DOE-STD-1073-93 Part I, Guide for Operational Configuration Management Program

NOT MEASUREMENT SENSITIVE DOE–STD–1073–93–Pt.1 November 1993 DOE STANDARD GUIDE FOR OPERATIONAL CONFIGURATION MANAGEMENT PROGRAM Including the Adjunct Programs of Design Reconstitution and Material Condition and Aging Management PART I U.S. Department of Energy AREA CMAN Washington, D.C. 20585 DISTRIBUTION STATEMENT A: Approved for public release; distribution Is unlimited. This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (615) 576-8401. Available to the public from the National Technical Information Service, U.S. Department of Commerce, 5285 Port Royal Rd., Springfield, VA 22161. Order No. DE94005407 i FOREWORD This DOE Standard provides guidance to DOE personnel and contractors on the development and implementation of an operational Configuration Management (CM) program, including its two adjunct programs, the Design Reconstitution program and the Material Condition and Aging Management program. This Standard is intended to serve as guidance only and does not impose new requirements. This guidance is based on principles successfully implemented at commercial nuclear plants and on related experiences at DOE-owned facilities. This Standard is applicable to DOE nuclear facilities in the operational phase. Although it was developed for application to DOE nuclear facilities, the concepts in this Standard can be adapted and applied to DOE non-nuclear facilities. Portions of this Standard are useful for other DOE processes, activities, and programs. The intent in using this Standard for other applications is to prevent proliferation of additional and inconsistent guidance throughout the DOE complex. This guidance presents established practices and implementation methods that reflect technically appropriate and feasible approaches. This guidance was written to address weaknesses known to exist at DOE nuclear facilities, as confirmed by occurrence reports, Tiger Team assessments, and other external reviews. This guidance was developed based on: review of configuration management guidance from various industries; interviews with licensed commercial nuclear utilities and DOE contractors; review of nuclear utility configuration management practices; and consideration of configuration management experience at DOE facilities. The CM program described in this Standard addresses the needs of an ongoing operation rather than the design and construction of a finite project, and includes activities for reestablishing control of configuration. Based on this guidance, contractors should evaluate the CM measures needed to adequately maintain the facility and the actions needed to augment the existing controls related to configuration management. Part I of this Standard describes the program principles, including the objective, functional model, program criteria, and graded approach. Part II of this Standard provides detailed guidance on the development and implementation of an operational CM program, the Design Reconstitution adjunct program, and the Material Condition and Aging Management adjunct program. For information regarding the technical content, please contact: M.J. Campagnone U.S. Department of Energy Office of Environment, Safety and Health (EH-63/GTN) 1000 Independence Avenue, S.W. Washington, D.C. 20585 301-903-7053 iii CONTENTS

FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i GLOSSARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix ACRONYMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv BIBLIOGRAPHY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii PART I CHAPTER 1 OPERATIONAL CONFIGURATION MANAGEMENT PROGRAM PRINCIPLES 1.1 Program Objective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–1 1.2 Functional Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–3 1.3 Program Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–4 1.3.1 Program Management Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–4 1.3.2 Design Requirements Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–7 1.3.3 Document Control Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–8 1.3.4 Change Control Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–9 1.3.5 Assessments Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–10 1.3.6 Design Reconstitution Adjunct Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–11 1.3.7 Material Condition and Aging Management Adjunct Program . . . . . . . . . . . . . . I–13 1.4 Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–15 1.4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–15 1.4.2 General Process for Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–15 1.4.3 General Application of Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–24 Appendix I–A CM Program Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–A–1 Appendix I–B Background Material and Conceptsfor Operational Configuration Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–B–1 PART II CHAPTER 2 IMPLEMENTATION GUIDANCE FOR OPERATIONAL CONFIGURATION MANAGEMENT 2.1 Program Management Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–1 2.1.1 Program Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–1 2.1.2 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–8 2.1.3 Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–9 2.1.4 Configuration Management Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–11 2.1.5 Specific Application of Graded Approach: Program Management Element . . . . . . . . . . II–15

2.2 Design Requirements Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–15 2.2.1 Establishment of Design Requirements and Design Basis . . . . . . . . . . . . . . . . . . . . . . . . II–17 2.2.2 Assignment of SSC Grades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–24 2.2.3 Fully Developed Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–29 2.2.4 Specific Application of Graded Approach: Design Requirements Element . . . . . . . . . . . II–29 2.3 Document Control Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–29 2.3.1 Initial Development Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–29 2.3.2 Fully Developed Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–34 iv 2.3.3 Specific Application of Graded Approach: Document Control Element . . . . . . . . . . . . . . II–38 2.4 Change Control Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–39 2.4.1 Initial Development Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–39 2.4.2 Fully Developed Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–43 2.4.3 Specific Application of Graded Approach: Change Control Element . . . . . . . . . . . . . . . II–48 2.5 Assessments Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–48 2.5.1 Initial Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–48 2.5.2 Post-Implementation Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–54 2.5.3 Ongoing Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–55 2.5.4 Specific Application of Graded Approach: Assessments Element . . . . . . . . . . . . . . . . . II–59 CHAPTER 3 IMPLEMENTATION GUIDANCE FOR DESIGN RECONSTITUTION 3.1 Program Plans and Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–61 3.1.1 Design Reconstitution Program Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–61 3.1.2 Design Reconstitution Action Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–65 3.1.3 Design Reconstitution Program Governing and Implementing Procedures . . . . . . . . . . II–65 3.2 Identification and Retrieval of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–66 3.2.1 Identification and Retrieval of Source Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–67 3.2.2 Extraction of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–70

3.3 Evaluation, Verification, and Validation of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . II–70 3.3.1 Verification of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–71 3.3.2 Technical Validation of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–71 3.3.3 Release of Verified and Validated Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . II–71 3.3.4 Correlation of Design Basis to Design Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–73 3.3.5 Technical Management Review of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . II–73 3.4 Resolution of Discrepancies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–74 3.5 Regeneration of Missing Critical Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–76 3.5.1 Regeneration of Design Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–76 3.5.2 Regeneration of Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–78 3.6 Preparation and Issuance of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . . II–78 3.6.1 Pilot Design Information Summary Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–78 3.6.2 Design Information Summary Format and Content Guide . . . . . . . . . . . . . . . . . . . . . . . . II–78 3.6.3 Design Information Summary Layout Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–79 3.6.4 Design Information Summary Users' Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–80 3.6.5 Final Verification of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–80 3.6.6 Issuance of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–80 3.6.7 Field Validation of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–80 3.6.8 Maintenance and Control of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . II–81 3.7 Specific Application of Graded Approach: Design Reconstitution . . . . . . . . . . . . . . . . . . . . . . . . II–82 CHAPTER 4 IMPLEMENTATION GUIDANCE FORMATERIAL CONDITION AND AGING MANAGEMENT 4.1 Preliminary MCA Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–85 4.1.1 Component Screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–85 4.1.2 Aging Degradation Mechanism Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–87 4.1.3 Estimation of Facility Remaining Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–87 4.1.4 Feasibility of Continued Operations and Extended Operations . . . . . . . . . . . . . . . . . . . . . II–87 4.1.5 MCA Program Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–88 4.2 Detailed MCA Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–88

v 4.2.1 MCA Action Plan and Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–88 4.2.2 Final Identification of Life-Limiting Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–89 4.2.3 Detailed Aging Degradation Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–91 4.2.4 Determination of Facility Remaining Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–95 4.2.5 Feasibility of Continued Operations and Extended Operations . . . . . . . . . . . . . . . . . . . . . II–98 4.3 Life Extension Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–99 4.4 Ongoing MCA Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–99 4.4.1 Degradation Trending . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–100 4.4.2 Application of Life Extension Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–101 4.5 Specific Application of Graded Approach: MCA Adjunct Program . . . . . . . . . . . . . . . . . . . . . . . II–101 Appendix lI–A Design Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–A–1 Appendix II–B Examples of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–B–1 Appendix II–C Conduct of Walkdowns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–1 Appendix II–D Content of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–D–1 vii FIGURES CHAPTER 1 Figure 1–1 Operational Configuration Management: Basic Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–2 Figure 1–2 Operational Configuration Management Program: Elements and Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–5 Figure 1–3 Operational Configuration Management: Implementation Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–17 Figure I–A–1 Relationship of a DOE CM Program to the Life of a Facility . . . . . . . . . . . . . . . . . . . . . I–A–5 Figure I–B–1 Design Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–B–4 Figure I–B–2 Assessments Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–B–14 Figure I–B–3 Remaining Lifetime and Desired Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–B–18 CHAPTER 2 Figure 2–1 Program Management Element: Overall CM Program Development andImplementation . . . . . . . . . . . . . . . . . . . . . . . II–2 Figure 2–2 Program Management Element: Management Actions for Program Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–3 Figure 2–3 Program Management Element: Directives, Plans, and Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–13 Figure 2–4 Design Requirements Element: Top-Level Development Flowchart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–16

Figure 2–5 Establishment of Design Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–18 Figure 2–6 Design Requirements Element: CM Equipment Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–23 Figure 2–7 Design Requirements Element: Assignment of System-Level Grades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–25 Figure 2–8 Design Requirements Program: Assignment of Component-Level Grades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–27 Figure 2–9 Interfaces with the Fully Developed Design Requirements Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–30 Figure 2–10 Document Control Element: Top-Level Development Flowchart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–31 Figure 2–11 Document Control Program: Document Control Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–33 Figure 2–12 Document Control Program: Document Control and Tracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–36 Figure 2–13 Change Control Program: Top-Level Development Flowchart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–40 Figure 2–14 Change Control Program: Change Control Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–41 Figure 2–15 Change Control Program: Design Envelope Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–44 Figure 2–16 Assessments Program: Vertical Slice Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–49 Figure 2–17 Assessments Program: Horizontal Slice Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–51 Figure 2–18 Comparative Procedures Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–53 viii CHAPTER 3 Figure 3–1 Design Reconstitution Program: Implementation Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–62 Figure 3–2 Design Reconstitution Program: Sample Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–64 Figure 3–3 Design Reconstitution Program: Design Information Identif ication and Retrieval . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–68 Figure 3–4 Design Reconstitution Program: Evaluation of Extracted Design lnformation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–72 Figure 3–5 Design Reconstitution Program: Discrepancy Resolution Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–75 CHAPTER 4 Figure 4–1 MCA Implementation Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–86 Figure 4–2 Final Identification of Life-Limiting Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–90 Figure 4–3 Detailed Aging Degradation Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–93 Figure 4–4 Identification of Aging Degradation Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–94 Figure 4–5 Identification of Material Condition Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–96 Figure 4–6 Final Determination of Facility Remaining Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–97

ix GLOSSARY Aging. The general process in which characteristics of structures, systems, and components gradually change with time or use. Aging Degradation. Aging effects that could impair the ability of structures, systems, and components to meet their design requirements. Aging Effects. Net changes in characteristics of structures, systems, and components that occur with time or use and are due to aging mechanisms. Aging Mechanism. The specific process that gradually changes characteristics of structures, systems, and components with time or use. As-Built. Documentation (for example, Piping and Instrument Diagrams, and database records) verified by physical inspection as depicting the actual physical configuration and verified as consistent with the design requirements. As-Building Process. The process of determining the as-found condition, resolving discrepancies, obtaining approval from the design authority, and producing the as-built documentation. As-Found. Information, often in the form of marked-up documents, that reflects the actual physical configuration and identifies any discrepancies with currently-approved facility documentation. Assessment. For engineering applications, the process of estimating the value of something using authoritative expert judgement based upon observations of representative cases and rough calculations, rather than determining the exact value based upon comprehensive and detailed examinations, and precise and rigorous complete calculations. Assessment Element. A CM program element that encompasses the following functions: conducting programmatic assessments; conducting physical configuration assessments; performing periodic equipment performance monitoring; and performing post-modification testing. Authorization Basis. Those aspects of the facility design basis relied on by DOE to authorize operation. These aspects are considered to be important to the safety of facility operations. The authorization basis is described in documents such as the facility Safety Analysis Report and other safety analyses, hazard classification documents, the Technical Safety Requirements, DOE-issued safety evaluation reports, and facility-specific commitments made in order to satisfy DOE Orders or policies. The authorization basis is an important subset of the design basis. Change. Any alteration or addition, temporary or permanent, to the facility physical configuration, facility documentation, or design requirements. Changes not within current design requirements involve design changes. Identical replacements are not changes. Change Control. A process that ensures all changes are properly identified, reviewed, approved, implemented, tested, and documented. Change Control Element. A CM program element that encompasses the following functions: identifying changes, performing technical review of changes, performing management review of changes, implementing changes, and documenting changes. Comprehensive Search. A process through which a broad spectrum of documents that may contain design information are identified, retrieved, and evaluated. Key steps involve locating and screening documents that may contain design information and reviewing them to extract design information. x

Configuration Management. An integrated management program that establishes consistency among design requirements, physical configuration, and facility documentation, and maintains this consistency throughout the life of the facility as changes occur. The CM program consists of CM functions associated with the following program elements: program management, design requirements, document control, change control, and assessments. The CM program also includes design reconstitution and material condition and aging management as adjunct programs. Design Authority. The organization responsible for establishing the design requirements and ensuring that design output documents appropriately and accurately reflect the design basis. The design authority is responsible for design control and ultimate technical adequacy of the engineering design process. These responsibilities are applicable whether the process is conducted fully in-house, partially contracted to outside organizations, or fully contracted to outside organizations. Design Basis. Design basis consists of the design inputs, the design constraints, and the design analysis and calculations. It includes topical areas such as seismic qualification, fire protection, and safe shutdown. The design basis encompasses consideration of such factors as facility availability, facility efficiency, costs, and maintainability, and that subset that relates to safety and the authorization basis. The design basis explains why a design requirement has been specified in a particular manner or as a particular value. Design Documents. Those documents that define either the design requirements or the design basis of the facility. Design documents include design specifications, design change packages, design drawings, design analysis, setpoint calculations, summary design documents, correspondence with DOE that provides design commitments, and other documents that define the facility design. Design Information. The combination of design requirements and design basis information associated with the design process, consisting of design inputs, design constraints, design analysis and calculations, and design outputs. Design Information Summary. A summary design document, organized by system or topical area, that provides both the associated design requirements and their design basis. Design Reconstitution. An adjunct program to the CM program that accomplishes the one-time effort of identifying, retrieving, extracting, evaluating, verifying, validating, and regenerating missing critical design requirements and basis. Design reconstitution encompasses the following functions: developing associated program plans and procedures; identifying and retrieving design information from identified source documents; evaluating, verifying, and validating the design information; resolving discrepancies; regenerating missing critical design information; and preparing and issuing Design Information Summaries. Design Requirements. Those engineering requirements reflected in design output documents (such as drawings and specifications) that define the functions, capabilities, capacities, physical sizes and dimensions, limits and setpoints, etc. specified by design engineering for a structure, system, and component. The design requirements provide the results of the design process.

Design Requirements Element. A CM program element that encompasses the following functions: establishing and maintaining the facility design requirements, establishing system and process boundaries , assigning structures, systems, and components (SSCs) grades based on the associated design requirements, identifying the specific list of SSCs for inclusion in the CM program, and establishing and maintaining the design basis for the design requirements. Discrepancy. Those open items that are determined to have safety significance. xi Document. Recorded information that describes, specifies, reports, certifies, requires, or provides data or results. For the purposes of the CM program, this includes paper copies (procedures, manuals, records, etc.),electronic media (such as word processor files and computer databases), and any other source(s) of information used to design or operate the facility or make sound technical decisions. It includes both current or working documents and historical records. See also "Facility Documents" and "Design Documents." Document Control. A process that identifies, stores and controls, tracks status (especially during revisions), and retrieves documents. Document Control Element. A CM program element that encompasses the following functions: identifying the types of documents and specific documents to be included within the CM program, storing these documents, controlling and tracking these documents and changes thereto, and retrieving these documents in a timely manner. Environmental Design Requirements. In the context of the CM program, those design requirements that are necessary to protect the environment. and to satisfy environmental requirements and permits, as well as other related DOE requirements. Equipment Failure. A condition in which equipment can no longer perform its design requirements. Failure may be random or the result of progressive aging degradation. Facility Desired Lifetime. The period of time specific led by the DOE as necessary for the facility to remain operational in order to carry out the mission of the facility. The desired lifetime could be shorter than, approximately the same as, or longer than the remaining lifetime based upon current material conditions. Facility Documents. Those documents that support facility operations, such as-built configuration information (such as drawings, valve lists, etc.), the facility procedures for activities (such as operations, maintenance, and testing), and facility operational records (such as completed tests, work requests, and radiation survey maps). Facility Grade. A measure of the importance of the facility, among other DOE facilities, that can be used to determine the appropriate level of effort and resources for the implementation. Facility Operational Status. One of several operational modes, including: operating (actual operations and shutdown periods for maintenance and/or refueling), stand-by, or preparing for restart. A facility might be operational but in stand-by and maintaining the capability to restart at a future time yet to be determined by DOE. Facility Life Cycle Phases. The set of different phases in the life cycle of a facility, including: the design phase, the construction phase, the operational phase, and the shutdown/decommissioning phase. A major renovation or redesign phase is included in some cases when the DOE programmatic mission for a facility may shift and significant facility changes might be involved.

