DOE-STD-1073-2003, Configuration Management

S NOT MEASUREMENT SENSITIVE DOE-STD-1073-2003 October 2003 DOE STANDARD Configuration Management U.S. Department of Energy AREA CMAN Washington, D.C. 20585 DISTRIBUTION STATEMENT: Approved for public release; further dissemination unlimited. DOE-STD-1073-2003 Configuration Management This document has been reproduced from the best available copy. Available to DOE and DOE contractors from ES&H Technical Information Services, U.S. Department of Energy, (800) 473-4375, fax (301) 903-9823 or on the web at http://tis.eh.doe.gov/techstds/. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 605-6000. ii DOE-STD-1073-2003 Configuration Management FOREWORD This Department of Energy (DOE) Technical Standard is available for use by DOE contractors and subcontractors and DOE operators responsible for DOE nuclear activities. It was written to apply to DOE hazard category 1, 2, and 3 nuclear facilities, but elements of this standard can be successfully applied to other types of facilities, activities, and operations, both nuclear and non-nuclear. This standard was developed using the consensus process of the DOE Technical Standards Program. Beneficial comments (recommendations, additions, deletions, and any pertinent data that may improve this document) should be sent to Mary Haughey at: U.S. Department of Energy 1000 Independence Avenue, SW EH-22/270CC/GTN Washington, D.C. 20585-0270 ATTN: Mary Haughey Phone: (301) 903-2867 Facsimile: (301) 903-6172 Email: Mary.Haughey@eh.doe.gov You may also use the pre-addressed Document Improvement Proposal Form, DOE F 1300.3, at the end of this standard to submit your comments. This standard is part of the DOE Technical Standards Program and is issued to provide supplemental information regarding the Department's expectations for configuration management of DOE nuclear activities. It provides guidance to DOE personnel and contractors for the development of a configuration management process for the design, operational, or post-operational phase of a DOE nuclear facility or activity. The guidance presented in this standard is based on configuration management guidance from various non-government standards, nuclear utility configuration management practices, and configuration management experience at DOE facilities. DOE contractors should refer to the guidance in this standard when developing procedures and other work processes involving configuration management. Appendix A lists the documents and standards that are either referenced within this standard or were consulted during the development of this standard. Appendix B contains a glossary of terms used in this standard and Appendix C lists the acronyms used in this standard. The following DOE directives contain requirements directly or indirectly related to configuration management of DOE nuclear activities and should be consulted regarding requirements for configuration management: iii mailto:Mary.Haughey@eh.doe.gov DOE-STD-1073-2003 Configuration Management • 10 Code of Federal Regulations (CFR) Part 830, Nuclear Safety Management • DOE O (Order) 413.3, Program and Project Management for the Acquisition of Capital Assets • DOE O 420.1A, Nuclear Facility Safety • DOE O 433.1, Maintenance Management Program for DOE Nuclear Facilities

In addition the process safety management provisions of 29 CFR 1910.119 contain requirements for management of change that can be addressed through the configuration management process in this standard. Contractors operate most DOE facilities. These facilities are referred to as government- owned, contractor-operated (GOCO) facilities. Consequently, most responsibilities for configuration management identified in this standard are to be performed by contractors. However, DOE personnel, not contractors, perform work at government-owned, government-operated (GOGO) activities. Therefore, throughout this standard, wherever an action is assigned to a contractor it should be assumed that the DOE operator should perform the action for GOGO activities. Much of the material in the original version of this standard issued in November 1993 was provided to establish configuration management programs for existing facilities where none existed. This involved a substantial effort including, in some cases, reconstitution of the design bases. The intent of this version of the standard is to provide guidance for continued management of the configuration of existing facilities and the establishment of configuration management processes for new facilities. For this reason, some of the material that addressed establishing a configuration management process for an existing facility has been deleted. Other discussions, such as the process for reconstituting a design basis, have been retained in the appendices as potentially useful reference material, but not part of the main focus of this standard. We have deleted the discussion on material condition and aging because it is a subject that is more appropriately covered in DOE directives on maintenance. We have also deleted the reference to configuration management “programs” to emphasize that configuration management should be part of an integrated management scheme and not a separate, isolated effort. We have added a section on work control, consistent with the work control process in DOE O 433.1. Work control is an important part of the process of managing the facility/activity configuration. Much of the content contained in the body of the original standard has been relocated to appendices to make the information easier to find and other information has been moved to chapters that address specific elements of configuration management. Check the table of contents for the new location of this information. We have also revised the scope of the standard to be applicable throughout the lifecycle of the facility or activity. This is further discussed in Chapter 2. iv DOE-STD-1073-2003 Configuration Management TABLE OF CONTENTS 1 INTRODUCTION/PURPOSE ......................................................................................................... 1-1 2 APPLICABILITY ............................................................................................................................. 2-1 2.1 SCOPE OF APPLICABILITY............................................................................................................. 2-1 2.2 REFERENCE TO CONFIGURATION MANAGEMENT IN DOE DIRECTIVES AND STANDARDS ............ 2-1 2.3 CONFIGURATION MANAGEMENT INTERFACES.............................................................................. 2-2 2.4 CHANGES TO THE SCOPE OF THIS STANDARD IN THIS REVISION................................................... 2-4 2.5 FACILITIES, ACTIVITIES, AND OPERATIONS.................................................................................. 2-4

3 DESIGN REQUIREMENTS ............................................................................................................ 3-1 3.1 GENERATING AND CONTROLLING DESIGN REQUIREMENTS ......................................................... 3-1 3.1.1 New Facilities and New Construction ................................................................................. 3-1 3.1.2 Existing Facilities and Activities ......................................................................................... 3-2 3.2 DEFINING THE SCOPE OF CM SSCS.............................................................................................. 3-4 3.3 IDENTIFYING AND DOCUMENTING DESIGN REQUIREMENTS......................................................... 3-6 3.3.1 Design Process .................................................................................................................... 3-6 3.3.2 Design Output...................................................................................................................... 3-7 3.4 TAKING INTERIM MEASURES WHILE THE DESIGN REQUIREMENTS ARE BEING DOCUMENTED ..... 3-8 3.5 ESTABLISHING A DESIGN AUTHORITY.......................................................................................... 3-9 3.6 REVIEWING DESIGN REQUIREMENTS............................................................................................ 3-9 3.7 USING SYSTEM DESIGN DESCRIPTIONS ...................................................................................... 3-12 3.8 ESTABLISHING EQUIPMENT DATABASES .................................................................................... 3-12 3.9 ASSURING A SMOOTH TURNOVER FROM DESIGN AND CONSTRUCTION...................................... 3-14 3.10 GRADING.................................................................................................................................... 3-14 3.10.1 Grading Based on Facility Hazard Category.................................................................... 3-16 3.10.2 Grading Based on SSC Importance ................................................................................... 3-16 3.10.3 Grading Based on Facility Type and Technical Characteristics....................................... 3-17 3.10.4 Grading Based on Facility Remaining Lifetime ................................................................ 3-18 3.10.5 Grading Based on Facility Operational Status and Lifecycle Phase................................. 3-20 3.10.6 Grading Based on Programmatic and Technical Issues ................................................... 3-22 3.10.7 Grading Based on Existing Programs and Procedures..................................................... 3-22 3.11 MANAGING DESIGN CHANGES AND SAFETY BASES UNDER CONFIGURATION MANAGEMENT.... 3-23 3.11.1 Design Changes................................................................................................................. 3-23 3.11.2 Safety Basis........................................................................................................................ 3-24 3.11.3 Design Basis versus Design Requirements ........................................................................ 3-24 3.12 USING COGNIZANT SYSTEM ENGINEERS IN THE PROCESS OF DOCUMENTING DESIGN REQUIREMENTS...................................................................................................................................... 3-25

4 WORK CONTROL........................................................................................................................... 4-1 5 CHANGE CONTROL ...................................................................................................................... 5-1 5.1 IDENTIFYING CHANGES ................................................................................................................ 5-1 5.1.1 Identifying Change Mechanisms.......................................................................................... 5-1 5.1.2 Considering the Impact of Minor Changes.......................................................................... 5-4 5.1.3 Making Equivalent Changes................................................................................................ 5-4 5.1.4 Using a Consistent Configuration Management Process .................................................... 5-4 5.1.5 Developing Efficient Configuration Management Processes .............................................. 5-5 5.2 DOCUMENTING PROPOSED CHANGES ........................................................................................... 5-5 5.2.1 Documenting Proposed Changes......................................................................................... 5-5 5.2.2 Using Change Control Packages......................................................................................... 5-5 5.3 REVIEWING CHANGES .................................................................................................................. 5-6 v DOE-STD-1073-2003 Configuration Management 5.3.1 Performing Technical Reviews of Changes. ........................................................................ 5-6 5.3.2 Performing Management Reviews of Changes .................................................................. 5-11 5.3.3 Performing USQ Reviews .................................................................................................. 5-12 5.3.4 Performing Other Reviews ................................................................................................ 5-12 5.4 APPROVING CHANGES................................................................................................................ 5-13 5.5 IMPLEMENTING CHANGES .......................................................................................................... 5-13 5.5.1 Performing Work ............................................................................................................... 5-13 5.5.2 Developing Change Control Packages.............................................................................. 5-13 5.5.3 Deviating from or Making Changes to the Change Control Package. .............................. 5-14 5.5.4 Tracking Changes to Completion ...................................................................................... 5-14 5.5.5 Reporting Implementation Progress. ................................................................................. 5-14 5.5.6 Paying Attention to Partially Implemented Changes......................................................... 5-15 5.5.7 Implementing Multiple Changes in Parallel...................................................................... 5-16 5.6 POST-MODIFICATION TESTING................................................................................................... 5-16 5.7 POST-MODIFICATION TRAINING................................................................................................. 5-17 5.8 DOCUMENTATION CHANGES ...................................................................................................... 5-17

5.8.1 Updating Critical Documents Before Implementing Changes........................................... 5-17 5.8.2 Providing As-built Documentation .................................................................................... 5-17 5.9 GRADING CHANGE CONTROL..................................................................................................... 5-17 5.10 IMPROVEMENT ........................................................................................................................... 5-18 5.11 BASELINE CHANGE CONTROL .................................................................................................... 5-18 6 DOCUMENT CONTROL ................................................................................................................ 6-1 6.1 IDENTIFYING DOCUMENTS TO BE CONTROLLED........................................................................... 6-2 6.2 STORING DOCUMENTS.................................................................................................................. 6-3 6.3 CONTROLLING AND TRACKING DOCUMENTS ............................................................................... 6-4 6.3.1 Control Procedures ............................................................................................................. 6-4 6.3.2 Secure File........................................................................................................................... 6-4 6.3.3 Controlled Document Distribution List ............................................................................... 6-5 6.3.4 Identification of Proposed Changes .................................................................................... 6-5 6.3.5 Major Vs. Minor Document Changes .................................................................................. 6-5 6.3.6 Notification of Pending Changes......................................................................................... 6-5 6.3.7 Timely Incorporation of Changes ........................................................................................ 6-6 6.3.8 Distribution of Documents................................................................................................... 6-6 6.3.9 Control of Superseded or Canceled Documents .................................................................. 6-6 6.3.10 Document Database ............................................................................................................ 6-7 6.4 RETRIEVING DOCUMENTS ............................................................................................................ 6-7 6.5 CONTROLLING INTERFACES.......................................................................................................... 6-8 6.6 CONTROLLING THE PRELIMINARY DOCUMENTED SAFETY ANALYSIS .......................................... 6-9 7 ASSESSMENT................................................................................................................................... 7-1 7.1 ASSESSMENT OBJECTIVES ............................................................................................................ 7-1 7.2 CONSTRUCTION ASSESSMENTS .................................................................................................... 7-2 7.3 PHYSICAL CONFIGURATION ASSESSMENTS .................................................................................. 7-2

7.3.1 Walkdowns........................................................................................................................... 7-4 7.3.2 Resolution of Configuration and Documentation Discrepancies ........................................ 7-4 7.4 DESIGN ASSESSMENTS ................................................................................................................. 7-5 7.5 POST-CONSTRUCTION/ -MODIFICATION/ -INSTALLATION ASSESSMENTS..................................... 7-6 7.6 PERIODIC PERFORMANCE ASSESSMENTS...................................................................................... 7-6 7.7 RESOLUTION OF OPEN ITEMS ....................................................................................................... 7-7 APPENDIX A - REFERENCES ................................................................................................................. 1 APPENDIX B - GLOSSARY....................................................................................................................... 1 vi DOE-STD-1073-2003 Configuration Management APPENDIX C - ACRONYMS..................................................................................................................... 1 APPENDIX D - REGENERATION/RECOVERY/DOCUMENTATION OF REQUIREMENTS, BASES, AND ENGINEERING INFORMATION .................................................................................... 1 APPENDIX E – EXAMPLE CHANGE REQUEST ................................................................................. 1 APPENDIX F - EXAMPLE CHANGE CONTROL PACKAGES .......................................................... 1 THIS PAGE INTENTIONALLY BLANK. ............................................................................................. 12 APPENDIX G - CONDUCT OF WALKDOWNS..................................................................................... 1 INDEX ............................................................................................................................................................ I CONCLUDING MATERIAL PAGE .......................................................................................................... I TABLE OF FIGURES FIGURE 2-1 BASIC RELATIONSHIPS IN CONFIGURATION MANAGEMENT ...................................................... 1-2 FIGURE 2-2 KEY CONFIGURATION MANAGEMENT ELEMENTS ..................................................................... 1-2 FIGURE 3-1 CONFIGURATION MANAGEMENT INTERFACES .......................................................................... 2-3 FIGURE 4-1 RELATIONSHIP OF CONFIGURATION MANAGEMENT TO DESIGN, SAFETY, AND AUTHORIZATION BASES .................................................................................................................................................. 3-1 FIGURE 4-2 GATHERING THE BEST AVAILABLE DESIGN REQUIREMENTS FOR THE CM SSCS...................... 3-3 FIGURE 4-3 COMPILING THE SET OF CM SSCS ............................................................................................ 3-5 FIGURE 4-4 DESIGN REQUIREMENTS............................................................................................................ 3-8 FIGURE 4-5 SAMPLE CONFIGURATION MANAGEMENT EQUIPMENT DATABASE ......................................... 3-13 FIGURE 4-6 DOCUMENTING THE CM DESIGN REQUIREMENTS................................................................... 3-25 FIGURE 5-1 WORK CONTROL PROCESS ........................................................................................................ 4-1 FIGURE 6-1 CHANGE CONTROL PROCESS..................................................................................................... 5-3 FIGURE 6-2 TECHNICAL REVIEW OF CHANGES............................................................................................. 5-7 FIGURE 7-1 DOCUMENT CONTROL FUNCTIONS............................................................................................ 6-1

vii DOE-STD-1073-2003 Configuration Management This page is intentionally blank. viii DOE-STD-1073-2003 Configuration Management 1 INTRODUCTION/PURPOSE The purpose of this standard is to define the objectives of a configuration management process for DOE nuclear facilities (including activities and operations), and to provide detailed examples and supplementary guidance on methods of achieving those objectives. Configuration management is a disciplined process that involves both management and technical direction to establish and document the design requirements and the physical configuration of the nuclear facility and to ensure that they remain consistent with each other and the documentation. The size, complexity, and missions of DOE nuclear facilities vary widely and configuration management processes may need to be structured to individual facilities, activities, and operations. It would generally be inappropriate to apply the same configuration management standards to widely different activities, for example, a reactor facility and a small, simple laboratory. The detailed examples and methodologies in this standard are provided to aid those developing their configuration management processes; however, they are provided for guidance only and may not be appropriate for application to all DOE nuclear activities. The individuals defining the configuration management process for a particular nuclear activity will need to apply judgment to determine if the examples and methods presented in this standard are appropriate for the activity. Nevertheless, the basic objectives and general principles of configuration management are the same for all activities. The objectives of configuration management are to: (1) establish consistency among design requirements, physical configuration, and documentation (including analysis, drawings, and procedures) for the activity, and (2) maintain this consistency throughout the life of the facility or activity, particularly as changes are being made. This objective and the relationship between design, documentation, and the actual physical plant configuration of the facility, activity, or operation are illustrated in Figure 1-1. 1-1 DOE-STD-1073-2003 Configuration Management Documentation Design Physical Configuration Note: Arrows denote primary relationships and information flow FIGURE 1-1 BASIC RELATIONSHIPS IN CONFIGURATION MANAGEMENT Fulfilling the configuration management objective is accomplished through the key configuration management elements as illustrated in Figure 1-2. Key Configuration Management Elements •Design Requirements •Work Control •Change Control •Document Control •Assessments FIGURE 1-2 KEY CONFIGURATION MANAGEMENT ELEMENTS The Chapters 3 through 7 in this standard address each of the key elements in Figure 1-2 and provide additional details on how they can be implemented. The contractor must have a formal policy that endorses the use of configuration management and defines key roles and responsibilities. The contractor must also ensure that sufficient resources are provided to adequately implement the configuration management process. The contractor should establish and document the configuration management requirements at the earliest practical time prior to facility operation or initiation of the activity. Configuration must be controlled for the life of the facility or the duration of the activity. Prior to the end of life of the facility or activity, the

1-2 DOE-STD-1073-2003 Configuration Management contractor, in coordination with DOE, must determine if configuration management should be applied to post-operation activities, such as decontamination and deactivation. If there is a contractor change at the end of operation, the operating contractor should work with the post-operation contractor to determine how the configuration management effort should be relayed to the new contractor. The contractor must formally document and implement the configuration management process to be used for the activity in a configuration management plan. The configuration management plan must address: • how each of the key elements of configuration management will be implemented (See Chapters 3 through 7); • what are the systems, structures, and components to be included in the configuration management process and what is the basis/justification for the selection (See CM SSCs in Chapter 3); • what configuration management training is provided; • who is assigned key responsibilities and authorities for configuration management; • how interfaces are controlled (for control of interfaces for documentation, see Section 6.5); and • what programs and procedures must incorporate configuration management. The individuals implementing the configuration management process must be given sufficient independence and authority. However, configuration management should not be viewed as a program separate from other safety and management activities. The very nature of configuration management is that it is an integrating activity. For this reason, the individuals who implement configuration management must be knowledgeable about the various activities being implemented for the facility or activity and the impact proposed changes might have on that facility or activity. For example, it might be inappropriate to store a chemical with noxious fumes in an area where new maintenance activities would require frequent access for maintenance personnel. Another, less frequently occupied area might be more appropriate. Individuals who are involved in the day-to-day work of a facility or activity, such as operations and maintenance supervisors, are likely to be more cognizant of the nearby activities and the impact of proposed changes. Therefore, they should directly participate in the configuration management process. In particular, where there is a Cognizant System Engineer for a system, the Cognizant System Engineer should be involved in the configuration management process for that system. In addition, as changes to a facility or activity impact the content of training programs, the training organization should be involved in the configuration management process. The contractor must incorporate configuration management requirements into its procedures and other work processes, and, consistent with 10 CFR 830.122(e), perform work in accordance with those procedures and work processes. Furthermore, consistent 1-3 DOE-STD-1073-2003 Configuration Management with 10 CFR 830.122(b), personnel must be trained to establish and maintain proficiency in meeting the configuration management process. Training should include: • instruction on the objectives of configuration management; • instruction on the implementation of configuration management, including applicable procedures; and • update and refresher training (e.g., annually).

