DOE-STD-1073-2016, Configuration Management (Invoked)

DOE-STD-1073-2016 December 2016 Superseding DOE-STD-1073-2003 DOE STANDARD CONFIGURATION MANAGEMENT U.S. Department of Energy Washington, DC 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. NOT MEASUREMENT SENSITIVE DOE-STD-1073-2016 ii FOREWORD This Department of Energy (DOE) Technical Standard contains provisions for developing configuration management (CM) processes for DOE facilities and activities. Application of a sound CM process protects the integrity of structures, systems, and components (SSCs) and credited controls (for accelerators), as well as design information and documentation; therefore, CM processes should be applied early in the life of a facility or activity and maintained throughout the lifecycle of the facility or activity. This Standard also includes examples and methods to support its implementation. This Standard was originally issued in 1993 to address CM for the operating phase of nuclear facilities. In 2003, this Standard was expanded to be applicable to the design and post- operational (deactivation, decontamination, and decommissioning) phases as well. In addition, in 2003 this Standard was organized into the topical areas of design control, work control, change control, document control, and assessments of the CM process and that format is continued in this revision. The previous versions of this Standard were written to apply primarily to DOE Hazard Category (HC) 1, 2, and 3 nuclear facilities. The use of this Standard may be beneficial when applied to DOE radiological and non-nuclear facilities and activities, as well as to HC 1, 2, and 3 nuclear facilities; consequently, DOE has made substantial changes in this revision, to allow DOE to invoke this Standard for these facilities and activities where it chooses to do so. This Standard also has been updated to conform to changes in other DOE directives and standards in the intervening decade since it was last revised. Consistent with DOE Order (O) 252.1A, Admin. Chg. 1, Technical Standards Program, this Standard was developed using the consensus process of the DOE Technical Standards Program. Beneficial comments (recommendations, additions, deletions, and any pertinent data that may improve this document) should be emailed to nuclearsafety@hq.doe.gov or sent to: Office of Nuclear Safety (AU-30) Office of Environment, Health, Safety and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 mailto:nuclearsafety@hq.doe.gov DOE-STD-1073-2016 iii TABLE OF CONTENTS 1.0 INTRODUCTION ....................................................................................................................... 1-1 1.1 APPLICABILITY .............................................................................................................................. 1-1 1.2 OBJECTIVES AND GENERAL PROVISIONS ....................................................................................... 1-3 1.3 CM SSCS AND CREDITED CONTROLS ............................................................................................ 1-5 1.4 GRADING ....................................................................................................................................... 1-7 2.0 DESIGN CONTROL .................................................................................................................. 2-1

2.1 NEW FACILITIES AND NEW CONSTRUCTION .................................................................................. 2-1 2.2 EXISTING FACILITIES AND ACTIVITIES ........................................................................................... 2-2 2.3 DESIGN REQUIREMENTS ................................................................................................................ 2-3 2.4 INTERIM MEASURES ....................................................................................................................... 2-4 2.5 DESIGN AUTHORITY ...................................................................................................................... 2-5 2.6 REVIEW .......................................................................................................................................... 2-5 2.7 SYSTEM DESIGN DESCRIPTIONS FOR HAZARD CATEGORY 1, 2, AND 3 NUCLEAR FACILITIES ........ 2-8 2.8 CM EQUIPMENT DATABASES ......................................................................................................... 2-8 2.9 TURNOVER FROM DESIGN AND CONSTRUCTION .......................................................................... 2-10 2.10 DESIGN CHANGES ........................................................................................................................ 2-11 2.11 COGNIZANT SYSTEM ENGINEERS FOR HAZARD CATEGORY 1, 2, AND 3 NUCLEAR FACILITIES .... 2-11 3.0 WORK CONTROL .................................................................................................................... 3-1 4.0 CHANGE CONTROL ................................................................................................................ 4-1 4.1 IDENTIFICATION OF CHANGES ........................................................................................................ 4-1 4.2 EQUIVALENT CHANGES ................................................................................................................. 4-3 4.3 CONSISTENT AND EFFICIENT CHANGE CONTROL PROCESSES ........................................................ 4-4 4.4 DOCUMENTATION OF PROPOSED CHANGES ................................................................................... 4-4 4.5 REVIEW OF CHANGES .................................................................................................................... 4-5 4.6 INDEPENDENT VERIFICATIONS ..................................................................................................... 4-10 4.7 APPROVAL ................................................................................................................................... 4-10 4.8 POST-MODIFICATION TESTING AND TRAINING ............................................................................ 4-11 4.9 IDENTIFICATION OF DOCUMENT TO BE REVISED .......................................................................... 4-11 5.0 DOCUMENT CONTROL .......................................................................................................... 5-1 5.1 DOCUMENTS TO BE CONTROLLED .................................................................................................. 5-1 5.2 DOCUMENT AND RECORD STORAGE .............................................................................................. 5-3 5.3 TIMELINESS.................................................................................................................................... 5-3 5.4 DOCUMENT RETRIEVAL ................................................................................................................. 5-3 5.5 DOCUMENT CONTROL FOR ACCELERATORS .................................................................................. 5-4

6.0 ASSESSMENTS .......................................................................................................................... 6-1 6.1 OBJECTIVES ................................................................................................................................... 6-1 6.2 CONSTRUCTION ASSESSMENTS ...................................................................................................... 6-2 6.3 PHYSICAL CONFIGURATION ASSESSMENTS .................................................................................... 6-2 6.4 DESIGN ASSESSMENTS ................................................................................................................... 6-4 6.5 PERIODIC PERFORMANCE ASSESSMENTS ....................................................................................... 6-5 6.6 RESOLUTION OF OPEN ITEMS FROM ASSESSMENTS ........................................................................ 6-6 APPENDIX A REFERENCES ......................................................................................................... A-1 APPENDIX B GLOSSARY ...............................................................................................................B-1 APPENDIX C ACRONYMS ............................................................................................................. C-1 DOE-STD-1073-2016 iv APPENDIX D DIRECTIVES AND STANDARDS REFERRING TO CONFIGURATION MANAGEMENT, CONFIGURATION CONTROL, AND CHANGE CONTROL ................................................................. D-1 APPENDIX E INTERFACING DIRECTIVES ...............................................................................E-1 APPENDIX F GRADING FOR CM ................................................................................................. F-1 APPENDIX G DOCUMENT REVIEWS FOR FACILITIES AND ACTIVITIES SUBJECT TO DOE-STD-1189 ................................................................................... G-1 APPENDIX H REGENERATION/RECOVERY/DOCUMENTATION OF REQUIREMENTS, BASES, AND ENGINEERING INFORMATION .................................................... H-1 APPENDIX I EXAMPLE CHANGE REQUEST ............................................................................ I-1 APPENDIX J EXAMPLE CHANGE CONTROL PACKAGE ..................................................... J-1 APPENDIX K CONDUCT OF WALKDOWNS ............................................................................. K-1 TABLE OF FIGURES FIGURE 2-1: SAMPLE CM EQUIPMENT DATABASE ....................................................................................... 2-9 FIGURE 3-1: WORK CONTROL FLOW ............................................................................................................ 3-1 FIGURE 4-1: POTENTIAL CHANGE CONTROL PROCESS FOR CM SSCS AND CREDITED CONTROLS ................. 4-2 1.0 INTRODUCTION This Standard provides the criteria and objectives for developing a configuration management (CM) process for design, construction, operation, and post-operation of a DOE facility or activity. It also includes examples and methods for achieving those criteria and objectives. The criteria and objectives presented in this Standard are based on industry practice and CM experience at DOE facilities. The following five key elements for effective CM are discussed in this Standard: • Design Control, • Work Control, • Change Control, • Document Control, and • Assessments. 1.1 APPLICABILITY

This Standard is applicable to DOE operators and DOE contractor personnel, including the National Nuclear Security Administration (NNSA) personnel and their contractors, for DOE Hazard Category (HC) 1, 2, and 3 nuclear facilities and activities. Contractors operate most DOE facilities. These facilities and activities are referred to as government- owned, contractor-operated (GOCO) facilities and activities. Consequently, most responsibilities for CM identified in this Standard are performed by contractors. However, DOE personnel, not contractors, perform work for government-owned, government-operated (GOGO) facilities and activities. Therefore, throughout this Standard, wherever an action is assigned to a contractor, the DOE operator would perform the action for GOGO facilities and activities. Many of the principles and methods provided in this Standard may also be useful to manage changes to non-nuclear activities or to nuclear facilities whose inventory of nuclear materials is below the threshold for HC-3 nuclear facilities (e.g., radiological facilities and non-nuclear facilities). Where this Standard is required to be met or included as a commitment by the contractor, the “shall” statements in this Standard are considered as requirements for the facilities and activities. The “should” statements are recommended where appropriate, but not required. Alternate approaches for HC 1, 2, and 3 nuclear facilities, including selective application of this Standard or use of another consensus standard, are also acceptable if formally approved by the applicable DOE Program Office. Contractors who selectively apply this Standard shall identify the exceptions to this Standard in the CM process. For some radiological and non-nuclear facilities and activities it might be more suitable to use a consensus standard, such as ANSI/EIA-649B, Configuration Management Standard, to develop the CM process for the facility or activity. If use of this Standard is required in DOE-STD-1073-2016 1-2 the contract and the contractor has determined that use of another standard would be more appropriate, the contractor should contact DOE for approval to use the other standard. Use of an alternate standard is acceptable if formally approved by the applicable DOE Program Office. See Appendix D of this Standard for a list of DOE orders, manuals, guides, standards, and handbooks referring to CM and related processes. See Appendix E for specific provisions for CM in DOE regulations, directives, and guidance which should be integrated into CM processes where applicable to the facility or activity. DOE O 413.3B, Chg. 2, Program and Project Management for the Acquisition of Capital Assets, and DOE O 430.1C, Real Property Asset Management, currently invoke the 2003 version of this Standard. Contractors with these directives included in their contracts are required to meet the provisions of the applicable version of DOE-STD-1073 as stated in those directives; however, they may use the equivalency/exemption process in Section 6.c of DOE O 251.1C, Departmental Directives Program, to request DOE to allow the use of this revision of this Standard in lieu of the earlier version. The provisions in this Standard may overlap provisions in other documents. These overlapping provisions are viewed as complementary, not conflicting, in an effort to ensure full safety and design coverage. The use of this Standard does not preclude the supplementary use of other standards that address particular aspects of CM in greater detail, such as the application of CM during construction or control of equipment status or the application of CM to computer software.

Most of the provisions of this Standard may be useful to all types of DOE facilities and activities. Some of the provisions of this Standard apply only to specific types of facilities or activities, such as nuclear facilities or accelerators. Where such limitations are applicable, the limitations are clearly indicated. The size, complexity, and missions of DOE facilities and activities vary widely and CM processes should be structured to individual facilities and activities. It would generally be inappropriate to apply the same CM process to widely different facilities and activities, for example, a reactor facility and a small, simple laboratory. The examples and methodologies provided as guidance in this Standard may not be appropriate for application to all DOE facilities and activities. The individuals defining the CM process for a particular facility or activity should apply judgment to determine if the non-mandatory guidance in this Standard is appropriate or if it should be modified to suit the facility or activity. The earlier the CM process is established for a facility or activity, the easier it will be to establish and maintain. It is generally more cost effective to establish and maintain accurate records during the design stage when memories are fresh and design documentation is still available, than to attempt to reconstruct them at a later date. Prior to the end of life of the facility or activity, the contractor, in coordination with DOE, shall determine if CM should be applied to post-operation activities, such as decontamination and deactivation. If there is a contractor change, the outgoing contractor DOE-STD-1073-2016 1-3 should work with the incoming contractor to determine how the CM effort is to be relayed to the new contractor. Such transitional activities should be documented in contracts to ensure that they are completed. Unless it is determined that CM is no longer needed for the facility or activity, the contract shall clearly define which contractor is responsible for CM at each point in time with no gap in time. Once the CM effort is transferred to the new contractor, the new contractor shall be responsible for CM at the facility or activity unless or until CM is no longer required. If a new CM process is needed it should be developed and approved so that it can be implemented at the point of transition with no gap in time from the previous CM process. In particular, for capital asset projects transitioning to operation, the CM process to be used during and following the transition should be documented in the Transition to Operations Plan discussed in DOE G 413.3-16A, Chg. 1, Project Completion/Closeout Guide. 1.2 OBJECTIVES AND GENERAL PROVISIONS The basic objectives of CM are the same for all facilities and activities which are to: (1) Establish consistency among design requirements, physical configuration, and documentation (including analysis, drawings, and procedures) for the facility or activity; and (2) Maintain this consistency throughout the life of the facility or activity, particularly as changes are being made. CM should be established as an integrated process to be used by all personnel when performing activities that affect configuration of items within the process, not as a separate program. If the contractor establishes a separate group with the responsibility for CM, the role of that group should be to develop and maintain the CM procedures, maintain the required documentation, and coordinate and facilitate the reviews of the various line organizations. It may also assume related responsibilities, such as documentation control. However, it should not be the sole group responsible for reviewing proposed changes and assessing impacts on operation.

Fulfilling the CM objective is accomplished through the key CM elements of design control, work control, change control, document control, and assessments which are addressed in detail in Sections 2 through 6 of this Standard. DOE-STD-1073-2016 1-4 In implementing CM, the DOE contractors shall meet the following general provisions for CM: • Establish a formal policy that endorses the use of CM. • Document the CM process in a CM plan which: o Defines the key roles and responsibilities for CM; o Identifies the structures, systems, and components (SSCs) and credited controls to be included in the CM process, as well as the basis and justification for the selection; o Addresses how each of the key elements of CM will be met; o Defines how interfaces are controlled; and o Describes how the graded approach is applied to the CM process. • Implement the CM process. • Commit sufficient resources to adequately implement the CM process. • Provide sufficient independence and authority to the individuals assessing the implementation of the CM process. • Ensure CM requirements are incorporated into procedures and other work processes and work is performed in accordance with those procedures and work processes. • Ensure the individuals who implement CM are knowledgeable about the various activities being implemented for the facility or activity and the impact proposed changes might have on that facility or activity and on related safety documentation. • Ensure participation of individuals who are involved in the day-to-day work of a facility or activity in the CM process, such as operations and maintenance supervisors. • Ensure the training organization is involved in the CM process so it is aware of changes needed to training programs and the content of training programs are maintained current with changes to the facility or activity. • Engage the applicable Cognizant System Engineers in the CM process when changes are being proposed or implemented. • Ensure configuration is controlled for the life of the facility or the duration of the activity. • Define the CM training for personnel which include: o Training on the facility or activity CM process, o Instruction on the objectives of CM, o Instruction on the implementation of CM, including applicable procedures, and o Update and refresher training (e.g., annually). DOE-STD-1073-2016 1-5 1.3 CM SSCS AND CREDITED CONTROLS The CM SSCs and credited controls that will be controlled under the CM process shall be identified for each facility or activity and will, in part, define the scope of the CM process. The CM SSCs and credited controls are compiled from several categories of SSCs and credited controls. In addition to the safety SSCs (which are considered to constitute the baseline or minimum set of CM SSCs for HC 1, 2, and 3 nuclear facilities as discussed later in this Section) and the credited controls for accelerators (which are considered to be the baseline or minimum set of CM SSCs and credited controls for accelerators as discussed later in this Section), the contractor should consider SSCs and credited controls in the following categories when establishing the SSCs and credited controls to be included in the CM process (CM SSCs): • Defense-in-Depth SSCs (for HC 1, 2, and 3 nuclear facilities only); • Mission Critical SSCs: SSCs whose failure could cause substantial interruption to the mission of the facility or activity; • Environmental Protection SSCs: SSCs that could have a significant impact on the

environment if they failed to perform their function; • Costly SSCs: SSCs that would be expensive to fix or replace or whose failure could result in problems that could be expensive to fix; • Critical Software and Firmware: Software and firmware whose proper performance is critical to the expected performance of a safety SSC, a defense-in- depth SSC, the safety of a nuclear facility, or a critical function of a radiological or non-nuclear facility; • Master Equipment List (MEL) SSCs: SSCs that are included in a maintenance program;1 • Collocated SSCs: SSCs that are located near important SSCs, such that changes to these SSCs could negatively impact the safety or mission of the facility or activity or the function of the important SSCs; • Authorization Bases (including Environmental Permits, as well as Safety Bases) where applicable; • Life/Safety SSCs and Controls: SSCs and controls that protect life and safety in the event of a fire; • Safety Management System (SMS) Work Processes: Processes and procedures e.g., for fire protection, maintenance, criticality safety, radiation protection, worker safety, hazardous materials handling, pressure safety, quality management, integrated safety management, nuclear explosive, non-nuclear explosive, accelerator beam safety, emergency preparedness procedures, and evacuation of accelerators before startup; • Worker Safety SSCs: Those needed to ensure safety of workers; and • SSCs needed to preserve the integrity of the facility or activity. 1 See DOE O 433.1B, Chg. 1, Maintenance Management Program for DOE Nuclear Facilities and DOE G 433.1-1A, Chg. 1, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1B, for additional information on master equipment lists that apply to HC 1, 2, and 3 nuclear facilities. DOE-STD-1073-2016 1-6 The CM process shall identify the sum of all of the CM SSCs and credited controls to be controlled by the CM process. The design authority (or other technical authority as documented in the CM process) should define the SSCs that fall under each type. Some SSCs will fall under multiple designations. CM requires resources to implement and, therefore, should not be applied indiscriminately. Some changes, such as plumbing upgrades to a restroom or the relocation of a storage shed for yard maintenance which do not impact safety or mission may be omitted from the list of CM SSCs. Other less stringent processes may be more appropriate to track the changes to these SSCs. System Boundaries Systems in the CM process shall have defined system boundaries and component lists. Systems shall contain those components necessary to accomplish the system functions and to meet the system design requirements. Applicable design codes and standards often define system boundaries. In addition, the following considerations may help to define system boundaries for some facilities or activities: • Location of piping class breaks, • Location of isolation valves, • Location of seismic class breaks, and • Location of test features. Some supporting features may be outside the system boundary, such as electrical power, instrument air, lubricating oil, and ventilation. In addition, some complete systems may cross multiple facility and activity boundaries, such as ventilation systems. Safety and Defense-in-Depth SSCs for HC 1, 2, and 3 Nuclear Facilities