Facility Remaining Lifetime. The remaining period during which the facility is expected to perform its intended functions (i.e., continue to meet its design requirements) under specified service conditions, based upon the current material conditions without applying life extension techniques. Facility Type and Technical Characteristics. Those considerations related to the particular technical nature of the facility and its design and operating characteristics. These include the facility process and functions, operating conditions, and the nature of hazards involved. xii Field Validation. For the design reconstitution program, the process of providing reasonable assurance that design requirements are properly reflected in the physical configuration and in the associated facility documentation. Field validation tests the strength of the basic CM relationships among the design requirements, physical configuration, and facility documentation. Formal Review. A process through which design information is identified and retrieved from on-hand, top-level, summary-type design documents such as the Safety Analysis Reports, Technical Safety Requirements, and System Design Descriptions. Graded Approach. A process by which the level of analysis, documentation, and actions necessary to comply with a requirement are made commensurate with a number of considerations, including the relative importance to safety, safeguards, and security; the magnitude of any hazard involved; the life cycle stage of a facility; the programmatic mission of a facility; the particular characteristics of a facility; and any other relevant factor. Horizontal Slice Assessment. An evaluation conducted on a program-by-program basis, such as change control or document control, across various facility systems to determine the effectiveness of the program or procedure. It compares existing program implementation against evaluation criteria, performs an effectiveness review through field evaluations, identifies program strengths and weaknesses, and develops recommendations for program improvement. Life Extension. Actions specifically designed to reduce aging stresses or reduce the effects of aging stresses for facility potentially life-limiting components, as might be necessary to achieve the desired lifetime. Lite-Limiting Component. A structure, system, and component whose failure could result in termination of facility operations. Material Condition & Aging Management. An adjunct program to the CM program that encompasses the functions of: developing associated program plans and procedures; screening components to determine those that are potentially life-limiting for the facility; evaluating, aging degradation mechanisms; estimating the facility remaining lifetime; evaluating feasibility of continued operations and extended operations; performing detailed material condition and aging analysis; and developing necessary life extension techniques to achieve the facility desired lifetime defined by DOE. Mission Design Requirements. Those design requirements that are necessary to prevent or mitigate substantial interruptions of facility operation or severe cost impacts or are necessary to satisfy other DOE mission considerations. Monitoring. Continuous or periodic observation or measurement to verify that the performance or physical characteristics of a structure, system, or component conform to acceptance criteria.

Non-reactor Nuclear Facility. Those activities or operations that involve radioactive and/or fissionable materials in such form and quantity that a nuclear hazard potentially exists to the employees or the general public. Included are activities or operations that: (1) Produce, process, or store radioactive liquid or solid waste, fissionable materials, or tritium; (2) Conduct separations operations; (3) Conduct irradiated materials inspection, fuel fabrication, decontamination, or recovery operations; (4) Conduct fuel enrichment operations; or (5) Perform environmental remediation or waste management activities involving radioactive materials. Incidental use and generating of radioactive materials in a facility operation (e.g., check and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and X-ray machines) would not ordinarily require the facility to be included in this definition. Accelerators and reactors and their operations are not included. The application of any rule to a non-reactor nuclear facility shall be applied using a graded approach. xiii Nuclear Facility. Reactor and non-reactor nuclear facilities. (For guidance on hazard categories for nuclear facilities please see DOE-STD-1027-93.) Open Item. A validated situation involving: apparent contradictions from different source documents; concerns; unanswered technical questions; or cases of missing, undocumented, or inaccurate information. Phased Implementation. Involves establishing priorities, milestones with deliverable products, and implementation schedules within the context of the amount of resources and funding that can reasonably be expected to be available. Physical Configuration. The actual physical location, arrangement, and material condition of structures, systems, and components within a facility. Program Management. The process of defining program objectives, identifying actions/tasks to accomplish those objectives, estimating the level of effort needed to complete each task, organizing and scheduling the planned tasks, staffing an organization to accomplish the planned tasks, assigning personnel to specific tasks, monitoring progress during the implementation, identifying problems and taking corrective actions, and recognizing tasks and program completion. Program Management Element. A CM program element that, in addition to general program management functions, encompasses the following functions: planning for the development and implementation of the CM program; establishing the criteria for the scope of the structures, systems and components to be included in the program; defining key concepts and terminology; identifying and controlling important organizational and programmatic interfaces; establishing the policy and criteria for necessary tools, such as CM databases; and developing and maintaining governing and implementing procedures. Programmatic or Technical Issues. Important issues that might need to be resolved, or partially resolved, in order to complete the CM planning process.

Reactor. Unless modified by words such as containment, vessel, or core, the entire nuclear reactor facility, including the housing, equipment, and associated areas devoted to the operation and maintenance of one or more reactor cores. Any apparatus that is designed or used to sustain nuclear chain reactions in a controlled manner, including critical and pulsed assemblies and research, test, and power reactors, is defined as a reactor. All assemblies designed to perform subcritical experiments that could potentially reach criticality are also to be considered reactors. Critical assemblies are special nuclear devices designed and used to sustain nuclear reactions. Critical assemblies may be subject to frequent core and lattice configuration change and may be used frequently as mockups of reactor configurations. Safety Design Requirements. Those design requirements that are necessary to protect off-site, on-site, and facility personnel from nuclear hazards and other hazards, such as sulfuric acid and chlorine. Safety design requirements include those necessary to satisfy DOE safety requirements. Smart Search. A process through which that set of documents that are most likely to contain design requirements are identified, retrieved and evaluated. Key steps involve location of the source documents most likely to contain design requirements, screening them for applicability, and reviewing them to extract design information. SSC Grade. A measure of the importance of structures, systems, and components (SSCs) within the facility, based on the most important design requirements applicable to the SSC, that can be used to determine priorities and proper levels of attention and resource allocations. An example of SSC grades and associated priorities is: (1) safety, (2) environmental, (3) mission, and (4) others. xiv Structures, Systems, and Components (SSCs). Structures are elements that provide support or enclosure such as buildings, free standing tanks, basins, dikes, and stacks. Systems are collections of components assembled to perform a function such as piping, cable trays, conduit, or HVAC. Components are items of equipment such as pumps, valves, relays, or elements of a larger array such as computer software, lengths of pipe, elbows, or reducers. Technical Validation. For the design reconstitution program, the process of providing reasonable assurance that the retrieved design information is reasonable, applicable, and technically appropriate. This includes determining the appropriateness of analytical methods and technical assumptions. Topical Areas. Those topics that involve or affect multiple structures, systems, and components in a facility. Examples include seismic qualification, fire protection, safe shutdown, environmental qualification, electrical separation, and nuclear criticality. Validation. See 'Technical Validation' and "Field Validation.' Verification. For the design reconstitution program, the process of checking that the retrieved design information has been completely and accurately translated from the source documents. Vertical Slice Assessment. A top-down evaluation conducted on a system-by-system basis, that assesses each program and process related to the system. It reviews system-related information for consistency, technical adequacy, and completeness; compares design requirements and as-built information; compares physical configuration to associated documentation through walkdowns; identifies strengths and weaknesses; and develops recommendations for improvements.

Walkdown. A visual inspection of facility structures, systems, and components to identify the as-found physical configuration and any discrepancies with currently approved facility documentation. xv ACRONYMS ACI American Concrete Institute AISC American Institute of Steel Construction ANSI American National Standards Institute ASCE American Society of Civil Engineers ASME American Society of Mechanical Engineers CAMP Capital Asset Management Process CAS Condition Assessment Survey CCB Change Control Board CM Configuration Management (program defined in this Standard) D&D Decontamination and Decommissioning DCN Document Change Notice DIS Design Information Summary DNFSB Defense Nuclear Facility Safety Board DOE Department of Energy DR Design Reconstitution EQ Environmental Qualification EPA Environmental Protection Agency ES&H Environment, Safety and Health FMEA Failure Modes and Effects Analysis HI Hydraulics Institute HVAC Heating, Ventilation, and Air Conditioning I&C Instrumentation and Control IEEE Institute of Electrical and Electronics Engineers ISA Instrument Society of America ISI In-service Inspection IST In-service Testing JCO Justification for Continued Operation M&O Management and Operations MCA Material Condition and Aging Management MEL Master Equipment List NRC Nuclear Regulatory Commission NUMARC Nuclear Management Resources Council OSHA Occupational Safety and Health Administration P&ID Piping and Instrument Drawing QA Quality Assurance RWP Radiation Work Permit SAR Safety Analysis Report SDD System Design Description SSC Structures, Systems, and Components SSFI Safety System Function Inspection TSR Technical Safety Requirement USQ Unreviewed Safety Questions xvii BIBLIOGRAPHY The following documents were considered during the development of this Standard. DOE Orders and Standards 1. DOE 1324.2A, Records Disposition, of 9-13-88. 2. DOE 4320.2, Capital Asset Management Program, of 3-13-92. 3. DOE 4330.4A, Maintenance Management Program, of 10-17-90. 4. DOE 4700.1, Project Management System, of 3-6-87. 5. DOE 5480.5, Safety of Nuclear Facilities, of 9-23-86. 6. DOE 5480.6, Safety of Department of Energy Owned Nuclear Reactors, of 9-23-86. 7. DOE 5480.19, Conduct of Operations Requirements for DOE Facilities, of 7-9-90. 8. DOE 5480.21, Unreviewed Safety Questions, of 12-24-91. 9. DOE 5480.22, Technical Safety Requirements, of 2-25-92. 10. DOE 5480.23, Nuclear Safety Analysis Reports, of 4-10-92. 11. DOE 5480.28, Natural Phenomena Hazards Mitigation for Department of Energy Facilities, of 1-15-93. 12. DOE 5480.30, Nuclear Reactor Safety Design Criteria, of 1-19-93. 13. DOE 5700.6C, Quality Assurance, of 8-21-91. 14. DOE 6430.lA, General Design Criteria, of 7-20-89. 15. DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, of 12-92. NRC Documents 1. UREG-1397, An Assessment of Design Control & Design Reconstitution Programs. 2. NUREG-CR-4640, Handbook of Software QA. 3. NUREG-C A-5147, Fundamental Attributes of a Configuration Management Program. 4 Regulatory Guide-1.33, QA Requirements for Operations. 5. Regulatory Guide-1.64, QA Requirements for Design. 6. Regulatory Guide-1.88, Collection, Storage & Maintenance of Records. 7. Regulatory Guide-5.29, Nuclear Materials Control Systems. xviii Other Commercial Nuclear Industry Documents

1. ARMA 4520-86, Developing & Operating a Records Retention Program. 2. ANS-N18-20, Nuclear Plant Reliability Data Collection & Reporting System. 3. ANSI-N402, QA Program Requirements for Research Reactors. 4. ANSI/ASME-NQA-1, Quality Assurance Requirements for Nuclear Power Plants, 1983, and Addenda, 1984 and 1985. 5. ANSI/ASME-N45.2-77, QA Program Requirements for Nuclear Facilities. 6. ANSI/ASME-N45.2.9-78, Requirements for Collection, Storage, and Maintenance of QA Records for Nuclear Plants. 7. ANSI/ASME-N45.2.11, QA Requirements for the Design of Nuclear Power Plants. 8. ANSI-N18.2A, Nuclear Safety Criteria for the Design of Stationary PWR Plants. 9. NIRMA PP-02-1989, Position Paper on Configuration Management. 10. NUMARC 90-12, Design Basis Guidelines. Other References 1. Department of Defense Directive 5010.19, DOD Configuration Management Program, of 10- 28-87. 2. MIL-STD-973, Configuration Management, of 4-17-92. DOE–STD–1073–93 I-1 CHAPTER 1 OPERATIONAL CONFIGURATION MANAGEMENT PROGRAM PRINCIPLES This Standard presents the program criteria and implementation guidance for an operational configuration management (CM) program for Department of Energy (DOE) facilities. This Standard is applicable to DOE nuclear facilities in the operational phase. Although it was developed for application to DOE nuclear facilities, the concepts in this Standard can be adapted and applied to DOE non-- nuclear facilities. Portions of this Standard are also useful for other DOE processes, activities, and programs. The first two sections of this Chapter describe the fundamental objective and functional model on which operational configuration management is based. Section 1.3 describes program criteria for the functions depicted in the model. Section 1.4 describes the graded approach recommended for the implementation of these criteria. 1.1 PROGRAM OBJECTIVE The CM program described in this Standard is founded on a concise objective that provides significant program benefits. The objective and benefits are explained in the subsections that follow. Program Objective. The objective of the operational CM program is to establish consistency among design requirements, physical configuration, and facility documentation, and to maintain this consistency throughout the operational life-cycle phase, particularly as changes are being made. These basic relationships are depicted in Figure 1-1. The physical configuration should conform with the design requirements, which are established by design output documents. The facility documentation, which includes as-built drawings and operating procedures, should accurately reflect both the physical configuration and the design requirements. Changes to design requirements should be reflected in both the physical configuration and the facility documentation. Changes to either the facility physical configuration or facility documentation should be supported by the design requirements. Program Benefits. The consistency among design requirements, physical configuration, and facility documentation that is the objective of operational configuration management offers many benefits in terms of the safety and efficiency of DOE facilities. Effective implementation of the elements and functions of an operational CM program provides the tools and information necessary for integrating and coordinating activities to ensure that work is done correctly and safely the first time.

For example, an effective CM program increases the availability and retrievability of accurate information to support safe, sound, and timely decision-making related to facility design and operations. It also increases efficiency by ensuring the prompt availability of needed information, thereby preventing errors and resultant rework, reducing duplications of effort, and improving scheduling and planning estimates. A CM program improves response to critical design and operational problems by making complete and accurate information readily available. Moreover, it enhances worker safety by providing assurance that equipment will perform as intended and by reducing exposures to radiological and other hazards, such as stored-energy sources. The cumulative benefits of a CM program include increased facility safety and reliability, improved environmental protection, and a reduced potential for extended facility shutdowns. Many other programs need an effective CM program to fulfill their objectives and requirements. By maintaining the basic relationships (shown in Figure 1-1), the CM program helps maintain the DOE–STD–1073–93 I-2 DOE–STD–1073–93 I-3 integrity and accuracy required of upgraded Safety Analysis Reports (SARs) required by DOE 5480.23, Nuclear Safety Analysis Reports), Technical Safety Requirements (TSRs) (required by DOE 5480.22, Technical Safety Requirements), maintenance procedures (required by DOE 4330.4A, Maintenance Management Program), and operating procedures (required by DOE 5480.19, Conduct of Operations. The CM program also supports DOE program implementation through the following: • It provides the mechanisms for identifying, cataloging, and maintaining the design requirements and design basis (established to satisfy DOE 6430.lA, General Design Criteria). • It carries forward the technical baseline established in the design and construction phase (in accordance with DOE 4700.1, Project Management System) into the operational phase and implements configuration management in the operational phase (as referenced by DOE 4700.1). Thus, the CM program supports the activities necessary to achieve design control (as required by DOE 5700.6C, Quality Assurance). • It provides the mechanisms to catalog design requirements and design basis related to the SAR, so that this information can be used to support the evaluation of nonconformances and proposed changes (as required by DOE 5480.23, Nuclear Safety Analysis Reports). • It identifies and retrieves design requirements information and physical configuration information that supports operability determinations (as required by DOE 5480.22, Technical Safety Requirements). • It validates the change control mechanisms that (1) identify and review changes to the design, physical configuration, or facility documentation (as required by DOE 5700.6C, Quality Assurance) and (2) ensure the relationships among design requirements, physical configuration, and facility documentation. • It provides for the systematic identification and control of design and facility information that is important to management and operation (as required by DOE 5480.19, Conduct of Operations, and DOE 5700.6C, Quality Assurance). • It supports operations control of equipment and system status and equipment labeling (as required by DOE 5480.19, Conduct of Operations). • Through the design reconstitution (DR) program, it provides effective methods for SAR reconstitution and upgrading (as required by DOE 5480.23, Nuclear Safety Analysis Reports).