The DOE Safety Management System (SMS) or Integrated Safety Management System (ISMS) is defined in DOE Policy (P) 450.4, Safety Management System Policy. DOE contractors are expected to use ISMS to integrate safety into all aspects of work planning and execution. All safety management systems and programs should be designed to fit together to permit safe and efficient performance. Consistent with that goal, configuration management should function as an integrated process that marries seamlessly with other safety management processes at the facility or activity, not as a separate and distinct program. In addition, the contractor must flow down the configuration management process to subcontractors and suppliers as appropriate to the work and ensure subcontractors and suppliers are implementing it appropriately. Configuration management should be established as an integrated process to be used by all personnel when performing activities that affect configuration of items within the process, not as a separate program. If the contractor establishes a separate group with the responsibility for configuration management, that group’s role should be to develop and maintain the configuration management procedures, maintain the required documentation, and coordinate and facilitate the reviews of the various line organizations. It may also assume related responsibilities, such as documentation control. However, it should not be the sole group responsible for reviewing the proposed changes to assess impacts on operation. In addition to maintaining consistency among the design requirements, the physical configuration, and the documentation for the activity, the configuration management process must: • support the ISMS (reference DOE P 450.4, Safety Management System Policy; 48 CFR 970.5204-2, Laws, Regulations, and DOE Orders; and applicable DOE contracts); • help to maintain the safety basis as required by Subpart B of 10 CFR Part 830; • meet the quality assurance requirements for work processes and assessments in Subpart A of 10 CFR Part 830; • meet the configuration management requirements of DOE O 420.1A, Facility Safety; • meet the configuration management and work control requirements of DOE Order 433.1, Maintenance Management Program for DOE Nuclear Facilities; 1-4 DOE-STD-1073-2003 Configuration Management • support the requirement for documentation, traceability, and accountability for pressure vessels in DOE O 440.1A, Worker Protection Management for DOE Federal and Contractor Employees; and • ensure changes to the design requirements, physical configuration, or documentation are reflected in procedures and training. Where appropriate, a graded approach should be used to implement configuration management. The configuration management plan should identify how the graded approach will be applied. For example, if the contractor applies different schedules for updating documents through the document control process based on the importance of the document type to operations, the schedules should be documented in the configuration management plan. The verbs "should," "may," and "must" are used throughout this standard. While our intent is that the purpose of this standard is to provide guidance, not requirements, some organizations may agree to have this standard included in the contract or in other commitments as a requirement. If this standard is listed as a requirement for a specific facility or activity or set of facilities or activities, the DOE contractor or other organization required to meet this standard must comply with all of the applicable provisions that include the word "must." They are not required to meet the provisions that use the word "should," although they are still recommended.

The word "may" denotes permission to do something and does not impose a requirement. 1-5 DOE-STD-1073-2003 Configuration Management This page is intentionally blank. 1-6 DOE-STD-1073-2003 Configuration Management 2 APPLICABILITY 2.1 Scope of Applicability This standard provides guidance and information to be used for the development and implementation of configuration management processes at DOE nuclear facilities. It was written specifically to apply to hazard category 1, 2, and 3 nuclear facilities as determined by DOE STD 1027, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE 5480.23, Nuclear Safety Analysis Reports, especially with respect to the references to safety bases and 10 CFR Part 830. However, many of the principles and methods provided in this standard may also be useful to manage changes to non- nuclear activities or to nuclear facilities whose inventory of nuclear materials is below the threshold for hazard category 3 nuclear facilities (e.g., radiological facilities and non- nuclear facilities). This standard is applicable to DOE and DOE contractor personnel, including National Nuclear Security Administration personnel and their contractor personnel. 2.2 Reference to Configuration Management in DOE Directives and Standards A number of DOE directives reference or require configuration management, configuration control, or a configuration management program. Some specifically reference this standard. References to configuration management or configuration control can be found in the following DOE directives and standards: • DOE Order (O) 413.3, Program and Project Management for the Acquisition of Capital Assets • DOE O 420.1A, Facility Safety • DOE O 430.1A, Life Cycle Asset Management • DOE O 433.1, Maintenance Management Program for DOE Nuclear Facilities • DOE O 452.2B, Safety of Nuclear Explosives Operations • DOE O 5480.19, Conduct of Operations Requirements for DOE Facilities • DOE O 5480.20A, Personnel Selection, Qualification, and Training Requirements for DOE Nuclear Facilities • DOE Manual (M) 435.1-1, Radioactive Waste Management Manual • DOE Guide (G) 200.1-1, Software Engineering Methodology • DOE G 423.1-1, Implementation Guide for Use in Developing Technical Safety Requirements • DOE G 430.1-5, Transition Implementation Guide • DOE G 433.1-1, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1 2-1 DOE-STD-1073-2003 Configuration Management • DOE G 435.1-1, Implementation Guide for use with DOE M 435.1-1 • DOE G 450.4-1B, Integrated Safety Management System Guide • DOE STD 1051, DOE Standard Guideline to Good Practices for Maintenance Organization and Administration at DOE Nuclear Facilities • DOE STD 1065, DOE Standard Guideline to Good Practices For Postmaintenance Testing at DOE Nuclear Facilities • DOE STD 1121, Internal Dosimetry • DOE STD 3003, Backup Power Sources for DOE Facilities • DOE STD 3006, Planning and Conduct of Operational Readiness Reviews • DOE STD 3011, DOE Standard Guidance For Preparation of DOE 5480.22 (TSR) and DOE 5480.23Implementation Plans • DOE STD 3024, Content of System Design Descriptions • DOE STD 6002, DOE Standard Safety of Magnetic Fusion Facilities: Requirements • DOE STD 6003, Safety of Magnetic Fusion Facilities: Guidance • DOE Handbook (HDBK) 1101, Process Safety Management for Highly Hazardous Chemicals • DOE HDBK 3027, DOE Handbook Integrated Safety Management Systems

(ISMS) These Orders, Manuals, and Guides can be found on http://www.directives.doe.gov. These Technical Standards and Handbooks can be found on http://tis.eh.doe.gov/techstds. 2.3 Configuration Management Interfaces Configuration management supports a number of contractor organizations and initiatives by ensuring conformance with the established design requirements. Figure 2-1 illustrates some of these interfaces. While the provisions in this standard necessarily overlap other provisions such as those illustrated in Figure 2-1, these are viewed as complementary, not conflicting requirements. The use of this standard does not preclude the use of other standards that address particular aspects of configuration management in greater detail, such as the application of configuration management during construction or control of equipment status. Contractors should use the ISMS process to integrate the work performed to meet the provisions in the configuration management process, as well as other processes. In particular, although some elements of the safety basis requirements can be met through configuration management processes, this standard is not intended to provide definitive guidance on the safety analysis or design basis processes. The following discussions illustrate some of the interfaces between configuration management and other DOE requirements and guidance. 2-2 http://www.directives.doe.gov/ http://tis.eh.doe.gov/techstds DOE-STD-1073-2003 Configuration Management The Contractor Requirements Document (CRD) in DOE O 413.3 states for project management systems for acquisition of capital assets: A configuration management process must be established that controls changes to the physical configuration of project facilities, structures, systems, and components in compliance with ANSI/EIA-649, National Consensus Standard for Configuration Management. This process must also ensure that the configuration is in agreement with the performance objectives in the technical baseline. DOE O 413.3 requires contractors to use ANSI/EIA-649 for configuration management. Wherever the provisions of DOE O 413.3 apply, DOE and the contractor should determine whether to use ANSI/EIA-649 in lieu of this standard or to use this standard to supplement ANSI/EIA-649. In addition, Chapter II of DOE O 413.3 contains specific requirements for Baseline Change Control that may apply (See Chapter 5). Authorization Agreement • DSA (including hazard & accident analysis) • TSRs • USQ Process • Environmental compliance • Contract terms and conditions Operations & Maintenance • Work planning & control • Procedures • Limits & setpoints • ISM • Safety reviews & critiques • QA • Drawings, vendor manuals, & SDDs • Parts & materials substitutions Engineering • Design • Modifications • Reviews Procurement • Specifications (including design requirements) • Material/parts lists Training • Manuals • Lesson Plans Configuration Management • Design Requirements • Change Control • Work Control • Document Control • Assessments Design Requirements Maintaining consistency among the facility/activity configuration, the design requirements, and the documentation throughout the lifetime of the facility/activity will help to maintain conformance with the Authorization Agreement and the design basis. It will also help to avoid operational and safety problems caused by changes or maintenance Activities that are not properly designed, reviewed, approved, installed tested or operated consistent with design requirements.

FIGURE 2-1 CONFIGURATION MANAGEMENT INTERFACES Section 4.5.1.2 of DOE O 420.1 states specific requirements for configuration management for DOE hazard category 1, 2, and 3 nuclear facilities and references this standard for further guidance. This standard recognizes the need for configuration management of software used to perform functions or analysis related to safe operations, but it does not provide detail on the special considerations related to software configuration management. For example, DOE STD 1121 states that dosimetry codes should be subject to configuration management including records of the version of the code, the user’s manual, instructions 2-3 DOE-STD-1073-2003 Configuration Management for running the code, limitations of the code, hardware requirements, acceptance testing records, and a copy of the code itself. Contractors should refer to DOE G 200.1-1, Software Engineering Methodology, or other standards on software configuration management to supplement the guidance in this standard for software. DOE O 5480.19 and DOE O 433.1 provide additional detail that compliments the work control section of this standard. In particular, DOE O 5480.19 provides requirements for the control of equipment and system status and DOE O 433.1 provides the work control process. DOE O 430.1A requires a configuration management process to ensure the integrity of physical assets and systems and configuration integrity in designs and acquisitions. DOE G 430.1-5, Transition Implementation Guide, encourages the use of configuration management and configuration control during transition from the operational to the disposition phase of a facility/activity life to ensure accurate and up-to-date drawings are used in the transition process. 2.4 Changes to the Scope of this Standard in this Revision This standard was originally issued in 1993 to address configuration management for the operating phase of facilities and activities. This revised standard is applicable to the design and post-operational (deactivation, decontaminations, and decommissioning) phases as well. Where possible, configuration management should be applied throughout the life cycle of critical structures, systems, and components. In fact, the earlier design requirements, work control, document control, and change control processes are established for a facility or activity, the easier they will be to establish and maintain. It is generally more cost effective to establish and maintain accurate records during the design stage when memories are fresh and design documentation is still available, than to attempt to reconstruct them at a later date. 2.5 Facilities, Activities, and Operations Where the term "nuclear facility" is used in this standard it is used consistent with the definition for "nuclear facility" in 10 CFR 830.3. That definition states that activities and operations are included in the definition, as well as "facilities." Consequently, wherever the term "nuclear facility" is used in this standard, it is intended to include nuclear activities, facilities, and operations. In addition, throughout this document, wherever the term “activity” appears (in the singular or in the plural “activities”) without the terms “facility” or “operation,” it is meant to apply to activities, facilities, and operations. The term “activity” as it is used in this standard is intended to apply in a broad sense to major activities, such as deactivation and decontamination, and not to small actions, such as repacking a valve.

2-4 DOE-STD-1073-2003 Configuration Management 3 DESIGN REQUIREMENTS The objective of the design requirements element of configuration management is to document the design requirements. The design requirements define the constraints and objectives placed on the physical and functional configuration. The design requirements to be controlled under configuration management will envelope the safety basis and, typically, the authorization basis. Consequently, proper application of the configuration management process should facilitate the contractor’s efforts to maintain the safety basis and the authorization basis. Contractors must establish procedures and controls to assess new facilities and activities and modifications to facilities and activities to identify and document design requirements. Facility Operations The operations, maintenance and surveillance of facility systems and equipment and the implementation of safety management programs. Authorization Basis Configuration Management Design Basis Safety Basis Figure 3-1 Relationship of Configuration Management to Design, Safety, and Authorization Bases 3.1 Generating and Controlling Design Requirements 3.1.1 New Facilities and New Construction For new construction or activities for which the configuration is not currently being managed, DOE and the contractor must formally agree on the point in time when the contractor will initiate formal control of the configuration. The schedule may contain a series of milestones tied to specific dates or activities. This will allow the contractor to phase-in configuration management as design requirements are established or construction activities are completed and turned over. Generally, when the design is 3-1 DOE-STD-1073-2003 Configuration Management completed prior to construction the design is “frozen.” This is an opportune time to initiate the configuration management process to control future changes. DOE G 420.1-1 states: Document and change control for project design documents and supporting documentation must be provided by the design activity during the design. By the start of construction, document and change control must be provided by an appropriate QA configuration management program. Subsequent changes to project design and supporting documents must be made by means of a formal change control program in accordance with 10 CFR 830.120 [10 CFR 830, Appendix A]. For new construction, (i.e., new facilities and major modifications to existing facilities), the design requirements must be identified and documented as part of the design process and incorporated into a formal configuration management process before start of construction. The contract with the architect engineer and/or construction contractor should specify the expected actions related to configuration management for the design and construction activities, as well as for construction turnover to the operating contractor. 3.1.2 Existing Facilities and Activities The contractor should have identified the design requirements for safety systems, structures, and components (SSCs) for existing, hazard category 1, 2, and 3 nuclear facilities during the development of the documented safety analysis (DSA) to meet 10 CFR Part 830, Subpart B. For facilities that lack thorough documentation of the design basis, or for SSCs other than safety SSCs, the requirements for previously installed SSCs may not be documented or available. In these cases, it may not make sense from a cost versus benefit perspective to immediately reconstruct the design requirements.