For HC 1, 2, and 3 nuclear facilities, the safety SSCs identified in the Documented Safety Analysis (DSA), as required by Title 10 Code of Federal Regulations (C.F.R.) Part 830, Nuclear Safety Management, Section 204(b)(1), shall be included in the list of CM SSCs. Safety SSCs are defined in 10 C.F.R. Part 830. The safety SSCs are the combination of safety-class SSCs and safety-significant SSCs, and they include those SSCs whose preventive or mitigative functions are considered to be major contributors to defense-in- depth and worker safety. For HC 1, 2, and 3 nuclear facilities, the safety SSCs identified in the DSA constitute the baseline set (i.e., minimum) of CM SSCs. Defense-in-depth refers to the various layers of protection provided to ensure public safety, worker safety, and protection of the environment. SSCs, which are major contributors to defense-in depth and worker safety, are included in the safety SSCs. Contractors for HC 1, 2, and 3 nuclear facilities should consider whether there are any other SSCs whose functions are considered to be important to defense-in-depth or worker safety, but were not considered to be important enough to include in the list of safety SSCs and add them to the list of CM SSCs if appropriate. DOE-STD-1073-2016 1-7 CM for Accelerators DOE O 420.2C, Safety of Accelerator Facilities, requires contractors to demonstrate that an effective Facility CM Program is in place as part of the Accelerator Readiness Review (ARR). The Order also requires that the Unreviewed Safety Issue (USI) process be included in the ARR. The USI process for accelerators supports CM efforts to ensure the facility and supporting safety documentation are maintained current and periodically updated. For accelerators, the credited controls as defined in DOE O 420.2C, Safety of Accelerator Facilities, shall form the baseline (i.e., minimum) set to be included in the list of CM SSCs and credited controls. Additional guidance on identifying the credited controls is provided in DOE G 420.2-1A, Accelerator Facility Safety Implementation Guide for DOE O 420.2C, Safety of Accelerator Facilities. CM of Real Property and Assets DOE O 430.1C states hazard category 1, 2, and 3 nuclear facilities are required to establish configuration management processes that comply with DOE-STD-1073-2003, Configuration Management. CM of Nuclear Explosives Operations (NEOs) DOE O 452.2E, Nuclear Explosive Safety, includes specific requirements for the CM process for NEOs to ensure consistency with design requirements and the safety basis. 1.4 GRADING Grading as used in this Standard does not permit the user to omit requirements, but allows different levels in depth or rigor of implementation of those requirements as appropriate. For example, levels of approval may be adjusted for higher or lower potential impacts on safety or cost. Specific requirements and guidance on grading and tailoring for DOE facilities can be found in a variety of documents including 10 C.F.R. Part 830 for nuclear facilities and DOE O 413.3B, Chg. 2, DOE G 413.3-15, Chg. 1, Department of Energy Guide for Project Execution Plans, and DOE G 413.3-2, Chg. 1, Quality Assurance Guide for Project Management, for capital asset projects. DOE G 413.3-20, Chg. 1, Change Control Management Guide, states for facilities under DOE O 413.3B, Chg. 2 the Federal Project Director recommends the tailoring (grading) for change control management in the Project Execution Plan (PEP).

Where a graded approach is used for CM, the bases for that graded approach shall be documented in the CM process. Additional guidance on grading CM processes is provided in Appendix F of this Standard. DOE-STD-1073-2016 2-1 2.0 DESIGN CONTROL In order to assess the impact of a change, the contractor should first understand the design requirements of a facility or activity. The design requirements define the objectives and the constraints placed on SSCs and other controls. The objective of the design control element of CM is to document and maintain the design requirements for CM SSCs and credited controls and to ensure that they are consistent with the as-built facility or activity. 2.1 NEW FACILITIES AND NEW CONSTRUCTION For new construction, the contract or other formal document between DOE and the contractor shall define the process for establishing the design baseline for CM. There should be a thorough review of the design, the documentation, and the physical configuration to establish the baseline for the CM process at the initiation of the CM process. Subsequent changes to project design and supporting documents should be made by means of a formal change control program. The schedule may contain a series of milestones tied to specific dates or activities. This will allow the contractor to phase-in different levels of CM as design requirements are established or construction activities are completed and turned over. Where different levels of CM are to be implemented, the CM plan shall document the provisions for CM at each level. The contractor shall formally document, and DOE shall approve, the conditions for transitioning from one level to the next and the process for handing off responsibility for CM from one DOE contractor to another. For capital asset projects transitioning to operation, the CM process to be used during and following the transition should be documented in the PEP discussed in DOE G 413.3-16A, Chg. 1. For design/build projects, the design/build contractor shall ensure that the facility can be built consistent with the design. HC 1, 2, and 3 Nuclear Facilities For new construction and major modifications for HC 1, 2, and 3 nuclear facilities, the design requirements shall be identified and documented as part of the design process and incorporated into a formal CM process before start of construction. Where phased construction is employed, this requirement applies for the portion being constructed. Following submittal of the preliminary documented safety analysis (PDSA) to DOE, the contractor shall review all changes for their potential impact on the PDSA and maintain the PDSA up-to-date as the design evolves so that both the contractor and DOE can rely on the information until it is replaced by the final DSA. Additional provisions for facilities and activities subject to DOE-STD-1189, Integration of Safety into the Design Process, during design and construction are included in Appendix G. These provisions are to ensure that as progress is made in the design and construction of a HC 1, 2, or 3 nuclear facility capital asset project, the integrity of the approved design documents are maintained to avoid the significant effort of redoing the DOE-STD-1073-2016 2-2 work to reestablish the design basis at a later time, and to ensure future work is done consistent with the current design basis. 2.2 EXISTING FACILITIES AND ACTIVITIES

For existing HC 1, 2, and 3 nuclear and other facilities that incorporate this Standard by contract, the contractor shall determine the essential design requirements applicable to the CM SSCs and credited controls based on environment, safety, and health considerations, mission requirements, and other potential costs of failure to meet design requirements. However, this determination does not need to include the reconstitution of the bases and requirements for SSCs in the CM program. CM shall be applied to these essential design requirements. The contractor shall continue to document the new or revised design requirements for CM SSCs and credited controls as maintenance and modifications are performed at the facility or activity. In these cases, the contractor shall: • Ensure the safety analysis [i.e., DSA, safety analysis document (SAD), hazard analysis report (HAR), or other safety or project documentation as appropriate] demonstrates that the design and functional requirements for the CM SSCs are sufficient, and • Validate that the credited controls, and other hazard controls will perform their essential safety and/or operational functions as assumed in the analysis. If the information is not sufficient to adequately document the CM baseline and validate proper operation of the CM SSCs, credited controls, and other hazard controls, as well as the performance of the work activities, then the contractor shall consider if additional action is necessary so changes can be adequately assessed. One way to do this is by using engineering data recovery techniques. Data recovery techniques include searching for and reviewing existing files, archived records, and other sources that might contain the information, and validating the accuracy of the information before it is used. If the data recovery techniques are still not sufficient to adequately complete the design requirements, the contractor should consider whether the information should be regenerated (e.g., performing analysis and/or calculations, or interviewing technical experts who are knowledgeable about the particular equipment or situation). If the contractor decides to pursue regeneration of the information, it should take maximum advantage of pertinent existing safety analyses and design information (i.e., requirements and their bases) that are immediately available or can be retrieved through reasonable efforts. Appendix H provides general information that may be used to regenerate documentation. When changes are performed, the contractor shall document the design requirements associated with the change. By doing this, contractors can incrementally enhance the information on design requirements in a cost-effective manner. DOE-STD-1073-2016 2-3 2.3 DESIGN REQUIREMENTS Once the design baseline is established and the set of CM SSCs and credited controls is identified, the contractor shall identify and document the design requirements for the CM SSCs and credited controls. The contractor shall thereafter assess the effects of changes to the design requirements of CM SSCs and credited controls through the CM change control process (see Section 4). Furthermore, unless (1) the SSC or credited control is deleted from the set of CM SSCs and credited controls or (2) the facility or activity no longer needs a CM process, the contractor shall maintain the design requirements for CM SSCs and credited controls throughout the life of the facility or activity.

The documentation should identify which of the design requirements are required for safety and which are necessary for cost, environmental, or other considerations, so the impacts of changes can be better assessed. The design requirements to be documented should include at a minimum those that affect: • Operation, • Installation, • Function, • Performance, and • Maintenance. Design requirement documentation should include design inputs, design analysis and calculations, and design output. Design inputs support the design analyses and calculations which, in turn, provide the design outputs. In establishing design inputs, the contractor should consider the effects of the operating environment (e.g., radiation, temperature, pressure, humidity, and chemical spray), material condition, and aging (e.g., erosion, corrosion, fatigue, chloride stress or intergranular stress corrosion cracking, and embrittlement). For example, in establishing the design inputs and subsequent requirements, the contractor should consider the effects of radiation exposure and aging on elastomeric materials, such as rubber O-rings and Teflon tape. Design inputs should be gathered from all affected parties. Design inputs for CM SSCs and credited controls should be controlled by the change control process. Design analyses and calculations should not be relied upon until independently verified in accordance with the requirements of QA Criterion 6 (DOE O 414.1D, Chg. 1, Quality Assurance, or 10 C.F.R. Part 830, Subpart A), the facility or activity Quality Assurance Program (QAP), and applicable work processes related to design verification. DOE-STD-1073-2016 2-4 Examples of design analyses and calculations are: • Transient analyses, • Criticality analyses (for HC 1, 2, and 3 nuclear facilities only), • Seismic stress calculations and analyses, • Equipment sizing calculations, • Net positive suction head calculations, and • Engineering evaluations of equipment qualifications and fire protection. Design output should be sufficient to support the CM process objectives in a form that allows easy and proper use by the various user organizations, including procurement, construction, operations, maintenance, testing, and design engineering. Design reviews should be conducted for all projects and major modifications. Design reviews should involve a formalized, structured approach to ensure the reviews are comprehensive, objective, professional and documented. Design reviews should meet the applicable requirements in the facility or activity QAP. In addition, specific requirements for design reviews are included in DOE O 413.3B, Chg. 2, for facilities and activities within the scope of that order in support of the capital asset critical decision (CD) process. Additional guidance on performing design reviews can be found in DOE G 413.3-9, Chg. 1, U.S. Department of Energy Project Review Guide for Capital Asset Projects. 2.4 INTERIM MEASURES The contractor should determine if interim measures are needed to preserve the design analysis of the facility or activity and to ensure safety while the design requirements are initially documented and the CM process is assessed. These actions may not be needed if CM is established early in the design process and maintained thereafter. The following are examples of interim measures that may be needed: • Additional controls to ensure newly generated design requirements and design basis are maintained and available;

• Additional procedural guidance on sources of design requirements to ensure an adequate design basis review is performed for potential changes to the facility or activity; • Additional procedural guidance to ensure designers thoroughly research the existing design basis before issuing new designs; • Additional procedural guidance to ensure the design process produces an adequate set of design requirements and design basis for each new design or design change; • Actions to retain source documents containing design requirements and design basis information; and • Actions and controls to ensure the knowledge of experienced engineering and operations personnel regarding facility or activity design requirements and design DOE-STD-1073-2016 2-5 bases (otherwise known as Knowledge Management) is not lost when they transfer or retire (this includes actions to collect and record design information from personnel who recently transferred, retired, or are near retirement). 2.5 DESIGN AUTHORITY Unless the design authority is designated by the acquisition executive or in the contract, contractors should establish the design authority for the CM SSCs. The design authority is responsible for establishing and maintaining the design requirements, ensuring design output documents accurately reflect the design basis, and maintaining design control and ultimate technical adequacy of the design process. There may be a single design authority or multiple design authorities for a facility or activity but each CM SSC should have an identified design authority. The Cognizant Systems Engineer may be identified as the design authority for one or more CM SSCs. For facilities without Cognizant Systems Engineers, and where the design authority is not already identified, the CM process may establish a design authority. When facilities or systems are turned over from one organization to another, the design authority may also change. This may occur over a period of time. Procedures should be developed to govern this turnover. However, at any given time, there should be a single, defined authority for each CM SSC. If components in a system have a different design authority than the overall system, or if systems in a structure have a different design authority than the structure, the CM process shall establish coordination and approval provisions for all impacted design authorities when making changes to CM SSCs. For nuclear facilities: • DOE O 414.1D, Chg. 1 requires that the facility design authority be involved in the CM for nuclear safety software; and • DOE O 413.3B, Chg. 2 requires the design authority to be designated at CD-1. 2.6 REVIEW When the design requirements are initially established for the CM SSCs and credited controls in the CM process, the contractor shall perform a review to determine the adequacy of these requirements and the associated documentation. The technical review team shall include technical managers who have broad design backgrounds and experience and represent the various design disciplines. In deciding whether the design requirement documentation for the CM SSCs and credited controls is adequate, the team should base its determination on the completeness, accuracy, and level of documentation. The team should also consider the results of applicable assessments, especially any initial CM assessments when performing its review. DOE-STD-1073-2016 2-6 The technical review process may include the following methods of assessing completeness:

• Certification of conformance with specified industry codes and standards that identify expected design requirements; • Comparisons of like design requirements for comparable components; • Comparisons of like design bases for comparable design requirements; • Review of design information to identify CM SSCs and credited controls with missing or incomplete design requirements; • Review of open items and discrepancies that have not been resolved; and • Review by independent, external, technical experts. The review team should determine if any essential design information is missing. The team should also correlate the design basis with the design requirements, the physical configuration, and the documentation to get insight into the completeness and accuracy of the existing information. A template or checklist may be used as a tool to help verify that the design requirements are complete. This approach involves making a list of the typical types of design requirements for various types of SSCs and credited controls. The template should be comprehensive and include both the expected and possible design requirements and design basis. This template would then be compared to the list of design requirements available for the CM SSCs and credited controls. If something on the list is not included in the design requirements, the team may question the basis for the omission or request that the design requirement be added. Because the template was developed broadly, it will not be unusual for the template to include more design parameters than are applicable to a particular structure, system, component or credited control. Furthermore, the template should not be relied upon as a complete list for every case. The template should be used only as a tool to help the user to notice design requirements that may be missing, and it is not a substitute for good technical judgment. For example, a template for a piping system might include: • System and component design descriptions or specification; • Basic flow diagrams; • Layout and arrangement diagrams; • Isometric diagrams; • Support details; • Testing requirements; • Material certifications; • Pipe sizing/flow calculations; • Minimum wall thickness calculations; • Corrosion/erosion allowances; • Certification of conformance with piping standards (e.g., ASME Boiler and Pressure Vessel Code or ANSI B31.3, Process Piping Design); • System interface requirements; • Operating and design pressures and temperatures; DOE-STD-1073-2016 2-7 • Component input and output design requirements (e.g., pump net positive suction head and power requirements); • Design procedure documentation; • Inspection acceptance criteria; • Documentation of hydrotest parameters and results; • Maintenance and testing procedures; and • QA requirements. Tools for assessing accuracy include: • Checks of reasonableness by competent design personnel; • Checks to determine whether the design requirements apply to current physical configuration; and • Independent verification of critical calculations and analysis. In determining whether the design requirements are properly documented, the team should consider whether: • The design information is clearly identified; • The design requirements are differentiated from the design basis; • Safety, environmental, and mission design requirements are differentiated from other types of design requirements; and • The design documentation is indexed, integrated, and usable.

The contractor shall document, retain, and maintain the team’s conclusions and the basis for the conclusions regarding the adequacy of the facility or activity design requirements in a retrievable form. The documentation should indicate the relevant design information by system and an index of design documents should be provided. At the conclusion of this review, the team shall decide if any of the still missing information is truly critical to safe and effective CM. If the information is not critical, then the contractor should not invest additional resources in recovering the information. If major construction or modification is performed on the system at a later date, the design information should be developed. If the conclusion of the team is the design requirements and their design basis are not adequately documented and additional information is critical to ensure safe and effective CM, then the team shall develop a plan to recover that information. If the missing information is necessary to support the safety or design basis, then the missing information shall be retrieved or regenerated. If the team concludes a design reconstitution is recommended, the team should develop and document specific recommendations for that effort. Appendix H provides additional information on regeneration and recovery of design requirements. Additional discussion evaluating the adequacy of design information for older facilities transitioning from operations to decontamination and decommissioning and the need for recovery of design information can be found in DOE G 430.1-3, Deactivation Implementation Guide. DOE-STD-1073-2016 2-8 Section 5 provides objectives for the documentation of design information. 2.7 SYSTEM DESIGN DESCRIPTIONS FOR HAZARD CATEGORY 1, 2, AND 3 NUCLEAR FACILITIES Contractors should consider using system design descriptions (SDDs) to document design requirements and to provide a link between engineering design documents, safety basis documents (DSAs and Technical Safety Requirements or TSRs), and implementing procedures for HC 1, 2, or 3 nuclear facilities. SDDs identify requirements, explain why those requirements exist (e.g., provides the bases for the requirements), and describe the features of the system design provided to meet those requirements. SDDs can be used to promote consistency among the engineering requirements, the actual installed physical configuration, and the associated documentation. SDDs help facility personnel understand system functions and requirements. In addition to providing a system drawing and written description, they include discussions of functional process requirements, system and component design requirements, system interfaces and interlocks, setpoints, and design requirements related to operations, maintenance, and testing, detailed design and operating descriptions, diagrams, and load lists. Information on the use and specific content of SDDs is provided in DOE-STD-3024-2011, Content of System Design Descriptions. 2.8 CM EQUIPMENT DATABASES Contractors should develop CM databases that cross-reference CM SSCs and credited controls with their design requirements, design basis, and associated documents. These databases will be the primary information source for design requirements. Contractors should use the best available design information to fill the database fields. Database software, where used, should meet DOE software quality assurance requirements, including, where applicable, nuclear safety software requirements in DOE O 414.1D, Chg. 1, Attachment 4.