• Through the material condition and aging management (MCA) program, it provides the technical and engineering methodology for establishing certain preventive and predictive maintenance activities (as required by DOE 4330.4A, Maintenance Management Program). This methodology will assist in resolving current MCA issues such as those related to trending, analyzing, and predicting corrosion-induced failures. Thus, the CM program provides a necessary link with other DOE programs for maintaining consistency, documenting results, facilitating information usage, and providing effective methods and mechanisms. Major CM program interfaces with existing DOE programs are described in Appendix I-A. DOE–STD–1073–93 I-4 1.2 FUNCTIONAL MODEL Configuration management is a method of doing business that maintains consistency among design requirements, physical configuration, and facility documentation. The success of any CM program depends on every individual who performs activities related to CM functions. Fulfilling the CM program objective necessitates that a number of functions be accomplished. For convenience, these functions are grouped Into five basic program elements: • program management • design requirements • document control • change control • assessments These five elements encompass the primary challenges to establishing and maintaining configuration management at most facilities. Certain additional functions may be needed to establish configuration management but may not be needed for the whole life of the operational CM program. These functions are grouped into two adjunct programs: design reconstitution, and material condition and aging management. The adjunct programs differ from the five basic program elements in that they are essentially one-time efforts, the results of which are integrated into the ongoing CM program. The five elements and two adjunct programs with their constituent functions are depicted in Figure 1-2, the functional model of operational CM. This model provides a framework for visualizing the extent and nature of the operational CM program. Figure 1-2 is purely functional; it is not intended to depict a particular organization of people nor a particular relationship to existing programs that may already accomplish some configuration management functions. The management of each facility decides what is best in terms of the organizational structure for implementing operational CM and the relationship of existing programs to the operational configuration management program. The functional model of operational configuration management implies, and the balance of this Standard makes explicit, that the operational CM program does not manage the interfacing programs; it identifies those interfaces and ensures their effectiveness in fulfilling CM functions. It is preferable that contractors build on existing programs within their established organizational structure, as much as practicable. The CM program is intended to orient personnel and programs toward establishing and maintaining the CM program basic relationships; to improve, where necessary, existing programs and procedures that provide CM functions; to establish new programs or functions where necessary; and to strengthen the interfaces among these programs. The extent to which existing programs fulfill the functions of CM (enumerated in Figure 1-2) has a significant bearing on the number and magnitude of new actions necessary to implement the operational CM program. For CM functions accomplished by existing programs, the operational CM program should ensure that those functions are implemented in an integrated and coordinated manner that satisfies the program objective.

1.3 PROGRAM CRITERIA This section provides the general program criteria that define the functions of operational CM, including those of the adjunct programs. These criteria encompass the program objectives and content and should guide the development and implementation of CM programs. These criteria describe an DOE–STD–1073–93 I-5 Figure 1-2. Operational Configuration Management Program: Elements and Functions DOE–STD–1073–93 I-6 operational CM program appropriate for a high-hazard facility that is expected to operate for an extended period. Section 1.4 describes the graded approach for applying these program criteria to other facilities and situations. The Glossary provides descriptions of key terms used in these program criteria and throughout this Standard. Appendix I-B provides background material and concepts that establish the context in which this Standard should be understood. 1.3.1 PROGRAM MANAGEMENT ELEMENT The objective of the program management element is to direct and monitor the development and implementation of the overall CM program. 1.3.1.1 Program Planning The CM program developed and Implemented by a contractor authorized to manage or operate a DOE-owned facility should reflect appropriate consideration of the guidance contained in this Standard. A graded approach (described in Section 1.4) should be used to determine the depth of detail necessary and the magnitude of resources to be invested in each CM program function. Configuration management program planning should include the following: a. Issuance by the DOE prime contractor of a site/division-level CM policy directive that announces top management support for the CM program, defines key roles and responsibilities, provides criteria for the CM equipment scope, and establishes key terminology and definitions. b. Initiation of immediate corrective actions for substantive weaknesses discovered during the initial assessments (as described in criterion 1.3.5.1.a). c. Development of the CM program plan, based on the graded approach and initial assessments, that defines the appropriate level of implementation for specific facilities, describes those actions already taken to develop and implement the CM program, and identifies the schedules and costs associated with those actions. This plan should address each of the following topics: scope of the structures, systems, and components (SSCs) to be included in the CM program; objectives of each program activity; description of each program activity; basis for the technical content of each program activity; organizational structure and staffing; interfaces; implementation priorities, milestone deliverables, and implementation schedules; and cost estimates. The CM program plan for the basic CM program elements should be provided for DOE review within 18 months after program planning is initiated. The DR and MCA adjunct program plans may be provided separately from the CM program plan, but they should be provided within an additional 6 months after the CM program plan is provided, and they should be incorporated as a part the CM program plan. 1.3.1.2 Equipment Scope Criteria The types of equipment to be included in the CM program should be identified. The equipment scope of the CM program should be based on the functions provided by the SSCs and should include those SSCs involving safety design requirements (those necessary to protect off-site personnel, on-site personnel, and facility workers from nuclear and other hazards), environmental design requirements (those necessary to protect the environment from significant damage or to satisfy environmental requirements or permits), and mission design requirements (those necessary to avoid substantial interruptions of the programmatic mission or severe cost impacts).

DOE–STD–1073–93 I-7 Specific criteria for design requirement types should be developed on the basis of input from the design authority. These design requirement types should encompass safety, environmental, and mission design requirements, and any other types deemed necessary. 1.3.1.3 Concepts and Terminology Concepts, standard terminology, and standard definitions should be established and maintained for the CM program. They should be based on the concepts, terms, and definitions provided in this Standard. 1.3.1.4 Interfaces Configuration Management programmatic and organizational interfaces should be identified and interface controls established. Appropriate interfaces should be established within the CM program (i.e., among the CM elements and functions) and between the CM program and other programs that have configuration management functions. Appropriate organizational interfaces should be established, both internal and external to the contractor organization, and should include policy and criteria for the control of vendor activities and information. Interface controls should include clear assignments of key roles and responsibilities. 1.3.1.5 Databases Databases for use in the identification, storage, control, and retrieval of information important to configuration management should be established, and policy and criteria for their use should be defined. 1.3.1.6 Procedures After DOE review of the CM program plan, action plans and specific CM implementation procedures consistent with the action plans should be developed. In addition, governing procedures that correlate the implementing procedures with the CM program plan should be developed and maintained. The CM program should include training on CM concepts, terminology, definitions, and procedures. 1.3.2 DESIGN REQUIREMENTS ELEMENT The objective of the design requirements element is to establish and maintain the design requirements and the associated design basis. 1.3.2.1 Establishment of Design Requirements The design requirements should be formally established, documented, and maintained. a. For each SSC, the design requirements should be categorized into the types established by the equipment scope criteria (see criterion 1.3.1.2). b. A technical management review should be performed to determine the adequacy of the design requirements. (The SAR upgrade program may provide useful information here.) If the design requirements are not fully documented, not accurate, or not complete, the design requirements should be reconstituted to the extent identified by the design reconstitution adjunct program. c. The design requirements should be incorporated into an equipment database that correlates each SSC with the SSC grade, the design requirements, technical topics involved, and associated documentation. DOE–STD–1073–93 I-8 d. The design requirements for new facilities and modifications to existing facilities should be established, categorized, and documented as they are developed, in a form amenable to review and addition to the equipment database. 1.3.2.2 System and Process Boundaries The boundaries for each system and process should be established in such a manner as to contain the components necessary to satisfy the design requirements for that system or process. 1.3.2.3 Assignment of SSC Grades Each SSC should be assigned a grade based on the most important type of design requirements applicable to it. The SSC grade should be used as the basis for the degree of control on all activities associated with the SSC.

1.3.2.4 Specific Equipment List On the basis of the equipment scope criteria and the assignment of SSC grades, the specific SSCs included in the CM program should be identified. 1.3.2.5 Establishment of Design Basis The basis for design requirements should be formally established, correlated with the design requirements, documented, and maintained. a. A technical management review should be performed to determine the adequacy of the design basis. If the design basis is not fully documented, not accurate, or not complete, it should be reconstituted to the extent identified by the design reconstitution adjunct program. b. The design basis for new or modified design requirements should be established and documented as these requirements are developed. 1.3.3 DOCUMENT CONTROL ELEMENT The objective of the document control element is to identify and maintain documents within the CM program consistent with the physical configuration and design requirements. 1.3.3.1 Identification of Documents The types of documents that need to be included in the CM program should be determined, and document owners should be established for each of these document types. The document owners should be responsible for the technical content of assigned documents. Within each document type, the specific documents to be included in CM document control should be identified for each SSC. The document owners should establish priorities for document revision and retrieval. 1.3.3.2 Storage Originals or master copies of documents within the CM program should be stored and protected. Retention times should be established to meet the needs of the document owners and users and the minimums specified by DOE 1324.2A, Records Disposition. DOE–STD–1073–93 I-9 1.3.3.3 Control and Tracking Only the currently-approved revisions of documents within the CM program should be used. Revisions to documents within the CM program to incorporate pending changes should be completed in a timely manner. The number of unincorporated document changes allowed to accumulate before revisions are implemented should be determined according to the priority of the document, the complexity of the changes and the overlap of the changes. For each document within the CM program, the following information should be readily available: revision level, current status, document owner, information regarding pending changes, and other data necessary for control and tracking, such as storage location and outstanding document change notices (DCNs). 1.3.3.4 Retrieval Documents should be retrieved in a timely manner upon request. Maximum retrieval times for each document should be established, and they should be based on the priorities established by the document owners. Documents should be identifiable from a document database, which should be able to identify documents within the CM program related to particular SSCs, types of SSCs, technical topics, and other information to support identification, such as SSC vendors. When a copy of a document within the CM program is issued, pending changes and associated information should be identified. 1.3.4 CHANGE CONTROL ELEMENT The objective of the change control element is to maintain consistency among the design requirements, the physical configuration, and the facility documentation as changes are made. 1.3.4.1 Identification of Changes

All mechanisms that can lead to temporary or permanent changes in the design requirements, facility configuration, or facility documentation within the CM program should be identified. Such mechanisms might include hardware modifications not controlled as projects, hardware modifications controlled as projects, maintenance changes, operational changes, procurement changes, document changes, and computer software changes. Change mechanisms should be evaluated to determine which are adequate as is, and which need to be improved, consolidated, or terminated. The resulting change mechanisms should be integrated with the CM program. Within approved CM change mechanisms, each proposed change, including temporary changes and partially implemented changes, should be described sufficiently to support technical reviews, management reviews, and approvals. 1.3.4.2 Technical Review of Changes Each specific proposed change should be reviewed to determine if it is within the bounds of the design requirements. Changes to the design requirements should be evaluated and approved by the design authority prior to implementation. The technical reviews should evaluate safety, environmental, and mission impacts; determine appropriate post-implementation acceptance criteria; and identify the affected SSCs and facility documentation. 1.3.4.3 Management Review of Changes Before implementation, management should review proposed changes (including those that do not involve a change to design requirements) to verify that the technical reviews have been performed adequately, that the change package is complete and ready for implementation, and that any external DOE–STD–1073–93 I-10 approvals necessary prior to implementation have been obtained. On the basis of these reviews, management should take approval action. 1.3.4.4 Implementation of Changes Each change should be implemented in accordance with its approved change package. The change process should include mechanisms for field change requests, and technical reviews and approvals of field changes should be commensurate with those of the original change package. The change process should generate accurate as-built information. After the physical implementation of changes, post-modification testing should be conducted (see criterion 1.3.5.4). 1.3.4.5 Documentation of Changes Each change should be documented and that documentation should include a description of the change, as well as an account of the technical reviews, management approvals, as-built information, and post-modification test results. Documents that are included in the CM program and are affected by a change, either directly or indirectly, should be revised. 1.3.5 ASSESSMENTS ELEMENT The objective of the assessments element is to help define facility configuration management needs and to measure how effective the CM program is in establishing and maintaining the program's basic relationships. Configuration management assessments are conducted in an initial phase, in a post- implementation phase, and throughout the life of the facility. 1.3.5.1 Programmatic Assessments The adequacy of CM programs and procedures should be assessed using vertical and horizontal slice assessments.

a. Initial assessments. During the planning for the CM program, initial assessments should be conducted to determine the strengths and weaknesses of existing programs and procedures with regard to determining where upgrade actions and resource investments are necessary. Two vertical slice assessments relevant to the facility should be conducted. One of these should be on a safety system related to the principal facility hazard, either nuclear or non-nuclear. Two horizontal slice assessments relevant to the facility should also be performed. One of these should be on change control and the other on a technical topical area, such as seismic qualification or fire protection. b. Post-implementation assessments. After the CM program upgrades are implemented, a horizontal slice assessment should be performed for each CM program element to determine if that element addresses identified weaknesses and is effective in accomplishing the CM functions. For each system design information summary (DIS) developed by the DR adjunct program, a field validation should be performed to ensure that the design requirements are accurately reflected in the physical configuration and the associated facility documentation. After the MCA adjunct program is developed, a technical quality review should be performed of its assumptions, methods, and products. c. Periodic effectiveness assessments. After the CM program and its adjunct programs have been implemented, a combination of vertical and horizontal slice assessments should be performed periodically to measure the overall CM program effectiveness and to determine if CM controls are DOE–STD–1073–93 I-11 adequate and appropriate. The results of these assessments should establish the basis for revisions to the CM program plan, either increasing or decreasing controls. 1.3.5.2 Physical Configuration Assessments Physical configuration assessments, or walkdowns, should be performed for representative sample SSCs to determine the degree of agreement between the physical configuration and the configuration depicted in the facility documentation. Physical walkdowns should be included as part of the programmatic assessments conducted during the initial assessments, post-implementation assessments, and periodic effectiveness assessments. If substantive discrepancies (either in number or type) are discovered, appropriate immediate corrective actions should be developed to establish agreement between the physical configuration and the documentation. The corrective actions should include additional walkdowns to characterize the problem and to determine the extent of the problem. They should also include technical evaluations to determine whether the physical configuration or the documentation should be changed. 1.3.5.3 Periodic Equipment Performance Monitoring Structures, systems, and components within the CM program should be tested periodically to determine it they are still capable of meeting their design requirements. This monitoring should also address surveillance actions, periodic in-service inspections and tests, and other monitoring of SSCs to ensure safe and reliable operation of the facility. Monitoring should also include measurements and trending of data related to the actual aging degradation of equipment, to the extent identified by the MCA adjunct program and approved by the design authority. 1.3.5.4 Post-Modification Testing