The contractor should document the new or revised design requirements as maintenance and modifications are performed at the facility or activity. In these cases, the contractor must: • ensure that the DSA demonstrates that the functional requirements for the safety SSCs are sufficient, and • validate that the safety SSCs will perform their safety functions as assumed in the analysis. If the information is not sufficient to adequately document the configuration management baseline to validate proper operation of the safety SSCs, then the contractor should determine if additional action is necessary to complete the available information on the design requirements for the nuclear activity so that changes can be adequately assessed. 3-2 DOE-STD-1073-2003 Configuration Management One way to do this is by using engineering data recovery techniques. Data recovery techniques include searching for and reviewing existing files, archived records, and other sources that might contain the information, and validating the accuracy of the information before it is used. If the contractor determines that the data recovery techniques are still not sufficient to adequately complete the design requirements, the contractor should consider whether the information should be regenerated (e.g., performing analysis and/or calculations, or interviewing technical experts who are knowledgeable about the particular equipment or situation). If the contractor decides to pursue regeneration of the information, it should take maximum advantage of pertinent existing safety analyses and design information (i.e., requirements and their bases) that are immediately available or can be retrieved through reasonable efforts. Appendix D provides general information that may be used to regenerate documentation. The regeneration process can be expensive and should only be pursued when it is essential to manage the configuration of the nuclear activity safely and efficiently. When changes are performed, the contractor must document the design requirements associated with the change. By doing this, contractors can incrementally enhance the information on design requirements in a cost-effective manner. Once the design requirements are established, the configuration management process should be used to control changes because recovery of design information at a later date can be time consuming and costly. Figure 3-2 illustrates the potential sources for gathering the best available design requirements for SSCs under the configuration management process, which will be referred to as the CM SSCs throughout this standard. Best Available Design Requirements Best Available Design Requirements CM Database for Design Requirements CM Database for Design Requirements Existing Design Requirements New/Revised Design Requirements Design Reconstitution FIGURE 3-2 GATHERING THE BEST AVAILABLE DESIGN REQUIREMENTS FOR THE CM SSCS 3-3 DOE-STD-1073-2003 Configuration Management 3.2 Defining the Scope of CM SSCs In order to assess the impact a change will have to an activity, the contractor must first understand the design requirements of the activity. These design requirements must be identified and documented, and changes to them must be controlled.

However, configuration management requires resources to implement and, therefore, should not be applied indiscriminately. Some changes, such as plumbing upgrades to a restroom or the relocation of a storage shed for yard maintenance that do not impact safety or mission-required SSCs may not need the more stringent controls required for systems necessary to ensure safety. The contractor should identify and document the set of SSCs for an activity that will be managed through the configuration management process. This set is referred to as the CM SSCs throughout this standard. The CM SSCs are compiled from several sets of SSCs. These sets may overlap. The first set of SSCs that must be included in the CM SSCs for hazard category 1, 2, and 3 nuclear facilities is the set of Safety SSCs identified in the DSA as required by 10 CFR 830.204(b)(1). Safety SSCs are defined as the combination of Safety-Class SSCs and Safety-Significant SSCs, and they include those SSCs whose preventive or mitigative functions are considered to be major contributors to defense-in-depth and worker safety. "Defense-in-depth" refers to the various layers of protection provided to ensure public safety, worker safety, and protection of the environment. The safety SSCs identified in the DSA constitute the baseline set of SSCs that must be included in the configuration management process. In addition, contractors should include in the set of CM SSCs the SSCs whose functions are considered to be important to defense-in-depth or worker safety, but are not already included in the Safety SSCs. The combination of the Safety SSCs and the other defense- in-depth SSCs should encompass the “vital safety systems.” The vital safety systems include the safety significant systems, the safety class systems, and other systems that perform an important defense-in-depth safety function. Additional information on vital safety systems is available in documents responding to Defense Nuclear Facilities Board (DNFSB) Recommendation 2000-2 and at https://www.hss.doe.gov/deprep. The contractor should also review the activity to determine if it is appropriate to include other SSCs in the set of CM SSCs. Other categories of SSCs that should be considered include the following: • Mission critical SSCs - SSCs whose failure could cause substantial interruption to the mission of the facility or activity; • Environmental protection SSCs - SSCs that could have a significant impact on the environment if they failed to perform their function; 3-4 https://www.hss.doe.gov/deprep/ DOE-STD-1073-2003 Configuration Management • Costly SSCs - SSCs that would be expensive to fix or replace or whose failure could result in problems that could be expensive to fix; • Critical Software - Software whose proper performance is critical to the expected performance of a safety SSC, a defense-in-depth SSC, or the safety of the nuclear facility; • Master Equipment List (MEL) SSCs – SSCs that are included in the maintenance program; and • Adjacent SSCs - SSCs that are located adjacent to the safety or defense-in-depth SSCs such that changes to these SSCs could negatively impact the safety or mission of the activity. Figure 3-3 illustrates the various sets of SSCs that should be considered by the contractor when compiling the set of CM SSCs. The design authority should define the SSCs that fall under each type. Some SSCs will fall under multiple designations. CM SSCs Other defense-in-depth SSCs

(including vital safety systems not in Safety SSCs) Safety SSCs Mission Critical SSCs Costly SSCs Environmental protection SSCs Critical software Adjacent SSCs MEL SSCs FIGURE 3-3 COMPILING THE SET OF CM SSCS Identified “systems” must have defined system boundaries and component lists. Defined systems should contain those components necessary to accomplish the system’s function and meet the system’s design requirements. Applicable design codes and standards often define system boundaries. In addition, the following considerations may help to define system boundaries for some facilities or activities: 3-5 DOE-STD-1073-2003 Configuration Management • location of piping class breaks • location of isolation valves • location of seismic class breaks • location of test features Some supporting features may be outside the system boundary, such as electrical power, instrument air, lubricating oil, and ventilation. In addition, some complete systems may cross multiple facility and activity boundaries, such as ventilation systems. 3.3 Identifying and Documenting Design Requirements Once the set of CM SSCs is identified, the contractor must identify and document the design requirements for this set of SSCs. The contractor must assess the effects of changes to the design requirements of CM SSCs through the configuration management process. Furthermore, the contractor must maintain the design requirements for CM SSCs throughout the life of the nuclear activity. The documentation should identify which of the design requirements are required for safety and which are necessary for cost, environmental, or other considerations, so the impacts of changes can be better assessed. The design requirements to be documented include those that affect: • function, • installation, • performance, • operation, and • maintenance. 3.3.1 Design Process Figure 3-4 illustrates the process of identifying design requirements for CM SSCs. The design process has three elements: • Design Inputs consist of those specific criteria, limits, bases, or other initial requirements (such as specific functional requirements, specific codes and standards, and specific regulatory commitments) upon which the detailed final design is based. In comparison to design constraints, design inputs are specific in nature; i.e., they are specific to one design activity. For example, a design input for a given air-operated valve might be that it needs to open in ten seconds against a differential pressure of 100 psig. Design inputs should consider the effects of the operating environment (e.g., radiation, temperature, pressure, humidity, chemical spray), material condition, and aging (e.g., erosion, corrosion, fatigue, chloride stress or intergranular stress corrosion cracking, and embrittlement). For example, the design requirements should consider the effects of radiation 3-6 DOE-STD-1073-2003 Configuration Management exposure and aging on elastomeric materials, such as rubber O-rings and Teflon tape. • Design Constraints are those general restrictions and limits to the engineering design process that ensure consistency and quality of design (such as general codes and standards, general regulatory commitments, quality assurance requirements, engineering procedures and good practices, and adopted design methodologies). In comparison to design inputs, design constraints are general in nature; they apply to multiple classes and categories of designs and, therefore, to many designs. For example, a design constraint for a safety system might be that it will be able to accomplish its assigned safety function in the event of a single failure.

• Design Analysis and Calculations are those intermediate design products that are necessary to convert the design inputs and constraints into appropriate and complete design outputs. Design analysis and calculations consist of a wide variety of engineering analyses, calculations, studies, reports, and technical review checklists necessary to perform complete engineering design. Design analyses and calculation capture the design assumptions and identify the available design margin. The design margin is the conservatism between the specified design requirement and the minimum requirement that could be developed from the design basis. Examples of design analysis and calculations are: ¾ transient analyses, ¾ criticality analyses, ¾ seismic stress calculations and analyses, ¾ Equipment sizing calculations, ¾ net positive suction head calculations, and ¾ engineering evaluations of equipment qualifications and fire protection. 3.3.2 Design Output Figure 3-4 also illustrates the design output documents, which are the products of the design process that specify the design output requirements for the facility or activity SSCs. The design output requirements are the composite result of the engineering organization’s consideration of the design inputs, design constraints, and design analysis and calculations. Design output requirements specify that which is essential to support the design basis, e.g., the necessary functions, capabilities, capacities, physical sizes and dimensions, limits and setpoints. The design output requirements include the functional requirements, as well as procurement requirements, quality assurance requirements, construction/installation specifications and instructions, post-installation testing, post- maintenance testing, and periodic surveillance/testing requirements. In some cases, the design output requirements are also referred to as the “as designed conditions.” The design output documents identify the design requirements that dictate the physical configuration of the facility. Design output requirements best support the configuration management process objectives when they are documented in a format amenable for 3-7 DOE-STD-1073-2003 Configuration Management proper use by the various user organizations, including procurement, construction, operations, maintenance, and testing, as well as design engineering. Examples of design output documents are: • design change packages, • drawings, • specifications, • load lists, • valve lists, • design (stress) reports, • one-line electrical drawings, and • setpoint lists. Design Process Design Process DESIGN CONSTRAINTS Engineering Procedures Quality Assurance Requirements General Codes & Standards Required Design Methodologies DESIGN INPUTS Functional Requirements Specific Standards Regulatory Requirements Commitments DESIGN ANALYSIS & CACULATIONS Analyses Calculations Studies Reports Checklists DESIGN OUTPUT DOCUMENTS Drawings Specifications Component Lists Setpoints Testing Requirements Functional Requirements Performance Criteria System Design Descriptions DESIGN OUTPUT REQUIREMENTS The Design Outputs provide the Design Output Requirements: • Safety Requirements • Environmental Requirements • Mission Requirements • Other Requirements Figure 3-4 Design Requirements 3.4 Taking Interim Measures while the Design Requirements are Being Documented

The contractor should determine if interim measures are needed to preserve the design basis of the nuclear activity and ensure safety while the configuration management process is being developed, the design requirements are documented, and the configuration management process is assessed. The following are examples of interim measures that may be needed: 3-8 DOE-STD-1073-2003 Configuration Management • additional controls to ensure that newly generated design requirements and design basis are maintained and available, • additional procedural guidance on sources of design requirements to ensure that an adequate design basis review is performed for potential changes to the nuclear activity, • additional procedural guidance to ensure that designers thoroughly research the existing design basis before issuing new designs, • additional procedural guidance to ensure that the design process produces an adequate set of design requirements and design basis for each new design or design change, • actions to retain source documents containing design requirements and design basis information, and • actions and controls to ensure that the knowledge of experienced engineering and operations personnel regarding facility design requirements and design basis is not lost when they transfer or retire (this includes actions to collect and record design information from personnel who recently transferred, retired, or are near retirement). 3.5 Establishing a Design Authority Contractors should establish the design authority for each SSC. The design authority is the single organization responsible for establishing and maintaining the design requirements, ensuring that design output documents accurately reflect the design basis, and maintaining design control and ultimate technical adequacy of the design process. When facilities or systems are turned over from one organization to another, the design authority may also change. This may occur over a period of time. Procedures should be developed to govern this turnover. However, at any given time, there should be a single, defined authority for each SSC. 3.6 Reviewing Design Requirements When the design requirements are initially established for the configuration management process, the contractor must perform a technical management review to determine the adequacy of these requirements. The technical management review team must include technical managers that have broad design backgrounds and experience and represent the various design disciplines. In deciding whether the design requirement documentation for the CM SSCs is adequate, the team should base its determination on the completeness, accuracy, and level of documentation. The team should also consider the results of applicable assessments, especially any initial configuration management assessments when performing its assessment. 3-9 DOE-STD-1073-2003 Configuration Management The technical management review process may include the following methods of assessing completeness: • certification of conformance with specified industry codes and standards that identify expected design requirements; • comparisons of like design requirements for comparable components; • comparisons of like design basis for comparable design requirements; • review of design information to identify CM SSCs with missing or incomplete design requirements; • review of open items and discrepancies that have not been resolved; and • review by independent, external, technical experts.

The review team should determine if any essential design information is missing. The team should also correlate the design basis with the design requirements, the physical configuration, and the documentation to get insight into the completeness and accuracy of the existing information. A template or checklist may be used as a tool to help verify that the design requirements are complete. This approach involves making a list of the typical types of design requirements for various types of SSCs. The template should be comprehensive and include both the expected and possible design requirements and design basis. This template would then be compared to the list of design requirements available for the structure, system, or component. If something on the list is not included in the design requirements, the team may question the basis for the omission or request that the design requirement be added. Because the template was developed broadly, it will not be unusual for the template to include more design parameters than are applicable to a particular structure, system, or component. Furthermore, the template should not be relied upon as a complete list for every case. The template should be used only as a tool to help the user to notice design requirements that may be missing, and it is not a substitute for good technical judgment. For example, a template for a piping system might include: • system and component design descriptions or specification, • basic flow diagrams, • layout and arrangement diagrams, • isometric diagrams, • support details, • testing requirements, • material certifications, • pipe sizing/flow calculations, • minimum wall thickness calculations, • corrosion/erosion allowances, • certification of conformance with piping standards [such as American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code or American National Standards Institute (ANSI) B31.3], • system interface requirements, 3-10 DOE-STD-1073-2003 Configuration Management • operating and design pressures and temperatures, • component input and output design requirements (e.g., pump net positive suction head and power requirements), • design procedure documentation, • inspection acceptance criteria, • documentation of hydrotest parameters and results, • maintenance and testing procedures, and • quality assurance requirements. Tools for assessing accuracy include: • checks of reasonableness by competent design personnel, • checks to determine whether the design requirements apply to current physical configuration, and • independent verification of critical calculations and analysis. In determining whether the design requirements are properly documented, the team should consider whether: • the design information is clearly identified; • the design requirements are differentiated from the design basis; • safety, environmental, and mission design requirements are differentiated from other types of design requirements; and • the design documentation is indexed, integrated, and usable. The contractor must document, retain, and maintain the team’s conclusions and the basis for the conclusions regarding the adequacy of the facility design requirements in a retrievable form. The documentation should indicate the relevant design information by system and an index of design documents should be provided.

At the conclusion of this effort, the team must decide if any of the still missing information is truly critical to safe and effective configuration management. If the information is not critical, then the contractor should not invest additional resources in recovering the information at this time. If major construction or modification is performed on the system at a later date, the design information should be developed at that time. If the conclusion of the team is that the design requirements and their design basis are not adequately documented, complete, or accurate and additional information is critical to ensure safe and effective configuration management, then the team must develop a plan to recover that information. If the missing information is necessary to support the safety or authorization basis, then the missing information must be retrieved or regenerated. If the team concludes that a design reconstitution is recommended, the team should develop and document specific recommendations for that effort. Appendix D provides additional information on regeneration and recovery of design requirements. 3-11 DOE-STD-1073-2003 Configuration Management Chapter 6 provides objectives for the documentation of design information. 3.7 Using System Design Descriptions A recommended approach to documenting design requirements and providing a link between engineering design documents, the safety basis, and implementing procedures is to develop system design descriptions (SDDs). SDDs identify requirements, explain why those requirements exist (e.g., provides the bases for the requirements), and describe the features of the system design provided to meet those requirements. SDDs can be used to promote consistency among the engineering requirements, the actual installed physical configuration, and the associated documentation. SDDs help facility personnel understand system functions and requirements. In addition to providing a system drawing and written description, they include discussions of functional process requirements, system and component design requirements, system interfaces and interlocks, setpoints, and design requirements related to operations, maintenance, and testing, detailed design and operating descriptions, diagrams, and load lists. Information on the use and specific content of SDDs is provided in DOE-STD-3024-98, Content of System Design Descriptions. 3.8 Establishing Equipment Databases Contractors must develop configuration management equipment databases that cross- reference SSCs with their design requirements, design basis, and associated documents. These databases will be the primary information source for design requirements. Contractors should use the best available design information to fill the database fields. The configuration management equipment database can be used to contain and correlate key information, such as: • system designators; • component designators; • component descriptive information such as type, manufacturer, model, and size; • grades/Priority/Classification; • design requirements or references to design requirements; • design basis references; • design topical area references (e.g., seismic, environmental qualification, fire protection); • range of acceptable setpoints; • facility document references (e.g., drawings, procedures, DSAs); • technical Safety Requirement (TSR) references; • maintenance equipment lists (MELs); • other desired system and component information; 3-12