The CM database can be used to contain and correlate key information, such as: • System designators; • Component designators; • Component descriptive information such as type, manufacturer, model, and size; • Grades/priority/classification; • Design requirements or references to design requirements; • Design basis references; • Design topical area references (e.g., seismic, environmental qualification, fire protection); • Range of acceptable setpoints; • Facility document references (e.g., drawings, procedures, safety analyses); • TSR references; DOE-STD-1073-2016 2-9 • MELs; or • Other desired system and component information. Linking the CM database with other equipment databases will not only result in greater efficiency because there are fewer databases to maintain, it will also facilitate CM as changes will be more thoroughly reviewed and coordinated. A sample format for a basic, CM equipment database is provided in Figure 2-1, Sample CM Equipment Database. The actual format, contents, and capabilities of an organization's CM equipment database will depend greatly on the identified needs and intended uses. The contractor should assign a database owner for the equipment database, with established roles and responsibilities. As most of the information is design information, the design authority is a likely choice. As such, the design authority would be the focal point for resolving discrepancies and updating the database. Other organizations should use the CM equipment database as their primary source of design information. SS C S ys te m s SS C C om po ne nt s D es cr ip tiv e In fo Sa fe ty D es ig n R qm ts En vi ro n. D es ig n R t M is si on D es ig n R qm ts D es ig n R qm ts fo r H ig h C os t D es ig n R qm t R ef 's D es ig n B as is R ef 's Se is m ic Pr og ra m Fi re Pr ot ec tio n Pr og ra m System 1 Comp 1 √ √ √ √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 √ System 1 Comp 2 √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 PC -3 System 1 Comp 2 √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 " " √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 PC -2 √ " " √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 √ " " √ √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 √ System 1 Comp M √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 PC -1 √ Ref. 1, Ref. 2 Ref. 1, Ref. 2 PC -1 √ System 2 Comp 1 √ " " System 2 Comp 2 √ " " System 2 Comp 3 √ " " " " √ " " PC -4 " " √ " " System 2 Comp M √ " " Figure 2-1 Sample CM Equipment Database DOE-STD-1073-2016 2-10 In order to facilitate tracking of CM SSCs and their design requirements, contractors should establish a unique and readily identifiable numbering system for SSCs, their parts, and assemblies. Unique identifiers that incorporate system designators, component type, and numbers, (e.g., SW-MOV-91) are more useful than strictly numeric identifiers (e.g., 135711317). Unique identifiers are important to support equipment and facility operations as well. See DOE O 422.1, Chg. 1, Conduct of Operations, and DOE-STD- 1044-93, Guide to Good Practices for Equipment and Piping Labeling, for additional discussion of equipment/component labeling. 2.9 TURNOVER FROM DESIGN AND CONSTRUCTION

To ensure a successful turnover of new facilities or activities or to new modifications prior to operations, the design contractor and the construction contractors should interface with the operating contractor early in the design and construction phases. When an effective interface is established early in the design process, it is more likely that the design contractor and the construction contractor will provide the needed design products to the operating contractor and turnover will be successful. The design and construction contractors, together with the operating contractor, should establish and agree upon the formal criteria for construction turnover. The criteria should include the following provisions: • Specify at design inception the format and content of design basis and design output documents such that they will be compatible with the operating contractor's work processes, • Periodically monitor the preparation of design basis and design output documents to ensure they will meet the operating contractor’s needs, • Specify the review and approval process for the format and content of final design basis and final design output documents, and • The design, construction, and operating contractors shall accept responsibility for the CM at respective turnovers. Although it is highly desirable, it is not always possible for the operating contractor to be involved with the design and construction contractors during the design and construction phases. For example, a major new facility might be ordered and designed before final assignment of the operating contractor. In such cases, each contractor should be responsible for ensuring the next responsible contractor has the necessary design requirement information at turnover. If the operating contractor is not involved in the design and construction process or if the design and construction contractors fail to provide effective interfaces, the operating contractor should identify and implement the actions necessary to recover the missing information. DOE-STD-1073-2016 2-11 2.10 DESIGN CHANGES If it is determined that a proposed change could impact the design requirements for a CM structure, system, or component or a credited control, then the contractor shall use the change control process (see Section 4) for the proposed change. Furthermore, following review and approval of the proposed change, the CM database shall be updated as appropriate to reflect the change. In addition to safety analysis documents (e.g., DSAs, TSRs, ASEs, HARs, and SADs), design requirements are found in transient calculations, setpoint calculations, and sizing calculations. There may be differences between the values in the design bases and the design requirements for a facility or activity. For example, the design basis may specify a requirement for a pump to deliver 160 gallons per minute (GPM), while the design requirements may specify a pump rated to deliver a flow of 200 GPM. This difference may represent conservatism that the design engineer felt was appropriate or the higher rating may have been chosen to match the rating of an available, off-the-shelf pump. The significance of the difference between the design basis and the design requirements is that a change to the design basis would necessitate a new design analysis, but a change to a design requirement would not require a new design analysis if the design basis is not affected. 2.11 COGNIZANT SYSTEM ENGINEERS FOR HAZARD CATEGORY 1, 2,

AND 3 NUCLEAR FACILITIES DOE O 420.1C, Chg. 1, Facility Safety, requires that contractors establish a Cognizant System Engineer Program for active safety-class and safety-significant systems, as defined in the facility’s DOE-approved safety basis, as well as for other active systems that perform important defense-in-depth functions, as designated by facility line management. Furthermore, DOE O 420.1C requires contractors to assign a Cognizant System Engineer to each system covered by the Program. DOE O 420.1C defines the qualifications for the Cognizant System Engineer. Additional guidance for System Engineers for HC 1, 2, or 3 nuclear facilities is delineated in DOE G 413.3-1, Chg. 1, Managing Design and Construction Using Systems Engineering for Use with DOE O 413.3A. Cognizant System Engineers and System Engineers defined in those directives are considered to be the same function for the purposes of this Standard. The Cognizant System Engineer is required to be knowledgeable of the system and the related safety basis. The Cognizant System Engineer is also required to retain a working knowledge of the facility’s operation and the existing condition of the system. The Cognizant System Engineer is responsible for overseeing the configuration of the assigned system to ensure it continues to be able to perform its expected functions. The Cognizant System Engineer should: DOE-STD-1073-2016 2-12 • Be knowledgeable of the system safety functions, requirements, and performance criteria and their bases; • Understand how the system SSCs are designed and how they function to meet the requirements and performance criteria; • Understand system operation; • Be knowledgeable of the testing and maintenance necessary to ensure the system continues to be able to perform its safety functions; • Be responsible for ensuring documents related to the system are complete, accurate, and up-to-date, including SDDs, technical drawings, diagrams, and procedures for surveillance, testing, and maintenance; • Be appropriately involved in the design, review, and approval of changes affecting/impacting system design, operation, and maintenance; and • Maintain awareness of the availability of replacement parts for SSCs and initiate any necessary design and change control reviews in anticipation of the need to replace obsolete (i.e., no longer available in the supply chain) SSCs as part of the preventative maintenance program (See DOE G 433.1-1A, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1B). Because the Cognizant System Engineer is expected to have a thorough understanding of system design expectations, operating requirements, and current configuration, the Cognizant System Engineers should have a major role in identifying the CM SSCs. Each Cognizant System Engineer should also participate in the identification of the design requirements for his/her system and the SSCs within the system. Finally, the Cognizant System Engineer should participate in the CM review of any changes made to the system for which the Cognizant System Engineer has responsibility. DOE-STD-1073-2016 3-1 3.0 WORK CONTROL Identify and Initiate Work Perform Work Validate and Review Completed Work Schedule & Coordinate Work Plan Work Approve Work Work Control Process Update Documentation Figure 3-1 Work Control Flow

In order to ensure work is appropriately evaluated and coordinated before it is performed, contractors shall incorporate work control into the CM process and into their work procedures. As depicted in Figure 3-1, work control is a process by which work activities are identified and initiated; planned, scheduled, coordinated, performed, validated and reviewed for adequacy and completeness; and approved as required before they are performed. It also ensures that changes are documented to ensure that consistency is maintained between the design requirements, the documents, and the physical configuration of the facility or activity. Detailed guidance on work control for HC 1, 2, and 3 nuclear facilities is provided in DOE-HDBK-1211-2014, Activity-Level Work Planning and Control Implementation, and DOE G 433.1-1A. This guidance should be considered for other facilities and activities as well. DOE-STD-1073-2016 3-2 Specific provisions for work control for CM include the following: • Work processes shall identify the work to be performed and clearly communicate the responsibilities, authorities, and expectations of work control to all individuals who do work. This expectation is consistent with the requirements of QA Criteria 1 and 5 (DOE O 414.1D, Chg. 1 and 10 C.F.R. Part 830, Subpart A). • The work shall be reviewed and approved under the applicable change control process in accordance with the approved CM process, including where applicable the unreviewed safety question (USQ) process (for HC 1, 2, or 3 nuclear facilities), the USI process (for accelerators), and the nuclear explosives safety (NES) change evaluation process (for NEOs). • If during the performance of work, additional changes affecting the CM SSCs are identified, these changes shall be processed using the approved change control process. Changes shall receive reviews commensurate with those of the original work and the approval authority level shall be at the same level as the original work. Work should not resume until these changes have been analyzed and approved. • If the contractor identifies any nonconforming items while implementing a change, the nonconformance shall be documented in a nonconformance report (NCR) or other appropriate means. The review and disposition of NCRs or other means would be documented and retained. Additional information on NCRs can be found in DOE G 413.3-1. • For NEOs, a detailed description of maintenance activity control and approval for maintenance implementation plans shall be included as required by DOE O 452.2E, Nuclear Explosive Safety (or successor documents). In addition, work processes should: • Use the approved design output documents in work planning. • Assign an individual the responsibility for tracking physical change status and ensuring the change is completed in accordance with the change control package. • Pay special attention to partially implemented changes including defining how temporary and partially implemented modifications are controlled and communicated to affected organizations. DOE-STD-1073-2016 3-3 • Pay special attention to parallel implementation of two or more changes which affect the same CM structure, system or component or credited control. • Contain provisions related to control of equipment status, lockouts and tagouts, and other areas associated with conduct of operations applicable to partially implemented changes as discussed in DOE O 422.1.

• Use Cognizant System Engineers or dedicated CM specialists to review work and track changes to completion. • Include provisions for issuing periodic progress reports on the implementation of major changes. DOE-STD-1073-2016 4-1 4.0 CHANGE CONTROL The objective of change control is to maintain consistency among design requirements, the physical configuration, and the related facility or activity documentation, even as changes are made. The change control process is used to ensure changes are properly reviewed and coordinated across the various organizations and personnel responsible for activities and programs at the facility or activity. It is also used to ensure changes are not made if they negatively impact the facility mission or the activity. Contractors shall establish and use a formal change control process for CM SSCs and credited controls as part of the CM process. Through the change control process, contractors shall ensure: • Changes are identified and assessed through the change control process; • Changes receive appropriate technical review to evaluate the consequences of the change; • Changes are approved or disapproved; • Waivers and deviations are properly evaluated and approved or denied and the technical basis for the approval or the denial is documented; • Approved changes are adequately and fully implemented or the effects of the partial implementation are evaluated and accepted; • Implemented changes are properly assessed to assure the results of the changes agree with the expectations; and • Documents are revised consistent with the changes and the revised documents are provided to the users. Figure 4-1 illustrates a potential change control process for CM SSCs and credited controls. 4.1 IDENTIFICATION OF CHANGES The contractor shall ensure each proposed change to the facility or activity is considered for processing through the change control process. To ensure all changes are controlled as appropriate, the contractor shall identify all mechanisms that can lead to temporary or permanent changes in: • The design requirements; • The physical configuration; or • The documentation. For any facility or activity there are typically multiple mechanisms for initiating change. Changes may be initiated through any of a variety of organizations, such as design, operations, maintenance, procurement, procedures, training, and security. Changes can include physical, document, procedural, operations, software, or design changes. Contractors shall assess each type of change to determine the mechanisms for initiating DOE-STD-1073-2016 4-2 changes and link them to the change control process. Contractors shall integrate the change control process into the work processes for all potential mechanisms of changes by requiring workers and organizations to use the change control process, as appropriate, when a change is to be made. The identification of change mechanisms is often the most critical step to achieving effective change control. Change mechanisms that are not identified cannot be controlled. Identify change Document proposed change in change control package Design or safety changes? Perform independent design/safety verification for change Perform interdisciplinary technical review Identify documents affected by the design change Perform management review Approve Change Implement through Work Control Perform post-modification testing & verify change is acceptable Track, update, & distribute documents

through document control Perform design/safety analysis DOE approval required? Obtain DOE approval yes no Perform review(s) yes yes no Technical Review no Reviews (e.g., USQ, USI) Management Review Other reviews to be performed? Change Control Process Can safety and mission be met following the change? Revise or cancel change no yes Prepare a safety analysis change package Continue ? Revise or cancel change no yes Perform any required reviews Figure 4-1: Potential change control process for CM SSCs and credited controls DOE-STD-1073-2016 4-3 Once change mechanisms are defined, contractors shall ensure the change control process is properly integrated into the procedures and other work processes for that change mechanism. Contractors should consider eliminating or combining change mechanisms to make changes easier to control. Specifically, DOE O 413.3B, Chg. 2, requires changes to capital asset projects meet the requirements for change control in that directive. Additional guidance is provided in DOE G 413.3-20, Chg. 1. Change control for capital assets governed by DOE O 413.3B, Chg. 2 focuses particularly on changes that impact the approved performance baseline for a project. For these capital asset projects, the change control provisions of the CM process should integrate the change control processes of DOE G 413.3-20, Chg. 1 with the change control provisions of this Standard. A change control process for capital asset projects subject to the requirements of DOE O 413.3B, Chg. 2 should be established before the CD-2 phase of construction.2 Additional provisions for capital asset projects required to meet DOE-STD-1189 are provided in Appendix G. These provisions are to preserve the integrity of the DOE approved safety design and analysis documents as design and construction progress. It is important to identify and consider even subtle changes under the CM process. Changes that are perceived to be minor or insignificant can significantly impact the functions of SSCs and credited controls required to maintain safe operation or to achieve mission objectives. They can also result in operation outside the approved safety or design basis. In addition, multiple minor changes could have a cumulative effect that should be considered. A well-designed change control process should include a screening process to determine if seemingly insignificant changes should have at least a cursory review by an interdisciplinary group to confirm that there are no significant impacts from the proposed change. 4.2 EQUIVALENT CHANGES Changes that are shown to be equivalent changes do not need to be evaluated under the change control process. Equivalent changes are hardware changes that: • Continue to meet the design requirements for the equipment, • Meet all interface requirements, and • Do not impact the safety or design basis. An example of an equivalent change would be replacement of a failed part with the same make and model number part. However, as vendors sometimes change materials or design of components, or modify the firmware without changing the model number, the contractor should ensure the design requirements continue to be met with the replacement part. 2 See DOE O 413.3B, Chg. 2 for detailed information on CD phases. DOE-STD-1073-2016 4-4 For HC 1, 2, and 3 nuclear facilities, the CM process should include a provision to allow the maintenance program to authorize the use of equivalent repair parts and a method for workers to verify this approval for the maintenance program in accordance with the guidance in DOE G 433.1-1A.

4.3 CONSISTENT AND EFFICIENT CHANGE CONTROL PROCESSES If multiple change control processes are being used, they should be consolidated into a single, consistent change control process that is both useful and effective. Unique change control processes for specific types of changes, such as software changes, should be integrated into the overall change control process for the facility or activity.3 The change control process may include provisions for varying levels of review based on a documented graded approach, as well as graded schedules for updating documents based upon their relative importance. Facility and activity managers should ensure vendors and subcontractors use the established process. All personnel in design, operations, and support organizations that do work for the facility or activity and could or do initiate or perform changes should: • Be trained on the change control process; • Follow the associated procedures closely; and • Be alert to activities that may not be planned or may occur without following appropriate procedures. The change control process should be efficient to ensure it is used effectively. Forms and procedures should be easy to use and understand, particularly as the change control process will be used by individuals from a number of organizations with varied backgrounds and experience. To be effective, forms and procedures should: • Facilitate complete and timely change identification and control; • Be easy to use and encourage participants to use them; and • Provide for management tracking and reporting. 4.4 DOCUMENTATION OF PROPOSED CHANGES The change control process shall include provisions for the initiator of the proposed change to document the proposed change. The following information should be considered for inclusion in the documentation: • A unique identifier for the proposed change; • A description of the proposed change sufficient to support technical and management reviews prior to approval; • The name and organization of the requester; • A description of the potentially affected SSCs and credited controls; 3 DOE O 414.1D, Chg. 1 specifies requirements for control of nuclear safety software. DOE-STD-1073-2016 4-5 • The reason for the proposed change; • A list of the alternative solutions considered and the results; • The date by which the decision about the change needs to be completed to facilitate timely implementation or to allow implementation to occur concurrent with other activities, such as a planned maintenance shutdown; • Constraints; and • Any other information needed to review, track, approve, or process the proposed change. Appendix G contains an example change request. The contractor should prepare a change control package consistent with the design process and controls for the proposed change. The change request should be verified to be accurate and appended to the change control package. The change control package should also include (either directly or by reference) drawings, analysis, procedures, instructions and other documents needed to properly assess, implement, verify, and validate the proposed change. If a work control document is being used to initiate the change, it should be included in the change control package.