An SSC within the CM program should be tested after modification (and before being turned over for service) to determine if it is capable of meeting its design requirements (i.e., the post-implementation acceptance criteria). If a changed SSC fails to meet its post-implementation acceptance criteria, turnover for operation should be postponed until either a technical review has been completed and any follow-up actions are completed or until the SSC is returned to its original condition and tested satisfactorily. 1.3.6 DESIGN RECONSTITUTION ADJUNCT PROGRAM The objective of the DR adjunct program is to establish, organize, and document design information (i.e., both design requirements and design basis), where existing design information is not adequate. 1.3.6.1 Program Plans and Procedures A program plan, an action plan, and implementing procedures should be developed for the DR adjunct program. The DR program plan should be based on the initial assessments and the graded approach. The DR adjunct program should be implemented in stages to provide a timely initial set of design information and more information as it becomes available. It should include prioritization of the development and issuance of DISs. Design information summaries for systems or technical topics necessary to support the facility accident analysis and TSRs should receive the highest priority. The DR program plan should address the same topics identified for the CM program plan (described in criterion 1.3.1.1.c). DOE–STD–1073–93 I-12 1.3.6.2 Identification and Retrieval of Design Information The identification and retrieval of design information should be accomplished in stages, with emphasis on the most important and most accessible information first. a. Identification and Retrieval of Source Documents. The objective and scope of source documents to be reviewed should be defined for each document identification and retrieval stage. The recommended stages are the formal review, the smart search, and the comprehensive search. The formal review should address those on-hand documents, such as the facility safety analysis and TSRs, that contain summary-type design information; the smart search should identify and retrieve those types of documents that can be identified as most likely to contain design requirements; and the comprehensive search should identify and retrieve any remaining documents that might contain design information, including DOE correspondence and vendor correspondence. b. Extraction of Design Information. Technical review and identification of design information from each source document should include both design requirements and design basis information. Extracted design information should be identified as to the applicable facility SSC, type of SSC, technical topic area, and whether it is a design requirement or design basis. The technical review and identification of design information from each source document should be complete, such that the document does not have to be reconsidered during subsequent searches and reviews. 1.3.6.3 Evaluation, Verification, and Validation of Design Information

Extracted design information should be verified by a second party to ensure that the design information was extracted completely and accurately from the source documents. Extracted design information should be technically validated to ensure that it is reasonable, that it is applicable to the current facility mission and configuration, and that the analytical methods and technical assumptions used in the design process are valid and appropriate. Design basis information should be correlated with the design requirements. Extracted design information should also be evaluated to identify any missing design requirements or design basis information. Design Information Summaries should be field validated to ensure that design requirements are properly reflected in the physical configuration and in the associated facility documentation. 1.3.6.4 Discrepancy Resolution Validated situations involving the following should be documented as open items: apparent contradictions in the information from different source documents; concerns; unanswered technical questions; and cases of missing, undocumented, or inaccurate information. The open items should be dispositioned by a formal resolution process and should be tracked to completion and closeout, including documentation of their resolution. Safety-significant open items (i.e., discrepancies) should be promptly addressed by existing programs for determining operability and reportability and resolved by those programs. 1.3.6.5 Regeneration of Missing Critical Design Information Missing design information should be evaluated to determine which part needs to be regenerated. Missing design information that is critical, including that necessary to support the facility accident analysis and TSRs, should be regenerated in order of priority. DOE–STD–1073–93 I-13 1.3.6.6 Preparation and Issuance of Design Information Summaries Extracted design requirements should be entered into the CM equipment database promptly after verification and technical validation. Design information summaries should include a system description (including systems interface information), system operability requirements, system-level design requirements, component-level design requirements, the design basis, and related design topical information. They also should identify design requirements by type; attributes of the design that were not mandatory for the designer should be distinguished from other types of design requirements. The authorization basis should be clearly distinguished from other aspects of the design basis. The DISs should be written for easy use by individuals at all levels of experience. A DIS should be initially issued when the design requirements are complete and technically validated, including the regeneration of missing critical design requirements. This Initial version should also contain available technically validated design basis information and should identify open items to be resolved. The DIS should be revised and reissued when the design basis has been reconstituted (including regeneration of missing critical design basis) and the field validation has been completed. 1.3.7 MATERIAL CONDITION AND AGING MANAGEMENT ADJUNCT PROGRAM The objective of the MCA adjunct program is to prevent the failure of facility life-limiting components from aging degradation and the associated impact on facility operations. Aging degradation can so impair the performance capability of equipment that it no longer meets its design requirements, and this can compromise the CM program basic relationships.

1.3.7.1 Program Plans and Procedures A program plan, an action plan, and implementing procedures should be developed for the MCA adjunct program. The program plan should be based on the initial assessments and the graded approach. The program plan should address the same topics identified for the CM program plan (described in criterion 1.3.1.1.c). 1.3.7.2 Component Screening Components in the facility, including passive components (e.g., structures), should be screened to identify those that are potentially life-limiting for the facility. 1.3.7.3 Aging Degradation Evaluations The remaining lifetime for each potentially life-limiting component should be evaluated. Major aging degradation mechanisms that could affect potentially life-limiting components should be identified. The present material condition of each such component should be determined. 1.3.7.4 Estimation of Facility Remaining Lifetime The remaining lifetime of each potentially life-limiting component, with no life extension techniques applied, should be estimated using engineering judgment. The facility remaining lifetime is the shortest estimated remaining lifetime for a potentially life-limiting component. 1.3.7.5 Feasibility of Continued Operations and Extended Operations If DOE has not specified a facility desired lifetime, the contractor should request that it do so. If not specified, the desired lifetime should be taken to be the same as the remaining lifetime without the DOE–STD–1073–93 I-14 application of life extension techniques. As appropriate, the feasibility of continued operations and the feasibility of extended operations should be assessed. Objects of such an assessment would include the following: management alternatives for continued operation or extended operations of the facility; the estimated costs for each alterative as a function of time; and recommendations regarding facility continued operations and extended operations. 1.3.7.6 Detailed MCA Analysis Detailed component screening, aging degradation evaluations, more rigorous determinations of facility remaining lifetime, the feasibility of continued operations, and the feasibility of extended operations should be performed. The physical characteristics related to aging degradation of specific life-limiting components should be determined, and measurements that could be made to determine the material condition of life-limiting components should be defined. Baseline measurements should be performed to establish the material condition of facility life-limiting components. The results of these measurements should be included in the aging degradation evaluations. 1.3.7.7 Degradation Trending, Aging Management, and Life Extension Aging degradation measurements and associated frequencies should be provided to the design authority as proposed new design requirements. Detailed aging degradation evaluations should also be provided to the design authority as the design basis for the new design requirements. The results of the periodic aging degradation measurements should be trended and extrapolated to update the remaining lifetime determinations after each set of measurements. As needed, life extension techniques for life-limiting components should be developed and implemented. 1.4 GRADED APPROACH This section provides the purpose, concepts, and general process for applying the graded approach to operational configuration management. 1.4.1 INTRODUCTION

DOE facilities are so diverse in character and age—many have been operating for several decades—that it is impossible to develop a single set of program criteria directly applicable to them all. However, a wide variety of facilities can be accommodated by means of a graded approach to adapt DOE general criteria. Use of a graded approach also makes it easier to apply resources where the greatest benefit can be realized. Therefore, DOE has decided to develop general criteria and to invoke the graded approach to adjust those criteria as appropriate for each facility. This Standard presents the program criteria that would apply to a highly hazardous facility (i.e., a worst case) and invokes the graded approach for less hazardous facilities. DOE defines the graded approach as a process by which the level of analysis, documentation, and actions necessary to comply with a requirement are made commensurate with a number of considerations, including: the relative importance to safety, safeguards, and security; the magnitude of any hazard involved; the life-cycle stage of a facility; the programmatic mission of a facility; the particular characteristics of a facility; and any other relevant factor. In applying the graded approach to the CM program, the following additional factors are relevant: facility size and complexity; facility remaining and desired lifetime; facility operational status; programmatic and technical issues; facility grade; SSC grades; existing programs and procedures; and phased implementation. These terms are explained below. DOE–STD–1073–93 I-15 These various considerations fall naturally into two types, as depicted below. The first type involves relative importance; one item can be identified as more important than another and therefore can be assigned a higher priority. The second type involves more situational or circumstantial considerations, independent of relative importance. Relative Importance Factors Situational/Circumstantial Considerations Facility grade Facility type and technical characteristics SSC grades Facility desired/remaining lifetime Facility operational status Programmatic and technical issues Existing programs and procedures Facility life-cycle phase Phased implementation Other DOE documents present various aspects of a graded approach. For example, DOE 5480.23, Nuclear Safety Analysis Reports, defines hazard categories for nuclear facilities and specifies requirements for facilities in those categories. DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, presents a method for determining the hazard categorizations for nuclear facilities. DOE 6430.1A, General Design Criteria, presents design criteria for various types of facilities and systems within facilities, defines and explains safety class items, and specifies design criteria for such items. Similarly, DOE 5480.30, Nuclear Reactor General Design Criteria, presents criteria for the safety design of nuclear reactors (criteria for the safety design of nonreactor nuclear facilities are under development). DOE 5481.1B, Safety Analysis and Review Systems, defines high-hazard, moderate-hazard, and low-- hazard classes of items from an environmental protection perspective. DOE 5480.28, Natural Phenomena Hazards Mitigation for Department of Energy-owned Facilities, defines performance goals for maintaining the integrity of SSCs against natural phenomena as necessary to confine nuclear and other hazardous materials and to protect personnel. DOE 5000.3B, Occurrence Reporting and Processing of Operations Information, defines Class A and B equipment and defines conditions that constitute a significant impact on the cost and schedule for completing the programmatic mission of a facility.

The graded approach described in this Standard is not another layer added to this collection of grading systems; rather, it is offered as a possible integration of several grading methods into a single method. The main purpose of a graded approach is to determine the appropriate level of resources that should be applied when implementing a program. The goal is to apply the highest level of resources to the most important equipment in the most important facilities and to avoid such expenditures where they are not warranted. For a highly hazardous facility such as a large nuclear reactor, which could potentially have serious off-site personnel safety consequences, a significant investment of resources is appropriate for the systems that prevent, detect, or mitigate such consequences. At the other extreme, for a low-hazard facility—a hot cell facility, for example—where the greatest hazard is localized (that is, offsite personnel and workers at other facilities on the site are unaffected), the same high level of investment would not be appropriate. The grading system should take into account both facility grades and SSC grades in determining the appropriate level of resources to be applied, and to this end, a composite grading system could be employed. DOE–STD–1073–93 I-16 1.4.2 GENERAL PROCESS FOR GRADED APPROACH The graded approach should be applied using the following process: 1. The general program criteria (provided in section 1.3) should be adjusted to become appropriate facility program criteria, which should be satisfied when the program is fully implemented. 2. The upgrade actions necessary to attain the facility program criteria should be identified. The existing programs and procedures should be evaluated to determine which already provide configuration management functions adequately, which can provide a configuration management function if modified, and where new activities need to be developed. A fundamental premise of the CM program is that it should take advantage of existing programs and procedures to the maximum extent practicable. The difference between the extent of the existing programs and procedures and the facility program criteria defines the upgrade actions that are needed to fully implement the CM program. 3. A schedule should be developed for implementation of the CM upgrade actions. The facility program criteria, upgrade actions, phased-implementation schedule, the bases for these items, and other pertinent considerations should be described in the CM program plan. The general process recommended for applying the graded approach to the development and implementation of a CM program is depicted in Figure 1-3. The order of the considerations is optimized for program planning efficiency and fits most facilities. Each consideration is discussed below. 1.4.2.1 Facility Type and Technical Characteristics Facility type and technical characteristics relate to the particular technical nature and design characteristics of a facility. For example, a nuclear hot cell facility is different from a nuclear reactor and would not be expected to implement piping code design criteria for high-pressure primary reactor piping systems. As another example, a waste tank farm would not be expected to meet the same technical criteria as a uranium enrichment facility. Similarly, a facility being designed and constructed to handle the decontamination and environmental restoration of, and the waste storage and disposal for, an old retired nuclear facility would not be expected to meet the same criteria as the facility being cleaned up. Furthermore, even facilities of the same technical type may have unique technical characteristics. For example, a plutonium-fueled critical facility has different characteristics than a uranium-fueled critical facility.

This consideration is used to determine what types of implementation actions would be technically appropriate for the facility when the CM program is fully implemented. The general program criteria should be reviewed in light of the facility type and technical characteristics to determine which are appropriate, which need adaptation, and which are not applicable. This step establishes the foundation for evaluating other graded-approach considerations that are used subsequently to make program criteria adjustments. Implementation of the CM program, a management system, is influenced less by facility type and technical characteristics than a program of technical (i.e., hardware) criteria would be. 1.4.2.2 Facility Desired/Remaining Lifetime The facility remaining lifetime is the period of time that the facility is expected to retain the capability of performing its intended functions (i.e., meet its design requirements) without applying life extension techniques. If DOE has formally notified the contractor that the facility is to be operated for only a specified period, or that the facility is to be shut down at a specified date and there is no intent to DOE–STD–1073–93 I-17 Figure 1-3. Operational Configuration Management: Implementation Considerations DOE–STD–1073–93 I-18 resume operations, the specified date should be used. If DOE has specified a desired lifetime that is longer than the remaining lifetime, the desired lifetime potentially may be achieved through the application of life extension techniques. The CM development period should be commensurate with the desired/remaining lifetime of the facility. As benefits of a CM program start accruing immediately, prompt and full implementation is warranted. Benefits are realized from the beginning of the implementation activities (e.g., inadequately controlled changes are arrested), and they increase through full implementation. Specific discrepancies can be resolved in a short time, yielding immediate benefits. In general, development of the CM program elements should be commensurate with the facility desired/remaining lifetime. For example, if the facility desired/remaining lifetime is 3 years, a 3-year CM development program should be planned. The DR adjunct program is an exception to this general guidance. The remaining lifetime is estimated as part of the MCA adjunct program. For the development of the CM program plan, precise estimates of remaining facility lifetime are not necessary. For example, contractors may estimate the remaining facility lifetime only to the extent of determining which of the following categories is applicable: • More than 10 years • Between 5 and 10 years • Between 2 and 5 years • Less than 2 years The 5- and 10-year points are significant to determining the impact of the remaining facility lifetime on the degree of implementation of the CM program. The majority of CM program development and implementation can be completed within about 5 years. Full reconstitution of the design basis can take longer — up to 10 years for the most complex facilities, less for more typical facilities.

For facilities with desired/remaining lifetimes of more than 10 years, the CM program functions, as well as those of the DR and MCA programs, should be implemented. For facilities whose desired/remaining lifetimes are between 5 years and 10 years, the CM program elements should be fully implemented, but DR adjunct program development might be limited both in the information searches and in the number of SSCs for which DISs are developed. For facilities with desired/remaining lifetimes of between 2 and 5 years, limited implementation of the CM elements should be considered, with similar adjustments for the implementation of the DR and MCA adjunct programs. For example, the scope of the SSCs to be included in the CM program might be defined to include only those with safety or environmental design requirements. Moreover, the searches involved in reconstituting the design might be limited to the formal review and the smart search. Similarly, the MCA adjunct program might be limited to the preliminary estimate of remaining lifetime. Facilities with a desired/remaining lifetime of less than 2 years should undertake only those CM activities that are important to the remaining operation or to the next phase of the facility life-cycle. The SSCs included might be limited to those related to safety. Walkdowns to determine the degree of correlation between the physical configuration and associated documentation, including as-built drawings, should be conducted. Change mechanisms should be identified. Physical changes should be reviewed, approved, and documented. Activities to reconstitute the design requirements might be limited to the formal review. Reconstitution of the design basis might not be appropriate. The MCA program should be developed to the extent necessary to define inputs to the Maintenance Department to support the establishment and maintenance of an appropriate lay-up program. DOE–STD–1073–93 I-19 1.4.2.3 Facility Operational Status If the facility is currently operating (including periodic shutdowns for maintenance and other conditions), the operational status consideration has no effect. However, a facility might be in the midst of its operational phase but not operating. For example, a chemical reprocessing facility could have its operational phase interrupted pending development of an environmental impact statement and a DOE decision to resume facility operations. Although the CM program described in this Standard applies primarily to the operational phase, post-operational interfaces need to be addressed. Facilities in a nonoperating status and maintaining the capability to resume operations (e.g., in standby mode or awaiting restart) should undertake only those CM activities that are important to ensure that the physical configuration does not degrade and that changes are identified and approved. Before a resumption date for operations is announced, the scope of SSCs included might be limited to those related to personnel safety. Walkdowns should be conducted to determine the degree of correlation between the physical configuration and associated documentation. Physical changes should be reviewed, approved, and documented. The DR adjunct program should not be implemented during this period. The MCA adjunct program might be implemented only to the extent necessary to support the restart capability by ensuring that the remaining lifetime is not compromised. Preliminary planning for the development of a CM program should be initiated. When a date for resumption of operations is announced, final planning should be initiated for the CM program. At that time, the objective of the planning, development, and implementation should be that the CM program be completed or in an advanced state of implementation when operations are resumed.