DOE-STD-1073-2003 Configuration Management Linking the management equipment database with other equipment databases with other databases, such as the MEL or other databases listed above, will not only result in greater efficiency because there are fewer databases to maintain, it will also facilitate configuration management as changes will be more thoroughly reviewed and coordinated. A sample format for a basic, configuration management equipment database is provided in Figure 3-5. The actual format, contents, and capabilities of an organization's configuration management equipment database will depend greatly on the identified needs and intended uses. The contractor must assign a database owner for the equipment database, with established roles and responsibilities. As most of the information is design information, the design authority is a likely choice. As such, the design authority would be the focal point for resolving discrepancies and updating the database. Other organizations should use the configuration management equipment database as their primary source of design information. In order to facilitate tracking of CM SSCs and their design requirements, contractors should establish a unique and readily identifiable numbering system for SSCs, their parts, and assemblies. Unique identifiers that incorporate system designators, component type, and numbers, (e.g., SW-MOV-91) are more useful than strictly numeric identifiers (e.g., 135711317). Unique identifiers are important to support equipment and facility operations as well. See DOE O 5480.19 for additional discussion of equipment designation and labeling. SSC Systems SSC Components Descriptive Info Safety Design Rqmts Environ. Design Rqmts Mission Design Rqmts Design Rqmts for High Cost Items Design Rqmt Ref's Design Basis Ref's Seismic Program Fire Protection Program System 1 Comp 1 √ √ √ √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 √ System 1 Comp 2 √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 PC-3 System 1 Comp 2 √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 " " √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 PC-2 √ " " √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 √ " " √ √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 √ System 1 Comp M √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 PC-1 √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 PC-1 √ System 2 Comp 1 √ " " System 2 Comp 2 √ " " System 2 Comp 3 √ " " " " √ " " PC-4 " " √ " " System 2 Comp M √ " " FIGURE 3-5 SAMPLE CONFIGURATION MANAGEMENT EQUIPMENT DATABASE 3-13 DOE-STD-1073-2003 Configuration Management 3.9 Assuring a Smooth Turnover from Design and Construction To ensure a successful turnover of new facilities or new modifications, the design contractor and the construction contractors should interface with the operating contractor early in the design and construction phases. When an effective interface is established early in the design process, it is more likely that the design contractor and the construction contractors will provide the needed design products to the operating contractor and turnover will be successful. The design and construction contractors, together with the operating contractor, should establish and agree upon the formal criteria for construction turnover. At a minimum, the criteria should include the following provisions: • specify at design inception the format and content of design basis and design output documents to ensure that they will be compatible with the operating contractor's work processes,

• periodically monitor the preparation of design basis and design output documents, • specify the review and approval process for the format and content of final design basis and final design output documents, and • accept responsibility for their configuration management at turnover. Although it is highly desirable, it is not always possible for the operating contractor to be involved with the designer/constructor during the design and construction phases. For example, a major new facility might be ordered and designed before final assignment of a management and operating (M&O) contractor. In such cases, the designer should be responsible for ensuring that the operating contractor has the necessary design requirement information at turnover. If the operating contractor is not involved in the design/construction process or if the design and construction contractor fails to provide an effective interface, the operating contractor should identify and implement the actions necessary to recover the missing information. 3.10 Grading The initial grading of SSCs for the configuration management process begins with the identification of the CM SSCs. That process separates the SSCs that will be assessed through the configuration management process when changes are made from those that will not. Additional grading may be appropriate. For example, the contractors may want to apply a more stringent configuration management process to safety SSCs, than to costly SSCs. If so, then the contractor must clearly document the different processes being used and the SSCs to which each process applies. Contractors should also consider that developing and implementing multiple levels of configuration management is not always more cost effective than developing and implementing a single, consistently-applied configuration management process. 3-14 DOE-STD-1073-2003 Configuration Management Consequently, contractors should use good judgment to determine what level of grading is both appropriate and cost effective. DOE defines graded approach as a process of ensuring that the level of analysis, documentation, and actions used to comply with a requirement are commensurate with: • the relative importance to safety, safeguards, and security; • the magnitude of any hazard involved; • the life cycle stage of a facility; • the programmatic mission of a facility; • the particular circumstances of a facility; • the relative importance of radiological and nonradiological hazards; and • any other relative hazard. The main purpose of using a graded approach is to determine and apply a level of resources that is appropriate when implementing a program. The goal is to apply the highest level of resources to the most important equipment in the most important facilities and to avoid such expenditures where they are not warranted. For a highly hazardous facility such as a large nuclear reactor, which could potentially have serious off-site personnel safety consequences, a significant investment of resources is appropriate for the systems that prevent, detect, or mitigate such consequences. At the other extreme, for a low-hazard facility—a glovebox operation, for example—where the greatest hazard is localized (i.e., offsite persons and workers at other collocated facilities are not affected), the same investment of resources may not be necessary. The grading system should take into account both facility grades and SSC grades in determining the appropriate level of resources to be applied.

In applying the graded approach to the configuration management process, the following factors should be considered: Relative Importance Factors Situational/Circumstantial Considerations1 Facility grade Facility type and technical characteristics SSC grades Facility remaining lifetime Facility operational status and life cycle phase Programmatic and technical issues Existing programs and procedures The first column lists factors that can be used to grade based upon relative importance. That is, one item can be identified as more important than another and therefore can be 1 One item from the 1993 list was removed (Phased Implementation) and two were combined (operational status and life-cycle phase). Phased implementation was removed because it is no longer necessary, because configuration management is no longer a new issue. 3-15 DOE-STD-1073-2003 Configuration Management assigned a higher priority. The second column lists special situations and circumstances that are independent of relative importance. In all of the discussions on grading in this standard, where the term “facility” is used it pertains to activities and operations, as well as the traditional use of the term facility (i.e., buildings). 3.10.1 Grading Based on Facility Hazard Category Facility grading for DOE nuclear facilities is performed using DOE STD 1027, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports. DOE STD 1027 provides the process for grading DOE nuclear facilities into hazard category 1, 2, and 3 nuclear facilities where • Hazard category 1 nuclear facilities have the potential for significant off-site consequences. • Hazard category 2 nuclear facilities have the potential for significant on-site consequences beyond localized consequences. • Hazard category 3 nuclear facilities have the potential for only local significant consequences. Contractors may develop a configuration management process that recognizes the need to impose greater requirements to ensure the configuration management for hazard category 1 nuclear facilities than hazard category 2 or 3 nuclear facilities, based upon their relative risks. 3.10.2 Grading Based on SSC Importance The Nuclear Safety Management rule, 10 CFR Part 830, defines Safety SSCs as containing both Safety Class SSCs and Safety Significant SSCs. In addition, Vital Safety Systems may include safety systems that are important to defense-in-depth, but may not be included in the set of Safety SSCs identified for the facility. These sets (i.e., Safety Class SSCs, Safety Significant SSCs and Vital Safety Systems not part of the Safety SSCs), define the relative importance of the SSCs. Additional information on classifying these sets of SSCs can be found in the following DOE guidance documents and standards for safety bases: • DOE G 421.1-2, Implementation Guide for Use in Developing Documented Safety Analyses for Subpart B of 10 CFR 830 • DOE G 423.1-1, Implementation Guide for Use in Developing Technical Safety Requirements • DOE G 424.1-1, Implementation Guide for Use in Developing Unreviewed Safety Question Requirements 3-16 DOE-STD-1073-2003 Configuration Management • DOE STD 3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analysis

Other DOE documents that may be used to facilitate SSC grading define the relative importance of SSCs based upon more specific criteria. For example, DOE STD 1021, Natural Phenomena Hazards Performance Categorization Guidelines for Structures, Systems, and Components, defines performance goals for maintaining the integrity of SSCs against natural phenomena as necessary to confine nuclear and other hazardous materials and to protect personnel. Many quality assurance programs also have a system for grading (quality levels) that indicate the importance of the SSCs to safety, mission, operation, or other considerations. Contractors may grade their configuration management activities consistent with the quality assurance levels. 3.10.3 Grading Based on Facility Type and Technical Characteristics “Facility” types include the variety of traditional facilities (i.e., buildings), as well as different types of activities and operations. Examples of facility types are: • reactors • hot cells • waste tank farms • remediation activities • laboratory facilities • glove box operations • storage vaults • transportation of radioactive materials • buried waste sites Each facility type has typical technical and design characteristics. For example, a reactor would be required to meet design codes for high-pressure primary reactor piping systems, while such codes would typically not apply to a nuclear hot cell facility. 3-17 DOE-STD-1073-2003 Configuration Management The different expectations for each facility type may be considered to determine what types of implementation actions would be technically appropriate for the facility when the configuration management process is fully implemented. The general process criteria should be reviewed in light of the facility type and technical characteristics to determine which configuration management process criteria are appropriate for the specific facility type, which criteria need to be adapted, and if any criteria are not applicable. Typically, however, the program type has less influence on the grading of the configuration management process than on the grading of other technical programs, such as accident analysis. 3.10.4 Grading Based on Facility Remaining Lifetime The facility remaining lifetime is the period of time that the facility is expected to continue to perform its intended functions. This consideration is pertinent if DOE has formally notified the contractor that the facility is to be operated for only a specified period, or that the facility is to be shut down at a specified date and there is no intent to resume operations. The facility remaining lifetime is most important in determining the level of effort to expend to develop a new configuration management process for an existing facility. It is easy to establish and document the design requirements for a new facility or activity as it is being designed and constructed or initiated. It is more difficult to reconstruct the design requirements for an existing facility or activity where the documentation on design requirements is not complete or the configuration has not been managed to ensure the documentation reflects the physical configuration of the facility as it currently exists.

The resources required by a contractor to establish the design requirements and a configuration management process for an existing facility can be substantial and may take considerable time. It is easy to see that if a facility has a remaining lifetime of twelve months and the time required to establish the configuration management process is eleven months, that the value added from the configuration management process may not be commensurate with the cost. In such cases, contractors should propose graded configuration management processes that provide some measure of control during the short period of operation, but do not require extensive resources. It is not essential for the contractor to have exact estimates of the remaining facility lifetime to use the remaining lifetime as a grading factor. Contractors may estimate the remaining facility lifetime only to the extent of determining which of the following categories is applicable: • more than 10 years • between 5 and 10 years • between 2 and 5 years • less than 2 years 3-18 DOE-STD-1073-2003 Configuration Management If the expected facility remaining lifetime is very long (i.e., more than ten years), then the facility remaining lifetime is not likely to be a factor in grading, although it should be used for decisions regarding document retention periods. A facility remaining lifetime of less than ten years may impact the decisions on the effort to be used to reconstitute design requirements for an existing facility. In general, contractors should be able to develop and implement configuration management processes for an existing facility in less than five years, but full reconstitution of the design basis can take up to 10 years for the most complex facilities. For less complex facilities, remaining lifetimes of five years or less may affect decisions on defining the design requirements. For existing facilities with remaining lifetimes of between 2 and 5 years, contractors should consider the level of effort to be expended in establishing the configuration management process. For example, CM SSCs might be defined to include only those with safety or environmental design requirements. Moreover, the searches involved in reconstituting the design might be limited to formal reviews and smart searches. Facilities with a remaining lifetime of less than 2 years should undertake only those configuration management activities that are important to the remaining operation or to the next phase of the facility lifecycle. The SSCs included might be limited to those related to safety. Contractors should conduct walkdowns to determine the degree of consistency between the physical configuration and associated documentation, including as-built drawings. The configuration management process should identify change control mechanisms. Physical changes should be reviewed, approved, and documented. Activities to reconstitute the design requirements might be limited to the formal review. Reconstitution of the design basis might not be appropriate. In all cases where limited facility lifetime is a factor in the grading of the configuration management process, the subsequent lifecycle phases should be considered. For example, while a contractor may discontinue the shipment of new waste to a tank farm, it will still need to control the existing configuration to ensure that the wastes are properly controlled. Another example is a processing facility that is deactivated and, many years later decontaminated and decommissioned. Even though the facility will only be operated for two more years, a process for configuration management will need to be implemented during the periods of deactivation and decontaminations. The configuration management process for the remaining operating period should be established with consideration of the needs of the later phases of activity (deactivation and decontamination).

Finally, many activities at DOE are planned and pursued over short time frames from a couple of years to a few weeks. While the limited duration of the activity may need to be considered in establishing a configuration management process, the short duration of these activities should not be used as a basis for not managing the configuration. In some cases, a single facility will be used for changing missions. In such cases, contractors may 3-19 DOE-STD-1073-2003 Configuration Management be able to establish a configuration management process that envelopes expected operations or is modified with changing missions. Because it is easier to establish and implement a configuration management process for a new facility, facility remaining lifetime will be a less significant factor in grading the configuration management process for a new facility. 3.10.5 Grading Based on Facility Operational Status and Lifecycle Phase The facility operating status and life-cycle stage indicate the amount of emphasis and rigor that is appropriate for the configuration management process. The life-cycle phases of a nuclear facility include: • design, • construction, • operation, • deactivation, • decontamination, and • decommissioning. During the early part of the design phase, designers may need to make rapid changes unhampered by configuration control, but as the design interfaces are established, design requirements will need to be documented and controlled to ensure systems will function properly and construction can proceed. During construction, which will likely overlap the final design phase, configuration changes need to be controlled and documented, but the contractor will continue to need a configuration management process that responds rapidly and provides timely resolutions to keep construction on schedule. If the facility is currently operating (including periodic shutdowns for maintenance and other conditions), the operational status consideration generally does not affect the grading of the configuration management process. However, during a major modification to an existing facility, contractors will need the configuration management process to be as responsive as when a facility is in the construction phase. In particular, the contractor must be vigilant that the changes in one part of the facility that affect another part of the facility are properly evaluated, approved, and documented. In addition, if part of the facility is operating during the modification, some of the configuration considerations of an operating facility will remain in effect. The phase of the facility life cycle during the modification will determine the relative importance of, and thus the degree of emphasis on: • design basis, • design requirements, 3-20 DOE-STD-1073-2003 Configuration Management • current as-built configuration information, • system acceptance and preoperational testing, • design control programs, • periodic operability surveillance programs, • document control programs, • facility life extension efforts, and • decommissioning plans.

If a facility is deactivated or being decontaminated or decommissioned, there are different considerations than during the operating phase. For example, during a maintenance shutdown at an operating facility, a pump with a safety function may be disassembled or removed. Before operation, that pump would need to be restored or replaced with a pump that meets the existing or new design requirements. In addition, performance testing would likely be needed. These changes and tests would need to be processed through the configuration management process. On the other hand, if the same facility is deactivated two years later with no intention of resuming operation, then the pump may no longer have a safety function. If the pump with no safety function is removed and it is no longer needed, configuration management for that action may be reduced to a simple documentation of removal of the pump. Contractors for facilities in deactivation status that may be returned to an operating status later will need to implement a configuration management process that maintains the design requirements for the facility and accurately documents the configuration of the facility. Accurate documentation will facilitate the later reactivation of the facility. In addition, the contractors should take actions through the maintenance process to ensure that the physical configuration does not degrade and that changes are identified and approved. If during the deactivation period the scope of SSCs under the configuration management process was reduced to only include the SSCs related to personnel safety during deactivation, contractors may need to re-establish the design requirements of the balance of the CM SSCs for operation. Contractors would also need to perform walkdowns to determine the degree of correlation between the physical configuration and associated documentation. Physical changes would need to be reviewed, approved, and documented. Consequently, when determining the scope and depth of configuration management to be pursued during deactivation, contractors should consider the probability of reactivation, the length of time prior to reactivation, and the cost of reactivation if the configuration management was limited during reactivation. In some cases it will be more cost effective to maintain robust configuration management and maintenance processes. In other cases (e.g., long reactivation periods with a low probability of reactivation) it may be more cost effective to reduce the configuration management process to address only those SSCs important to safety during the reactivation period. 3-21 DOE-STD-1073-2003 Configuration Management Prior to reactivation of a deactivated facility, the contractor must ensure that the configuration has been restored and a configuration management process appropriate for operation is implemented. During decontamination, the facility may have fewer active safety systems from the original design, however, there may be more workers and those workers may be closer to the hazards (e.g., contamination or fuels being removed, open pipes, asbestos, steam) than they typically would during operation. Additional safety precautions may be added to the activity (e.g., contamination huts, enhanced radiation monitoring, new procedures). Prior to decontamination, contractors will need to update their CM SSCs to include new SSCs as appropriate. Contractors should also review the CM SSC list and delete SSCs that no longer are needed to meet safety or mission functions or other considerations as appropriate. In addition, as SSCs are removed from the facility and from active status, the contractor will need to remove them from the list of CM SSCs, as appropriate.