Change control packages should define the methods and acceptance criteria for the post- modification testing. Change control packages are generally used when performing the reviews of the proposed change. They should be revised, updated, and supplemented as the review progresses. They should contain a copy of all approvals. Once the proposed change is approved for implementation, the change control packages are used to facilitate implementation. Appendix H provides an example change control package. 4.5 REVIEW OF CHANGES The review of the change control package shall include a technical review and a management review. The technical review should be interdisciplinary, except where the change is so isolated as to not impact the efforts of more than one discipline. The management review should ensure management considerations, such as funding and procurement, have been adequately considered prior to approving the change for implementation. The results of both reviews should be documented. Where review under the USQ, USI, or the NES change control process is required, these reviews may be performed concurrent with the technical and management reviews, but all reviews shall reflect the final configuration of the change. If during the management review or other reviews modifications are made to the proposed change, those modifications may need to undergo new technical reviews. Design changes should be subject to the same level of reviews as applicable to the original design. DOE-STD-1073-2016 4-6 The change control process shall contain provisions for a formal, multidisciplinary, technical review to be performed for proposed changes to assess the impacts of the proposed changes to the facility or activity. The technical review should include: • Design basis and safety analysis reviews, • Independent design verification, • Interdisciplinary technical reviews, • Identification of affected hardware and documents, • Identification of post-implementation acceptance criteria, • Conduct of operations requirements, and • Other reviews, as appropriate. The technical review should verify: • The change can be implemented; • The facility or activity will continue to operate safely and provide adequate protection to workers, the public, and the environment; • The contractor’s ability to continue to meet safety and environmental requirements, performance criteria, permit requirements, environmental impact statements (EIS), or any other applicable state or Federal requirement is not negatively affected; • The mission can continue to be achieved; • The change will not create unacceptable maintenance problems; • The security of the facility or activity is not compromised; and • The safety or design basis is preserved or the changes are assessed and determined to be acceptable. If the proposed change is not within the current design basis, the contractor shall perform an analysis for the change. The analysis should be sufficiently detailed that the independent verifiers can assess the adequacy of the analysis. The change control package should be made available to the individuals responsible for the technical review of the analysis. The analysis should include: • Current and proposed design inputs and constraints, • An analysis of the proposed changes and their impacts, • Design outputs, • Consideration of systems interactions, • Any assumptions that are to be verified in the post-operational testing, and • Identification of any computer program that was used in the analysis.

The design basis is generally identified by the design requirements in the equipment database or the references listed in the CM equipment database. Therefore, changes to DOE-STD-1073-2016 4-7 the design requirements identified in the CM equipment database will likely require a design analysis. Examples of changes that would require a design analysis include: • A change that permits an increase in the maximum number of plugged tubes in a heat exchanger beyond that indicated in the CM equipment database or safety analysis; or • A setpoint change outside the range of acceptable setpoints identified in the CM equipment database. An example of a change that does not impact the design basis and generally would not require a new design analysis is a change to an equipment setting that continues to be within the range specified in the CM equipment database (e.g., a pump actuation setpoint that is changed from 60 pounds per square inch gauge or psig to 62.5 psig when the CM equipment database indicates the acceptable range is 55 to 65 psig). For HC 1, 2, and 3 nuclear facilities, potential inadequacies of the safety analysis (PISAs)4 may be identified which result in the need to revise the design or safety basis. Because such changes may impact other SSCs it may be appropriate to review the PISA under the change control process to ensure an integrated review. The CM process, as well as the USQ process, shall address how such changes are to be reviewed. A change to the design basis will often involve a revision to the safety analysis (e.g., DSA, TSR, ASE, SAD, or HAR). Revisions to design bases involve significant effort by the design authority or other technical authority and include external evaluations and approvals. Consequently, the contractor should weigh the resources needed to process the design change against the benefits of the proposed change. Another change that could accomplish the objectives of the original change within the current design basis might be more cost-effective. If the design requirements for the proposed change are not available in the CM equipment database, then the design authority or other technical authority may need to recover or generate those requirements before the evaluation can proceed. Unless the contractor determines the proposed change does not need to be reviewed through the change control process, the contractor shall perform the technical review before proceeding with the proposed change. Often a change that does not appear to be significant can be assessed to have an impact to another discipline. For example, the temporary removal of a door to facilitate a maintenance activity could impact security or fire protection. A change to a component also may impact system performance. A change to a component or system may impact nearby or interconnected components or systems. These potential impacts should be assessed in the review. 4 The PISA process is a part of the USQ process. DOE-STD-1073-2016 4-8 The technical review team shall include technical experts who can assess the potential impact of the change on safety and reliability, as well as the design requirements, and will share this assessment with the team. One of the challenges of change control is to be cognizant of many ongoing changes—from proposal, through development, to implementation—and to understand the integrated effect of the various changes. Consequently, the persons engaged in the technical review should include representatives from all potentially affected disciplines and organizations including Cognizant System Engineers, safety organizations, QA, design, operations, maintenance, training, radiation protection, fire protection, and security.

Using Cognizant System Engineers to review changes for HC 1, 2, and 3 nuclear facilities The Cognizant System Engineer develops resident technical expertise and facility knowledge, centralizes resolution of SSC performance problems for more timely and effective response, and interfaces between the facility or activity operations and maintenance organizations and the design engineering organization. The Cognizant System Engineer concept benefits CM, as well as many other facility or activity operations including facility status and troubleshooting, operations support, coordination of testing and other system-related activities, and communication among departments. The Cognizant System Engineers, or assigned technical engineers, for nearby or interfacing systems should be consulted as appropriate when making changes. As discussed in Section 2 of this Standard, DOE O 420.1C requires contractors to designate a Cognizant System Engineer for each active safety system for DOE HC 1, 2, or 3 nuclear facilities. The duties, responsibilities, and interfaces of each Cognizant System Engineer to support CM shall be clearly defined, documented, and communicated to supporting facility or activity organizations.5 To facilitate the change control process, each Cognizant System Engineer should perform the following functions: • Monitor and track the status of the assigned system, especially during changes (e.g., physical changes in progress and temporary physical changes); • Conduct and/or observe equipment performance monitoring, evaluating the results of performance monitoring and surveillance, trending important data, and initiating corrective actions; • Review and approve post-modification, post-maintenance, surveillance, and special test procedures and test results; • Review and concur with design changes, use-as-is, equivalency, and commercial grade dedication determinations; • Provide assistance to operations as needed, including the review of key system parameters and the evaluation of system performance; • Provide assistance to maintenance as needed, including remaining cognizant of system-specific maintenance and operations history and of industry operating 5 Clear delineation of roles and responsibilities is required by QA criterion 1 of 10 C.F.R. Part 830 (for nuclear facilities) and DOE O 414.1D, Chg. 1 (for all DOE facilities and activities). DOE-STD-1073-2016 4-9 experience, as well as manufacturer and vendor recommendations and any product warnings regarding their assigned systems and use; and • Identify any situation where the design engineering organization should be consulted for advice or services, including advance discussion on the future replacement of obsolete SSCs. Specific review processes: For HC 1, 2, and 3 nuclear facilities: To maintain the integrity of the safety basis, contractors for HC 1, 2, or 3 nuclear facilities shall ensure the USQ process is invoked and applied consistent with the requirements of 10 C.F.R. Part 830 and the DOE-approved USQ process prior to implementing changes to these facilities. For accelerators: To ensure the facility or activity and the supporting safety documentation are maintained current and periodically updated, proposed changes or modifications to accelerator facilities or experiments are required by DOE O 420.2C to be assessed in accordance with the approved USI process and the SAD is required to be maintained current. Additional information on using the USI process can found in DOE G 420.2-1A. DOE O 420.2C states the process for identifying USIs is considered to be an important component of CM. See DOE G 420.2-1A (or successor document) for additional information on applying the USI process to accelerators.

For nuclear explosive operations: DOE O 452.2E requires organizations responsible for NEOs and associated activities and facilities to establish and implement an NES change evaluation process in accordance with NNSA SD 452.2, Nuclear Explosive Safety Evaluation Process or successor directive. This process is separate and independent from the USQ process which may also apply to these facilities and activities. The NES change evaluation is required to be completed before approval and implementation of the change. See DOE O 452.2E and NNSA SD 452.2 (or successor documents) for additional information on the NES change evaluation and change control process requirements for NEOs. For capital asset projects: Contractors for capital asset projects should refer to their contracts and DOE O 413.3B, Chg. 2 for requirements related to changes to capital asset projects during construction. DOE G 413.3-20, Chg. 1 provides specific guidance on the approval and documentation related to such changes. Changes often involve increases in project costs and schedule impacts. Some of the additional costs can be addressed through already budgeted project costs if the changes are within the same baseline project scope. If not, specific authorization may be needed from DOE before proceeding with changes. Consequently, it may be valuable to include persons responsible for cost estimating and contract change approval on the Change Control Boards, management review teams, or other change control review teams. DOE G 413.3-20, Chg. 1, Section 3.1, provides specific guidance for the use of Change Control Boards for capital asset projects under DOE O 413.3B, Chg. 2. DOE-STD-1073-2016 4-10 Documentation of change decisions may be important to support requests for funding. In particular DOE G 413.3-21, Chg. 1, Cost Estimating Guide, states: Changes require documentation, and as each estimate is updated, modified, or revised, an audit trail must be maintained to show the relationship between the new estimate and the previous estimate. The reason(s) for each change should be identified and may include such things as modification of scope, unexpected increases in labor rates, schedule extensions, variance in escalation rates, project reprioritization, etc. All such changes should be identified in a manner that will permit verification of the specific quantitative change(s) in the cost estimate. Changes may be documented by the use of addenda, officially approved change request documents, or by completion of a new estimate. The method used depends upon the magnitude of the estimated change and the underlying causes. All estimate changes should include the appropriate level of indirect costs, escalation, and allowances, as dictated by the phase of the project when the change was identified. As projects evolve, baselines are established and changes are managed against those baselines. Changes to the approved baseline shall be properly identified, reviewed, approved, implemented, and tested. Cost estimates supporting proposed or directed changes should follow the recommended level of quality in DOE G 413.3-20, Chg. 1 and DOE G 413.3-21, Chg. 1 at a minimum. 4.6 INDEPENDENT VERIFICATIONS The provisions of QA Criterion 6 (DOE O 414.1D, Chg. 1 or 10 C.F.R. Part 830, Subpart A) require the contractor to use individuals or groups other than those who performed the work to verify or validate the adequacy of design products. Documentation of the independent design verification should be included in the change control package. The independent design verification shall verify:

• Design inputs and constraints are correctly identified; • Design analyses and calculations are complete and correct; • Design outputs are complete and consistent; • Reasonable methods are used in the analysis and, where applicable, computer programs are verified; • System interactions are considered appropriately; • The assumptions are reasonable; and • Appropriate post-modification testing and acceptance criteria are established. 4.7 APPROVAL The CM plan shall identify the approval authority for changes that may impact CM SSCs or credited controls. The approval authority for various changes may vary based on the significance of the change. DOE-STD-1073-2016 4-11 4.8 POST-MODIFICATION TESTING AND TRAINING The QA Criteria 6, 7, and 8 (DOE O 414.1D, Chg. 1 or 10 C.F.R. Part 830, Subpart A) require contractors to validate work before implementation and to perform acceptance testing. The change control package shall specify any post-modification testing to be performed and the acceptance criteria. Post-modification testing validates that the system or component performs as intended and operates within the design requirements after the change is installed and before turnover to operations. These tests serve as the final and independent check of the adequacy of the design review for the proposed change. All post modification testing should be completed and all acceptance criteria satisfied prior to turnover to operations, unless specific tests are to be done post-turnover. QA Criterion 2 (DOE O 414.1D, Chg. 1 or 10 C.F.R. Part 830, Subpart A) requires contractors to train and qualify personnel to be capable of performing their assigned work and to provide continuing training to personnel to maintain their job proficiency. Before returning a CM system, structure, component, or credited control to service following changes, the contractor shall train staff on the modifications that have been made and their effect on normal, abnormal, and emergency operations. 4.9 IDENTIFICATION OF DOCUMENT TO BE REVISED Once it is determined a proposed change can be made, either within the defined design requirements or within new or revised design requirements, each affected document shall be identified as part of the change control process and identified in the change control package. This includes the documents that are directly affected by the change, such as drawings, as well as indirectly affected documents such as the DSA, TSR, ASE, SAD, HAR, hazard controls, training information, procedures, procurement documents, and systems drawings. A complete and thorough review shall be done to identify each document affected by the change. If other CM SSCs or credited controls are affected by the change, the contractor shall determine if documentation for those also needs to be changed. Examples of documents that are sometimes overlooked are CM equipment databases, operating and maintenance procedures, and training lesson plans. The CM equipment database and the document database should be used as primary tools to identify affected documents. Cross-disciplinary and cross-organizational reviews may be necessary to identify all affected documents. Critical facility or activity documents, such as drawings and procedures needed for operation, should be updated prior to placing systems and components in operation.

Because every change directly or indirectly affects associated documentation, a major interface exists between the change control and document control processes. The contractor shall identify any drawings and procedures to be updated as part of the work processes to implement the change. Other documents should be updated and issued as needed following implementation. The affected documents should be updated in a timely manner. DOE-STD-1073-2016 4-12 As-built documentation shall be prepared at the completion of implementation of the physical changes. Revised documentation shall be distributed (or made available in the case of electronic document files) to users of controlled documents. Maintenance of documents and records is required by the QA Criterion 4 (DOE O 414.1D, Chg. 1 or 10 C.F.R. Part 830, Subpart A). Additional information on document control is provided in Section 5 of this Standard. DOE-STD-1073-2016 5-1 5.0 DOCUMENT CONTROL Documents are to be controlled consistent with QA Criterion 4 (DOE O 414.1D, Chg. 1 or 10 C.F.R. Part 830, Subpart A) which requires contractors to prescribe processes for the development, maintenance, and use of documents and records. Document control shall ensure only the most recently approved versions of documents are used in the process of operating, maintaining, and modifying the facility or activity. Document control helps ensure: • Important facility or activity documents are properly stored; • Revisions to documents are controlled, tracked, and completed in a timely manner; • Revised documents are formally distributed to designated users; and • Information concerning pending revisions is made available. As controlled documents are updated to reflect changes to the requirements and physical installation, the contractor shall ensure: • Each updated document is uniquely identified and includes a revision number and date; and • Each outdated document is replaced by the latest revision. 5.1 DOCUMENTS TO BE CONTROLLED The CM process shall identify what documents need to be controlled. It should define "document owners" who are responsible for developing and revising the technical content of the documents and ensuring they are maintained current. Document owners should establish the schedules for document revisions, distribution, and retrieval. Documents to be controlled should include those documents that reflect the facility or activity requirements, performance criteria, and associated design bases; however, the number of documents that are controlled should be limited because of the resources required to properly control documents. DSAs, TSRs, ASEs, SADs, HARs, and the documents that identify or define design requirements shall be controlled documents. Other documents, such as the safety management programs and documents supporting the DSA, SAD, or HAR, should be evaluated for potential inclusion in the CM program. The application of document control on vendor documents should be graded consistent with the importance of that information to operation of the CM SSC or credited control. In addition to DSAs, SADs, and HARs, additional documents that should be controlled include: • Safety management programs; • Design specification and calculations; • Hazard and accident analyses supporting documents; • Software data and manuals for operation and maintenance of critical software; DOE-STD-1073-2016 5-2 • Key procedures; • Key drawings; and • Key vendor supplied documents.