Facilities in a nonoperating status and not maintaining the capability to resume operations (e.g., in shutdown or deactivation mode, pending decommissioning and decontamination) should undertake only those CM activities that are important to track changes and to provide documentation of the SSCs that remain in the facility. Limited walkdowns of the facility should be conducted to confirm that the configuration shown on the associated documentation is accurate. Physical changes should be identified and documented. Neither of the two adjunct programs should be implemented. 1.4.2.4 Programmatic and Technical Issues Programmatic and technical issues should be evaluated to determine which, if any, need to be resolved early in the CM program development or implementation process. Programmatic issues include safety evaluations, probabilistic risk assessment, human factors engineering, operating and emergency procedures and planning, and operator training. Technical issues include topical areas such as seismic qualification, fire protection, safe shutdown, and equipment environmental qualification. The resolution of these issues might place additional importance on SSCs initially thought to have only limited design requirements and, therefore, potentially change the grading of those SSCs. For example, in resolving a fire protection or safe shutdown issue, the capabilities of existing SSCs may be used to good advantage. When credit for these capabilities is taken, the associated design requirements assume a higher level of importance than they may have had previously. This greater importance could cause the SSC to take on a higher grade. 1.4.2.5 Facility Grades and SSC Grades The graded approach involves both the assignment of grades and the subsequent application of those grades in determining the degree of implementation. The importance and priorities of SSCs within a facility need to be considered within the context of the overall importance of the facility. The objective is to ensure that the highest level of attention and resources is applied to the most important SSCs at the most important facilities. Grading should focus on avoiding the cost of applying high levels of DOE–STD–1073–93 I-20 attention where such attention is not warranted. It is important that the grading system include consideration of both the overall facility importance grade and the importance grades for the SSCs within the facility. The graded approach for the CM program is based on hazard. Hazard is related to the worst possible accident, without regard for either the physical SSCs or the administrative programs (such as safety reviews, QA programs, procedures, and training) intended to prevent, detect, or mitigate potential accidents. Hazard considers the material types, quantities, forms, locations, dispersibility, and interaction with available energy sources that could cause harm to personnel or the environment. Hazard is a measure of the unmitigated consequences of source terms; it provides an indication of the importance of having SSCs and administrative controls that prevent, detect, or mitigate accidents. In contrast, risk is a measure of the combination of the probability of the occurrence and the consequences of such an occurrence. In risk assessments, the SSCs and administrative controls are assumed to function. By providing these SSCs and administrative controls, the risks associated with the operation of hazardous facilities become acceptably small. Risk is a measure of both the hazard and the effectiveness of the SSCs and administrative controls. Because the purpose of grading often relates to the value of improvements, it is appropriate to use hazard, or unmitigated risk, rather than risk to gauge importance.

Facility Grades. Determination of facility grades involves consideration of the hazard category, the programmatic mission, and the complexity of the facility. Therefore, the facility grade reflects the overall importance of the facility and is a broader consideration than the hazard category. In keeping with its established policy that safety be given priority over programmatic considerations, DOE has focused initial development of the facility grading process on nuclear hazards. DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE 5480.23, Nuclear Safety Analysis Reports, provides guidance for evaluating facility hazards. Chemical and other hazards are also being considered. DOE recognizes that at some nuclear facilities, the dominant hazard may not be a nuclear hazard but rather some other type of hazardous material, such as sulfuric acid or chlorine. The hazard category of any facility, nuclear or non-nuclear, should be based on the dominant hazard. Some DOE facilities have already evaluated their nuclear hazards. If a facility has a DOE-approved hazard category, it should be incorporated into the facility grade. The degree of implementation necessary to maintain adequate safety varies with facility size and complexity. Large, complex facilities such as plutonium reprocessing facilities or production reactors generally have more SSCs and therefore more opportunities for failure than less complex facilities such as dry storage vaults. Similarly, if a facility is small and uncomplicated, such as a waste storage tank, its safety may depend more heavily on manual actions than on automatic safety actions. In situations that depend heavily on manual safety decisions and actions, the man-machine interface becomes more important. Pending the development of detailed DOE guidance, judgment should be used to estimate the relative programmatic mission importance and complexity of the facility. Those estimates would then be merged with the hazard category to arrive at an overall facility importance grade. The facility grade should be a reasonable estimate of the overall importance of the facility, regardless of the method used to arrive at that estimate. SSC Grades. Importance grading of SSCs is needed to determine the level of controls appropriate for various functions of the CM program. Such grading is not new; DOE has graded nuclear facility systems into safety-class systems and non–safety-class systems for years. SSC grading is a measure of the relative importance of SSCs, based upon the most important design requirements applicable to each SSC. SSC grading should be based on the functions (design requirements) that the SSC DOE–STD–1073–93 I-21 provides. The importance and priorities of SSCs cannot be established accurately until the design requirements associated with them are identified and categorized. Activities (e.g., design, procurement, construction, installation, operations, maintenance, surveillance and testing, and physical changes) related to the SSCs should be assigned the same grade as the SSCs involved. Examples of SSC grading systems are presented below; other SSC grading systems may also be acceptable.

In the recommended SSC grading system, the categories and priorities of design requirements are (1) safety design requirements, (2) environmental design requirements, (3) mission design requirements, and (4) others. Safety design requirements involve protecting on-site and off-site personnel and facility workers from both nuclear and non-nuclear hazards. Environmental design requirements involve protecting the environment from irreversible consequences by satisfying environmental regulations and environmental permits. Mission design requirements involve avoiding large cost impacts and substantial interruptions of the programmatic mission of the facility. Other design requirements can include a collection of design categories such as maintainability requirements, operational efficiency and cost requirements, reliability requirements, and security and safeguards for special nuclear materials. This system makes clear that the protection of personnel is of primary importance. Most SSCs will have several design requirements. The highest category of design requirements that is applicable to an SSC establishes the SSC grade. For example, an SSC with both safety design requirements and environmental design requirements would be graded and treated as a safety SSC. Similarly, an SSC with some mission design requirements but no safety or environmental design requirements would be graded and treated as a mission SSC. In an alternative SSC grading system, the categories and priorities of design requirements could be (1) nuclear safety design requirements; (2) environmental, safety and health (ES&H) design requirements; (3) mission design requirements; and (4) others. In this system, the nuclear safety hazards to personnel—off-site personnel, on-site personnel, or facility workers—are presumed to be the most important type of hazard. The ES&H design requirements would mitigate non-nuclear safety hazards. In applying the graded approach, a matrix can be used to relate various activities within a CM function to the SSC grade. The cells within the matrix indicate the degree of implementation appropriate for each item. An example of this type of matrix is provided below, where the CM activities (the A, B, C, etc. in order of decreasing value per cost) and the SSC grades (1, 2, 3, and 4 in order of decreasing importance) are illustrative only. SSC GRADE CM ACTIVITIES A B C D E 1 Necessary Necessary Necessary Necessary Necessary 2 Recommended Recommended RecommendedNecessary Necessary 3 Recommended Recommended Recommended OptionalNecessary 4 Recommended Recommended Optional OptionalNecessary DOE–STD–1073–93 I-22 If desired, the categories of design requirements can be subdivided. For example, within the safety design requirements, subsets can be defined to cover hazards to off-site personnel, on-site personnel, and facility workers. In such a subcategorization, protection of off-site personnel would correspond to Safety Class 1 as defined in DOE 6430.1A; the environmental design requirements, with the terms "high hazard," "moderate hazard," and "low hazard" as defined in DOE 5481.1B; and mission design requirements, with the DOE 5000.3B definitions of operational delays or interruptions that are reportable. When the design requirements categories are subcategorized, correlations with existing graded approaches become more obvious. Such subcategorizations might be advantageous when phasing program implementation. For example, the protection of off-site personnel could be emphasized during the first phase, with other levels of protection being developed in subsequent phases. The following matrix shows how safety and environmental design requirements can be subcategorized and correlated with each other. For example, the abbreviation SC-2 indicates Safety Class 2.

SUBCATEGORY PERSONNEL PROTECTION ENVIRONMENTAL PROTECTION Nuclear Hazards Other Hazards SC-1 OFF-SITE Significant OFF-SITE Significant N/A Consequences Consequences SC-2 ON-SITE Significant ON-SITE Significant OFF-SITE Consequences Consequences Irreversible Consequences SC-3 LOCALIZED LOCALIZED ON-SITE Irreversible Consequences Consequences Consequences Composite Facility/SSC Grades. Many QA programs now have different quality levels that can be used to differentiate work activities in terms of the importance of the equipment involved. However, there is only a limited number of quality levels—at some facilities, only two; at others, three. Typically, quality level I is applied to safety equipment; quality level II, to other important equipment, such as environmental protection equipment; and quality level III, to the remaining equipment. It is difficult to establish more than three different quality levels for application to activities such as maintenance or testing. The numerous grades of more complex grading systems ultimately need to be reduced to a small number of quality levels for practical application. Integrated, fairly simple grading systems are essential. The following matrix illustrates an example of composite consideration of facility grading and SSC grading and how quality levels can be assigned to various grades of SSCs at facilities of various importance levels. The purpose of this matrix is to show how the highest level of quality (QL–I) should apply to the most important SSCs at the most important facilities. The lowest level of quality (QL–III) should apply to the least important SSCs at the least important facilities. In the middle, medially important SSCs at medially important facilities receive the middle level of quality assurance actions (QL–II). This table illustrates one method for achieving the general goal of applying the greatest resources to the most important SSCs and the least resources to the least important SSCs. DOE–STD–1073–93 I-23 SSC GRADE FACILITY GRADE Most Important Important Least Important Most Important QL-IIQL-I QL-I Important QL-IIQL-I QL-III Least Important QL-II QL-III QL-III After facility and SSC grades are applied, the general CM program criteria have been adjusted to become appropriate facility-specific criteria. The second step In program planning is to determine what new work (i.e., upgrade actions) is necessary to meet those criteria and when those actions should be taken. 1.4.2.6 Existing Programs and Procedures A primary intent of this Standard is: to take credit for existing programs and procedures where appropriate; to modify existing programs and procedures where necessary; and to develop new activities only when essential. At a facility where the existing programs virtually satisfy the facility CM program criteria, very little new work is needed; at a facility where the related procedures are weak, more work is necessary. A CM program should not initiate repackaging of existing programs and procedures. For example, if a facility has an adequate document control program, there would be little benefit in requiring that facility to repackage the program for the sole purpose of meeting new CM program criteria. Improvements that ensure satisfaction of the technical aspects of the facility CM program criteria should be pursued.

For existing individual procedures that provide CM-related functions and for fully developed CM programs, a comparative evaluation should be performed to determine how well the functions provided by the existing programs and procedures match the functions described in this Standard. Such an evaluation would establish a technical basis for concluding that existing programs provide the CM functions. For example, the following programs should be reviewed for interfaces with the CM program: SAR upgrade, design control, quality assurance, document control and records management, procedure change control, temporary modification control, maintenance, facility status and operational configuration control, and lockout and tagout. Some of these interfacing programs provide important inputs to the CM program, some perform functions for which the CM program can take credit, and others need a functioning CM program to have valid information to use. At some DOE facilities, the contractor may have already developed a CM program. Rather than discard that program and begin developing a new one to meet the program criteria described in this Standard, the contractor should assess the original to determine the extent to which it conforms to these criteria. This graded-approach consideration involves evaluating those currently approved programs and procedures that are closely related to the functions of a CM program. Functional flowcharting techniques and functional comparative reviews should be used to evaluate existing programs and procedures. These evaluation techniques are discussed in Section 2.5. DOE–STD–1073–93 I-24 1.4.2.7 Facility Life-cycle Phase The life-cycle of a facility includes a design phase, a construction phase, an operational phase, and a shutdown/deactivation phase. A major renovation or redesign phase is needed in some cases because the DOE programmatic mission for a facility may shift and significant facility changes may be involved. The phase of the facility life-cycle determines the relative importance of, and thus the degree of emphasis on, issues such as design basis, design requirements, current as-bult configuration information, system acceptance and preoperational testing, design control programs, periodic operability surveillance programs, document control programs, facility life extension efforts, and decommissioning plans. The facility life-cycle indicates the amount of emphasis and rigor that is appropriate at various stages in the life of the facility. Once the life-cycle phase has been taken into account, the upgrade actions necessary to meet the facility-specific criteria have been defined. 1.4.2.8 Phased Implementation The CM program plan establishes schedule milestones, each defined by and associated with a specific deliverable. These milestones form the basis for implementation scheduling. Most facilities have multiple safety improvements in the planning or implementation stages at any given time, and the CM program upgrade actions need to be integrated with these improvements. The improvements on the composite list of should be prioritized and appropriate schedules developed. The schedules should provide for implementation over a specific period, with due consideration of facility needs and resources that can realistically be expected to be available. The availability of qualified personnel and program funding can influence the achievable schedule for implementing the CM program.

The CM program plan should discuss the prioritization methods used to establish phased implementation and explain why the priorities are appropriate for the facility and its situation. It should also discuss the feasibility of the work involved in attaining each of the top-level and intermediate milestones: Are sufficient resources available? How does the priority assigned the CM program compare with that of other programs? What are the most likely causes of delays or interruptions in implementation of the CM program? 1.4.3 GENERAL APPLICATION OF GRADED APPROACH From an overall CM program perspective, the greatest impact of the graded approach is related to the facility size and complexity. A significant impact can arise from consideration of the facility remaining lifetime, because many facilities may have relatively short remaining lifetimes. Another significant impact is related to the number of SSCs selected to be included in the CM program. Two CM program elements, change control and document control, are continuous processes. The graded approach should not be used to eliminate any steps or functions from these processes. The level of effort for processes is generally determined more by the number of items entering the process than by the graded approach. Management may decide to tailor the degree or rigor of certain functions based on SSC importance. For example, adjusting the degree of technical and management reviews to be commensurate with SSC grades would be expected. The DR adjunct program is the portion of the overall CM program most amenable to a graded approach. Adjustments in design information searches, regeneration, and documentation are determined primarily by the SSC grade. For the MCA adjunct program, on the other hand, the graded approach is based on facility-level rather than SSC-level considerations. Many facilities may need no further MCA activities beyond estimating the facility remaining lifetime and preparing the MCA program DOE–STD–1073–93 I-25 plan. If the DOE desired lifetime is greater than the remaining lifetime, application of life extension techniques is necessary. As the overall CM program effectiveness and completeness is reviewed in subsequent years, questions may arise regarding the original application of the graded approach. In response to these questions, first, the periodic programmatic assessments should be considered for determining whether the program is effective in maintaining the CM basic relationships. Second, the program plan should be reviewed to ascertain if the planning and development assumptions remain valid. In some cases, the controls appropriate at program initiation may be found several years later to be no longer necessary. Third, the CM Standard should be re-reviewed to ascertain if any features that were not incorporated in the original CM program need to be added because the situation or circumstances have changed. If significant adjustments are needed, the CM program plan should be revised. Specific application of the graded approach to each CM program element and the adjunct programs is presented following the associated implementation guidance. DOE–STD–1073–93 I-A-1 APPENDIX I-A CM PROGRAM INTERFACES Identifying interfacing programs and defining the appropriate interface to achieve effective configuration management is an important function of the program management element. Some of these interfacing programs provide important inputs to the CM program and some perform functions for which the CM program can take credit. Recognition of program interfaces can prevent establishment of new programs and functions where they are not needed.