3.10.6 Grading Based on Programmatic and Technical Issues The resolution of a programmatic or technical issue can change the importance of a structure, system, or component. For example, a component may be moved from the list of non-safety components to the list of safety components or a system may be determined to be a vital safety system. When such changes occur, contractors will need to review their impact on the list of CM SSCs and revise it accordingly. Issues that are likely to trigger programmatic or technical changes include: • safety evaluations, • probabilistic risk assessments, • human factors engineering, • operating and emergency procedures and planning, • operator training, • seismic qualification, • fire protection, • safe shutdown, and • equipment qualification. 3.10.7 Grading Based on Existing Programs and Procedures In implementing a configuration management process, contractors should: • take credit for existing programs and procedures where appropriate, • modify existing programs and procedures where necessary, and • develop new activities only when essential. 3-22 DOE-STD-1073-2003 Configuration Management Contractors with existing processes that satisfy the configuration management criteria should continue to use those processes, modifying them only as necessary. This standard should not be used to justify repackaging existing processes that are already adequate. For example, if a facility has an adequate document control process, there would be little benefit in requiring that facility to repackage the process for the sole purpose of matching the format or terminology in this standard. Improvements can be made to existing processes to ensure they address the criteria in this standard, rather than complete revisions to existing processes. Contractors who have questions regarding changes that may be necessary to comply with this standard are urged to consult with their DOE line organizations prior to expending significant budget. Configuration management activities may already be present in a variety of processes at a facility. Some areas where contractors may find elements of configuration management include: • DSA upgrades, • design control, • quality assurance, • document control and records management, • procedure change control, • temporary modification control, • maintenance, • facility status and operational configuration control, and • lockout and tagout. Some of these interfacing programs input information important to the configuration management process, some perform functions necessary to ensure configuration management, and others require configuration management to ensure valid information is used. 3.11 Managing Design Changes and Safety Bases under Configuration Management 3.11.1 Design Changes Figure 3-5 illustrates the relationship between the configuration management equipment database and the design process. Changes to the design requirements must be processed through the change control process discussed in Chapter 5. Requests for changes to the design of the activity typically include a description of the problem and sometimes include an associated proposed facility configuration change. When a change is requested, the individual preparing the documentation for the proposed change should consult the configuration management equipment database and assess how the design requirements in that database will be affected. That assessment should be part 3-23 DOE-STD-1073-2003

Configuration Management of the documentation for the proposed change. If it is determined that the proposed change could impact an SSC that is part of the configuration management equipment database, then the proposed change will need to be processed through the change control process. Furthermore, following review and approval of the proposed change, the configuration management equipment database will need to be updated as appropriate to reflect the change. 3.11.2 Safety Basis Section 3.2 discusses how the Safety SSCs identified in the DSA constitute the baseline set of SSCs that are to be controlled under the configuration management process. It also discusses including other SSCs such as those identified as necessary for: • defense-in-depth, • critical mission functions, • environmental protection, • protection of costly equipment or functions, • protection of adjacent SSCs, or • critical software functions Configuration management should be used to control and document changes to the safety basis (including the DSA and the Technical Safety Requirements or TSRs). The relationship of the process of documenting the configuration management design requirements to the safety basis required by Subpart B of 10 CFR Part 830 for hazard category 1, 2, and 3 nuclear facilities is illustrated in Figure 3-6. The relationship of the Unreviewed Safety Question (USQ) process to configuration management is addressed in the discussion on change control in Chapter 5. 3.11.3 Design Basis versus Design Requirements The design requirements are the output of the design process as shown in Figure 3-4. The design basis provides the technical and analytical basis for the design requirements. The design requirements specify “what” is required and the design basis documents “why” a design requirement is specified. In addition to safety basis documents (DSAs and TSRs), design basis information is found in other documents, such as transient calculations, setpoint calculations, and sizing calculations. There may be differences between the values in the design bases and the design requirements for a facility or activity. For example, the design basis may specify a requirement for a pump to deliver 160 GPM, while the design requirements may specify a pump rated to deliver a flow of 200 GPM. This difference may represent conservatism that the design engineer felt was appropriate or the higher rating may have been chosen to match the rating of an available, off-the-shelf pump. 3-24 DOE-STD-1073-2003 Configuration Management The significance of the difference between the design basis and the design requirements is that a change to the design basis would necessitate a new design analysis, but a change to a design requirement would not require a new design analysis if the design basis is not affected. To simplify the process, design requirements should be specified consistent with the design basis. If the design requires a 160 GPM pump and the contractor intends to purchase a 200 GPM pump, the procurement specification can document this without revising the design requirements. Identify & document design requirements for the CM SSCs Test/Validate the Design Requirements Define scope of CM SSCs Documenting the CM Design Requirements Safety SSCs Complete? Generate Needed Design Requirements Hazard Assessment and Categorization DSA Identify Safety SSCs and major Defense-in-Depth SSCs TSRs Testing Maintenance Surveillance Procedures

Training Developing the Safety Basis Safety Basis Other CM SSCs including Vital Safety Systems Document design requirements for CM SSCs and update the Safety Basis Establish design authority Review design requirements New facility or Essential requirements? Establish equipment database Upgrade design requirements when modifying system no yes no yes FIGURE 3-6 DOCUMENTING THE CM DESIGN REQUIREMENTS 3.12 Using Cognizant System Engineers in the Process of Documenting Design Requirements DOE O 420.1A, Facility Safety, requires contractors to designate a Cognizant System Engineer for each system for DOE Category 1, 2, or 3 nuclear facilities. The qualifications for the Cognizant System Engineer must be consistent with those defined in DOE O 420.1A. In addition, as stated in DOE O 433.1, Maintenance Management 3-25 DOE-STD-1073-2003 Configuration Management Program for DOE Nuclear Facilities, the Cognizant System Engineer has the lead responsibility for the configuration management of design. The Cognizant System Engineer must be knowledgeable of the system and the related safety basis. The Cognizant System Engineer must also retain a working knowledge of the facility’s operation and the existing condition of the system. Consequently, the Cognizant System Engineer is also responsible for overseeing the configuration of the assigned system to ensure that it continues to be able to perform its expected functions. The Cognizant System Engineer should: • be knowledgeable of the system safety functions, requirements, and performance criteria and their bases; • understand how the system SSCs are designed and how they function to meet the requirements and performance criteria; • understand system operation; • be knowledgeable of the testing and maintenance necessary to ensure the system continues to be able to perform its safety functions; • be responsible for ensuring that documents related to the system are complete, accurate, and up-to-date, including SDDs, technical drawings, diagrams, and procedures for surveillance, testing, and maintenance; • be appropriately involved in the design, review, and approval of changes affecting/impacting system design, operation, and maintenance. Because the Cognizant System Engineers are expected to have a thorough understanding of system design expectations, operating requirements, and current configuration, the Cognizant System Engineers should have a major role in identifying the CM SSCs. Each Cognizant System Engineer should also participate in the identification of the design requirements for their system and the SSCs within the system. Finally, the Cognizant System Engineer should participate in the configuration management review of any changes that are made to the system for which the Cognizant System Engineer has cognizance responsibility. 3-26 DOE-STD-1073-2003 Configuration Management 4 WORK CONTROL In order to ensure that work is appropriately evaluated and coordinated before it is performed, contractors must incorporate a work control process into their procedures. Work control is an administrative process by which work activities are identified, initiated, planned, scheduled, coordinated, performed, approved, validated and reviewed for adequacy and completeness, and documented (See Figure 4.1). Work control processes should ensure that when work activities are performed, consistency is maintained between the documents, the procedures, and the physical configuration of the nuclear facility.

Identify and Initiate WorkIdentify and Initiate Work Perform WorkPerform Work Validate and Review Completed Work Validate and Review Completed Work Schedule & Coordinate Work Schedule & Coordinate Work Plan Work Plan Work Approve WorkApprove Work Work Control ProcessWork Control Process Update DocumentationUpdate Documentation FIGURE 4-1 WORK CONTROL PROCESS Contractors should apply the work control process described in DOE G 433.1-1, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1 to work being performed at facilities/activities covered by this standard. 4-1 DOE-STD-1073-2003 Configuration Management The contractor must clearly communicate the responsibilities, authorities, and expectations of work control to all individuals who do work, including facility personnel, subcontractors, and non-facility personnel. The specific responsibilities, authorities, and interfaces related to work control must be defined in applicable work processes, including procedures. Contractors must use the ISMS Process to integrate safety into all aspects of work planning and execution. Safety requires both the involvement of the workers and hands- on involvement of line managers. The ISMS Process is designed to promote this involvement. ISMS ensure that environment, safety, and health management is an integral part of performing work. Line managers are responsible for safety, as well as the work being performed. Authorized personnel approving the work should ensure that the change control process, including the USQ Process, was used for changes that could impact the safety analysis or the hazard controls. If during the performance of work, additional changes affecting the safety analysis or the hazard controls are identified, these changes should be processed using the change control and USQ processes and work should not resume until these changes have been analyzed and approved. 4-2 DOE-STD-1073-2003 Configuration Management 5 CHANGE CONTROL Contractors must establish and use a formal change control process as part of the configuration management process. The objective of change control is to maintain consistency among design requirements, the physical configuration, and the related facility documentation, even as changes are made. The change control process is used to ensure changes are properly reviewed and coordinated across the various organizations and personnel responsible for activities and programs at the nuclear facility. Through the change control process, contractors must ensure that: • changes are identified and assessed through the change control process, • changes receive appropriate technical and management review to evaluate the consequences of the change, • changes are approved or disapproved, • waivers and deviations are properly evaluated and approved or denied and the technical basis for the approval or the denial is documented, • approved changes are adequately and fully implemented or the effects of the partial implementation are evaluated and accepted, • implemented changes are properly assessed to ensure the results of the changes agree with the expectations, and • documents are revised consistent with the changes and the revised documents are provided to the users. A diagram of the change control functions is provided in Figure 5-1. 5.1 Identifying Changes 5.1.1 Identifying Change Mechanisms

The contractor must ensure that each proposed change to the facility, activity, or operation is considered for processing through the change control process. To ensure that all changes are controlled as appropriate, the contractor must identify all mechanisms that can lead to temporary or permanent changes in: • the design requirements, • the physical configuration, or • the documentation. For any facility, activity, or operation there are typically multiple mechanisms for initiating change. Changes may be initiated through any of a variety of organizations, such as design, operations, maintenance, procurement, procedures, training, and security. Changes can include physical, document, procedural, operations, software, or design 5-1 DOE-STD-1073-2003 Configuration Management changes. Contractors should assess each type of change to determine the mechanisms for initiating changes and link them to the change control process. Contractors should integrate the change control process into the work processes for all potential mechanisms of changes by requiring workers and organizations to use the change control process, as appropriate, when a change is to be made. The identification of change mechanisms is often the most critical step to achieving effective change control. Change mechanisms that are not identified cannot be controlled. Once change mechanisms are defined, contractors should ensure that the change control process is properly integrated into the procedures and other work processes for that change mechanism. Contractors should consider eliminating or combining change mechanisms to make changes easier to control. 5-2 DOE-STD-1073-2003 Configuration Management Identify change Document proposed change in change control package Design basis or safety basis changes? Perform independent design/safety verification for change Perform interdisciplinary technical review Identify documents affected by the design change Perform management review USQ review required? Approve Change Implement through Work Control Perform post-modification testing & verify change is acceptable Track, update, & distribute documents through document control Perform design/safety analysis Perform USQ determination USQ? Obtain DOE approval yes no yes no Perform review(s) yes yes no Technical Review 5.3.1 no USQ Review 5.3.1 Management Review 5.3.2 Other reviews to be performed? Change Control Process Can adequate safety be met following the change? Revise or cancel change no yes FIGURE 5-1 CHANGE CONTROL PROCESS 5-3 DOE-STD-1073-2003 Configuration Management 5.1.2 Considering the Impact of Minor Changes It is important to identify and consider even subtle changes under the configuration management process. Changes that are perceived to be minor or insignificant can significantly impact the functions of SSCs required to maintain safe operation or to achieve mission objectives. They can also result in operation outside the approved safety basis. A well-designed change control process should include a screening process to determine if seemingly insignificant changes should have at least a cursory review by an interdisciplinary group to confirm that there are no significant impacts from the proposed change. In addition, the contractor must ensure that the USQ process is invoked and applied to changes consistent with the requirements of 10 CFR Part 830 and the DOE- approved USQ process to maintain the integrity of the safety basis.

5.1.3 Making Equivalent Changes Changes that are shown to be equivalent changes do not need to be evaluated under the change control process. Equivalent changes are hardware changes that: • continue to meet the design requirements for the equipment, • meet all interface requirements, and • do not impact the safety basis. An example of an equivalent change would be replacement of a failed part with the same make and model number part. However, as vendors sometimes change materials or design of components without changing the model number, the contractor should ensure that the design requirements continue to be met with the replacement part. 5.1.4 Using a Consistent Configuration Management Process If multiple change control processes are used, they should be consolidated into a single, consistent change control process that is both useful and effective. Unique change control processes for specific types of changes, such as software changes, should be integrated into the overall change control process for the activity. The change control process may provide provisions for varying levels of review based on a documented graded approach, as well as graded schedules for updating documents based upon their relative importance. Facility managers should ensure that vendors and subcontractors use the established process. All personnel in design, operations, and support organizations that do work for the facility or activity should: • be trained on the change control process, • follow the associated procedures closely, and • be alert to activities that may not be planned or may occur without following appropriate procedures. 5-4 DOE-STD-1073-2003 Configuration Management 5.1.5 Developing Efficient Configuration Management Processes The change control process should be efficient to ensure that it is used effectively. Forms and procedures should be easy to use and understand, particularly as the change control process will need to be used by individuals from a number of organizations with varied backgrounds and experience. To be effective, forms and procedures should: • facilitate complete and timely change identification and control, • be easy to use and encourage participants to use them, and • provide for management tracking and reporting. 5.2 Documenting Proposed Changes 5.2.1 Documenting Proposed Changes The change control process must include provisions for the initiator of the proposed change to document the proposed change including: • a unique identifier for the proposed change • a description of the proposed change sufficient to support technical and management reviews prior to approval; • the name and organization of the requester; • a description of the potentially affected SSCs; • the reason for the proposed change; • a list of the alternative solutions considered and the results; • the date by which the decision about the change needs to be completed to facilitate timely implementation or to allow implementation to occur concurrent with other activities, such as a planned maintenance shutdown; • constraints; and • any other information needed to review, track, approve, or process the proposed change. Appendix E contains a sample change request. 5.2.2 Using Change Control Packages

The design authority should prepare a change control package consistent with the design process and controls for the proposed change. The change request should be verified to be accurate and appended to the change control package. The change control package should also include drawings, analysis, procedures, instructions and other documents needed to properly assess, implement, verify, and validate the proposed change. If a work control document is being used to initiate the change, it should be included in the change control package. 5-5 DOE-STD-1073-2003 Configuration Management The change control package will be used when performing the reviews of the proposed change. It should define the methods and acceptance criteria for the post-modification testing. The change control package should be revised, updated, and supplemented as the review progresses. It should contain a copy of all approvals. Once the proposed change is approved for implementation, the change control package will be used to facilitate implementation. Appendix F provides sample change control packages. 5.3 Reviewing Changes The change control process must involve a formal change control review for each proposed change. The change control review must include a technical review and a management review. The technical review should be interdisciplinary, except where the change is so isolated as to not impact the efforts of more than one discipline. The management review should ensure that management considerations, such as funding, have been adequately considered prior to approving the change for implementation. The results of both reviews must be formally documented. Finally, some changes will need to be reviewed under the DOE-approved USQ process for the facility or activity in accordance with the requirements of 10 CFR Part 830. The USQ review may be performed concurrent with the technical and management reviews, but it must reflect the final configuration of the change. In addition, if during the management review modifications are made to the proposed change, those modifications must also receive a technical review. Changes to computer software that is used to support safety functions or safety applications must also be considered under the change control process. Design changes should be subject to the same level of management and technical review as applicable to the original design. 5.3.1 Performing Technical Reviews of Changes The change control process must contain provisions for a formal, multidisciplinary technical review to be performed for proposed changes to assess the impacts of the proposed changes to the facility, activity, or operation. The technical review must verify that: • the facility, activity, or operation will continue to operate safely and provide adequate protection to workers, the public, and the environment; • the contractor’s ability to continue to meet safety and environmental requirements, performance criteria, permit requirements, or any other applicable state or Federal requirement is not negatively affected; • the mission can continue to be achieved; 5-6 DOE-STD-1073-2003 Configuration Management • the change will not create unacceptable maintenance problems; • the security of the facility or activity is not compromised; and • the safety basis is preserved or the changes to the safety basis are assessed and determined to be acceptable. The technical review includes:

• design basis review • independent design verification • interdisciplinary technical reviews • identification of affected hardware and documents • identification of post-implementation acceptance criteria • other reviews, as appropriate The technical review process is illustrated in Figure 5-2. Perform Design Envelope Review Identify post-implementation acceptance criteria Design basis or safety basis changes? Perform independent design/safety verification for change Perform interdisciplinary technical review Identify hardware & documents affected by the design change Perform design/safety analysis yes no Revise or cancel change Verify: 1. Provides adequate safety 2. Meets standards & criteria 3. Supports mission 4. Does not pose maintenance problems Design Envelope Review and Independent Verification Interdisciplinary Technical Review Identification of Affected Documents Identification of Post-Acceptance Criteria Technical Review of Changes Figure 5-2 Technical Review of Changes 5-7 DOE-STD-1073-2003 Configuration Management 5.3.1.1 Design Basis Review If the proposed change is not within the current design basis, the contractor must perform a design analysis for the change. The design analysis must be sufficiently detailed that the technical reviewers can assess the adequacy of the analysis. The individuals responsible for the technical review must be provided with the change control package for those reviews. The design analysis should include: • current and proposed design inputs and constraints, • an analysis of the proposed changes and their impacts, • design outputs, • consideration of systems interactions, • any assumptions that must be verified in the post-operational testing, and • identification of any computer program that was used in the analysis. Changes that affect the design basis require a design analysis by the design authority. The design basis is generally identified by the design requirements in the equipment database or the references listed in the equipment database. Therefore, changes to the design requirements identified in the equipment database will likely require a design analysis. Examples of changes that would require a design analysis: • a change that permits an increase in the maximum number of plugged tubes in a heat exchanger beyond that indicated in the equipment database or safety analysis or • a setpoint change outside the range of acceptable setpoints identified in the equipment database. Example of a change that does not impact the design basis and generally would not require a design analysis is a change to an equipment setting that continues to be within the range specified in the equipment database (e.g., a pump actuation setpoint that is changed from 60 psig to 62.5 psig when the equipment database indicates the acceptable range is 55 to 65 psig). A change to the design basis will often involve a revision to the safety basis (DSA and/or the TSRs). Revisions to safety bases involve significant effort by the design authority and include external evaluations and approvals. Typically, changes to safety bases will require USQ reviews. Consequently, the contractor should weigh the resources needed to process the design change against the benefits of the proposed change. Another change that could accomplish the objectives of the original change within the current design basis might be more cost-effective. 5-8 DOE-STD-1073-2003 Configuration Management