In addition, for HC 1, 2, and 3 nuclear facilities as listed in DOE G 433.1-1A, the maintenance procedures, maintenance plans, maintenance policy manuals, maintenance records and documentation, drawings, vendor technical manuals, and maintenance correspondence should be controlled information. DOE G 433.1-1A also states vendor technical information related to SSCs should be controlled at the same level as other facility or activity documentation applicable to that SSC. SDDs and other similar documents may contain specific information about preventive and mitigative SSCs that is too detailed to include in the safety analysis, but which facility or activity personnel need to understand design, operation, and maintenance of the facility or activity. Whenever a change is initiated, the contractor should also review any applicable SDDs to determine if they need to be updated. The Contractor Requirements Document of DOE O 413.3B, Chg. 2 requires contractors for nuclear projects to maintain a Code of Record under configuration control throughout the Conceptual Design process and for the remainder of the nuclear facility’s life-cycle. After identifying which specific documents need to be controlled, the following information on each document should be recorded in the document databases to facilitate tracking and control: • Document type, • Unique document number (document control number), • Document owner, • Revision level, • Current status (approved, draft, cancelled, superseded, etc.), • Information regarding pending changes, and • Other information needed for control and tracking, such as location and outstanding Document Change Notices. This information should be retained in an easily retrievable manner. Selected document information should also be entered into the CM equipment database to establish a cross- reference or link between CM systems and components and the associated documents. In order to ensure the efforts and resources of document control are appropriately focused, contractors should review the list of controlled documents periodically and strive to consolidate and reduce the volume of controlled documents. DOE-STD-1073-2016 5-3 5.2 DOCUMENT AND RECORD STORAGE The objective of temporary and long-term storage facilities for documents and records is to preclude damage or loss from age, weather, deterioration, larceny, or vandalism. The methods of storage should be based on the particular characteristics of the document or record. Special consideration should be given to light-, pressure-, or temperature- sensitive documents (e.g., radiographs, photographs, film) consistent with applicable industry standards. Contractors should assign specific individuals the responsibility to ensure those records (active and inactive) and other documents and records are protected, preserved, and stored such that they can be retrieved within defined retrieval times. A central document control organization may be assigned these storage responsibilities. Storage and retention of documents and records shall meet government recordkeeping requirements, including applicable DOE Orders, specific commitments to DOE and other Federal organizations, and applicable consensus standards. The needs of the document owners and users should also be considered. Document control procedures should establish requirements for regularly backing up electronically stored documents and records on a defined schedule.6 5.3 TIMELINESS

Contractors shall incorporate approved changes into controlled documents in a timely manner as defined in the CM process. The contractor should control and limit the backlog of changes that have not been incorporated. Contractors should consider incorporating small changes in batches, where appropriate. When there is a large backlog of changes that have not been incorporated on a document, the document may not reflect the physical facility or activity or the approved design basis or safety analysis, consequently diminishing the value of the document. Document control procedures should specify the number of changes that may be outstanding for a document before the document is revised. That limit may vary depending upon the type of document, document priority, complexity of the changes, and the degree of overlap of those changes. The document control process should include provisions to ensure that document users are provided information on outstanding approved changes whenever they request a controlled document. 5.4 DOCUMENT RETRIEVAL Contractors should ensure documents are made available in a timely manner upon request. Easy retrieval of documents is a service that facilitates contractor activities and encourages workers to use up-to-date information. In selecting the appropriate document information system, the contractor should ensure the system is available and documents can be retrieved as needed to support document owners and users. 6 See ASME NQA-1, where applicable, for additional information on document control. DOE-STD-1073-2016 5-4 The document database should have the capability to sort and identify documents based on identified characteristics such as: • Their relationship to particular systems and components (such as a particular pump); • Types of systems and components (such as motor-operated valves); • Technical topics (such as fire protection); and • Other relational data (such as the specific vendor) necessary for the adequate identification of documents. 5.5 DOCUMENT CONTROL FOR ACCELERATORS DOE G 420.2-1A contains information on preparing and maintaining documentation for accelerator facilities. DOE-STD-1073-2016 6-1 6.0 ASSESSMENTS In accordance with the requirements for periodic assessments in QA criteria 9 and 10 (DOE O 414.1D, Chg. 1 or 10 C.F.R. Part 830, Subpart A), contractors shall periodically assess the performance of the approved CM process. For HC 1, 2, and 3 nuclear facilities and activities, the maintenance criteria of DOE O 433.1B, Chg. 1 also require periodic assessments to verify the condition of systems and equipment. This Section discusses four different types of assessments that should be performed to determine the effectiveness of different aspects of the CM process. Periodic assessments help ensure work processes continue to function properly or problems are identified, root causes are determined, and problems are corrected. This Section contains provisions for performing assessments directly related to CM. These assessments may either be performed separately or combined with other periodic assessments of the facility or activity. The assessment of the adequacy of CM for a facility or activity may be integrated into broader management and performance assessments, such as QA, maintenance, or ISMS assessments. If the contractor decides to fold the assessment of CM into a broader assessment, it should consider the provisions in this Section when developing the assessment criteria for the broader assessment.

6.1 OBJECTIVES The objective of assessing CM is to detect, document, determine the cause of, and initiate correction of inconsistencies among design requirements, documentation, and physical configuration. Properly performed assessments should help identify inconsistencies between these areas, evaluate the root causes for these problems, and prescribe improvements to avoid similar inconsistencies in the future. The specific types of assessments discussed in this Section are: • Construction assessments which are performed to ensure configuration is managed throughout the construction process for new construction or major modifications. • Physical configuration assessments which are conducted to evaluate the consistency between the physical configuration and the facility or activity documentation. • Design assessments which are done to ensure design documents have been updated to reflect changes and accurately reflect the physical configuration of the facility or activity. • Periodic performance assessments which are conducted to verify systems and components continue to meet design and performance requirements in their current configurations. DOE-STD-1073-2016 6-2 6.2 CONSTRUCTION ASSESSMENTS There should be a documented plan for CM during construction. It may be appropriate to use different CM processes as construction proceeds and the physical configuration approaches completion. Construction assessments shall be performed throughout the construction process for new construction or major modifications, to assure the quality of the construction and the conformance to design specifications. Adherence to the applicable CM process should be a part of the construction assessment process. In particular, the physical configuration should be assessed at construction turnover to assure the physical configuration is consistent with the design requirements and the documentation, including (but not limited to) as-built drawings. Construction assessments may involve physical configuration assessments; design assessments; post-construction, -modification, or -installation inspections and tests; and periodic performance assessments. There should be a thorough review of the design, documentation and physical configuration prior to turnover from construction to testing/commissioning. Additional provisions for capital asset projects required to meet DOE-STD-1189 are provided in Appendix G. These provisions are to preserve the integrity of the DOE approved safety design and analysis documents as design and construction progress. 6.3 PHYSICAL CONFIGURATION ASSESSMENTS Physical configuration assessments are performed to determine if the actual physical configuration agrees with the design requirements and the documentation. They also determine the effectiveness of CM in the field. Information is gathered through interviews with knowledgeable facility or activity personnel, document reviews, and detailed walkdowns and observations of the actual facility or activity configuration. Physical configuration assessments may be performed on a sample basis, with the sample providing a representative cross-section of component types within the system being assessed. The sample should be large enough to ensure a statistically significant portion of the system and its components are chosen. For instance, the sample should include major and minor components, large and small bore piping (where applicable), and instruments and controls.

Two common types of physical configuration assessments are "walkdowns" and resolution of configuration and documentation discrepancies. While the processes of walkdowns and resolution of configuration and documentation discrepancies have significant overlaps, the distinctions between them should be understood. One distinction is based on the products of these processes. A product of the walkdown process is a set of marked-up documents that reflect the actual physical configuration and identified discrepancies with the currently approved facility or activity documentation. "As-built documents" which have been field-verified and design-verified are products of the resolution of configuration and documentation discrepancies. DOE-STD-1073-2016 6-3 Walkdowns During walkdowns, the as-found configuration is identified by comparing the existing physical configuration with the facility or activity documentation to identify any discrepancies, typically by marking up the documents. Walkdowns are sometimes conducted to: • Record manufacturers' nameplate data from equipment; • Identify missing or incorrect equipment labeling; • Determine the present material condition of equipment; and • Identify potential physical interactions between equipment (such as non- seismically qualified equipment mounted in such a position as to impact seismically qualified equipment during an earthquake). A sample walkdown procedure is provided in Appendix K. Resolution of configuration and documentation discrepancies The resolution of configuration and documentation discrepancies involves: • Determining the actual physical configuration that exists at a point in time; • Identifying any discrepancies with the facility or activity documentation; and • Technically resolving those discrepancies. The level of detail of a particular facility or activity document type establishes the threshold of the corrections that need to be made. If a document provides, or is intended to provide, information that does not agree with the actual physical configuration, those discrepancies should be identified and resolved. Leaving incorrect or unverified information on a document is likely to mislead users of the document. Further, any information that is left on as-found documents and has not been verified should be clearly identified. If the contractor is made aware of an as-found discrepancy, the contractor should perform a technical review to determine if the current physical configuration is the desired configuration (in accordance with design requirements) or if the documentation indicates the appropriate configuration (the physical configuration needs to be changed to meet design requirements) and identify any needed changes. The CM process shall identify who may approve discrepancy resolutions (i.e., through a design verification) to ensure the final configurations are consistent with the design requirements. Changes to either the physical configuration or the documentation should be tracked through a design change document. The end product of the resolution of configuration and documentation discrepancies is documentation that has been both field-verified and design-verified to be consistent with the "as-built" or actual physical configuration.

Physical configuration assessments for HC 1, 2, and 3 nuclear facilities For HC 1, 2, and 3 nuclear facilities, DOE O 420.1C specifically requires system assessments to include periodic reviews of system operability, reliability, and material condition. For these facilities, physical configuration assessments should be conducted as part of the inspections required by the nuclear maintenance management program in accordance with DOE O 433.1B, Chg. 1, as well as the assurance system developed to DOE-STD-1073-2016 6-4 meet the requirements of DOE O 226.1B, Implementation of Department of Energy Oversight Policy. These periodic reviews assess the ability of the system to perform its design and safety functions. In addition, these assessments should be integrated with the activities performed to meet the quality assurance program (QAP) under the applicable requirements of 10 C.F.R. Part 830, Subpart A. The goal of the assessment process should be to assure the integrity of the CM SSCs. During the physical configuration assessments, contractors should assess whether the equipment in use has become obsolete making replacement of failed parts more difficult. If so, the contractor should inform the engineering and maintenance organizations and request these organizations to develop plans for replacing the obsolete equipment when necessary. Physical configuration assessments should be conducted at a specified periodicity to establish confidence. Systems of lesser importance may be included at a lesser periodicity to ensure the breadth of the configuration is being maintained adequately. Special reviews may be required on an as needed basis, such as to verify input into a DSA update or when unusual or off-normal occurrences affecting the safety basis systems results in a lack of confidence in the facility or activity configuration or in a concern that it has been compromised. Contractors should consider scheduling reviews of the configuration of safety SSCs on a schedule appropriate to support the annual update of the DSA. 6.4 DESIGN ASSESSMENTS Consistent with DOE O 413.3B, Chg. 2, contractors shall perform design reviews before operation of new facilities and activities and before operation following major modifications to facilities and activities to assure the consistency among the documented design and system requirements, the system documentation (including drawings and procedures), and the physical configuration of the facility or activity for CM SSCs and credited controls. The assessment should confirm the completeness and accuracy of the design and system requirements documented in design and safety documentation. In particular, during these assessments the contractor should verify the design and safety documentation accurately reflects any modifications made to the facility or changes made to the activity since the previous design review. In addition, contractors should periodically assess the documented design and system requirements on a sample basis to assure they continue to be accurate and provide accurate information for operations, training, and maintenance documents and activities. These assessments may be done as part of routine assessments of the facility or activity. Contractors should also assure operations, training, and maintenance documents are maintained consistent with the documented design and system requirements. The CM process should define the frequency of the design assessments. DOE-STD-1073-2016 6-5

As these assessments may be useful to support periodic updates of design and safety documentation, contractors should consider scheduling their periodic assessments at a time appropriate to support those updates. 6.5 PERIODIC PERFORMANCE ASSESSMENTS The CM SSCs and credited controls shall be monitored and tested periodically to determine if they are still capable of meeting their design and performance requirements. The process for performing this monitoring and testing should be described in the facility or activity maintenance plans or other procedures. Monitoring and testing may take the form of surveillance actions, periodic in-service inspections and tests, and other monitoring of systems and components to ensure safe and reliable operation of the facility or activity. In addition to observing direct results, derived results may include reliability assessments, performance trending, and equipment aging characteristics. Contractors should use the results of this monitoring to identify and avoid inconsistencies between functional and performance requirements identified in the design and actual capability of systems and components. In addition, contractors should use trending of data to detect degradation of equipment due to aging or other causes. By performing periodic performance monitoring, contractors shall verify selected systems and components continue to be able to perform their intended functions (i.e., meet their design requirements). In accordance with QA Criterion 3 (DOE O 414.1D, Chg. 1 or 10 C.F.R. Part 830, Subpart A), contractors should correct any deficiencies identified during the periodic performance assessments that cause the systems or components to deviate from design requirements and identify any root causes of performance degradation. Contractors should routinely monitor, collect, trend, and analyze performance data (including thermal, hydraulic, electrical, and mechanical data). Consistent with QA criterion 5 (DOE O 414.1D or 10 C.F.R. Part 830, Subpart A) calibrated instrumentation should be used when performing these activities. The methods of implementation should include procedures, checklists, or other guidance documents necessary to conduct these activities. Periodic Performance Assessments of HC 1, 2, 3 Nuclear Facilities For HC 1, 2, 3 nuclear facilities and activities, the Cognizant System Engineers, as discussed in DOE O 420.1C, shall maintain cognizance over performance monitoring activities on assigned systems. Their responsibilities should include the identification of performance goals and acceptance criteria consistent with the associated SSC design requirements. Reviewing trend graphs of collected equipment data at specified intervals is a proven, effective approach to assess performance. For example, if the trend graph indicates the equipment likely will not meet the acceptance criteria at or before the next scheduled test, an adjustment in the test schedule and other maintenance actions would be necessary. Recognition of interfaces with existing maintenance program requirements is necessary. Surveillance testing is typically performed to satisfy TSR, regulatory, code, or other requirements to ensure operability of the equipment within established limits. The results DOE-STD-1073-2016 6-6

of surveillance testing should be used to detect and correct any deficiencies that cause the equipment to deviate from the design requirements. Surveillance testing techniques are similar in many ways to those used in SSC performance monitoring. The results of surveillance testing should be reviewed and trended, and necessary corrective actions taken to return equipment performance to within the design requirements. The periodic equipment performance monitoring function should take credit for periodic surveillance testing, where appropriate. Periodic testing, beyond that in the TSR surveillance requirements, may be adjusted both in frequency and degree of technical content based on the importance of the SSC or the particular SSC function. The origins of various testing requirements should be documented and maintained in the nuclear maintenance management program as specified in DOE O 433.1B, Chg. 1. Contractors should include the Cognizant System Engineers, as well as design engineers, in the periodic review of operating and maintenance procedures. Periodic performance assessments for accelerators Periodic performance assessments should be performed for accelerators, including monitoring and testing of credited controls. See DOE G 420.2-1A for additional guidance. 6.6 RESOLUTION OF OPEN ITEMS FROM ASSESSMENTS The contractor should establish a formal, documented process for recording assessment findings and resolution of open items. That process should include tracking the open items to completion and closeout, including documentation of the resolution. The process should also be consistent with the provisions in the facility or activity applicable QAP. DOE-STD-1073-2016 A-1 APPENDIX A REFERENCES The following documents are referenced within this Standard. Federal Regulations 10 C.F.R. Part 830 Nuclear Safety Management 10 C.F.R. Part 851 Worker Safety and Health Program 29 C.F.R. 1910.119 Process Safety Management of Highly Hazardous Chemicals 48 C.F.R. 970.5223-1 Integration of Environment, Safety, and Health into Work Planning and Execution DOE Directives (Policies, Orders, Manuals, and Guides) DOE G 413.3-1 Managing Design and Construction Using Systems Engineering for Use with DOE O 413.3A DOE G 413.3-9, Chg. 1 U.S. Department of Energy Project Review Guide for Capital Asset Projects DOE G 413.3-15, Chg. 1 Department of Energy Guide for Project Execution Plans DOE G 413.3-16A, Chg. 1 Project Completion/Closeout Guide DOE G 413.3-20, Chg. 1 Change Control Management Guide DOE G 413.3-21, Chg. 1 Cost Estimating Guide DOE G 420.2-1A Accelerator Facility Safety Implementation Guide for DOE O 420.2C, “Safety of Accelerator Facilities” DOE G 421.1-2A Implementation Guide For Use in Developing Documented Safety Analyses To Meet Subpart B of 10 CFR 830 DOE G 430.1-3 Deactivation Implementation Guide DOE G 430.1-5 Transition Implementation Guide DOE-STD-1073-2016 A-2 DOE G 433.1-1A, Admin. Chg. 1 Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1B DOE O 226.1B Implementation of Department of Energy Oversight Policy DOE O 251.1C Departmental Directives Program DOE O 252.1A, Admin.Chg. 1 Technical Standards Program DOE O 413.3B, Chg. 2 (PgChg) Program and Project Management for the Acquisition of Capital Assets DOE O 414.1D Quality Assurance DOE O 415.1, Admin. Chg. 1 Information Technology Project Management DOE O 420.1C, Chg. 1 Facility Safety DOE O 420.2C

Safety of Accelerator Facilities DOE O 422.1 Conduct of Operations DOE O 426.1, Chg. 1 Federal Technical Capability DOE O 425.1D Verification of Readiness to Start Up or Restart Nuclear Facilities DOE O 430.1C Real Property Asset Management DOE O 433.1B, Admin. Chg. 1 Maintenance Management Program for DOE Nuclear Facilities DOE O 450.2 Integrated Safety Management DOE O 452.2E Nuclear Explosive Safety DOE Handbooks and Technical Standards DOE-HDBK-1211-2014 Activity-Level Work Planning and Control Implementation, DOE-STD-1020-2016 Natural Phenomena Hazards Analysis and Design Criteria for DOE Facilities DOE-STD-1073-2016 A-3 DOE-STD-1027-92, CH1 Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports DOE-STD-1044-93, CH1 Guide to Good Practices for Equipment and Piping Labeling DOE-STD-1189-2016 Integration of Safety into the Design Process DOE-STD-3009-2014 Preparation of Nonreactor Nuclear Facility Documented Safety Analysis DOE-STD-3024-2011 Content of System Design Descriptions Other Consensus Standards American National Standards Institute (ANSI)/American Nuclear Society (ANS)/ Electronics Industries Alliance (EIA) ANSI B31.3 Process Piping Design ANSI/ANS-2.26-2004 (R2010) Categorization of Nuclear Facility Structures, Systems, and Components for Seismic Design ANSI/EIA-649B Configuration Management Standard American Society of Mechanical Engineers (ASME) ASME Boiler and Pressure Vessel Code ASME NQA-1 Quality Assurance Requirements for Nuclear Facility Applications International Atomic Energy Agency (IAEA) IAEA-TECDOC-1335 Configuration Management in Nuclear Power Plants IAEA-TECDOC-1651 Information Technology for Nuclear Power Plant Configuration Management National Nuclear Security Administration (NNSA) NNSA SD 452.2 Nuclear Explosive Safety Evaluation Process DOE-STD-1073-2016 B-1 APPENDIX B GLOSSARY Accelerator safety envelope (ASE). An ASE is a set of verifiable physical and administrative credited controls that define the bounding conditions for safe operation and address the accelerator facility hazards and risks. (DOE O 420.2C) As-built documentation. Documentation (for example, Piping and Instrument Diagrams, and database records) verified by physical inspection as depicting the actual physical configuration and verified as consistent with the design requirements. As-found. Information, often in the form of marked-up documents that reflects the actual physical configuration and identifies any discrepancies with currently approved facility or activity documentation. Assessment. A review, evaluation, inspection, test, check, surveillance, or audit to determine and document whether items, processes, systems, or services meet specified requirements and perform effectively. Authorization basis. Those aspects of the facility design basis considered important to the safety of facility operations and therefore relied on by DOE to authorize operation. The authorization basis is described in documents such as the facility documented safety analysis and other safety analyses, hazard classification documents, the Technical Safety Requirements, DOE-issued safety evaluation reports, and facility-specific commitments made in order to satisfy DOE Orders or policies and may include Federal and State regulatory permits, licenses and commitments thereto.