Some of the applicable existing programs have been established or adapted to satisfy the requirements of DOE Orders. The following summarizes some of the more important anticipated interfaces of the DOE CM program with some DOE Orders. • DOE 5480.23, Nuclear Safety Analysis Reports (SARs) establishes requirements for evaluating the adequacy of facility safety bases and developing safety analysis reports. Existing programs to accomplish the SAR upgrade requirements will likely identify, define, and refine important portions of the facility design requirements and design basis, particularly those related to safety. The primary interface is with the design requirements element, including the DR adjunct program. For facilities that are reconstituting their accident analysis to satisfy the SAR Order, this Standard provides effective methods to support the SAR reconstitution. As a summary document, the SAR captures those design, operations, and management aspects necessary for DOE authorization of facility operation. Configuration management encompasses the broader range of design requirements, including not only those aspects necessary to operate a facility safely, but also aspects related to environmental protection and mission needs. DOE 5480.23 requires that SARs be kept up-to-date to reflect current designs, operations, management, and so forth. A DOE CM program establishes complementary mechanisms needed to ensure that the design requirements (summarized in the SAR) are in concert with the facility physical configuration and documentation. Maintaining the integrity of upgraded SARs is an important result of an effective CM program; keeping the SAR up to date is a result of the CM change control and document control processes. • DOE 5700.6C. Quality Assurance (QA) establishes quality assurance requirements for DOE and provides high-level guidance. Topics covered by DOE 5700.6C that interface with configuration management include design control and document control. In the area of design control, the CM program focuses on maintaining CM program basic relationships. With regard to document control, almost every facility has established document control practices, which have been reviewed and enhanced to meet the quality requirements of DOE 5700.6C. In contrast to QA requirements, the CM program establishes integrated, detailed document control processes for facilitating effective and efficient configuration management while continuing to meet the upper-level criteria established by DOE 5700.6C. DOE 5700.6C does not contain the detailed guidance and understanding provided by this Standard. The assessments element of a CM program differs from traditional QA assessments in that it is oriented toward performance and effectiveness and is diagnostic in nature. • DOE 4700.1, Project Management System governs the acquisition, design, and construction of new facilities and major projects. The operational CM program interfaces with DOE 4700.1 in two areas: (1) transition of new facilities to the operational phase from the design and construction phase and (2) major physical changes to existing facilities. For new projects and physical changes performed under DOE 4700.1, the operational CM program should DOE–STD–1073–93 I-A-2 interface both at the initiation of the project and at the transition or turnover to operations. At turnover, the operational CM program needs to receive the design requirements, design basis, and as-built drawings in a format amenable for use in operations and in the CM program. The turnover interface is primarily with the design requirements element.

DOE 4700.1 specifies configuration management activities for design and construction. Each DOE 4700.1 project is required to provide a Project Management Plan at project inception, which addresses project configuration management during design and construction. DOE 4700.1 calls for generation of as-built documentation and other critical record documents during the Title III Construction Inspection activities. The transition plan prepared in accordance with DOE 4700.1 needs to consider the CM program criteria in this Standard to avoid an undue burden during the turnover of new facilities and major modifications. Several key terms used within DOE 4700.1 bear discussion in relationship to definitions established by this Standard. DOE 4700.1 defines baselines as a quantitative expression of projected costs, schedules, or technical progress to serve as a basis or standard of measurement during the project. DOE 4700.1 identifies and controls three different baselines: the cost baseline, the schedule baseline, and the technical baseline. In addition, DOE 4700.1 defines and discusses configuration management in the context of design change control, after initial design requirement identification through final design documentation. This configuration management is necessary but differs from the scope of a DOE operational CM program, which encompasses the design requirements as well as the as-built physical configuration and the facility documentation. DOE 4700.1 also discusses configuration management regarding control of baselines (technical baseline as well as other baselines). The DOE 4700.1 final technical baseline (Title II design) provides the design requirements necessary for the operating organization to implement the operational CM program. The DOE 4700.1 design documents prepared as part of the conceptual design and refined during the preliminary and final design phases, provide the associated design basis. DOE 4700.1, Title III provides the as- built documentation and may also modify the final technical baseline established previously. • DOE 4330.4A. Maintenance Management Program establishes DOE expectations regarding the conduct of maintenance activities on various equipment, including repairable or replaceable equipment and non-replaceable facility life-limiting equipment, at both DOE nuclear and non-- nuclear facilities. DOE 4330.4A identifies the need for preventive and predictive maintenance activities, such as tests, inspections, diagnostics, and trending. These maintenance activities provide assurance that the physical configuration is maintained within its design requirements. DOE 4330.4A includes DOE policy that directly relates to material condition and aging management: "Structures, components, and systems (active or passive) that are important to safe operation of a properly or facility shall be subject to a maintenance program to ensure that they meet or exceed their design requirements throughout the life of the property or facility."

The maintenance program called for by DOE 4330.4A involves the engineering and technical support functions of identifying and evaluating potential degradation mechanisms caused by environmental conditions and service over time and provides direction for timely mitigation of those effects. DOE 4330.4A states that: "Periodic examination of structures, systems, components, and equipment, particularly those important to safe and reliable operation of a facility, shall be performed to determine whether deterioration is taking place ... which threatens performance, safety, or facility preservation." Predictive maintenance, as defined by DOE 4330.4A, consists of the actions necessary to monitor, find trends, and analyze parameter, property, and performance characteristics or signatures associated with a piece of equipment that indicate the equipment may be approaching a condition in which it may no longer be capable of performing its intended function. However, DOE 4330.4A does not provide technical DOE–STD–1073–93 I-A-3 guidance on how these measurements are to be established or how degradation is to be forecasted. The MCA adjunct program develops analytical methods and testing techniques that can be used to meet the requirements of the maintenance program. The MCA program provides an important technical supplement to the maintenance program requirements. In addition to the MCA interface, the CM program interfaces with the maintenance program through the change control and document control elements, which address control of hardware and procedure changes. Within the maintenance program, the main interface is with the work control process, which manages and sequences maintenance activities in the field. Another important interface exists between preventive and predictive maintenance activities and the performance monitoring function of the assessments element. • DOE 4320.2. Capital Asset Management Program (CAMP) establishes appropriate DOE management of its capital assets over the full life-cycle of the assets. As part of CAMP, Condition Assessment Surveys (CASs) determine the current condition of capital assets, estimate times to failure, estimate costs involved in correcting deficiencies, and determine the remaining useful life of capital assets. CASs address a wide spectrum of assets ranging from architectural features and security systems to cafeteria equipment and office machines to paving and street lights. CASs use national consensus standards, methods, and technologies to determine the condition of capital assets. The annual CAMP report, which uses the CAS results, provides DOE with an indication of the funding levels necessary to maintain DOE facilities in adequate working condition. DOE 4320.2 provides for CASs of infrastructure items. The CAS standards and techniques applied to the mainstream of DOE assets are different from the specialized techniques necessary to evaluate the aging degradation of nuclear facility equipment. DOE 4320.2 is linked to the Maintenance Order in that CASs are to be performed when invoked by the Maintenance Order. The Maintenance Order invokes CASs for non-nuclear facilities. Some of the methods and data provided through the MCA program serve a similar purpose to the CAS program. The MCA program can complement the CAS program by providing analytical evaluations of the current material condition and time-to-failure.

• DOE 5480.19, Conduct of Operations Requirements for DOE Facilities establishes DOE expectations regarding the conduct of operations activities. Interfaces with a CM program include operations procedures, control of equipment and system status, and equipment labeling. Both the change control and document control elements address control of procedures important to configuration management, including operations procedures. Control and status of equipment are important for operations control of the as-built facility configuration. The CM program provides input in that it provides a method for determining the as-built configuration. When equipment is removed from operational status for maintenance or testing, the equipment status and control function assures that the operational configuration is known such that the physical configuration can be restored to its proper state upon return to service. Equipment labeling also supports operations control of the operational configuration. • General Design Criteria are established by DOE 6430.1A, General Design Criteria, and DOE 5480.30, Nuclear Reactor General Design Criteria. DOE 6430.1A, which establishes general design criteria for use in the design and acquisition of nonreactor DOE facilities, defines safety class items for nuclear facilities and provides specific criteria for safety class items. DOE 5480.30 defines safety class structures, systems, and components (SSCs) as those, including primary environmental monitors and portions of process systems, whose failure could adversely affect the environment or the safety and health of the public as identified by safety analysis. DOE–STD–1073–93 I-A-4 The CM program assigns SSC grades based upon the most important design requirements applicable to the SSC. SSCs to be included in the CM program encompass safety class Items. In addition to interfaces with DOE Orders, there may be interfaces with established Department-level programs. For example, existing programs and activities to address DNFSB Recommendation 90-2, Codes and Standards, may interface with the development of the CM program. Some of the existing efforts are directed toward identifying the codes and standards used for facility designs, evaluating their adequacy, and reestablishing appropriate codes and standards where necessary. This effort may contribute to formal design establishment and reconstitution activities necessary for a successful CM program. If, however, design reconstitution is pursued first, the CM/DR activities may be used to respond to this DNFSB recommendation. The primary interface is with the design requirements element, including the DR adjunct program. Interfaces with Other Facility Life-Cycle Phases. Some form of configuration management should be provided for each phase of a facility's life, beginning with the design of the facility, continuing throughout the operating phase of the facility, and extending into deactivation. Figure I–A–1 depicts how the CM program described in this Standard relates over the life of a facility. The CM program described in this Standard applies directly to the operational life-cycle phase, with interfaces with the phases before and after. Configuration management during design and construction is vital to having adequate design and as-built information for the operational phase. The interface with the design and construction phase is discussed previously in relation to DOE 4700.1, Project Management System.

The need for configuration management also extends beyond the operational phase. Even when a site is undergoing deactivation, some facilities on that site can be in different life-cycle phases, including design and operation. Site deactivation often includes design and operation of select or new facilities and facility processes to effect cleanup and remediation, such as verification facilities; these should be treated as being in the design and operational phases regarding the extent of CM needed. Further, for facilities being deactivated, the design requirements and documents necessary will be different from those that were appropriate during the operational phase. For example, design requirements and as- built drawings related to waste storage and leak detection and mitigation would likely be maintained during cleanup, whereas items related to process operations might no longer be needed. The information that will be needed for environmental restoration and remediation of the site, such as radiation survey maps and disposal records, should also be identified and controlled. Thus, to support configuration management during deactivation, a review of the design requirements and other documents should be performed to determine which need to be maintained within the CM program. In general, many configuration management processes and controls during facility deactivation are similar to those used during operation, although the scope of design requirements and documents may be greatly reduced. The deactivation plan should address configuration management needs and identify the applicable CM program criteria in establishing an appropriate CM program for deactivation, decontamination and decommissioning, and environmental restoration and remediation. DOE–STD–1073–93 I-A-5 Figure I-A-1. Relationship of a DOE CM Program to the Life of a Facility DOE–STD–1073–93 I-B-1 APPENDIX I-B BACKGROUND MATERIAL AND CONCEPTS FOR OPERATIONAL CONFIGURATION MANAGEMENT This appendix provides background material and concepts to establish the proper context in which this Standard should be understood. The additional information provided here is intended to help managers (and others who want a broad overview of operational CM) understand the background behind this technical standard. This appendix also describes the context in which to apply the concepts of operational CM discussed in this Standard. This guidance was developed to address weaknesses known to exist at DOE nuclear facilities, as confirmed by occurrence reports, Tiger Team assessments, and other external reviews. The main existing source of DOE configuration management requirements, DOE 4700.1, Project Management System, addresses design and procurement configuration control (similar to the DOD/NASA model) in a general manner. These existing requirements are not consistently implemented and are viewed by many DOE contractors to be applicable only during the design and construction phase. Because of uncertainty in the congruence of design requirements, facility physical configuration, and facility documentation, DOE contractors have found that accurate and complete information is not always available to make decisions related to design, operations, and safety evaluations. The Defense Nuclear Facilities Safety Board (DNFSB) has also reviewed configuration management practices in the DOE complex and recommended improvements to enhance safety.

The development of this Standard was based on a technical feasibility study. The study included: review of information on configuration management from the Department of Defense (DOD), the National Aeronautics and Space Administration (NASA), the Nuclear Regulatory Commission (NRC), the Nuclear Management Resources Council (NUMARC), and the commercial nuclear industry; interviews with licensed commercial nuclear utilities and DOE contractors; review of nuclear utility configuration management programs and procedures; and consideration of the status of configuration management experience at DOE nuclear facilities. The study established the basis for a technically appropriate and feasible approach for operational CM programs at DOE facilities. Although developed for nuclear facilities, this Standard can be adapted and applied to non-nuclear applications and provides information that may be useful for other processes, activities, and programs. One of the models of configuration management with which many professionals in the DOE Complex are aware is that used by both DOD and NASA. Discussion and consideration of this model helped in the development of the functional model of operational configuration management described in this Standard. Although the DOD/NASA model and its terminology were not used directly in the functional model of operational configuration management, the philosophy and many of the basic concepts are similar. For example, the basic program elements of the DOD/NASA model (configuration identification, configuration control, configuration audits, and status accounting) generally can be correlated to the basic elements of the DOE operational configuration management program model: configuration identification correlates to the design requirements element; configuration control correlates to the change control element; configuration audits correlates to the assessments element; and status accounting correlates to the document control element. The DOD/NASA model of configuration management is strongly oriented toward the configuration management challenges that arise during the design, procurement, and acquisition phases of a project, rather than those that predominate during the operational phase. This orientation makes its difficult to apply the DOD/NASA model to configuration management of DOE facilities during their operational phase because many of the challenges are quite different in nature and extent. Further, the DOE–STD–1073–93 I-B-2 DOD/NASA model is based on the reasonable assumption that configuration control is established at the beginning of the design phase and maintained throughout the design and construction phases and into the operational phase. Thus, the DOD/NASA model does not address efforts such as design reconstitution that may be needed to reestablish configuration control once it is lost. Yet, this is one of the most common challenges facing DOE nuclear facilities today. Experience in the restoration of configuration control at commercial nuclear facilities offers a rich source of lessons learned that address this aspect of operational configuration management. For this and other reasons, DOE operations and facilities must streamline operations and administration as much as possible. Streamlining and combining functions to achieve greater efficiency are made easier by the functional model of configuration management. The functional model encourages adaptation, improvement, and incorporation of existing programs that accomplish configuration management functions, rather than the creation of new programs and procedures.

