. However, while performing a USQ determination for TSR changes is not required, it may be desirable. When the TSR change is submitted to DOE for review and approval, the contractor should include appropriate information to support the contractor's position that the change should be approved (i.e., the contractor should include the basis for the proposed change). Such supporting information might include some of the same considerations that would be addressed in a USQD. B.8 Tenant/Landlord Relationships In some cases a “tenant/landlord” relationship exists, such as for research and development activities or other operations being performed by one organizational unit at a nuclear facility that is operated or managed by a different organizational unit. In these cases, the recommended approach to allow flexibility for the tenant’s activities and still protect the safety basis via the USQ process is to: (1) ensure that a hazards analysis (or other appropriate safety analysis) exists for each tenant activity such that the collective hazards analyses for all tenant activities are encompassed by the facility safety basis, (2) require that the tenant review any changes in the activities being considered against the corresponding hazards analysis (this step might be identified as a USQ “pre-screen”), and then (3) if the current hazards analysis does not envelope the change, require that the USQ process be entered more formally. There is a potential conflict between requiring that all changes within a facility be considered within a formal change control process and allowing sufficient flexibility that researchers and other tenants may conduct their activities without undue restrictions that might stifle the desired creativity. In addition, at some facilities the activities or operations conducted within the facility are considered quite separately from the facility that houses those activities. In both cases, the objective should be to impose the formality necessary to ensure that all activities are conducted safely within the DOE approved safety basis for the facility without applying any unnecessary restrictions on the activities. Having the tenant take an active role in the development of an appropriate envelope for the activities within the hazards analysis can promote ownership. This participation can also enhance safety responsibility without limiting the activities. B.9 Graded Approach The Graded Approach is applied to the USQ process only indirectly. During the hazards analysis and safety analysis processes, equipment is classified as Safety-Class, Safety-Significant, “Other” Safety, or non-safety. Once these classifications are established, they are used to indicate how much effort should be applied. However, no steps of the USQ process can be eliminated based on such grading. In some situations, attempts to apply the graded approach to the USQ process have resulted in inadequate USQDs. For example, some contractors have applied the graded approach to the change control processes in a manner that does not require the application of formal change controls unless the change involves equipment, procedures, or operations important to safety. Caution needs to be applied in such a situation to ensure that this approach does not prevent changes from being considered by the USQ process, which is a subset of change control. The only application of the graded approach to the USQ process is indirect. The graded approach may give a rough indication of how much justification or basis information should be provided when explaining the answers to each of the seven USQD criteria. More elaborate and thorough basis information would be expected for changes to safety equipment than for non-safety equipment. In any case, the justification for the answers to the USQD criteria needs to be defensible. B.10 Unified and Consolidated Procedures Contractors should consider the desirability of requiring that each nuclear facility at the site adhere to a single site-wide USQ procedure and site-wide USQ training/qualification requirements. Facility-specific considerations, such as identifying the safety basis documents, could be addressed by appendices to the site-wide procedure. At some sites, each nuclear facility uses a different USQ procedure, leading to inconsistencies and misapplications. One DOE field office assessment found that a root cause of USQ problems was the lack of a common procedure and common USQ training. A single site-wide USQ procedure could improve the quality of the USQ process by taking advantage of the best aspects of each of the different facility procedures. Using the same USQ forms for screens and USQDs and using the same training and qualification requirements can help develop a high-quality USQ process across the site. B.11 USQ Screening USQ screening is intended to be a simple Go/No-Go decision-making step, without evaluative consideration. When appropriately streamlined, this step in the USQ process can often be completed in a matter of minutes. Screening to determine whether an SSC is described in the safety analyses (safety basis) should consider only whether the equipment is identified anywhere in the safety basis. Screening criteria should not be based on whether the SSC is formally classified as a safety SSC (that is safety class or safety significant), is taken credit for in the safety analysis (or accident analysis) chapter of the safety basis document, nor whether the particular characteristic(s) of the SSC to be changed are taken credit for. The basic intent of screening is to eliminate unnecessary time and effort being spent performing a USQD if there is no possible way that the change could impact the safety basis and involve a USQ. Conversely, screening criteria must make certain that changes which could possibly involve a USQ are “screened in” and hence a USQD is performed. The USQ screening criteria center on the question of whether the item to be changed is described in the safety basis. An example of an inappropriate, highly evaluative, screening criterion is: “Does this change significantly adversely impact the capability of the ability of an SSC described in the safety basis to perform its safety functions?” Such a criterion encompasses four separate considerations: (1) determining if the SSC is identified in the safety basis, (2) finding out what the safety functions are for the SSC, which might not be stated very clearly or completely, (3) evaluating if the impact of this change could adversely affect the capability to perform a safety function, and (4) evaluating if the impact could be significant. All but the first consideration are evaluative considerations that depend strongly on which individual does the USQ Screen. These types of evaluative considerations should be in the domain of the USQD, not part of the simple screening step. If someone were to subdivide the safety basis documents into those parts that are “descriptive” and those parts that are important to safety, the results would be highly subjective. Limiting the performance of USQDs to only those SSCs taken credit for in the safety analysis chapter, or even further to only those characteristics of SSCs taken credit for can lead to serious problems, including bypassing the USQD and thereby, unknowingly exceeding the bounds of the safety basis. Similarly, limiting screening to safety SSCs (that is, those identified as Safety-Class or Safety-Significant) before a USQD is done is inappropriate due to the potential for unrecognized direct or indirect interactions. B.12 DOE Involvement in the USQD The contractor should make every effort to complete its USQDs without DOE involvement. DOE has charged the contractor with performing the USQ process to determine if contractor approval is sufficient. At times, there will be borderline cases or “gray areas” where engineering judgement will play a large role in the determination. The contractor should complete the determination with sufficient justification to defend the conclusion, despite whether the final determination is positive or negative. While DOE and the contractor are “partners” in many senses, when it comes to its nuclear safety regulatory and oversight responsibilities, DOE must maintain an appropriate degree of independence from the contractor’s activities. For the purposes of this appendix, "change" will mean any change to procedures or equipment (including prior undocumented changes), any new tests or experiments, or any new information which has the potential to invalidate the safety basis. 2 DOE G 424.X DRAFT XX-XX-XX DISTRIBUTION: INITIATED BY: All Departmental Elements Office of Nuclear and Facility Safety Policy DOE G 424.X iii DRAFT XX-XX-XX DOE G 424.X 11 DRAFT XX-XX-XX DOE G 424.X 1 DRAFT XX-XX-XX Appendix A DOE G 424.X Page A-8 DRAFT XX-XX-XX DOE G 424.X Appendix A DRAFT XX-XX-XX Page A-9 DOE G 424.X Appendix A DRAFT XX-XX-XX Page A-12 A-5 Appendix B DOE G 424.X Page B-4 DRAFT XX-XX-XX DOE G 424.X Appendix B DRAFT XX-XX-XX Page B-5 DOE G 424.X Appendix B DRAFT XX-XX-XX Page B-1