Change. Any alteration or addition, temporary or permanent, to the facility or activity physical configuration, facility or activity documentation, or design requirements is considered to constitute a change. Changes not within current design requirements involve design changes. Identical replacements are not changes. Change control. A process that ensures all changes are properly identified, reviewed, approved, implemented, tested, and documented. Change control package. The change control package is the documentation that accompanies a change to a facility or activity from the planning and initiation through completion of the implementation and testing. Change traveler. A form used to transmit the change control package. CM equipment database. The CM equipment database cross references SSCs with their design requirements, design basis, and associated documents. It is the primary source for design requirements. See section 3.8 of the Standard. CM SSCs and credited controls. The SSCs and/or credited controls identified in the CM process as being controlled by the CM process. Code of Record. A set of requirements, including Federal and state laws, as defined in contracts and Standards or Requirements Identification Documents (or their equivalent), that are in effect at the time a facility or item of equipment was designed and accepted by DOE. It is initiated during DOE-STD-1073-2016 B-2 the Conceptual Design 7 phase and prior to approval of CD-1. It is placed under configuration control to ensure it is updated to include more detailed design requirements as they are developed during preliminary design and prior to approval of CD-2. It is controlled during final design and construction with a process for reviewing and evaluating new and revised requirements to determine their impact on project safety, cost and schedule before a decision is taken to revise the Code of Record. It is maintained and controlled through facility decommissioning. Collocated SSC. An SSC located near or interfacing with a CM SSC or credited control whose failure (structurally or functionally) could negatively impact a CM SSC or credited control. Comprehensive search. A process through which broad spectrums of documents that may contain design information are identified, retrieved, and evaluated. Key steps involve locating and screening documents that may contain design information and reviewing them to extract design information. Cognizant System Engineer. The engineer assigned technical responsibility for a particular system who coordinates technical activities related to the assigned system. The Cognizant System Engineer has technical understanding of the system requirements design, operation, testing and maintenance. The Cognizant System Engineer ensures that relevant documents, such as system design descriptions, technical drawings, diagrams, lists, and procedures for surveillance, testing and maintenance are complete, accurate, and up to date. The Cognizant System Engineer may also keep vendor technical information and appropriate files concerning system history of repairs, modifications, operational problems, and other unique conditions or circumstances. Equivalent terms include cognizant engineer, system engineer, system specialist, and subject matter expert. Configuration. Configuration is the combination of the physical, functional, and operational characteristics of the structures, systems, and components (SSCs), credited controls, or parts of the existing facility or activity.

Configuration management (CM). Configuration management is a disciplined process that involves both management and technical direction to establish and document the design requirements and the physical configuration of the facility or activity and to ensure that they remain consistent with each other and the documentation. Credited control. A credited control is one determined through safety analysis to be essential for safe operation directly related to the protection of personnel or the environment. (DOE O 420.2C) Defense-in-depth. Defense-in-depth describes the multiple equipment and administrative features that together are relied upon to provide preventive or mitigative functions to a degree proportional to the potential hazard. Design analyses and calculations. Design analyses and calculations are the intermediate design products necessary to convert the design inputs and constraints into appropriate and complete design outputs. Design analysis and calculations consist of a wide variety of engineering analyses, calculations, studies, reports, and technical review checklists necessary to perform complete engineering design. Design analyses and calculations capture the design assumptions 7 The Conceptual Design phase is defined in DOE O 413.3B, Chg. 2. DOE-STD-1073-2016 B-3 and identify the available design margin. Design assessments. Design assessments are performed to ensure that design documents have been updated to reflect changes and accurately reflect the physical configuration of the facility or activity. Design authority. The Design Authority is the individual who formally signs off on the design drawings, calculations, and specifications. The design authority is responsible for assuring the technical adequacy of the design. These responsibilities are applicable whether the process is conducted fully in-house, partially contracted to outside organizations, or fully contracted to outside organizations. Design basis. Design basis consists of the design inputs, the design analysis and calculations, and the design outputs. It includes topical areas such as seismic qualification, fire protection, and safe shutdown. The design basis explains why a design requirement has been specified in a particular manner or as a particular value. Design documents. Design documents define either the design requirements or the design basis of the facility or activity. Design documents include design specifications, design change packages, design drawings, design analysis, setpoint calculations, summary design documents, correspondence with DOE or other regulator that provides design commitments, and other documents that define the facility or activity design. Design information. The combination of design requirements and design basis information associated with the design process, consisting of design inputs, design analysis and calculations, and design outputs. Design inputs. Those specific criteria, limits, performance requirements, bases, or other initial requirements (i.e., specific operational requirements, design bases, and commitments), as well as general restrictions and limits to the engineering design process that ensure consistency and quality of design (i.e., quality assurance or QA requirements, applicable codes and standards, regulatory requirements, and required design methodologies) upon which the detailed final design is based.

Design margin. The design margin is the conservatism between the specified design requirement and the minimum requirement that would meet the design basis. Design outputs. Design outputs include documentation such as drawings, design change packages, specifications, load lists, valve lists, design reports, and setpoint lists. They are the composite result of the engineering organization’s consideration of the design inputs and the design analysis and calculations. The design outputs specify the requirements of the design basis, e.g., the necessary functions, capabilities, capacities, physical sizes and dimensions, limits and setpoints. They include the operational requirements, as well as procurement requirements, QA requirements, construction/installation specifications and instructions, post-installation testing, post-maintenance testing, and periodic surveillance/testing requirements. Design reconstitution. An adjunct program to the configuration management process that accomplishes the one-time effort of identifying, retrieving, extracting, evaluating, verifying, validating, and regenerating missing critical design requirements and basis. Design reconstitution encompasses the following functions: developing associated program plans and procedures; identifying and retrieving design information from identified source documents; evaluating, DOE-STD-1073-2016 B-4 verifying, and validating the design information; resolving discrepancies; regenerating missing critical design information; and preparing and issuing Design Information Summaries. Discrepancy. As used in this standard, a discrepancy is an inconsistency among the physical configuration, the design, and the documentation. Document. Document means recorded information that describes, specifies, reports, certifies, requires or provides data or results. Documented safety analysis (DSA). Documented safety analysis means a documented analysis of the extent to which a nuclear facility can be operated safely with respect to workers, the public, and the environment, including a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety. Environmental design requirements. In the context of the configuration management process, those design requirements that are necessary to protect the environment, and to satisfy environmental requirements and permits, as well as other related DOE requirements. Facility or activity documents. Facility or activity documents include those documents that support facility or activity operations, for example as-built configuration information (such as drawings, valve lists, etc.), the facility or activity procedures for activities (such as operations, maintenance, and testing), and facility or activity operational records (such as completed tests, work requests, and radiation survey maps). Formal approval. An approval in writing which is completed using the procedures or processes defined by the approving office. Formal review. A process through which design information is identified and retrieved from on- hand, top-level, summary-type design documents such as documented safety analysis (DSAs), safety analysis documents (SADs), hazard analysis reports (HARs), technical safety requirements (TSRs), accelerator safety envelope (ASE), and system design descriptions (SDDs). Graded approach. The term graded approach, when used in this Standard, means the process of ensuring that the level of analysis, documentation, and actions used to comply with a requirement in this part are commensurate with:

(1) The relative importance to safety, safeguards, and security; (2) The magnitude of any hazard involved; (3) The life cycle stage of a facility or activity; (4) The programmatic mission of a facility or activity; (5) The particular characteristics of a facility or activity; (6) The relative importance of radiological and nonradiological hazards; and (7) Any other relevant factor. Independent design verification. Independent design verification is a verification performed by a person other than the person who performed the original design work. It is the act of checking the design or requirement, often by using a different calculation method, to verify that the structure, system or component will meet established performance criteria. Integrated Safety Management System (ISMS). See Safety Management System. DOE-STD-1073-2016 B-5 Item. An all-inclusive term used in place of appurtenance, assembly, component, equipment, material, module, part, structure, product, software, subassembly, subsystem, system, unit, or support systems. Major modification. Major modification means a modification to a DOE nuclear facility that substantially changes the existing safety basis for the facility. (10 C.F.R. Part 830) Master equipment list (MEL). The master equipment list is a detailed master list of equipment, components, and structures to be included in the maintenance program. This includes both safety-related and non-safety-related systems and equipment. (DOE G 433.1-1A, Chg. 1) Nonreactor nuclear facility. Nonreactor nuclear facility means those facilities, activities or operations that involve, or will involve, radioactive and/or fissionable materials in such form and quantity that a nuclear or a nuclear explosive hazard potentially exists to workers, the public, or the environment, but does not include accelerators and their operations and does not include activities involving only incidental use and generation of radioactive materials or radiation such as check and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and X-ray machines. (10 C.F.R. Part 830) Nuclear facility. Nuclear facility means a reactor or a nonreactor nuclear facility where an activity is conducted for or on behalf of DOE and includes any related area, structure, facility, or activity to the extent necessary to ensure proper implementation of the applicable requirements. (10 C.F.R. Part 830) Physical Configuration. Physical configuration means the actual physical location, arrangement, and material condition of structures, systems, and components or credited controls within a facility or for an activity. Post-operational. This phase is following the operational phase of a facility or activity and may include deactivation, decontamination, and decommissioning. Radiological facilities. Nuclear facilities classified as below HC 3 in accordance with DOE-STD- 1027-92. Reactor. Reactor means any apparatus that is designed or used to sustain nuclear chain reactions in a controlled manner such as research, test, and power reactors, and critical and pulsed assemblies and any assembly that is designed to perform subcritical experiments that could potentially reach criticality; and, unless modified by words such as containment, vessel, or core, refers to the entire facility, including the housing, equipment and associated areas devoted to the operation and maintenance of one or more reactor cores. (10 C.F.R. Part 830)

Safety assessment document (SAD). The safety assessment document is a document containing the results of a safety analysis for an accelerator or other facility pertinent to understanding the risks of operating the accelerator facility. Safety-class structures, systems, and components. Safety-class structures, systems, and components are the structures, systems, or components, including portions of process systems, whose preventive or mitigative functions are necessary to limit radioactive hazardous material exposure to the public, as determined from safety analyses. (10 C.F.R. Part 830) DOE-STD-1073-2016 B-6 Safety design requirements. Those design requirements that are necessary to protect off-site, on- site, and facility or activity personnel from nuclear hazards and other hazards, such as sulfuric acid and chlorine. Safety design requirements include those necessary to satisfy DOE safety requirements. Safety management program. The safety management program is a program designed to ensure a facility or activity is operated in a manner that adequately protects workers, the public, and the environment by covering topics such as: quality assurance; maintenance of safety systems; personnel training; conduct of operations; inadvertent criticality protection; emergency preparedness; fire protection; waste management; and radiological protection of workers, the public, and the environment. Safety Management System (SMS). Safety management system means an integrated safety management system established consistent with 48 C.F.R. 970.5223-1. Safety-significant structures, systems and components. Safety-significant structures, systems, and components are the structures, systems, and components that are not designated as safety class structures, systems, and components, but whose preventive or mitigative functions are a major contributor to defense-in-depth and/or worker safety as determined from safety analyses. (10 C.F.R. Part 830) Safety structures, systems, and components. Safety structures, systems, and components are both safety-class structures, systems, and components and safety-significant structures, systems, and components. (10 C.F.R. Part 830) Smart search. A process through which that set of documents that are most likely to contain design requirements are identified, retrieved and evaluated. Key steps involve location of the source documents most likely to contain design requirements, screening them for applicability, and reviewing them to extract design information. Structures, systems, and components (SSCs). Structures are elements that provide support or enclosure such as buildings, free standing tanks, basins, dikes, and stacks. Systems are collections of components assembled to perform a function such as piping; cable trays; conduit; or heating, ventilating and air conditioning (HVAC). Components are items of equipment such as pumps, valves, relays, or elements of a larger array such as computer software, lengths of pipe, elbows, or reducers. Technical Safety Requirements (TSRs). TSRs are the limits, controls, and related actions that establish the specific parameters and requisite actions for the safe operation of a nuclear facility and include, as appropriate for the work and the hazards identified in the documented safety analysis for the facility: safety limits, operating limits, surveillance requirements, administrative and management controls, use and application provisions, and design features, as well as a bases appendix. (10 C.F.R. Part 830)

Unreviewed Safety Issue (USI). A significant increase in the probability of or consequences from (1) a planned modification that creates a previously unanalyzed postulated accident or condition that could result in a significant adverse impact or (2) a previously analyzed postulated accident or condition. (DOE O 420.2C) DOE-STD-1073-2016 B-7 Unreviewed Safety Question (USQ). A situation involves a USQ when: (1) The probability of the occurrence or the consequences of an accident or the malfunction of equipment important to safety previously evaluated in the documented safety analysis could be increased; (2) The possibility of an accident or malfunction of a different type than any evaluated previously in the documented safety analysis could be created; (3) A margin of safety could be reduced; or (4) The documented safety analysis may not be bounding or may be otherwise inadequate. (10 C.F.R. Part 830) Verification. For the purposes of the design reconstitution program, verification is the process of checking that the retrieved design information has been completely and accurately translated from the source documents. Waiver or deviation. Documented authorization to depart from specified requirements. Walkdown. A visual inspection of facility or activity structures, systems, and components to identify the as-found physical configuration and any discrepancies with currently approved facility or activity documentation. Work Control Document. A proceduralized document used by facility personnel to perform activities, such as maintenance, inspections, testing, or other work. (DOE G 433.1-1A, Chg. 1) DOE-STD-1073-2016 C-1 APPENDIX C ACRONYMS ALARA As Low As Reasonably Achievable ARR Accelerator Readiness Review ASE Accelerator Safety Envelope CCD Component configuration data (sheets) CD Critical Decision C.F.R. Code of Federal Regulations CM Configuration Management CSDR Conceptual Safety Design Report DBA Design Basis Analysis DOE Department of Energy DSA Documented Safety Analysis EIS Environmental Impact Statements ES&H Environment, Safety and Health FHA Fire Hazards Analysis G Guide GOCO Government-Owned, Contractor-Operated GOGO Government-Owned, Government-Operated HAR Hazard Analysis Report HDBK Handbook HVAC Heating, Ventilation, and Air Conditioning ISMS Integrated Safety Management System M Manual MDL Master Document List MEL Master Equipment List NCR Nonconformance Report NEO Nuclear Explosives Operation NES Nuclear Explosives Safety O Order P&ID Piping and Instrument Drawing PEP Project Execution Plan PDSA Preliminary Documented Safety Analysis PHA Preliminary Hazard Analysis PISA Potential Inadequacy of a Safety Analysis PSDR Preliminary Safety Design Report PSI Pounds per square inch PSIG Pounds per square inch gauge QA Quality assurance QAP Quality Assurance Program QC Quality Control RWP Radiation Work Permit DOE-STD-1073-2016 C-2 SAC Specific Administrative Control SAD Safety Analysis Document SDD System Design Description SDS Safety Design Strategy SMS Safety Management System (see also ISMS) SSC Structures, Systems, and Components STD Standard TSR Technical Safety Requirement USI Unreviewed Safety Issue USQ Unreviewed Safety Questions DOE-STD-1073-2016 D-1 APPENDIX D DIRECTIVES AND STANDARDS REFERRING TO CONFIGURATION MANAGEMENT, CONFIGURATION CONTROL, AND CHANGE CONTROL The following directives and technical standards and handbooks specifically reference configuration management (CM), configuration control, or change control:

DOE Directives (Policies, Orders, Manuals, and Guides) DOE G 226.1-2A Federal Line Management Oversight of Department of Energy Nuclear Facilities DOE G 413.3-1 Managing Design and Construction Using Systems Engineering for Use with DOE O 413.3A DOE G 413.3-2, Chg. 1 Quality Assurance Guide for Project Management DOE G 413.3-4A Technology Readiness Assessment Guide DOE G 413.3-5A U.S. Department of Energy Performance Baseline Guide DOE G 413.3-7A Risk Management Guide DOE G 413.3-12 U.S. Department of Energy Project Definition Rating Index Guide for Traditional Nuclear and Non-Nuclear Construction Projects DOE G 413.3-15, Chg. 1 Department of Energy Guide for Project Execution Plans DOE G 413.3-16A, Chg. 1 Project Completion/Closeout Guide DOE G 413.3-18A Integrated Project Team Guide for Formation and Implementation DOE G 413.3-20, Chg. 1 Change Control Management Guide DOE-STD-1073-2016 D-2 DOE G 414.1-1B Management Assessment and Independent Assessment Guide for use with 10 CFR, Part 830, Subpart A, and DOE O 414.1C, Quality Assurance; DOE M 450.4-1, Integrated Safety Management System Manual; and DOE O 226.1A, Implementation of Department of Energy Oversight Policy DOE G 414.1-2B Quality Assurance Program Guide DOE G 414.1-4 Safety Software Guide for Use with 10 CFR 830 Subpart A, Quality Assurance Requirements, and DOE O 414.1C, Quality Assurance DOE G 420.1-1A Nonreactor Nuclear Safety Design Guide for Use with DOE O 420.1C, “Facility Safety” DOE G 420.2-1A Accelerator Facility Safety Implementation Guide for DOE O 420.2C, “Safety of Accelerator Facilities” DOE G 421.1-2A Implementation Guide For Use in Developing Documented Safety Analyses To Meet Subpart B of 10 CFR 830 DOE G 423.1-1 A Implementation Guide For Use In Developing Technical Safety Requirements DOE G 424.1-1 B Implementation Guide For Use In Addressing Unreviewed Safety Question Requirements DOE G 430.1-2 Implementation Guide for Surveillance and Maintenance During Facility Transition and Disposition DOE G 430.1-5 Transition Implementation Guide DOE G 433.1-1A, Admin. Chg. 1 Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1B DOE G 435.1-1 Implementation Guide for use with DOE M 435.1- 1 DOE G 450.4-1C Integrated Safety Management System Guide DOE-STD-1073-2016 D-3 DOE Manual (M) 435.1-1, Admin. Chg. 2 Radioactive Waste Management Manual DOE O 413.3B, Chg. 2 (PgChg) Program and Project Management for the Acquisition of Capital Assets DOE O 414.1D Quality Assurance DOE O 415.1, Admin. Chg. 1 Information Technology Project Management DOE O 420.1C, Chg. 1 Facility Safety DOE O 420.2C Safety of Accelerator Facilities DOE O 422.1, Admin. Chg. 2 Conduct of Operations DOE O 425.1D, Admin. Chg. 1 Verification of Readiness to Startup or Restart Nuclear Facilities DOE O 426.1, Chg. 1 Federal Technical Capability DOE O 430.1C Real Property Asset Management DOE O 433.1B, Admin. Chg. 1 Maintenance Management Program for DOE Nuclear Facilities DOE O 452.2E Nuclear Explosive Safety DOE O 461.2 Onsite Packaging and Transfer of Materials of National Security Interest DOE O 474.2, Admin. Chg. 2 Nuclear Material Control and Accountability DOE Manuals DOE Technical Standards (Standards and Handbooks) DOE HDBK-3027-99 Integrated Safety Management Systems (ISMS) Verification Team Leader's Handbook DOE STD-1121-2008 Internal Dosimetry DOE-STD-1189-2016 Integration of Safety into the Design Process

DOE-STD-1211-2014 Activity Level Work Planning and Control Implementation DOE-STD-1073-2016 D-4 DOE-STD-3006-2010 Planning and Conduct of Readiness Reviews DOE-STD-3009-94, CN3 Preparation Guide for U.S. DOE Nonreactor Nuclear Facility Documented Safety Analyses DOE-STD-3024-2011 Content of System Design Descriptions DOE-STD-6002-96 Safety of Magnetic Fusion Facilities: Requirements DOE-STD-6003-96 Safety of Magnetic Fusion Facilities: Guidance Other NNSA 452.2 Nuclear Explosive Safety Evaluation Process DOE-STD-1073-2016 E-1 APPENDIX E INTERFACING DIRECTIVES The following discussions identify specific provisions for CM in DOE regulations, directives, and guidance which should be integrated into CM processes where applicable to the facility or activity. Cognizant system engineers for HC 1, 2, and 3 nuclear facilities DOE Order (O) 420.1C, Facility Safety, requires that HC 1, 2, and 3 nuclear facilities have a Cognizant System Engineer Program by CD-4 for active safety systems and active defense-in-depth systems. DOE O 420.1C also states facility management should consider establishing Cognizant System Engineer programs before CD-4. In addition, DOE O 420.1C requires the Cognizant System Engineering Program to establish a CM program and identifies DOE-Standard (STD) -1073-2003 as an acceptable methodology for establishing CM programs. Where there is a Cognizant System Engineer for a system, the Cognizant System Engineer should be involved in the CM process for that system. Quality assurance (QA) CM overlaps a number of the ten QA criteria in DOE O 414.1D, Chg. 1, Quality Assurance, and 10 C.F.R. Part 830, Subpart A, as discussed throughout this Standard, as well as the nuclear safety software requirements for CM in DOE O 414.1D. In particular, as required by QA Criterion 5, the contractor shall incorporate CM requirements into its procedures and other work processes, and perform work in accordance with those procedures and work processes. Consistent with QA Criterion 2, personnel involved in making or reviewing changes to the design or documentation of a facility or activity or in work planning and control shall be trained in the applicable facility or activity CM process, and establish and maintain proficiency in that process. QA Criterion 4 requires management of documents and record and criterion 6 requires design be done using sound engineering principles and appropriate standards and the work be verified and validated using independent individuals and groups and be completed before approval and implementation of the design. DOE O 414.1D, Chg. 1 requires nuclear safety software to be acquired, developed, and implemented using ASME NQA-1, Quality Assurance Requirements for Nuclear Facility Applications, Part I and Subpart 2.7 or other national or international consensus standards that provide an equivalent level of quality assurance requirements as NQA-1-2008. As many of the functions of CM overlap those of QA, the CM process should be referenced in the site or facility QA Program (QAP) where appropriate and the CM process should be developed consistent with the programs and expectations of the site or facility QAP. All safety management systems and programs should be designed to fit together to permit safe and efficient performance. Consistent with that goal, CM should function as an integrated process that marries seamlessly with other safety and management processes at the facility or activity, not as a separate and distinct program. In addition, the contractor shall flow down the CM process to subcontractors and

DOE-STD-1073-2016 E-2 suppliers as appropriate to the work and ensure subcontractors and suppliers are implementing it appropriately. Integrated safety management The DOE Safety Management System (SMS) or Integrated Safety Management System (ISMS) is defined in DOE O 450.2, Integrated Safety Management. Many DOE contractors are expected to use ISMS to integrate safety into all aspects of work planning and execution consistent with the hazards and complexity of the facilities and work performed. As stated in the previous section on QA, all safety management systems and programs should be designed to fit together to permit safe and efficient performance. In addition, the contractor shall flow down the CM process to subcontractors and suppliers as appropriate to the work and ensure subcontractors and suppliers are implementing it appropriately. Safety-in-design for HC 1, 2, and 3 nuclear facilities DOE-STD-1189-2016, Integration of Safety into the Design Process, recognizes the need for a robust CM process to control the design and safety analyses for HC 1, 2, and 3 nuclear facilities during the design and construction phases. DOE-STD-1189 describes configuration management provisions for the conceptual design stage, the preliminary design phase, and the final design stage. It also discusses the need to have the design outputs controlled under a configuration management process. Capital assets • The Contractor Requirements Document in DOE O 413.3B, Chg. 2, Program and Project Management for the Acquisition of Capital Assets, states for project management systems for acquisition of capital assets: A configuration management process must be established that controls changes to the physical configuration of project facilities, structures, systems and components in compliance with ANSI/EIA-649A and DOE- STD-1073-2003. This process must also ensure that the configuration is in agreement with the performance objectives identified in the technical baseline and the approved QA plan. • DOE O 413.3B, Chg. 2 requires contractors to use ANSI/EIA-649B as well as DOE-STD-1073 for CM. Wherever the provisions of DOE O 413.3B apply, contractor, subcontractors, and DOE operators are expected to use ANSI/EIA-649B and the applicable version of this Standard. In such cases, a single CM process shall address the provisions of both standards. Software CM Specific CM is required to ensure changes do not impact the expected performance of the software. DOE O 415.1, Chg. 1, Information Technology Project Management, requires Project Management Plans for information technology projects to include a CM and change control plan. DOE-STD-1121-2008, Internal Dosimetry, states dosimetry codes should be subject to CM, including the software code being used, the records of the version of the code, the user manual, instructions for running the code, list of limitations DOE-STD-1073-2016 E-3 to the use of the code, hardware requirements, and acceptance testing records. Additional consideration for nuclear safety software is discussed in the QA section of this Appendix. Accelerator CM DOE O 420.2C requires a CM program for accelerator safety and includes an Unreviewed Safety Issues (USI) process to support configuration management efforts and to help ensure the facility and supporting safety documentation are maintained current and periodically updated. Work planning and control and maintenance

• DOE-Handbook (HDBK) -1211-2014, Activity Level Work Planning and Control Implementation, provides detailed guidance for work process and control for HC 1, 2, and 3 nuclear facilities. • DOE O 422.1 and DOE G 433.1-1A, Chg. 1 provide additional detail that compliments the work control section of this standard. In particular, DOE O 422.1 provides requirements for the control of equipment and system status and DOE G 433.1-1A, Chg. 1 provides the work control process for HC 1, 2 and 3 nuclear facilities. • DOE O 430.1C, Real Property Asset Management, requires CM for hazard category 1, 2, and 3 nuclear facilities. • DOE O 433.1B, Chg. 1 requires the Nuclear Management Maintenance Program for HC 1, 2, and 3 nuclear facilities to include a configuration management program to control approved modifications and to prevent unauthorized modifications to safety SSCs. Transition from operation to disposition phase DOE G 430.1-5, Transition Implementation Guide, encourages the use of CM and configuration control during transition from the operational to the disposition phase of a facility or activity life to ensure accurate and up-to-date drawings and procedures are used in the transition process. Nuclear explosives operations DOE O 452.2E, Nuclear Explosive Safety (and successor documents) requires organizations responsible for nuclear explosives operations (NEOs) and associated activities and facilities to develop and implement a CM program. The discussions of the various elements of CM in this Standard have been revised to note the associated additional requirements for CM of nuclear explosives safety (NES) facilities and activities in DOE O 452.2E and in NNSA SD 452.2, Nuclear Explosive Safety Evaluation Process (or successor documents). Facilities with highly hazardous chemicals The process safety management provisions of 29 C.F.R. 1910.119, Process Safety Management of Highly Hazardous Chemicals, contain requirements for management of DOE-STD-1073-2016 E-4 change for facilities and activities with highly hazardous chemicals. These requirements are invoked through reference in 10 C.F.R. Part 851, Worker Safety and Health Program. Readiness to startup or restart nuclear facilities Consistent with the objectives of CM, the startup and restart requirements in DOE O 425.1D, Chg 1 requires that for HC 1, 2, or 3 nuclear facilities there be a formal program to control facility modification and The facility systems and procedures, as affected by facility modifications, are consistent with the description of the facility, procedures, and accident analysis and assumptions included in the safety documentation. DOE-STD-1073-2016 F-1 APPENDIX F GRADING FOR CM The initial grading of SSCs and credited controls for the CM process begins with the identification of the CM SSCs and credited controls. That action separates the SSCs and credited controls that will be assessed through the CM process when changes are made from those that will not. Additional grading may be appropriate. For example, the contractors may want to apply a more stringent CM process to safety SSCs, than to costly SSCs. If so, the contractor should clearly document the different processes being used and the SSCs to which each process applies. For SSCs in more than one category (e.g., a safety SSCs that could also be a costly SSC) the requirements of the more stringent category should be applied. Grading may also provide a basis for different review and approval levels where appropriate and consistent with other requirements.

Contractors should consider that developing and implementing multiple levels of CM is not always more cost effective than developing and implementing a single, consistently- applied CM process or a process with just two or three grading levels. Consequently, contractors should use good judgment to determine what level of grading is both appropriate and cost effective. DOE generally defines graded approach as a process of ensuring the level of analysis, documentation, and actions used to comply with a requirement are commensurate with: • The relative importance to safety, safeguards, and security; • The magnitude of any hazard involved; • The life cycle stage of a facility or activity; • The programmatic mission of a facility or activity; • The particular circumstances of a facility or activity; • The relative importance of radiological and non-radiological hazards; and • Any other relative hazard. The main purpose of using a graded approach is to determine and apply a level of resources that is appropriate when implementing a program. The goal is to apply the highest level of resources to the most important equipment in the most important facilities and to avoid such expenditures where they are not warranted. For a highly hazardous facility such as a large nuclear reactor, which could potentially have serious off-site personnel safety consequences, a significant investment of resources is appropriate for the systems that prevent, detect, or mitigate such consequences. At the other extreme, for a low-hazard activity—e.g. local construction with only localized risk (i.e., offsite persons and workers at other collocated facilities are not affected), the same investment of resources may not be necessary but sufficient resources should be provided to protect the workers and nearby individuals. The grading system should take into account both facility risks and SSC importance in determining the appropriate level of resources to be applied. DOE-STD-1073-2016 F-2 In applying the graded approach to the CM process, the following factors should be considered: Relative Importance Factors Situational/Circumstantial Considerations Facility grade Facility or activity type and technical characteristics SSC grades Facility or activity remaining lifetime Facility or activity operational status and life cycle phase Programmatic and technical issues Existing programs and procedures The first column lists factors that can be used to grade based upon relative importance. That is, one item can be identified as more important than another and therefore can be assigned a higher priority. The second column lists special situations and circumstances that are independent of relative importance. Grading based on facility HC for HC 1, 2, and 3 nuclear facilities Facility hazard categorization for DOE nuclear facilities is performed using DOE-STD- 1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports. DOE-STD-1027-92 provides the process for categorizing DOE nuclear facilities into HC 1, 2, and 3 nuclear facilities where • HC-1 nuclear facilities have the potential for significant off-site consequences. • HC-2 nuclear facilities have the potential for significant on-site consequences beyond localized consequences. • HC-3 nuclear facilities have the potential for only local significant consequences.

HC 1, 2, and 3 nuclear facilities may require greater assurance of adequate design of safety SSCs because of the hazards at these sites. Contractors should develop a CM process that recognizes the need to impose greater requirements to ensure the CM for HC-1 nuclear facilities than HC-2 or 3 nuclear facilities, based upon their relative risks. Grading based on SSC importance Many QA programs also have a system for grading (e.g., quality levels) that indicate the importance of the SSCs to safety, mission, operation, or other considerations. Unless otherwise directed, contractors may grade their CM activities consistent with the QA levels. Contractors may also establish CM grading based on SSC importance which is based upon other established criteria. DOE-STD-1073-2016 F-3 Grading based on SSC importance for HC 1, 2, and 3 nuclear facilities An example of grading based on the SSC importance is the list of safety SSCs for HC 1, 2, and 3 nuclear facilities which are identified in the facility documented safety analysis. Title 10 C.F.R. Part 830, Nuclear Safety Management, defines safety SSCs which include both safety class SSCs and safety significant SSCs. Safety class SSCs are more important to safety than safety significant SSCs, and both would be considered to be more important to safety than SSCs not designated as safety SSCs. Additional information on classifying these sets of SSCs can be found in the following DOE guidance documents and standards for safety bases: • DOE G 421.1-2A, Implementation Guide for Use in Developing Documented Safety Analyses for Subpart B of 10 CFR 830 • DOE G 423.1-1A, Implementation Guide for Use in Developing Technical Safety Requirements • DOE G 424.1-1B, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements • DOE-STD-1189-2016, Integration of Safety into the Design Process • DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis Other DOE documents may be used to facilitate SSC grading and define the relative importance of SSCs based upon more specific criteria. For example, DOE-STD-1020- 2016, Natural Phenomena Hazards Analysis and Design Criteria for DOE Facilities, and ANSI/ANS-2.26-2004 (R2010), Categorization of Nuclear Facility Structures, Systems, and Components for Seismic Design, define five seismic design categories, and discuss performance goals for maintaining the integrity of SSCs against seismic and other natural phenomena hazards. Grading based on facility or activity type and technical characteristics Facility or activity types include the variety of traditional facilities (i.e., buildings), as well as different types of activities and operations. Examples of facility or activity types are: • Reactors, • Hot cells, • Waste tank farms, • Remediation activities, • Accelerators, • Laboratory facilities, • Glove box operations, • Storage vaults, • Transportation of radioactive materials, • Buried waste sites, • Temporary waste sites, • Training facilities, DOE-STD-1073-2016 F-4 • Dams and ponds, • Traditional office buildings, • Storage facilities, or • Parking garages. Each facility or activity type has typical technical and design characteristics. For example, a reactor would be required to meet design codes for high-pressure primary reactor piping systems, while standard plumbing codes would apply to an office building and standard building codes would apply to a parking garage. On the other hand, restrictions on leakage of hazardous material into the water table might be more important for a waste site.

The different provisions for each facility type should be considered to determine what types of implementation actions are technically appropriate for the facility when the CM process is fully implemented. The general process criteria should be reviewed in light of the facility type and technical characteristics to determine which CM process criteria are appropriate for the specific facility type, which criteria should be adapted, and if any criteria are not applicable. Similarly, the loss of a production or waste treatment facility might be more significant to the mission than loss of an office building from which employees may be moved to another location with minimal impact on mission. These differences will influence the importance of different SSCs, controls, and processes to safety and mission. Consequently, the facility or activity will influence the acceptable level of risk of loss and the importance and grading of the CM process. Grading based on facility or activity remaining lifetime The facility or activity remaining lifetime is the period of time that the facility is expected to continue to perform its intended functions. This consideration is pertinent if DOE has formally notified the contractor that the facility is to be operated for only a specified period, or that the facility is to be shut down at a specified date and there is no intent to resume operations. A limited remaining lifetime might impact the value of establishing a CM process requiring extensive resources for design basis reconstitution where none currently exists. The resources required by a contractor to establish the design requirements and a CM process for an existing facility can be substantial and may take considerable time. It is easy to see if a facility or activity has a remaining lifetime of twelve months and the time required to establish the CM process is eleven months, that the value added from the CM process may not be commensurate with the cost. In such cases, contractors should propose graded CM processes that provide some measure of control during the short period of operation, but do not require extensive resources. They should also establish CM processes for applicable periods of surveillance and maintenance and/or decontamination and decommissioning. It is not essential for the contractor to have exact estimates of the remaining facility lifetime to use the remaining lifetime as a grading factor. Contractors may estimate the DOE-STD-1073-2016 F-5 remaining facility lifetime only to the extent of determining which of the following categories is applicable: • More than 10 years, • Between 5 and 10 years, • Between 2 and 5 years, and • Less than 2 years. If the expected facility or activity remaining lifetime is very long (i.e., more than ten years), then the facility or activity remaining lifetime is not likely to be a factor in grading, although it should be used for decisions regarding document retention periods. A facility or activity remaining lifetime of less than ten years may impact the decisions on the effort to be used to reconstitute design requirements for an existing facility. In general, contractors should be able to develop and implement CM processes for an existing facility or activity in less than five years, but full reconstitution of the design basis can take up to 10 years for the most complex facilities or activities. For less complex facilities or activities, remaining lifetimes of five years or less may affect decisions on defining the design requirements.