1-B.1 PROGRAM MANAGEMENT ELEMENT The DOE CM program includes the program management element to manage overall program development and implementation. Program management is necessary because of a number of factors, including the size and complexity of the overall program, the number of organizations affected, the investment of resources, and the importance of the program to facility safety and mission. The CM program affects many organizations and disciplines, such as design engineering, operations, maintenance, testing, and procurement. To achieve CM program success, maintaining the CM program basic relationships should become a goal of each interfacing program and organization, and every person involved in these programs and organizations. The program management element ensures that the various aspects of program development and implementation are integrated, complete, and effective. The program management element provides the leadership and management necessary to coordinate and integrate the many program functions and activities. This program element ensures that the efforts of the other elements are in balance (i.e., there is not too much effort in one area and too little in another) and maintains sight of the overall programs objectives. This program element also establishes the overall CM program scope and objectives, develops the program plan, and defines the appropriate program and organizational interfaces. To establish a consistent and common understanding throughout the affected organizations, the program management element communicates the program scope and activities through standard concepts and terminology, CM program orientations and general training, and top-level CM procedures. Terminology, definitions, procedures, and training associated with the CM program are very important to program success. This program element also establishes and maintains certain controls that cross many organizational boundaries, such as technical vendor control and database control. In addition, this program element controls and monitors CM program development and implementation activities to ensure adequate performance of the CM program. Implementation of the most successful CM programs is initiated by: (1) instituting the program in a top- down manner, beginning with a top-level policy and plan; (2) planning the initial scope of the CM program in broad enough terms to support overall design and operations activities; and (3) determining at the outset the end products of the program. Most facilities implementing CM programs have found that because of the size, complexity, and interfaces with existing programs, careful program planning is needed and should include identification of milestones, schedules, deliverables, and projected costs. Because the development of the CM program will likely extend over several years, intermediate deliverables are essential. In addition, because of staff and/or contract support turnover, long-term planning is necessary for continuity of implementation. The program management element establishes and communicates program expectations through a number of formal policy documents, such as policy directives, program and action plans, and governing DOE–STD–1073–93 I-B-3

procedures. The program management element also ensures that appropriate lower-level or implementing procedures are in place for each CM program function. These vehicles or mechanisms, used to implement the program management element, support program implementation by providing increasing levels of detail to communicate program direction and guidance. CM policy directives confirm management support for the CM program, establish program scope and terminology, and establish key roles and responsibilities. CM program plans define specific actions and program commitments. Action plans go into further detail, describing methods, procedures, staffing, and schedules to accomplish the program plan commitments. Governing procedures identify the specific implementing procedures for accomplishing the CM program functions and correlate the implementing procedures to the CM program plan. CM programs can be directed and managed at different organizational levels: the corporate level, the site or division level, and the facility level. Program management and direction need to be consistent through each level. Where possible, consistent corporate approaches should be pursued. Based on the structure of most of the operating/managing organizations at DOE facilities, a centralized approach to CM program development and implementation should be adopted for each site/division. In this top- down approach, general she/division program policy and criteria are established at the site/division level (i.e., the prime contractor at a DOE site), with guidance on acceptable implementation variations allowed for different facilities within the site/division structure. These implementation variations would be based on individual situations and considerations. Upon receipt of the site/division CM policy directive, each facility manager should promulgate the information contained within the directive, and should adapt and expand CM program criteria, consistent with the site/division direction. Site/division directives should provide the expectations and guidance necessary for facility CM program planning. Recognizing that the structure of each operating/managing organization is different, an additional management level might exist between the site/division level and the facility level. In this case, site/division CM policy directives might be prepared at more than one organizational level. Wherever the term site/division is used, the appropriate interpretation should be applied. I-B.2 DESIGN REQUIREMENTS ELEMENT Design Process. The design process is the technical and management process that begins with the identification of design inputs and constraints, processes this information, and results in the issuance of design requirements. For each design, the design process; defines and documents the design inputs; identifies and adheres to the design constraints; performs and documents the analyses, calculations, and technical evaluations; and assures that the design outputs are complete and documented. Design requirements may be changed only through the engineering design process. Figure I-B-1 depicts the design process to support understanding of these four fundamental parts, described further below.

• Design inputs consist of those specific criteria, limits, bases, or other initial requirements (such as specific functional requirements, specific codes and standards, and specific regulatory commitments) upon which the detailed final design is based. In comparison to design constraints, design inputs are specific in nature; they are specific to one design activity. For example, a design input for a given air-operated valve might be that it needs to open in 10 seconds against a pressure differential of 100 psig. • Design constraints are those general restrictions and limits to the engineering design process that ensure consistency and quality of designs (such as general codes and standards, general regulatory commitments, quality assurance requirements, engineering procedures and good practices, and adopted design methodologies). In comparison to design inputs, design constraints are general in nature; they apply to multiple classes and categories of designs and, DOE–STD–1073–93 I-B-4 DOE–STD–1073–93 I-B-5 therefore, to many different designs. For example, a design constraint for various safety systems might be that they will be designed with sufficient capabilities to accomplish their assigned safety functions in the presence of a single failure. • Design analysis and calculations are those intermediate design products that are necessary to convert the design inputs and constraints into appropriate and complete design outputs. Design analysis and calculations consist of a wide variety of engineering analyses, calculations, studies, reports, and technical review checklists necessary to perform complete engineering design. Examples of design analysis and calculations are: transient analyses, criticality analyses, seismic stress calculations and analyses, equipment sizing calculations, net positive suction head calculations, and engineering evaluations of equipment qualification and fire protection. Design analysis and calculations capture the design assumptions and identify the available design margin. The design margin is the conservatism between the specified design requirement and the minimum requirement that could be developed from the design basis. • Design outputs are the documented products of the design process that specify the design requirements for the facility structures, systems, and components, (SSCs). The design outputs are the composite result of the engineering organization's consideration of the design inputs, design constraints, and design analysis and calculations. Design outputs specify what is required. Design outputs specify the necessary functions, capabilities, capacities, physical sizes and dimensions, limits and setpoints, etc., as supported by the design basis. Examples of design output documents are design change packages, drawings, specifications, load lists, valve lists, one-line electrical diagrams, and setpoint lists. Design outputs include the functional requirements, as well as procurement requirements, quality assurance actions, construction/installation specifications and instructions, post-installation testing, post- maintenance testing, and periodic surveillance/testing requirements. In some cases, the design outputs are also referred to as the "as-designed conditions." The design output documents provide the design requirements that dictate the physical configuration of the facility. Design outputs best support the CM program objectives when they are documented in a format amenable for proper use by the various user organizations, including procurement, construction, operations, maintenance, and testing, as well as design engineering.

In relation to the design process, the CM program should be concerned primarily with identifying the design requirements and design basis established by the design process and with maintaining the CM program basic relationships based on the established design requirements. Design controls are the measures established to ensure that the design process activities are carried out in a planned, orderly, correct, and documented manner. Design controls have a direct impact on the quality of the design requirements that ultimately drive a CM program. One of the most important design controls is the establishment of the design authority. The design authority is the single organization responsible for establishing the design requirements, ensuring that design output documents accurately reflect the design basis, and maintaining design control and ultimate technical adequacy of the design process. Appendix II-A provides further information on design control. Appendix II-B provides examples of design inputs, constraints, analysis and calculations, and outputs. Design Basis vs. Design Requirements. Proper implementation of the DOE CM program entails an understanding of the terms "design requirements" and "design basis." These terms have been a particular source of contusion in the commercial nuclear industry. Some references define design requirements to include not only the specific requirements but also the basis for those requirements. Other references define design basis to include essential design requirements. From the designer's viewpoint, design requirements might be the design inputs that are essential; from a construction or installation viewpoint, design requirements might be everything on the drawings and specifications DOE–STD–1073–93 I-B-6 generated by the engineering organization and approved for construction; from an operator's viewpoint, design requirements might be a combination of these other views. Because the DOE operational CM program focuses on the operational life-cycle phase, it is oriented more toward the operating organizations (which includes maintenance and testing) than the facility design or construction organizations. From this context, a DOE operational CM program defines design requirements as the output requirements the design organization has placed on the facility configuration. In contrast, incoming requirements to the design organization are design inputs. Historically, changes were made to the facility hardware at some commercial nuclear facilities without a full recognization that the design was being changed. Heightened industry awareness led to an appreciation that hardware changes were, in fact, design changes that needed careful evaluation and prior approval. Everything involved with the design of the physical hardware was considered to be the basis for the physical design, including the functional requirements, the physical characteristics, and the required performance capabilities, as well as the underlying calculations and analyses. Many nuclear utilities developed summary design documents, which they called Design Basis Documents, describing both what is required and why it is required. The term "design basis" was used to support the central concepts that physical changes are design changes and that an appreciation for the basis of the physical design is necessary. However, this usage of the term design basis lacked accuracy.

As commercial nuclear and DOE experience accumulates, it has become apparent that the physical design does not actually conform with the design basis. Rather, the physical design matches the design output requirements. The design basis, in turn, provides the information demonstrating that the design output requirements are appropriate. To take advantage of this improved understanding, this Standard adopts refined definitions for design requirements and design basis. In simple terms, the design requirements specify what is required and the design basis explains why it is required. The total set of design requirements and design basis is referred to as the design information. The following example illustrates the difference between design requirements and design basis. A design has been requested for a safety heat removal system. The design inputs might state that the system needs to provide at least 165 gpm of light water with a temperature no greater than 80 EF into a system that is pressurized at 125 psig. The origin for this design input might have been a worst-case accident heat removal calculation. The pump sizing calculation might be performed according to a defined engineering procedure for pump sizing. From these design inputs, constraints, analysis and calculations, the design outputs might specify a centrifugal pump with a 200 gpm rating at 150 psig. For this example, the requirement for 165 gpm at 80 EF into 125 psig is a design input. However, the pump design requirement specifies a 200 gpm pump at 150 psig. The difference might have come out of calculational uncertainties or specified design constraints, or it might be a reflection of the conservative margin employed by the designer. Regardless, the design requirement is 200 gpm at 150 psig. In addition, the nameplate rating of the pump purchased to meet this requirement might exceed the design output requirement, thus providing an additional margin. In a different case, the design output might be identical to the design input. The design process, through its constraints and analysis and calculations, does not always result in a change of the original design input. As a matter of good practice, design requirements are best specified as the minimum acceptable value, without excessive built-in design margin. For example, a design analysis determines that a 200 gpm pump is needed to meet system requirements, but the vendor can only supply a 250 gpm pump. The pump design requirement is best established at 200 gpm because this is the value the designer determined is needed to satisfy the system design requirements. The procurement specification might state the 200 gpm design requirement and request the 250 gpm pump that is available to satisfy it. The 200 gpm value is preferred as the specified design requirement because it tends to minimize DOE–STD–1073–93 I-B-7 unnecessary requests for engineering evaluations from the operations and maintenance organizations (e.g., if the pump loses its ability to pass a surveillance test for 250 gpm). If, on the other hand, the designer had decided to specify an oversized pump, the design requirement would be 250 gpm and the design basis would reflect the rationale for the requirement. Appendix II-B provides further examples of design requirements and design basis.

Distinguishing Types of Design Requirements. Distinguishing among the various types of design requirements is beneficial, not only for establishing, documenting, and maintaining the design requirements and associated design basis, but also for evaluating changes. Changes to safety design requirements generally involve unreviewed safety questions (USQ) evaluations and more significant reviews and approvals. Other design requirement changes may be readily accepted from a safety viewpoint. Further, certain CM functions and activities may be implemented on a graded approach. Distinguishing among the design requirement types is necessary to apply graded approach options. SSC grading is also necessary and useful for other facility programs, including the maintenance program, the QA program, the SAR upgrade program, etc. Some design requirements do not relate directly to safety, environment, or mission. For example, the designer might specify a design requirement for ease of operations, maintenance, or testing, or based on equipment availability. Specifically, a centrifugal pump might be available and specified, while a positive displacement pump could also have been acceptable. These design requirements cease to be optional after the design process is complete. They were optional to the design engineer, but once established, they are design requirements that need to be translated into the physical configuration and facility documentation. The ability to control overall configuration depends on identifying and including the full set of design requirements, particularly for important systems. As an example of the importance of categorizing design requirements, suppose the pump installation specification from design engineering states that a minimum of 4 feet of free space needs to be provided around the pump. This requirement might have emerged from a maintenance consideration, in which case it is not directly related to safety, environment or mission. The documented basis for this design requirement might have been a simple notation in the design package. Alternatively, the pump might need free space to dissipate worst-case heat loads to achieve its safety function. In this case, the design requirement would be a safety design requirement and a heat-load calculation would be expected as part of the design basis information for the pump. Knowledge of the design requirement type and its basis is needed to evaluate proposed design or operational changes. I-B.3 DOCUMENT CONTROL ELEMENT A CM program does not encompass the entire scope and functions of an overall facility or site document control program. The scope of an overall document control program might be larger than the CM program's document control element; it might include administrative records and information on equipment outside the CM program scope. A CM program deals with that subset of information necessary for adequate configuration management. A CM program provides input to the overall program by defining those special document control activities needed to support an effective CM program. However, it should not absorb the functions of an overall document control program. Individual facilities will have to decide the best method to integrate CM document control criteria into their existing program for document control. In contrast to traditional document control programs for satisfying QA requirements, the CM program document control element emphasizes the technical content of the documents and the needs of the document users. It includes provisions for document ownership by technical organizations, tools to support document identification and retrieval, timely distribution of document changes, tracking of pending document changes, and timely retrieval of requested documents.

DOE–STD–1073–93 I-B-8 An objective test of whether a CM program is effective is through comparison of the design documents, the facility documents, and the physical configuration for consistency. Within the DOE CM program, the term "document" includes paper copies (procedures, manuals, records, etc.), electronic media (such as word processor files and computer databases), and any other source(s) of information used to design or operate the facility or make sound technical decisions. Types of Documents. Many types of documents are important to a CM program. These document types can be grouped into two broad categories: (1) design documents that are used primarily by the design organization and (2) facility documents that are used primarily by the facility operating organization. The design documents include both the design output documents that define the design requirements and the design basis documentation, which captures the rationale behind the design requirements. Design documents include design specifications, design change packages, design drawings, design baseline analyses, setpoint calculations, design engineering procedures, system descriptions, seismic pipe hanger design and support detail drawings, summary design documents (such as SARs), correspondence with DOE that provides design commitments, and other documents that define the facility design. Appendix II-B provides further examples of design documents. The facility documents include the as-built documentation, facility procedures to support operational activities, and facility operational records. Facility documents include: emergency and normal operations procedures, maintenance procedures, and test procedures; as-built drawings; facility equipment/component lists; vendor manuals and bulletins; Technical Safety Requirements; equipment performance and maintenance records; radiation survey maps; correspondence with DOE that provides operating commitments; and other documents that support facility operations. Training lesson plans, examinations, and associated material are also important facility documents that should receive attention within the CM program. Each type of document may have associated with it different objectives regarding storage, retrievability, control, and tracking. As-built drawings of safety systems might have the most stringent objectives for prompt revision and immediate access, reflecting their importance to ongoing operation. In contrast, certain design basis records might be stored remotely, with the capability to be retrieved within 1 week of request. Document Owners. Ownership of documents within a CM program is essential for controlling the documents and avoiding unauthorized changes. The owners are the functional groups assigned responsibility by facility management for developing and maintaining the technical adequacy of these documents. Typically, the operations organization would be the document owner for normal and emergency operating procedures; the engineering organization might be responsible for facility drawings, and the procurement organization would be responsible for purchase documents. The document owner, not a central document control organization, establishes the document types to be controlled within the CM program. The owner also establishes document's relative importance to users, which influences its storage, retrievability, control, and tracking objectives. A central document control organization may be established to support the owners by ensuring that documents important to the CM program are properly stored, controlled, tracked, and retrieved. The document owners maintain active involvement in any activity that can affect the technical adequacy of the documents assigned to them.

Document Control vs. Records Management. The terms "document control" and "records management" are sometimes used to differentiate active and historical documents. Although the objectives, techniques, and emphasis for both these processes are somewhat different, for the purpose of the DOE CM program, many records management functions parallel the document control element functions. These terms are briefly described as follows: DOE–STD–1073–93 I-B-9 • Document control activities deal with current or working documents such as procedures and drawings. The objective is to ensure that the latest approved revision is available and used by facility staff in the daily performance of their jobs. Emphasis is placed on identifying, tracking, and statusing controlled documents. • Records management activities deal with historical records (such as test and calibration results) retained to ensure auditability and proof of performance. Emphasis is placed on indexing (i.e., showing existence and location), storing, and retrieving records for future use. Since both the working documents and historical records can contain design requirement and facility configuration information, their availability, consistency, and accuracy need to be maintained in accordance with the CM document control element. I-B.4 CHANGE CONTROL ELEMENT The identification and clear understanding of the mechanisms that can lead to configuration changes is the first step in the development of an effective change control element. At facilities where configuration management has been compromised most severely, the primary cause is often inadequately controlled changes. Particular problem areas noted at DOE facilities include recognition and control of changes made during maintenance, operational changes, temporary hardware and procedure changes, and document-only changes. Effective implementation of change control often entails a culture change within the facility operating organization. Often facility personnel need to be trained to understand how unapproved configuration changes could be accidentally introduced, why every change affecting facility configuration needs to be identified and controlled, and what methods will be used to control them. To ensure completeness in the identification of all potential change mechanisms, facilities should review their facility work processes for both the change types and their associated change sources. Change control needs to be established prior to performing other configuration management activities that involve changes, such as establishing or reconstituting design requirements, or else the improperly controlled products of these activities can become obsolete. Types of Changes. Changes can be grouped into three basic types, corresponding to these areas whose relationship is maintained by the CM program: (1) design changes which involve changes to the design requirements; (2) physical changes, or hardware changes, which involve changes to the physical configuration; and (3) document changes, which involve changes to the facility documents. Although a proposed change can involve each change type (design, physical, and document), each change type is not necessarily involved in every proposed change. For example, CM document changes may be made without changing the physical configuration or the design requirements. Further, physical changes within the established design envelope do not involve design changes. Each change type is discussed further below.