If the design requirements for the proposed change are not available in the equipment database, then the design authority may need to recover or generate those requirements before the evaluation can proceed. 5.3.1.2 Independent Design Verifications The provisions of 10 CFR 830.122(f) (4) require the contractor to use individuals or groups other than those who performed the work to verify or validate the adequacy of any changes to design products. Documentation of the independent design verification must be included in the change control package. The independent design verification must verify that: • design inputs and constraints are correctly identified; • design analyses and calculations are complete and correct; • design outputs are complete and consistent; • the reasonable methods are used in the analysis and, where applicable, computer programs are verified; • system interactions are considered appropriately; • the assumptions are reasonable; and • appropriate post-modification testing and acceptance criteria are established. 5.3.1.3 Interdisciplinary Technical Reviews Unless the contractor determines that the proposed change does not need to be reviewed through the change control process, the contractor must perform an interdisciplinary technical review before proceeding with the proposed change. The technical review should involve all potentially affected disciplines and organizations such as design, operations, maintenance, training, radiation protection, fire protection, and security. Often a change that does not appear to be significant can be assessed to have an impact to another discipline. For example, the temporary removal of a door to facilitate a maintenance activity could impact security or fire protection. A change to a component also may impact system performance. Consequently, a Cognizant System Engineer should be engaged in the review process. A change to a component or system may impact nearby or interconnected components or systems. This potential should be assessed in the review. The Cognizant System Engineers for nearby or interfacing systems should be consulted as appropriate. The technical review team must be aware of the potential impact of the change on safety and reliability, as well as the design requirements. One of the challenges of change control is to be cognizant of many ongoing changes—from proposal, through development, to implementation—and to understand the integrated effect of the various changes. The Cognizant System Engineer concept has been used in the commercial nuclear industry to provide a technical focal point for each system. The Cognizant 5-9 DOE-STD-1073-2003 Configuration Management System Engineer develops resident technical expertise and facility knowledge, centralizes resolution of SSC performance problems for more timely and effective response, and interfaces between the facility operations and maintenance organizations and the design engineering organization. The Cognizant System Engineer concept benefits configuration management as well as many other facility activities including facility status and troubleshooting, operations support, coordination of testing and other system- related activities, and communication among departments.

As discussed in Chapter 3 of this standard, DOE O 420.1A, Facility Safety, requires contractors to designate a Cognizant System Engineer for each system for DOE Category 1, 2, or 3 nuclear facilities. The duties, responsibilities, and interfaces of each Cognizant System Engineer need to be clearly defined, documented, communicated to and understood by supporting facility organizations. To facilitate the change control process, each Cognizant System Engineer should perform the following functions: • monitor and track the status of the assigned system, especially during changes (e.g., physical changes in progress and temporary physical changes); • conduct and/or observe equipment performance monitoring, evaluating the results of performance monitoring and surveillance, trending important data, and initiating corrective actions; • review and approve post-modification, post-maintenance, surveillance, and special test procedures and test results; • provide assistance to operations and maintenance, as needed; and • identify any situation where the design engineering organization should be consulted for advice or services. Finally, the technical review team must include someone who has demonstrated competence in the area of the change and who understands the design and system requirements and functions. Reviewers may meet to consider the change concurrently or they may be sent the proposed change to review and provide comments or approval to a central coordinator. If a change is made to the proposal as a result of either the technical or management review, the reviewers should be given an opportunity to review the change and reaffirm or retract their approval of the proposed change. Some DOE sites and facilities use Change Control Boards (CCBs) to conduct all or part of the technical evaluation of changes. 5.3.1.4 Identification of Affected Documents Once it is determined that a proposed change can be made, either within the defined design requirements or within new or revised design requirements, each affected document must be identified. This includes the documents that are directly affected by the change, such as drawings, as well as indirectly affected documents such as the DSA, hazard controls, training information, procedures, and systems drawings. 5-10 DOE-STD-1073-2003 Configuration Management A complete and thorough review must be done to identify each affected item. If other SSCs are affected by the change, the contractor must determine if documentation for the affected SSCs also needs to be changed. Examples of documents that are sometimes overlooked are configuration management databases, operating and maintenance procedures, and training lesson plans. The configuration management equipment database and the document database should be used as primary tools to identify affected documents. Cross-disciplinary and cross-organizational reviews may be necessary to identify all affected documents. The document control process is addressed in greater detail in Chapter 6. 5.3.1.5 Identification of Post-Implementation Acceptance Criteria As part of the design review, contractors should define the post-implementation (or post- modification for physical changes) test methods and acceptance criteria. All post- implementation testing should be completed and all acceptance criteria satisfied prior to turnover to operations, unless specific tests are to be done post-turnover. 5.3.2 Performing Management Reviews of Changes

5.3.2.1 Management Verifications Following the technical review, contractor management must review the proposed change to verify that: • the technical review was adequately performed, • the change control package is complete and ready for implementation, • any necessary external reviews and approvals have been obtained, and • funding is expected to be available to complete the implementation and update the documentation. The management review may also consider: • whether the change is necessary, • whether the benefits of the change warrant the cost and schedule impacts, • the source of funding to complete the change, and • whether management approval should be based on other criteria. In some cases, it may be possible to perform the technical review and the management review concurrently. However, in such cases, the contractor must ensure that both sets of responsibilities are sufficiently executed. 5-11 DOE-STD-1073-2003 Configuration Management 5.3.2.2 Appropriate Levels of Management Review The configuration management process should specify the expectations for a management review of proposed changes. The configuration management process may specify different levels of management review for changes based on a documented graded approach. The managers at the lowest authorized level should normally perform the management review, in order to reduce the time needed to process the proposed change. However, it is important that the appropriate level of management in affected organizations are aware of pending changes and are actively involved in their review and approval. Consequently, it may be advantageous in some situations to elevate the management review to a higher level of management to facilitate implementation of the change when it is approved. 5.3.2.3 Clear Documentation Change control packages must be provided for the management review. The packages should be complete and easy to use and understand. 5.3.3 Performing USQ Reviews The USQ process was established to allow contractors to make changes without prior approval from DOE, provided those changes do not explicitly or implicitly affect the safety basis of the facility or activity. The configuration management process should specifically state that the DOE-approved USQ procedure must be consulted for all proposed changes and implemented whenever required by the 10 CFR Part 830 or the DOE-approved USQ process. If the USQ review determines that the change involves a USQ, then DOE approval is required before implementing the change. Additional guidance on the USQ process can be found in DOE G 424.1-1. 5.3.4 Performing Other Reviews In addition to the design, management, and USQ reviews, the following reviews should be considered and performed, where appropriate: • peer review • cost and benefit review • maintenance and reliability review • review of the impact on the operations schedule • reviews required by regulatory or contract requirements. • facility walkdown (a sample procedure for conducting a walkdown is provided in Appendix G). 5-12 DOE-STD-1073-2003 Configuration Management 5.4 Approving Changes The configuration management process should define the approval authority for a change. The approval authority for various changes may vary based in the significance of the change. 5.5 Implementing Changes 5.5.1 Performing Work

Changes must be reviewed, approved, verified, and validated before they are implemented. They must be implemented consistent with the approved change control package. Work must be performed consistent with hazard controls and using approved instructions, procedures, or other appropriate means. 5.5.2 Developing Change Control Packages. The contractor should (1) document each step of the change control process (i.e., identification, reviews, approvals, implementation, and document updates) and (2) track the implementation in the change control package. Documenting and tracking are essential to ensure that each change is fully assessed, approved, and implemented in accordance with the approved change, and that the affected documentation is identified, updated, and distributed to controlled users. The change control package should be used to capture the change request, the various technical reviews and evaluations, the management review, and the implementation results. The contractor must also include related information (such as the change request, design package, installation package and, post-modification testing) in the change control package. The change control package should be kept in one location until installation is complete. The change control package should be used to track the changes to completion. Prior to implementation of the changes, the change control package should be reviewed to ensure that: • it is complete and usable, • there are no unidentified physical interferences, • the change is likely to meet defined post-implementation acceptance criteria, and • the change has been approved for implementation. The change control package should: • identify all deviations from current design requirements so that the changes are tracked and documented, 5-13 DOE-STD-1073-2003 Configuration Management • identify all documents that need to be revised consistent with the approved change, • define the authorities and responsibilities associated with the approved change, • identify the work processes to be used to implement the change, and • identify any constraints to the implementation process. An individual or group other than the one that developed the package must perform the review of the change control package. A modification or construction package may be used to further define implementation instructions. 5.5.3 Deviating from or Making Changes to the Change Control Package. Changes should be implemented consistent with the change control package. The design authority must identify, review, and approve any deviations from, or changes to, the change control package prior to implementation. Contractor procedures must define this process (often called field change requests or FCRs) and the authority levels. FCRs should receive technical and management reviews commensurate with those of the original package and the approval authority level should be at the same level as the original change. Following evaluation and approval by the design authority, field change notices (FCNs) should be issued that revise the work processes consistent with the approved change. In addition, if the contractor identifies any nonconforming items while implementing a change, the contractor should document the nonconformance in a nonconformance report (NCR). The NCR should be reviewed to verify that it: (1) meets design criteria and assumptions and (2) is consistent with the analyses. The review and disposition of NCRs must be documented and retained.

5.5.4 Tracking Changes to Completion Consideration should be given to assigning an individual the responsibility for tracking physical change status and ensuring that the change is completed in accordance with the change control package. Contractors have successfully used Cognizant System Engineers or dedicated configuration management specialists to perform this function. 5.5.5 Reporting Implementation Progress The contractor should consider issuing periodic progress reports on the implementation of major changes. These reports should: 5-14 DOE-STD-1073-2003 Configuration Management • identify the approved change, • list the systems, and major SSCs affected by the change, • identify any impacts or constraints on current operations, • identify and deviations or waivers that have been approved to originally approved change, • provide a status report on the implementation and verification of the changes. 5.5.6 Paying Attention to Partially Implemented Changes The contractor should pay special attention to partially implemented changes. Failure to identify and take the proper precautions for partially implemented changes can lead to the premature closure of a modification package, operation in an unanalyzed condition, and/or documentation that is inconsistent with the actual configuration. Two types of partially implemented changes can occur: • staged implementation, where availability of time, money, or equipment dictates that the modification has to be planned and implemented in a staged manner or • interrupted implementation, where the implementation could not be completed as planned for any of a variety of reasons. DOE O 5480.19 defines requirements for conduct of operation, including temporary modification control. It states: Administrative control systems should be established for installation of temporary modifications such as electrical jumpers, lifted leads, pulled circuit boards, disabled annunciators/alarms, mechanical jumpers/bypasses, temporary setpoint changes, installed or blocked flanges, disabled relief or safety valves, installed or removed filters or strainers, plugged floor drains, and temporary pipe supports. Prior to modification, these controls should provide for communicating the installation of temporary modifications to the design authority to allow for technical oversight and an evaluation of the impact on current design activities, and approval of the design modification. These control systems should make provisions for safety reviews, installation approval, independent verification of correct installation and removal, documentation of the modification, update of operating procedures and documents, training, marking of installed modifications, and the periodic audits of outstanding modifications. In addition, DOE O 5480.19 contains additional instructions related to control of equipment status, lockouts and tagouts, and other areas associated with conduct of operations applicable to partially implemented changes. 5.5.6.1 Design Analysis for Partially Implemented Changes The change control package for a staged implementation should identify the various stages of implementation and provide an analysis of the operation at each stage. For 5-15 DOE-STD-1073-2003 Configuration Management interrupted implementation, an analysis should be developed and reviewed and approved by the design authority as soon as possible after the interruption is identified. 5.5.6.2 Operation with Partially Implemented Changes

The design authority must approve partially implemented changes prior to operation. Documents should be updated and distributed for partial implementation consistent with the process for documents for uninterrupted implementation. The design engineering review should confirm that the original technical review is still valid or indicate that a new technical review is completed and approved. 5.5.6.3 USQ Reviews for Partially Implemented Changes The contractor should determine if a USQ review is needed prior to operation in the interrupted condition. The contractor must use the requirements of 10 CFR 830.203 and the DOE-approved USQ procedures to determine if a USQ review is required. 5.5.7 Implementing Multiple Changes in Parallel Another area where the contractor must pay particular attention is the parallel implementation of two or more changes that affect or involve the same structure, system, or component. In such cases, a single person, such as the Cognizant System Engineer, should be assigned to oversee the implementation of all changes being made to the system, structure, or component. In addition, the change control packages should note any parallel changes that are being made to the system, structure, or component and any restrictions or limitations on the order of activities from the multiple changes. The individual assigned to oversee the multiple changes should also sign all field change notices for any of the parallel changes. The design analysis for the change must consider any parallel changes and the level of completion of the change prior to return to operation of the system, structure, or component. 5.6 Post-Modification Testing The quality assurance provisions of 10 CFR 830.122 require contractors to validate work before implementation and perform acceptance testing. The change control package should specify the post-modification testing to be performed and the acceptance criteria. Post-modification testing validates that the system or component performs as intended and operates within the design requirements after the change is installed and before turnover to operations. These tests serve as the final and independent check of the adequacy of the design review for the proposed change. 5-16 DOE-STD-1073-2003 Configuration Management 5.7 Post-Modification Training Criterion 2 of 10 CFR 830.122 (b) requires contractors to train and qualify personnel to be capable of performing their assigned work and to provide continuing training to personnel to maintain their job proficiency. Before returning a system, structure or component to service following changes, the contractor must train staff on the modifications that have been made and their affect on normal, abnormal, and emergency operations. 5.8 Documentation Changes Because every change directly or indirectly affects associated documentation, a major interface exists between the change control and document control processes. Drawings and procedures will need to be updated as part of the work processes to implement the change. Other documents will need to be updated and issued as “as-built” documents following implementation. All affected documents must be identified as part of the design review of changes and identified in the change control package. The affected documents should be updated in a timely manner. 5.8.1 Updating Critical Documents Before Implementing Changes

Critical facility documents, such as drawings and procedures needed for operation, must be updated prior to placing systems and components in operation. 5.8.2 Providing As-built Documentation As-built documentation should be prepared at the completion of implementation of the physical changes. Revised documentation should be distributed to users of controlled documents. Maintenance of documents and records is required by the quality assurance requirements in 10 CFR 830.122(d). Additional information on document control is provided in Chapter 6 of this standard. 5.9 Grading Change Control The contractor’s configuration management process may enhance or limit the degree or rigor and detail of the review and approval of the change depending upon the importance of the SSCs involved. For example, safety SSCs may warrant a higher level of approval than defense-in-depth SSCs not designated safety SSCs. The approval levels and other grading of the change control process must be documented in the configuration management plan. 5-17 DOE-STD-1073-2003 Configuration Management 5.10 Improvement If a significant change needs to be made to the facility or activity because of a deficiency in the design process, the design process should be reviewed and corrected to prevent reoccurrence of the problem. 5.11 Baseline Change Control Contractors should refer to their contracts and Chapter II of DOE O 413.3 for possible requirements related to changes to project and capital assets. 5-18 DOE-STD-1073-2003 Configuration Management 6 DOCUMENT CONTROL Document control ensures that only the most recently approved versions of documents are used in the process of operating, maintaining, and modifying the nuclear facility. Document control helps ensure that: • important facility documents are properly stored; • revisions to documents are controlled, tracked, and completed in a timely manner; • revised documents are formally distributed to designated users; and • information concerning pending revisions is made available. As controlled documents are updated to reflect changes to the requirements and/or physical installation, the contractor must ensure that: 1) Each updated document is uniquely identified and includes a revision number and date and 2) Each outdated document is replaced by the latest revision. A diagram of the features of document control functions is provided in Figure 6-1. Identify Documents Store Documents DCN Control Program Document Database Revise Document Controlled Document Distribution List Retrieve Documents Manual Request For Documents List of Applicable Documents Copies of Selected Documents Document Change Notice (DCN) Automatic Distribution of DCN/Revised Document Receipt Acknowledgements FIGURE 6-1 DOCUMENT CONTROL FUNCTIONS 6-1 DOE-STD-1073-2003 Configuration Management 6.1 Identifying Documents to be Controlled Contractors must determine what documents need to be controlled. They also must define "document owners" who are responsible for developing and revising the technical content of the documents and ensuring they are maintained current. Document owners will also establish the schedules for document revisions, distribution, and retrieval. Documents to be controlled should include those documents that reflect the facility's requirements, performance criteria, and associated design bases. However, the number of documents that must be controlled should be limited because of the resources required to properly control documents.