For existing facilities or activities with remaining lifetimes of between 2 and 5 years, contractors should consider the level of effort to be expended in establishing the CM process. For example, CM SSCs might be defined to include only those with safety or environmental design requirements. Moreover, the searches involved in reconstituting the design might be limited to formal reviews and smart searches. Smart searches involve seeking and using those documents most likely to include the information needed. Additional information on smart searches may be found in International Atomic Energy Agency (IAEA) TECDOC-1335, Configuration Management in Nuclear Power Plants. Facilities with a remaining lifetime of less than two years typically should undertake only those CM activities important to the remaining operation or to the next phase or subsequent phases of the facility or activity lifecycle. The CM SSCs included might be limited to those related to safety. Contractors should conduct walkdowns to determine the degree of consistency between the physical configuration and associated documentation, including as-built drawings. The CM process should identify change control mechanisms. Physical changes should be reviewed, approved, and documented. Activities to reconstitute the design requirements might be limited to the formal review. Reconstitution of the design basis might not be appropriate. In all cases where limited facility lifetime is a factor in the grading of the CM process, the subsequent lifecycle phases should be considered. For example, while a contractor may discontinue the shipment of new waste to a tank farm, it should control the existing configuration to ensure the wastes are properly controlled. Another example is a processing facility that is deactivated and, many years later decontaminated and decommissioned. Even though the facility will only be operated for two more years, a DOE-STD-1073-2016 F-6 process for CM will need to be implemented to support the periods of deactivation and decontamination. The CM process for the remaining operating period should be established with consideration of the needs of the later phases of activity (deactivation and decontamination). Caution should be taken in the process of estimating remaining lifetime of a facility or activity as some DOE facilities and activities have been notified of very limited remaining lifetimes but have been required to operate for considerably longer than the originally estimated time because of limited funding for replacement facilities or activities or other considerations. Although difficult to foresee, such possibilities should also be considered in the planning and additional attention to CM practices would be expected. Finally, many activities at DOE are planned and pursued over short time frames from a couple of years to a few weeks. While the limited duration of the activity should be considered in establishing a CM process, the short duration of these activities should not be used as a basis for not managing the configuration. In some cases, a single facility will be used for changing missions. In such cases, contractors may be able to establish a CM process that envelopes expected operations or is modified with changing missions. Because it is easier to establish and implement a CM process for a new facility or activity, facility or activity remaining lifetime will be a less significant factor in grading the CM process for a new facility or activity.

Grading based on facility operational status and lifecycle phase The facility or activity operating status and life-cycle stage indicate the amount of emphasis and rigor that is appropriate for the CM process. Life-cycle phases of a facility or activity generally include: • Determination of need, • Planning, • Design, • Construction, • Operation and maintenance, • Deactivation, • Surveillance and maintenance • Decontamination, • Decommissioning, and • Disposal. During the early part of the design phase, designers may need to make rapid changes unhampered by complex configuration control, but as the design interfaces are established, design requirements should be documented and controlled to ensure systems will function properly and construction can proceed. However, in order to preserve currently approved design and safety documents, changes that potentially impact these DOE-STD-1073-2016 F-7 documents during the design and construction phases should be reviewed under the change control process. During construction, which will likely overlap the final design phase, configuration changes should be controlled and documented, but the contractor will continue to need a CM process that responds rapidly and provides timely resolutions to keep construction on schedule. The operational status consideration generally does not affect the grading of the CM process if the facility or activity is currently operating (including periodic shutdowns for maintenance and other conditions). However, during a major modification to an existing facility or activity, contractors will need the CM process to be as responsive as when a facility or activity is in the construction phase. In particular, the contractor should be vigilant that the changes in one part of the facility or activity that affect another part of the facility or activity are properly evaluated, approved, and documented. In addition, if part of the facility is operating during the modification, some of the configuration considerations of an operating facility will remain in effect. The phase of the facility life cycle during the modification will determine the relative importance of, and thus the degree of emphasis on: • Design basis, • Design requirements, • Current as-built configuration information, • System acceptance and preoperational testing, • Design control programs, • Periodic operability surveillance programs, • Document control programs, • Facility life extension efforts, and • Decommissioning plans. If a facility or activity is deactivated or being decontaminated or decommissioned, there are different considerations than during the operating phase. For example, during a maintenance shutdown at an operating facility, a pump with a safety function may be disassembled or removed. Before operation, that pump would need to be restored or replaced with a pump that meets the existing or new design requirements. In addition, performance testing would likely be needed. These changes and tests would need to be processed through the CM process. On the other hand, if the same facility is deactivated two years later with no intention of resuming operation, then the pump may no longer have a safety function. If the pump with no safety function is removed and it is no longer needed, CM for that action may be reduced to a simple documentation of removal of the pump.

Contractors for facilities or activities in deactivation status that may be returned to an operating status later should implement a CM process that maintains the design requirements for the facility or activity and accurately documents the configuration of the facility or activity. Accurate documentation will facilitate the later reactivation of the DOE-STD-1073-2016 F-8 facility or activity. In addition, the contractors should take actions through the maintenance process to ensure the physical configuration does not degrade and changes are identified and approved. If during the deactivation period the scope of CM SSCs and credited controls was reduced to only include the SSCs and credited controls related to personnel safety during deactivation, contractors should re-establish the design requirements of the balance of the CM SSCs and credited controls for operation if the facility or activity is to be reactivated. Contractors should also perform walkdowns to determine the degree of correlation between the physical configuration and associated documentation, as well as to determine the current condition of the facility or activity. Physical changes would need to be reviewed, approved, and documented. Consequently, it might be more cost effective to maintain some level of CM during deactivation if there is a possibility of reactivation later. In some cases, it will be more cost effective to maintain robust CM and maintenance processes. In other cases, (e.g., long deactivation periods with a low probability of reactivation) it may be more cost effective to reduce the CM process to address only those SSCs, controls, and work activities important to safety during the deactivation period. Prior to reactivation of a deactivated facility or activity, the contractor should ensure the configuration has been restored and a CM process appropriate for operation is implemented. During decontamination, the facility or activity may have fewer active safety systems from the original design, however, there may be more workers and those workers may be closer to the hazards (e.g., contamination or fuels being removed, open pipes, asbestos, steam) than they typically would during operation. Additional safety precautions should be added to the decontamination activity (e.g., contamination huts, enhanced monitoring of hazardous materials and/or radiation, new procedures). Prior to decontamination, contractors should update their CM SSCs and credited controls to include new SSCs and credited controls as appropriate. Contractors should also review the CM SSC list and delete SSCs, controls and work activities that no longer are needed to meet safety or mission functions or other considerations as appropriate. In addition, as SSCs and credited controls are removed from the facility or activity and from active status, the contractor should remove them from the list of CM SSCs and credited controls as appropriate. Grading based on programmatic and technical issues The resolution of a programmatic or technical issue can change the importance of a structure, system, or component. For example, a component may be moved from the list of non-safety components to the list of safety components or a system may be determined to be a hazard control. When such changes occur, contractors should review their impact on the list of CM SSCs and credited controls and revise it accordingly. DOE-STD-1073-2016 F-9 Issues likely to trigger programmatic or technical changes include:

• Safety evaluations, • Probabilistic risk assessments, • Human factors engineering, • Operating and emergency procedures development and planning, • Operator training, • Seismic qualification, • Fire protection, • Safe shutdown, • Equipment qualification, • Changes in missions, and • New requirements and/or safety considerations. Grading based on existing programs and procedures In implementing a CM process, contractors should: • Take credit for existing programs and procedures where appropriate, • Modify existing programs and procedures where necessary, and • Limit the development of new activities to those that are needed. Contractors with existing processes that satisfy the CM criteria should continue to use those processes, modifying them only as necessary. This Standard should not be used to justify repackaging existing processes that are already adequate. For example, if a facility has an adequate document control process, there would be little benefit in requiring that facility to repackage the process for the sole purpose of matching the format or terminology in this Standard. Improvements can be made to existing processes to ensure they address the criteria in this Standard, rather than complete revisions to existing processes. Contractors who have questions regarding changes that may be necessary to comply with this Standard are urged to consult with their DOE line organizations prior to expending significant budget. CM activities may already be present in a variety of processes at a facility or activity. Some areas where contractors may find elements of CM include: • DSA, TSR, accelerator safety envelope (ASE), SAD, or HAR upgrades, • Design control, • QA, • Document control and records management, • Procedure change control, • Temporary modification control, • Maintenance management, • Facility status and operational configuration control, • Procurement procedures, • Project management documents, and DOE-STD-1073-2016 F-10 • Lockout and tagout procedures. Some of these interfacing programs input information important to the CM process, some perform functions necessary to ensure CM, and others require CM to ensure valid information is used. DOE-STD-1073-2016 G-1 APPENDIX G DOCUMENT REVIEWS FOR FACILITIES AND ACTIVITIES SUBJECT TO DOE-STD-1189 DOE-STD-1189-2016, Integration of Safety into the Design Process, identifies a number of design and safety documents that are to be developed at specified phases of design and construction. Many of these are submitted to DOE for review and/or approval. In order to preserve the integrity of these documents and to maintain configuration management as design and construction progress, the configuration management plan and processes for facilities and activities subject to the requirements of DOE-STD-1189 shall identify which of these documents shall be controlled and at what time during the project that control of these documents will be established. Changes to the facility or activity that potentially impact these documents shall be reviewed for potential impacts to these approved design and safety documents as part of the change control and document control aspects of the CM process. If the change is approved, the implementation package shall include requirements to update the affected documents and submit them for review and approval at the same level as the original document on a schedule either identified in the CM process or in contractual documents. The Integrated Project Team and the Safety Design Integration Team should be included in the review of changes to these documents.

The following documents should be considered for inclusion in the CM process during design and construction: • Baseline requirements, • Project Execution Plan (PEP), • Safety Design Strategy (SDS), • Quality Assurance Program (QAP), • Preliminary Hazards Analysis (PHA) and Hazards Analysis, • Project Fire Hazards Analysis (PFHA), • Safety-in-Design Risk and Opportunities Analysis, • Integrated Safety Management (ISM) Plan, • Code of Record, • Preliminary Documented Safety Analysis (PDSA), • Nuclear safety Software list, • Criticality Safety Evaluation, • ALARA Design Considerations, and • Natural Phenomena Hazards design. • Conceptual Safety Design Report • Long Lead Procurement Specifications DOE-STD-1073-2016 H-1 APPENDIX H REGENERATION/RECOVERY/DOCUMENTATION OF REQUIREMENTS, BASES, AND ENGINEERING INFORMATION For new construction, i.e., new facilities and major modifications to existing facilities, the design requirements will generally be identified and documented as part of the design process.8 The design requirements define the facility or activity physical configuration and the functions of its parts. However, for existing facilities that may lack thorough documentation of the design basis, the requirements for previously installed SSCs or credited controls may not be documented or available. In these cases, it may not make sense from a cost perspective to immediately reconstruct the design requirements; although the contractor should document the new or revised design requirements as maintenance and modifications are performed at the facility or activity. In any event, the contractor shall ensure that the SSCs and credited controls can perform the safety functions assumed in the design documents and safety analyses (e.g., DSA, SAD, or HAR). If additional information is needed to establish the design requirements or to ensure that a CM SSC or credited control is capable of performing its assumed safety function, this documentation can be obtained by regenerating the information or interviewing technical experts who are knowledgeable about the particular equipment or situation. Maximum advantage should be taken of pertinent existing safety analyses and design information (i.e., requirements and their bases) that are immediately available or can be retrieved through reasonable efforts. Missing information can often be found through the identification and evaluation of existing engineering documents (e.g., drawings, calculations, analyses, and documented justification to support engineering judgments). As a part of the evaluation effort described above, selected design material may need to be reverified for accuracy and applicability. The need for reverification should be reserved for those design documents for which the accuracy of the original calculations/analyses is uncertain. Reverification also addresses the degree of as-built variance from the current design requirements and should include techniques for physical verification such as system walkdowns. Once the baseline design requirements are established for the facility or activity, a rigorous program of change control and document control shall be initiated to maintain the accuracy of the information. Failure to install rigorous programs of change control and document control following the establishment or verification of design requirements could result in the need for expensive, repeated efforts to reverify the information later.

8 For new hazard category 1, 2, and 3 nuclear facilities and major modifications thereto, DOE O 420.1C, Facility Safety, requires design requirements to be documented as part of the design process. DOE-STD-1073-2016 H-2 Methods that have proven successful for reestablishing missing requirements information include: • Performing reanalysis. This approach is basically equivalent to redesign. It applies the design process to determine design requirements. Although it is the most technically acceptable method for regenerating missing requirements, this approach is typically the most expensive. This approach should be used only for the most important missing design requirements. • Gathering and documenting information from the experience of knowledgeable engineering and operations personnel. Their memory is a valuable (and frequently undocumented) source of information, and that information could be lost through attrition, transfers, retirement and death. Following recognition of the need to identify design information, contractors should promptly initiate this activity to prevent any further loss of knowledge. • Repeating the original design process to decide which design outputs or portions of the equipment specifications are essential and which are optional. This approach is a combination of the first two approaches. While it may not go as far as reanalysis, it does carefully consider the likely design inputs, constraints, analysis and calculations, and outputs. After reanalysis, this is the most technically acceptable method. • Testing equipment to determine its current functionality and accepting the results as design requirements after a technical evaluation by the engineering organization. In some cases, testing might be the only practical method for showing that system performance remains adequate. When selecting the approach to be used, the contractor should consider: • What information is already available; • The importance of the systems and components; • Feasibility; and • Resources. A combination of methods is often the most cost-effective approach. Throughout design requirements regeneration, the design basis resulting from the regeneration efforts should be documented. The regenerated requirements should be incorporated into the configuration management process. The Code of Record should be updated consistent with the updated requirements. Additional guidance on design basis reconstitution for a nuclear facility can be found in IAEA-TECDOC-1335, Configuration Management in Nuclear Power Plants, and IAEA- TECDOC-1651, Information Technology for Nuclear Power Plant Configuration Management. DOE-STD-1073-2016 I-1 APPENDIX I EXAMPLE CHANGE REQUEST Change Request 1. Identification Number: __________________________________________________________ 2. Title: _________________________________________________________________________ 3. Classification: [ ] Safety SSC [ ] Defense-in-Depth [ ] Environmental [ ] Mission Critical [ ] High Cost Potential [ ] Critical Software [ ] Collocated SSC [ ] Credited control [ ] other __________ 4. Contacts Nam e Organizatio n Phone Numbe r Email Addres s SPONSOR (WORK ORIGINATOR/REQUESTER/FUNDE R): Design Engineer: Design Authority: Cognizant System Engineer(s) or technical engineer identified in CM process: Quality Assurance Environment, safety, and health (ES&H) 5. Description of Proposed Change (sufficient to support technical and management reviews – add

pages if needed): ______________________________________________________________________________ _________________________________________________________________ _________________________________________________________________ 6. Description of the potentially affected SSCs and/or credited controls: ___________________ _______________________________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________ 7. Reason for the proposed change: __________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________ 8. Schedule considerations (any schedule constraints, such as maintenance outages when work is to be performed or date by which work needs to be completed to support mission):_______________ _______________________________________________________________________________ 9. Alternative solutions considered: __________________________________________________ DOE-STD-1073-2016 I-2 10. Constraints: __________________________________________________________________ 11. Any other information needed to review, track, or process the proposed change: _____________________________________________________________________________ Approved for Change Control Review: [ ] yes [ ] no __________________________________ Signature & date of approval authority DOE-STD-1073-2016 J-1 APPENDIX J EXAMPLE CHANGE CONTROL PACKAGE This Appendix contains sample formats for change control packages and change travelers. The first, entitled, Example Change Control Package, illustrates the types of information typically contained on a change traveler, the steps normally taken in the change control process, and the formality of the process and is based on expected contents of a change control package to meet Section 4 of this Standard. Contractors are not required to use the example change control packages, nor are they required to meet any of the statements in the examples. Contractors should not assume that by using these examples they are assured that the change control process is complete. In addition, these examples may not contain all of the steps necessary to meet the change control process at some sites or facilities. Consequently, contractors should adapt these or similar documents to be applicable to their facility or activity and incorporate them in their configuration management processes. DOE-STD-1073-2016 J-2 Example Change Control Package 1. Identification Number (from Change Request): ______________________________________ 2. Title: _________________________________________________________________________ 3. Classification: [ ] Safety SSC [ ] Defense-in-Depth [ ] MEL [ ] Environmental [ ] Mission Critical [ ] Costly [ ] Critical Software [ ] Collocated SSC 4. Contacts and Authorities: Nam e Organizatio n Phone Numbe r Email addres s SPONSOR (WORK ORIGINATOR/REQUESTER/FUNDER ): Design Engineer: Cognizant System Engineer(s) (if applicable): Technical Review Lead: Management Review Lead: Independent Design Reviewer: Approval Authority: Individual responsible for implementation of the approved change:

Individual responsible to approve final completion of change: 5. Description of Proposed Change (sufficient to support technical and management reviews): _______________________________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________ 6. Location: (Site/Area/Building/Room): ______________________________________________ 7. Change Request Form is complete, verified accurate, and attached? [ ] 8. Deviations from current design requirements: ______________________________________ Technical Review 9. Identify technical review team members and their organizations, applicable experience and knowledge. (attach sheet) DOE-STD-1073-2016 J-3 10. Affected SSCs or credited controls (List the