DSAs, the TSRs, the documented design requirements, the safety management plans, and any other documents that are referenced by, or support, the DSAs should be controlled documents. Contractors should assess controlled documents to determine if they need to be updated whenever changes are made to the facility or activity configuration, the design requirements, or other documentation that might impact them. Typical controlled documents include: • DSAs; • Authorization Agreements and associated references; • Safety Management Plans; • hazard controls, including TSRs; • documents that identify or define design requirements; • design specification and calculations; • accident analyses; • software data and manuals for operation and maintenance of critical software; • key procedures; • key drawings; and • key vendor supplied documents. SDDs and other similar documents may contain specific information about preventive and mitigative SSCs that is too detailed to include in the DSA, but which facility personnel need to understand design, operation, and maintenance of the facility, activity, or operation. Whenever a change is initiated, the contractor should also review the applicable SDDs to determine if they need to be updated. The SDDs typically include • detailed design and operating descriptions; • diagrams, such as electrical schematics and piping and instrumentation diagrams; and • load lists. 6-2 DOE-STD-1073-2003 Configuration Management After identifying which specific documents need to be controlled, the following information on each document should be recorded in the document databases to facilitate tracking and control: • document type, • unique document number (document control number), • document uses and priority, • document owner, • revision level, • current status (approved, draft, cancelled, superseded, etc.), • information regarding pending changes, and • other information needed for control and tracking, such as location and outstanding Document Change Notices (DCNs). This information should be retained in an easily retrievable manner. Selected document information should also be entered into the configuration management equipment database to establish a cross-reference or link between configuration management systems and components and the associated documents. As new documents are generated, they should be reviewed for inclusion in the controlled document database. One factor to consider in determining if a document should be controlled is whether the new document supports a CM SSC. The appropriate data on the document should be entered into the controlled document database with the appropriate data fields completed. The completeness and accuracy of the controlled document database is essential to the control and tracking and the retrieval functions of document control. In order to ensure that the efforts and resources of document control are appropriately focused, contractors should review the list of controlled documents periodically and strive to consolidate and reduce the volume of controlled documents. 6.2 Storing Documents The objective of temporary and long-term storage facilities for documents is to preclude damage or loss from deterioration, larceny, or vandalism. The methods of storage should be based on the particular characteristics of the document. Special consideration should be given to light-, pressure-, or temperature-sensitive documents (e.g., radiographs, photographs, film) consistent with applicable industry standards. Contractors should assign specific individuals the responsibility to ensure those records (active and inactive) and other documents are protected, preserved, and stored such that they can be retrieved within defined retrieval times. A central document control organization may be assigned these storage responsibilities.

6-3 DOE-STD-1073-2003 Configuration Management Storage and retention of documents must meet government record keeping requirements. They should also meet applicable DOE Orders, specific commitments to DOE, national standards, and the needs of the document owners and users. Originals or master copies of controlled documents should be stored and protected. Retention times should be established to meet the needs of the document owners and users and adhere to Federal record keeping requirements. Document control procedures should establish requirements for regularly backing up electronically stored documents on a defined schedule. 6.3 Controlling and Tracking Documents Contractors must control select documents to ensure that only the currently approved revisions of the documents are used. Contractors must track information on documents to ensure the current status of documents is reflected and information is available on pending changes. The major features for the effective control and tracking of documents are discussed below. 6.3.1 Control Procedures Contractors should develop and implement procedures that specify the document identification, control, storage, and retrieval requirements. These procedures should establish responsibilities and methods for each document control function. They should also include provisions for the review of controlled documents to ensure they are complete and approved prior to distribution. Document change notices should be used to notify users of document changes. 6.3.2 Secure File Contractors should establish and maintain a secure master file of the original documents or master copies. The master copies should not be released from that file; only reproductions should be provided, either on a regular distribution schedule or in response to specific requests. Contractors should establish: • strict controls for the viewing of master copies and • access and security precautions to ensure that the document master file is controlled and kept current. Alternatively, the documents may be stored electronically and made available through the web. Appropriate controls must be established to ensure that: • the document files are backed up • they are not lost and • the latest version is available on the web and postings do not lag behind changes. 6-4 DOE-STD-1073-2003 Configuration Management 6.3.3 Controlled Document Distribution List Contractors should establish and maintain controlled document distribution lists. The lists should identify both the documents that are to be controlled and the individuals who are holders of copies of those documents ("controlled document users," or as identified in 10 CFR Part 830, Appendix A, paragraph G.5, the "authorized users list"). The document owner should determine the list of controlled document users to be included on the controlled document list. The distribution list should include any satellite document distribution centers. To ensure they are included on the distribution list for revised documents, controlled document users should inform the document owners of their need for specific documents. Whenever a document is superseded by a new revision, a copy of the new revision must be sent to each controlled document user of the document. 6.3.4 Identification of Proposed Changes

The organization responsible for document control should be notified of any need to change a document as soon as that need is identified and approved, typically through the change control or work control processes. A DCN may be used for this purpose. The organization responsible for document control should provide a receipt acknowledging the notification that a document should be changed. The organization responsible for document control should take the appropriate action to update the document and record the status in the document control database. 6.3.5 Major Vs. Minor Document Changes The contractor should specifically identify in the change control process what constitutes a minor change (e.g., inconsequential, editorial corrections). Major changes to controlled documents are any changes that are not defined as minor changes. Major changes to controlled documents must be reviewed and approved by the document owners. The configuration management process may specify a simpler review for minor changes. 6.3.6 Notification of Pending Changes Pending changes are changes that have been approved for which the associated documents have not yet been updated and distributed. The organization responsible for document control should provide notice of pending changes to the controlled document users for the applicable documents. A notice of the pending change should also be attached to, or appropriately referenced on, the affected master document, in order to alert anyone requesting a copy of the document. 6-5 DOE-STD-1073-2003 Configuration Management 6.3.7 Timely Incorporation of Changes Contractors must incorporate approved changes into controlled documents in a timely manner. The contractor should control and limit the backlog of changes that have not been incorporated. Contractors should consider incorporating small changes in batches, where appropriate. When there is a large backlog of changes that have not been incorporated on a document, the documents may not reflect the physical facility or the approved safety basis consequently diminishing the value of the documents. Document control procedures should specify the limit of the number of changes that may be outstanding for a document before the document is revised. That limit may vary depending upon the type of document, document priority, complexity of the changes, and the degree of overlap of those changes. 6.3.8 Distribution of Documents Whenever a document is issued or superseded by a new revision, the contractor organization responsible for document control must send a copy of the new revision to each controlled document user of the document, along with a request for written receipt acknowledgment. Contractors can facilitate the return of receipt acknowledgments by sending a receipt acknowledgment form with the revised document. Document control procedures should specify guidelines for the maximum time between issuance of the revised controlled document and distribution. For example: Level of importance of controlled documents… Maximum time before distribution… Most important (e.g. TSRs) 24 hours Important 72 hours Least important 7 days The recipients (controlled document users) should update their copy of the document (for example, by inserting changed pages), and discard any obsolete pages or copies of documents. The recipient must return a written acknowledgment of receipt to the document control organization. The controlled document users should periodically review controlled copies in use to ensure their accuracy and their consistency with the master copies.

6.3.9 Control of Superseded or Canceled Documents The contractor should ensure that the document control process includes measures to ensure that superseded or canceled documents are replaced. If someone requests a copy of a superseded or canceled document, the provider should clearly and distinctively mark the document as "Superseded" or "Canceled" before providing the document. 6-6 DOE-STD-1073-2003 Configuration Management 6.3.10 Document Database The document control process should include a database for tracking document status and pending changes. The contractor must assign a database owner for the document database with assigned roles and responsibilities. The database should contain basic information about the document, including: • the unique document identification number, • the document owner, • the document type, • the current revision number, • the current document status (e.g., in revision, recently revised, needs to be revised), • information regarding pending changes, • outstanding document change notices, and • any other information necessary for control and tracking. As discussed below, the document database also supports the document retrieval function with associated information such as retention times, storage location, retrievability guidelines, and key words. 6.4 Retrieving Documents Contractors should ensure that documents are retrieved (made available) in a timely manner upon request. The contractor should establish the maximum retrieval time for each document based upon priorities provided by the document owners and users. Easy retrieval of documents is a service that facilitates contractor activities and encourages workers to use up-to-date information. When a copy of a document is issued, it should be the most recent version. The contractor should make the status of controlled documents available to the affected organizations. Additionally, the organization responsible for document control should supply information regarding pending changes, including references to detailed information, to anyone requesting the latest copy of the document. For example, if a drawing is requested, the document control organization should also provide the requester with a list or copies of existing change information (e.g., outstanding document change notices, pending changes, and related physical changes in progress). This will alert the requester to upcoming changes that could affect the retrieved document. There are numerous document identification systems available, each possessing unique advantages and disadvantages. Document identification systems range from the simple, manual control of hard copies to elaborate computer-based, keyword-searchable, full-text databases linked to the document images. Variables that affect the type and degree of sophistication of the document identification systems selected include the size of the 6-7 DOE-STD-1073-2003 Configuration Management facility, the volume of documents, available resources, existing programs, and the retrieval requirements of the users of these documents. The document database selected needs to provide the capability to support identification of relevant documents. The document database should have the capability to sort and identify documents based on: • their relationship to particular systems and components (such as a particular pump), • types of systems and components (such as motor-operated valves), • technical topics (such as fire protection), and • other relational data (such as the specific vendor) necessary for the adequate

identification of documents. Furthermore, when the document or document sets are provided, the system should also provide related information, such as the identification of pending changes. Consideration should be given to assigning key words or using fully searchable text files for the most important documents. In selecting the appropriate document information system, the contractor should ensure that the system is available and documents can be retrieved as needed to support document owners and users. If the documents are necessary for the day-to-day operation of the facility, they should be available on a real-time or short-turnaround basis [e.g., controlled copies of procedures and piping and instrument drawings (P&IDs) should be located or accessible in a central area such as a control room]. Conversely, if the documents are not routinely needed, a retrieval time of 24 hours or more may be acceptable. This is typical, for example, of design basis information used by the design engineering organization for physical change preparation. In order to establish appropriate retrieval times the contractor may need to formally solicit and consider input from the document owners and the users. 6.5 Controlling Interfaces The contractor should clearly define the interfaces among facility, maintenance, and non- facility organizations to ensure configuration-related information is completely and accurately communicated. For example, a change to a vendor manual may result in changes to maintenance procedures, training materials, equipment lists, repair parts, and design basis documents such as specifications and drawings. In addition, information may flow in both directions across organizational interfaces. For example, information related to a design change may be needed by operations, maintenance, and/or training to update procedures to conform to the facility requirements. Conversely a procedure change initiated by maintenance personnel that affects an operating parameter may necessitate validation by design engineering personnel to verify expected operating conditions fall within the requirements. The configuration management process should establish controls to ensure: 6-8 DOE-STD-1073-2003 Configuration Management • necessary information that initiates a configuration change is sent to all affected organizations and • the appropriate reviews, actions, and document updates are accomplished in a timely manner. 6.6 Controlling the Preliminary Documented Safety Analysis Following submittal of the preliminary documented safety analysis (PDSA) to DOE, the contractor must review all changes for their potential impact on the PDSA and maintain the PDSA up-to-date as the design evolves so that both the contractor and DOE can rely on the information until it is replaced by the final DSA. 6-9 DOE-STD-1073-2003 Configuration Management 7 ASSESSMENT The quality assurance criteria of 10 CFR Part 830, Subpart A, require DOE contractors for nuclear facilities (including activities and operations) to assess management processes and measure the adequacy of work performance. Furthermore, the assessment criteria require that the persons performing the assessments: • have sufficient authority and freedom from line management and • are qualified to perform the assessments. The maintenance criteria of DOE O 433.1 also require periodic assessments to verify the condition of systems and equipment.

This chapter discusses four different types of assessments that can be performed to determine the effectiveness of different aspects of the configuration management process (see section 7.1). Periodic assessments help ensure that work processes continue to function properly or problems are identified, root causes are determined, and problems are corrected. This chapter provides guidance on performing assessments directly related to configuration management. While contractors may perform these assessments of the configuration management process separate from other assessments, it may be more efficient to combine these assessments with other periodic assessments of the activity. All or part of the assessment of the adequacy of configuration management for an activity may be integrated into broader management and performance assessments, such as quality assurance, maintenance, or integrated safety management assessments. If the contractor decides to fold the assessment of configuration management into a broader assessment, it must consider the criteria in this chapter when developing the assessment criteria for the broader assessment. 7.1 Assessment Objectives The objective of assessing configuration management is to detect, document, determine the cause of, and initiate correction of inconsistencies among design requirements, documentation, and physical configuration. Properly performed assessments should help identify inconsistencies between these areas, evaluate the root causes for these problems, and prescribe improvements to avoid similar inconsistencies in the future. The five specific types of assessments discussed in this chapter are: • Construction assessments, which are performed to ensure configuration is managed throughout the construction process for new construction or major modifications. 7-1 DOE-STD-1073-2003 Configuration Management • Physical configuration assessments, which are conducted to evaluate the consistency between the physical configuration and the facility documentation. • Design assessments, which are done to ensure that design documents have been updated to reflect changes and accurately reflect the physical configuration of the nuclear facility. • Post-construction, -modification, or -installation inspections and tests, which are performed either after construction, modification, or installation to verify operation is as expected. • Periodic performance assessments, which are conducted to verify that systems and components continue to meet design and performance requirements in their current configurations. 7.2 Construction Assessments Because of the changing nature of the physical configuration of a facility under construction, the contractor may not impose a rigid change control process in early construction. As stated in paragraph 3.1.1, DOE and the contractor must formally agree on the point when the configuration management process will be imposed and what process will be used. There should be a documented plan for configuration management during construction. It may be appropriate to use different processes as construction proceeds and the physical configuration approaches completion. Construction inspections/audits are performed throughout the construction process for new construction or major modifications, to ensure the quality of the construction and the conformance to design specifications. Adherence to the applicable configuration management process should be a part of the construction assessment process. In particular, the physical configuration should be assessed at construction turnover to ensure that the physical configuration is consistent with the design requirements and the documentation, including (but not limited to) as-built drawings. Construction assessments may involve physical configuration assessments; design assessments; post- construction, -modification, or -installation inspections and tests; and/or periodic performance assessments.

7.3 Physical Configuration Assessments Physical configuration assessments are performed to determine if the actual physical configuration agrees with the design requirements and the documentation. They also determine the effectiveness of configuration management in the field. Information is gathered through interviews with knowledgeable facility personnel, document reviews, and detailed walkdowns and observations of the actual facility configuration. 7-2 DOE-STD-1073-2003 Configuration Management As specified in DOE O 420.1A, Facility Safety, these assessments should be conducted as part of the review of system operability, reliability, and material condition during facility inspections required by DOE O 433.1, Maintenance Management Program for DOE Nuclear Facilities. These periodic reviews assess the system's ability to perform its design and safety functions. In addition, these assessments should integrate with the activities performed to meet the Quality Assurance Program (QAP) under 10 CFR Part 830, Subpart A. As stated in DOE O 433.1, the goal of the assessment process should be to ensure the integrity of the identified SSCs. Contractors must analyze discrepancies and take appropriate corrective action to resolve them. If substantive discrepancies (either in number or type) are discovered, the contractor must develop appropriate immediate corrective actions to establish agreement between the physical configuration and the documentation. Corrective actions should include technical evaluations, based on system requirements, to determine whether the physical configuration or the documentation should be changed. For existing facilities, the corrective actions should include additional walkdowns to characterize the problem and to determine the extent of the problem. Physical configuration assessments should be conducted at a specified periodicity to establish confidence. Contractors should routinely review the configuration of those systems performing vital safety functions (safety SSCs). Additional systems of lesser importance should be included at a lesser periodicity to ensure the breadth of the configuration is being maintained adequately. Special reviews may be required on an as needed basis, such as to verify input into a new DSA or when unusual or off-normal occurrences affecting the safety basis systems results in a lack of confidence in the facility configuration or in a concern that it has been compromised. Contractors should consider scheduling reviews of the configuration of safety SSCs on an annual basis on a schedule appropriate to support the annual update of the DSA. Physical configuration assessments may be performed on a sample basis, with the sample providing a representative cross-section of component types within the system being assessed. The sample should be large enough to ensure that a statistically significant portion of the system and its components are chosen. For instance, the sample should include major and minor components, large and small bore piping (where applicable), and instruments and controls. Two common types of physical configuration assessments are "walkdowns" and resolution of configuration and documentation discrepancies. While the processes of walkdowns and resolution of configuration and documentation discrepancies have significant overlaps, the distinctions between them need to be understood. One distinction is based on the products of these processes. A product of the walkdown process is a set of marked-up documents that reflect the actual physical configuration and identify discrepancies with the currently approved facility documentation. A product of the resolution of configuration and documentation discrepancies is "as-built documents" that have been field-verified and design-verified.

7-3 DOE-STD-1073-2003 Configuration Management 7.3.1 Walkdowns During walkdowns, the as-found configuration is identified by comparing the existing physical configuration with the facility documentation to identify any discrepancies, typically by marking up the documents. Walkdowns are sometimes conducted to: • Record manufacturers' nameplate data from equipment, • Identify missing or incorrect equipment labeling, • Determine the present material condition of equipment, and • Identify potential physical interactions between equipment (such as non- seismically qualified equipment mounted in such a position as to impact seismically qualified equipment during an earthquake). A sample walkdown procedure is provided in Appendix G. 7.3.2 Resolution of Configuration and Documentation Discrepancies The resolution of configuration and documentation discrepancies involves: • determining the actual physical configuration that exists at a point in time, • identifying any discrepancies with the facility documentation, and • technically resolving those discrepancies. In some cases, discrepancies arise simply because the facility documentation is incomplete or inaccurate in some detail. In other cases, discrepancies arise because inadequately controlled hardware changes caused the physical configuration to become different from the facility documentation. The level of detail of a particular facility document type establishes the threshold of the corrections that need to be made. If a facility document provides, or is intended to provide, information that does not agree with the actual physical configuration, those discrepancies should be identified and resolved. Leaving incorrect or unverified information on a document is likely to mislead users of the document. Further, any information that is left on as-found documents and has not been verified should be clearly identified. If the contractor is made aware of an as-found discrepancy, the contractor should perform a technical review to determine if the physical configuration is the desired configuration (in accordance with design requirements) or if the facility documentation indicates the appropriate configuration (the physical configuration needs to be changed to meet design requirements). In some cases, the resolution of a discrepancy might be to establish the acceptability of the existing physical configuration and change the design requirements. The design authority should approve the discrepancy resolution (i.e., design verification) to ensure that the final configuration is consistent with the design requirements. Changes to either the physical configuration or the documentation should be tracked through a design change document. The end product of the resolution of configuration and documentation discrepancies is 7-4 DOE-STD-1073-2003 Configuration Management documentation that has been both field-verified and design-verified to be consistent with the "as-built" or actual physical configuration. 7.4 Design Assessments Contractors should perform design assessments to determine the consistency among the documented design and system requirements, the system documentation (including drawings and procedures), and the physical configuration of the nuclear facility. The audit should confirm the completeness and accuracy of the design and system requirements documented in the DSA, the TSRs, and other authorization basis documents. In particular, during these audits the contractor should verify that the safety basis and authorization basis documents accurately reflect any modifications made to the facility or changes made to the activity since the previous design assessment.

One reason for ensuring that the documented design and system requirements continue to be accurate is to provide accurate information for operations, training, and maintenance documents and activities. Contractors should also ensure that operations, training, and maintenance documents are maintained consistent with the documented design and system requirements. Ideally, contractors should schedule the design assessments at a time appropriate to support the annual update of the safety basis. 7-5 DOE-STD-1073-2003 Configuration Management 7.5 Post-Construction/ -Modification/ -Installation Assessments Following completion of construction, modification, or installation, the contractor should perform inspections and tests to verify expected operation. Section 4.5.1.2 of DOE O 420.1A requires contractors to test systems following modifications to ensure that they continue to be capable of fulfilling system requirements. These inspections and tests ensure that the system, structure, or component is installed as documented, meets the design requirements, and is verified to be operable prior to being placed into service initially or returned to service. This function prevents unintended changes from being introduced through errors during design or construction. For physical changes, these inspections and tests serve as a final and independent adequacy check of the design and technical reviews for the change. If a changed SSC fails to meet its acceptance criteria, it should not be turned over for normal operations until either a technical review has been completed and any follow-up actions completed or the SSC is returned to its original condition and tested satisfactorily. For the post-modification tests to be effective test conditions should be consistent with normal and emergency operating conditions and acceptance criteria should demonstrate that the applicable design requirements are met. It is important to verify that inadvertent changes were not introduced during a modification. Depending on the extent and complexity of a modification, and the degree of work control, the contractor may need to perform inspections and tests on portions of the nuclear facility that were not modified to properly verify the expected operation after a modification. 7.6 Periodic Performance Assessments As required by DOE O 433.1, Maintenance Management Program for DOE Nuclear Facilities, systems, and components within the configuration management process must be monitored and tested periodically to determine if they are still capable of meeting their design and performance requirements. The process for performing this monitoring and testing should be described in the Maintenance Implementation Plan (MIP) required by DOE O 433.1. DOE G 433.1-1, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1, provides information useful for developing and implementing this monitoring program. Monitoring and testing may take the form of surveillance actions, periodic in-service inspections and tests, and other monitoring of systems and components to ensure safe and reliable operation of the facility. In addition to observing direct results, derived results may include reliability assessment, performance trending, and equipment aging characteristics. Contractors should use the results of this monitoring to identify and avoid inconsistencies between functional and performance requirements identified in the design and actual capability of systems and components. In addition, contractors should use trending of data to detect degradation of equipment due to aging or other causes.

By performing periodic performance monitoring, contractors should verify that selected systems and components continue to be able to perform their intended functions (i.e., meet their design requirements). Contractors should correct any deficiencies identified 7-6 DOE-STD-1073-2003 Configuration Management during the periodic performance assessments that cause the systems or components to deviate from design requirements (see 10 CFR 830.122(c)(2)). Contractors should also identify any root causes of performance degradation (see 10 CFR 830.122(c) (3)). Contractors should routinely monitor, collect, trend, and analyze performance data (including thermal, hydraulic, electrical, and mechanical data). Calibrated instrumentation should be used when performing these activities (see 10 CFR 830.122(e) (4) and (h) (2)). The methods of implementation should include procedures, checklists, or other guidance documents necessary to conduct these activities. Cognizant System Engineers should maintain cognizance over performance monitoring activities on assigned systems. Their responsibilities should include the identification of performance goals and acceptance criteria consistent with the associated SSC design requirements. Reviewing trend graphs of collected equipment data at specified intervals is a proven, effective approach. For example, if the trend graph indicates that the equipment likely will not meet the acceptance criteria at or before the next scheduled test, an adjustment in the test schedule and other maintenance actions would be necessary. Recognition of interfaces with existing maintenance program requirements is necessary. Surveillance testing is typically performed to satisfy regulatory, code, or other requirements to ensure operability of the equipment within established limits. The results of surveillance testing should be used to detect and correct any deficiencies that cause the equipment to deviate from the design requirements. Surveillance testing techniques are similar in many ways to those used in SSC performance monitoring. The results of surveillance testing should be reviewed and trended, and necessary corrective actions taken to return equipment performance to within the design requirements. The periodic equipment performance monitoring function should take credit for periodic surveillance testing, where appropriate. Periodic testing, beyond that in the TSR surveillance requirements, may be adjusted both in frequency and degree of technical content based on the importance of the SSC or the particular SSC function. The origin of various testing requirements should be documented and maintained in the MIP as specified in DOE O 433.1, Maintenance Management Program for DOE Nuclear Facilities. Contractors should include the design engineers, as well as Cognizant System Engineers, in the periodic review of operating and maintenance procedures to alert maintenance and other organizations to any design changes in the affected systems. 7.7 Resolution of Open Items Contractors should document assessment findings as open items if they are validated to involve one or more of the following: • contradictory information from different source documents • unanswered technical questions • missing, undocumented or inaccurate information 7-7 DOE-STD-1073-2003 Configuration Management

The contractor should establish a formal, documented process for resolution of open items. That process should include tracking the open item to completion and closeout, including documentation of the resolution. Any identification or a potential inadequacy of the DSA should be assessed through the USQ process. 7-8 DOE-STD-1073-2003 Configuration Management APPENDIX A - REFERENCES The following documents are either referenced within this standard or were considered during the development of this standard. Federal Regulations http://www.access.gpo.gov/ecfr/ 10 CFR Part 830 Nuclear Safety Management 29 CFR 1910.119 Process safety management of highly hazardous chemicals 36 CFR Chapter XII, Part 1220 Federal Records, General 48 CFR 945.102-71 Maintenance of Records 48 CFR 970.0470 Department of Energy Directives 48 CFR 970.5204-2 Laws, Regulations, and DOE Directives 48 CFR 970.5223-1 Integration of environment, safety, and health into work planning and execution DOE Directives (Policies, Orders, Manuals, and Guides) http://www.directives.doe.gov/ DOE G 200.1-1 Software Engineering Methodology DOE G 414.1-1A Management Assessment and Independent Assessment Guide DOE G 414.1-2 Quality Assurance Management System Guide for use with 10 CFR 830.120 and DOE O 414.1 DOE G 420.1-2 Guide for the Mitigation of Natural Phenomena Hazards for DOE Nuclear Facilities and NonNuclear Facilities DOE G 421.1-2 Implementation Guide For Use in Developing Documented Safety Analyses To Meet Subpart B Of 10 CFR 830 A-1 http://www.access.gpo.gov/ecfr/ http://www.directives.doe.gov/ DOE-STD-1073-2003 Configuration Management DOE G 423.1-1 Implementation Guide For Use In Developing Technical Safety Requirements DOE G 424.1-1 Implementation Guide For Use In Addressing Unreviewed Safety Question Requirements DOE G 430.1-1 Project Controls DOE G 430.1-5 Transition Implementation Guide DOE G 433.1-1 Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1 DOE G 435.1-1 Implementation Guide for use with DOE M 435.1-1 DOE G 450.4-1B Integrated Safety Management System Guide DOE Manual (M) 435.1-1 Radioactive Waste Management Manual DOE O 412.1 Work Authorization System DOE O 413.1A Management Control Program DOE O 413.3 Program and Project Management for the Acquisition of Capital Assets DOE O 414.1A, Chg 1 Quality Assurance DOE O 420.1A Facility Safety DOE O 430.1A Life Cycle Asset Management DOE O 433.1 Maintenance Management Program for DOE Nuclear Facilities DOE O 452.2B Safety of Nuclear Explosive Operations DOE O 5480.19 Conduct of Operations Requirements for DOE Facilities DOE O 5480.20A Personnel Selection, Qualification, and Training Requirements for DOE Nuclear Facilities A-2 DOE-STD-1073-2003 Configuration Management DOE P 450.4 Safety Management System Policy DOE Technical Standards http://tis.eh.doe.gov/techstds/ DOE HDBK 1101 Process Safety Management for Highly Hazardous Chemicals DOE HDBK 3027 Integrated Safety Management Systems (ISMS) DOE STD 1027 Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports DOE STD 1051 Guideline to Good Practices for Maintenance Organization and Administration at DOE Nuclear Facilities DOE STD 1065 Guideline to Good Practices for Postmaintenance Testing at DOE Nuclear Facilities DOE STD 1121 Internal Dosimetry DOE STD 3003 Backup Power Sources For DOE Facilities

DOE STD 3006 Planning and Conduct of Operational Readiness Reviews DOE STD 3009 Preparation Guide for U.S. DOE Nonreactor Nuclear Facility Safety Analysis Reports DOE STD 3011 Guidance For Preparation of DOE 5480.22 (TSR) and DOE 5480.23Implementation Plans DOE STD 3024 Content of System Design Descriptions DOE STD 6002 Safety of Magnetic Fusion Facilities: Requirements A-3 http://tis.eh.doe.gov/techstds/ DOE-STD-1073-2003 Configuration Management DOE Technical Standards http://tis.eh.doe.gov/techstds/ DOE STD 6003 Safety of Magnetic Fusion Facilities: Guidance Other DOE References Defense Programs Safety Information Letter, Issue No: 95-04 Management of Safety Analysis Report Information Using Standard Configuration Management Practices Other Government Standards MIL-STD-973, 17 April 1992 Military Standard Configuration Management Other Commercial Nuclear Industry Documents American Society of Mechanical Engineers (ASME) NQA-1-2000 Quality Assurance Requirements for Nuclear Facility Applications Electronics Industries Alliance (EIA)-649, August 1998 National Consensus Standard for Configuration Management IAEA-TECDCO-1335, January 2003 Configuration Management in Nuclear Power Plants Institute of Nuclear Power Operations (INPO) AP-929, May 1998 Configuration Control Process Description INPO 87-006, July 1987 Report on Configuration Management in the Nuclear Utility Industry International Organization for Standards (ISO) 10007:1995(E) Quality Management – Guidelines for Configuration Management A-4 DOE-STD-1073-2003 Configuration Management APPENDIX B - GLOSSARY As-built documentation. Documentation (for example, Piping and Instrument Diagrams, and database records) verified by physical inspection as depicting the actual physical configuration and verified as consistent with the design requirements. As-found. Information, often in the form of marked-up documents that reflects the actual physical configuration and identifies any discrepancies with currently approved facility documentation. Assessment. For engineering applications, the process of estimating the value of something using authoritative expert judgment based upon observations of representative cases and rough calculations, rather than determining the exact value based upon comprehensive and detailed examinations, and precise and rigorous complete calculations. Authorization agreement. A documented agreement between DOE and the contractor for high-hazard facilities (Hazard Category 1 and 2), incorporating the results of DOE’s review of the contractor’s proposed authorization basis for a defined scope of work. The authorization agreement contains key terms and conditions (controls and commitments) under which the contractor is authorized to perform the work. Authorization basis. Those aspects of the facility design basis considered important to the safety of facility operations and therefore relied on by DOE to authorize operation. The authorization basis is described in documents such as the facility documented safety analysis and other safety analyses, hazard classification documents, the Technical Safety Requirements, DOE-issued safety evaluation reports, and facility-specific commitments made in order to satisfy DOE Orders or policies. Change. Any alteration or addition, temporary or permanent, to the facility physical configuration, facility documentation, or design requirements is considered to constitute a change. Changes not within current design requirements involve design changes. Identical replacements are not changes.

Change control. A process that ensures all changes are properly identified, reviewed, approved, implemented, tested, and documented. Change control package. The change control package is the documentation that accompanies a change to a facility, activity, or operation from the planning and initiation through completion of the implementation and testing. The change control package documents the following as applicable: • The description of the proposed change sufficient to support technical and management reviews prior to approval; • The name and organization of the requester; • The description of the potentially affected SSCs; • The reason for the proposed change and any known schedule issues; • A list of the alternative solutions considered and the results; • The date by which the decision about the change needs to be completed to facilitate timely implementation or to allow implementation to occur concurrent with other activities, such as a planned maintenance shutdown; • Constraints; and • Any other information needed to review, track, approve, or process the proposed change. It also includes related information such as: • Change request • Design package B-1 DOE-STD-1073-2003 Configuration Management • Installation package • Post-modification testing documentation Change traveler. A form used to transmit the change control package. Comprehensive search. A process through which broad spectrums of documents that may contain design information are identified, retrieved, and evaluated. Key steps involve locating and screening documents that may contain design information and reviewing them to extract design information. Cognizant system engineer. The engineer assigned technical responsibility for a particular system, who coordinates technical activities related to the assigned system. The Cognizant System Engineer has technical understanding of the system requirements design, operation, testing and maintenance. The Cognizant System Engineer ensures that relevant documents, such as system design descriptions, technical drawings, diagrams, lists, and procedures for surveillance, testing and maintenance are complete, accurate, and up to date. The Cognizant System Engineer may also keep vendor technical information and appropriate files concerning system history of repairs, modifications, operational problems, and other unique conditions or circumstances. Equivalent terms include: cognizant engineer, system engineer, system specialist, and subject matter expert. Configuration. Configuration is the combination of the physical, functional, and operational characteristics of the structures, systems, and components (SSCs) or parts of the existing facility, operation, or activity. (NQA-1) Configuration baseline. A configuration baseline consists of all approved documents that represent the definition of the product at a specific point. (ISO 10007:1995(E)) Configuration control board or configuration board. The Configuration Control Board is a collection of technical, management, and administrative experts assigned the authority and responsibility to make decisions on the configuration and its management. Configuration management (CM). Configuration management is a disciplined process that involves both management and technical direction to establish and document the design requirements and the physical configuration of the nuclear facility and to ensure that they remain consistent with each other and the documentation. Configuration management structures, systems and components (CM SSCs). CM SSCs are the set of structures, systems, and components that are managed under the configuration management process when changes are proposed and implemented. At a minimum, the CM SSCs include the safety SSCs as identified in the documented safety analysis, the Vital Safety System SSCs and