• Design Changes. Design changes are usually prepared to support desired changes in facility operational capability and often lead to physical changes. Design changes may also be made based on new design analysis or new information. Field changes, facility physical changes outside the design envelope, and nonconforming items dispositioned "use-as-is" and "repair" also involve design changes and need design evaluation. Design changes need to be approved by the design authority, in accordance with the design process, under appropriate design control. A small subset of design changes affects only design documents. However, most design changes result in both changes to the facility physical configuration and the associated facility documentation. The control of facility physical changes and facility documentation changes that result from design changes is covered by this program element. DOE–STD–1073–93 I-B-10 • Physical Changes (Hardware Changes). Uncontrolled physical changes can be a major contributor to the loss of facility configuration. They are changes made to SSCs that after the characteristics or function of the facility. A fundamental objective of the change control element is to ensure that each physical change is formally processed to evaluate consistency with the design requirements and to identify possible impacts on the facility documents. Physical changes that are associated with design changes are easily recognized and, thus, tend to be well controlled. For example, changes processed formally as projects under DOE 4700.1 are obvious changes and receive more rigorous review and implementation than some other changes. Other sources of physical changes (such as maintenance or operations activities) can be less obvious and can receive inadequate attention. Temporary physical changes, such as hoses and temporary pumps, that have been allowed to remain in place for extended durations can be major contributors to configuration problems. • Document Changes. Document changes are usually necessary to implement changes in the physical configuration. Each physical change may involve a number of facility document changes to maintain configuration control. For example, the following document changes may be needed: drawing revisions, procedure revisions, setpoint list revisions, equipment list revisions, and training lesson plan revisions. A subset of document changes is document-only changes. These changes do not affect the facility physical configuration, but do after the intent, content, or accuracy of facility documents. Document-only changes are often made to correct errors or discrepancies or to enhance existing documentation. Possible document-only changes are drawing corrections, corrected equipment lists, procedure changes, or training lesson plan changes. Each document-only change needs to be carefully evaluated to ensure that it is consistent with the design requirements and the facility physical configuration. A common problem affecting facility configuration is updating facility documents to reflect the as-built configuration without performing the appropriate technical review.

Inadequately evaluated document changes can result in facility equipment being operated outside of the design requirements. For this reason, changes to documents that are controlled within the CM program need to be included in the change control program and be evaluated to determine possible impact on facility operation and consistency with the design requirements. Because document changes with subtle or no physical changes often may not receive a technical review, special attention should be given to deviations from normal valve line-ups, special tests, setpoint changes, or other changes that can be a departure from the design requirements or previously evaluated conditions. Sources of Changes. The basic change types can be initiated from a variety of sources. Changes can be initiated by numerous organizations such as operations, maintenance, procurement, design engineering, and technical support/systems engineering. The following discussion of major change sources demonstrates some of the ways the facility configuration is changed. Operations changes are those adjustments of normal practices and operational limits made to enhance system availability or to accommodate special operating conditions. Operations can be the source of design changes, such as a change to a control system to provide better flexibility or more margin. Such a design change would also result in a change to the physical configuration and the facility documentation. Operations can also be the source of physical changes that do not involve a design change, such as an allowed alternate mode of operation or a setpoint change within the established design envelope. Operations also initiates document changes such as operating procedure changes. DOE–STD–1073–93 I-B-11 Acceptable operations changes are only those that have been documented and evaluated to ensure consistency with the design requirements. Unreviewed operations changes can cause inadvertent deviations from the design requirements. For example, adjustments in instrument and equipment setpoints can have adverse secondary effects on such engineering considerations as safety margins and response times. Similarly, lifted leads, jumpers, and other temporary physical changes need careful attention. Maintenance activities can also be a major contributor to changes in the facility. Effective controls are essential to ensure that unevaluated changes are not introduced into the facility by maintenance personnel. Therefore, clear guidance on the conduct of maintenance should be provided to ensure that the differences between a change and routine maintenance are known and understood. Under adequate change controls, the maintenance organization may not make physical changes except when it is acting as the constructor for an approved physical change or is making changes within the design envelope. Maintenance activities that change the facility without an evaluation for consistency with the design requirements are unacceptable. The work control program, which manages and sequences maintenance activities in the field, is the vehicle to implement effective change control.

Acceptable maintenance activities involve the routine repair or restoration of facility hardware without altering the physical or functional characteristics (i.e., the design requirements). Maintenance may replace a part or SSC with an identical item (i.e., identical make and model number, identical constituent parts, identical function, etc.). Identical replacements do not involve a change to the physical configuration, the facility documentation, or the design requirements. An equipment replacement with anything other than the identical part constitutes a change. In other words, the facility physical configuration is no longer the same, and the corresponding facility documentation should be updated to reflect the physical change. To support maintenance activities, the design engineering organization may predefine acceptable replacements or changes (other than the identical item) and provide this information to the maintenance organization in the form of a design envelope. Design envelopes provide the preapproved set of limits or constraints within which changes may be made without exceeding the design requirements. Maintenance changes that lend themselves to design envelopes are changes to torque values, maintenance assembly sequences, machining tolerances, heat exchanger tube plugging limits, rotating equipment vibration limits, or other routine activities where design envelopes can be established. If a proposed change is not within the bounds of the defined design envelope or if no envelope has been provided, the change involves a design change and may not be made without design engineering evaluation. Procurement of replacement parts to support maintenance activities can introduce unidentified and uncontrolled changes. Procurement changes may result from changes in suppliers or changes in production by current suppliers. For example, the procurement organization might purchase a slightly different (but manufacturer's equivalent) lubricant for a pump. Procurement of replacement parts that differ from the original item should be identified for technical review. Any difference, including a so- called manufacturer's equivalent, needs to be formally evaluated and documented by the design engineering organization to ensure that safety and reliability have not been degraded and that conformance to the design requirements is maintained. Timely identification and evaluation of procurement changes can enhance maintenance productivity. Each facility will need to thoroughly review existing work practices to identify every change source. Some change sources are subtle and can be overlooked. For example, facility and document changes can be introduced through software changes. Software has diverse applications, from supporting design analysis and documentation to performing safety functions as part of the facility configuration. As such, software changes can lead to any of the three basic change types. Software that reflects DOE–STD–1073–93 I-B-12 design basis information, design requirements, facility configuration, or is used in any manner to make technical or safety decisions would fall within the scope of the CM program. Like other changes, software changes need to be identified, evaluated, approved, implemented (with post-implementation acceptance criteria for verification and validation), and documented prior to use.

Process Owner Concept. Each identified change control process encompasses a group of subprocesses, activities, and tasks that take an input, add value to it, and provide an output to an internal or external customer. The process owner is the individual assigned by management to be responsible for ensuring that the total process is both effective and efficient. As part of this responsibility, the process owner ensures that CM change control functions are accomplished. Processes often have a natural owner, the person who produces the final process result, makes the significant process decisions, or facilitates the process flow. The process owner also needs to have process knowledge, leadership ability, and the power to act on the process (eg., resources, authority, influence). Within the context of the CM program, once valid change control processes are identified, facility management would assign a process owner for each process. The process owner would lead the evaluation of existing CM controls to determine their effectiveness and recommend upgrade actions, if needed. After upgrade is complete, the process owner would continue to ensure that the CM change control functions are effectively performed. If needed, personnel with CM training and expertise would be provided to assist the process owner, particularly during process evaluation and improvement. System Engineer Concept. One of the challenges of change control is to be cognizant of many ongoing changes—from proposal, through development, to implementation—and to understand the integrated effect of the various changes. The system engineering concept has been used in the commercial nuclear industry to provide a technical focal point for each system. The system engineer develops resident technical expertise and facility knowledge, centralizes resolution of SSC performance problems for more timely and effective response, and interfaces between the facility operations and maintenance organizations and the design engineering organization. The systems engineering concept benefits configuration management as well as many other facility activities including facility status and troubleshooting, operations support, coordination of testing and other system- related activities, and communication among departments. For the purpose of change control, it is recommended that DOE contractors, in a manner similar to the commercial industry, institute the systems engineering concept. The duties, responsibilities, and interfaces of each system engineer need to be clearly defined, documented, communicated to and understood by supporting facility organizations. System engineer responsibilities should include these major items: (1) monitoring and tracking the status of the system, especially during changes (e.g., physical changes in progress and temporary physical changes); (2) conducting and/or observing equipment performance monitoring, evaluating the results of performance monitoring and surveillance, trending, important data, and initiating corrective actions; (3) reviewing and approving post-modification, post-maintenance, surveillance, and special test procedures and test results; (4) providing assistance to operations and maintenance, as needed; and, (5) identifying any situation where the design engineering organization should be consulted for advice or services.

To implement systems engineering, selected facility engineers would be assigned the responsibility of important systems. These individuals should have an engineering degree or a strong technical background combined with a knowledge of the assigned system and how it relates to overall facility operation. An understanding of the policies, procedures, and organizational interfaces is also important. The number of systems assigned to each engineer should be limited (e.g., two to five) based on system complexity, the experience of the individual, and time considerations. DOE–STD–1073–93 I-B-13 I-B.5 ASSESSMENTS ELEMENT Performance of the assessment element functions occurs over three phases or stages: Initial Assessments (performed to support CM program planning); Post-Implementation Assessments (performed after the development of various CM programs, program elements, and functions); and Ongoing Assessments (established during CM program development and performed throughout the operational life of the facility). Figure I-B-2 shows the major assessment functions or activities, grouped by appropriate time frame, that are necessary to fully establish the assessments element. The initial vertical and horizontal slice assessments accomplish the initial CM programmatic effectiveness and initial physical configuration assessments. The initial CM programmatic assessments review various existing programs, processes, and information related to configuration management to determine which of these are already adequate for an effective CM program and which need improvement. One-time, post-implementation assessments provide assurance that the CM program elements and functions have been properly developed and are being implemented effectively. The ongoing assessments provide assurance that proposed changes are acceptable and properly implemented, that equipment continues to meet its design requirements, and that the overall CM program is effectively meeting Its objectives. Some functions fall into more than one timeframe. For instance, CM programmatic assessments are conducted in the initial, post-implementation, and ongoing timeframe; physical configuration assessments are also conducted in each time frame. Each of the assessments element functions has ongoing activities. Vertical and Horizontal Slice Assessments. The main objective of the initial CM assessments is to assess existing programs and processes related to configuration management (such as change control, the design process, and document control) in order to identify strengths and weaknesses as early in the development phase as possible to determine whether upgrades are necessary. The extent of existing CM functional deficiencies can be determined by assessing the technical adequacy and consistency among the design requirements, physical configuration, and documentation. The magnitude and underlying cause(s) of these deficiencies establish the foundation for improvements. Initial programmatic assessments are a combination of vertical slice and horizontal slice assessments. Vertical slice assessments are top-down, diagnostic evaluations performed on a selected system across various programs that affect the hardware system. The primary objective of this application of vertical slice assessments is to determine which programs have been effective for that facility system and which programs have not been effective. Horizontal slice assessments concentrate on a single program, such as change control or document control, and are also diagnostic, but cut across many systems to determine the effectiveness of the program. Horizontal assessments also include assessments of topics (such as seismic or fire protection) across many systems and organizations. Both assessments types use many similar assessment techniques, although the focus is different.

Each assessment type can identify problems in existing control programs related to configuration management through different but complementary approaches. Although it is necessary to correct specific weaknesses that could cause system unavailability or unreliability, the primary purpose of these diagnostic assessments is to identify the underlying causes that could affect other systems and programs. Information acquired through these assessments is used to establish the basis for the CM program development and implementation efforts. Increased in-house knowledge of system design and program operation is an additional benefit of the assessment. A frequently used form of a vertical slice assessment is the Safety System Function Inspection (SSFI). Although an SSFI is not the only method for performing a vertical slice assessment, it is the DOE–STD–1073–93 I-B-14 DOE–STD–1073–93 I-B-15 recommended method for accomplishing initial assessments. Since most system-specific deficiencies identified by the SSFI are an indication of programmatic weaknesses, an SSFI has proven to be an effective method for evaluating facility CM programs and processes. For example, an SSFI might find that the design requirements for the inspected CM system are not adequately documented. The solution may be to update the change control and document control programs consistent with the CM program objective and criteria. NSAC-121, "Guidelines for Performing Safety System Functional Inspections," provides additional guidance regarding the performance of an SSFI. The traditional regulatory objectives of an SSFI are to assess the operational readiness of the inspected system (i.e., Is the system capable of performing its intended functions?) and to find and correct underlying causes of potential system unavailability. For the purposes of the CM program, the latter objective regarding the identification of underlying causes is the primary objective of the initial assessments. I-B.6 DESIGN RECONSTITUTION ADJUNCT PROGRAM Complete, accurate, and retrievable design information is necessary to make facility changes that preserve safety, environmental and mission requirements. Design information is needed to support facility design changes and their evaluation and to enhance existing design control and configuration management practices. In addition, design information is necessary to support operability evaluations, justifications for continued operation, facility transient evaluations, SAR and TSR revisions, and various facility activities. Complete design information is also necessary to evaluate unplanned facility changes that might result from equipment degradation and aging. In summary, design information summaries (DISs) enhance facility safety and mission, and improve efficiency for design and operations. Appendix II-D provides further discussion of DISs benefits. The DR adjunct program is a structured approach toward accomplishing design reconstitution and producing Design Information Summaries. The initial activities focus on identifying and retrieving documents that might contain design information and reviewing them to identify and extract design information. The program then evaluates this information to produce technically valid design information. Discrepancies are identified and resolved. Missing design requirements and design basis are identified and the most critical missing design information is regenerated. The design information is formatted into DISs and field validated.

Design reconstitution is accomplished in a phased manner with defined milestones and associated deliverables. A phased approach is used to effectively support design activities and facility operations by providing for an early set of design information with steadily increasing quantity and quality. If the design information were not available for use until completely reconstituted, configuration control and facility operations would likely suffer in the interim. The DR adjunct program is structured with emphasis on reconstituting the design requirements rather than the design basis. The CM program interfaces with the DR adjunct program primarily at the design requirements element. The design requirements element determines whether reconstitution of existing design information is necessary. Throughout design reconstitution, the design requirements element maintains the equipment database that relates equipment to their design requirements and design basis. The design requirements element ensures that design requirements are collected and catalogued in the CM equipment database that relates them to their SSCs, design basis, and associated documentation. Once design information is reconstituted, maintenance and control of this information is integrated into CM program work activities under the design requirements element. Authorization basis. The authorization basis is an important subset of the design basis. Distinguishing between the authorization basis and other design basis information is important for change control as well as other programs such as USQ evaluations. The authorization basis consists of those aspects of the facility design basis relied on by DOE to authorize operation. These aspects are important to the DOE–STD–1073–93 I-B-16 safety of the facility operations. The authorization basis is described in documents such as the facility SAR and other safety analyses, hazard classification documents, the TSR, DOE-issued safety evaluation reports, and commitments made to satisfy DOE Orders or policies. The design basis encompasses the authorization basis, as well as consideration of such factors as facility availability, efficiency, mission, costs, and maintainability. I-B.7 MATERIAL CONDITION AND AGING MANAGEMENT ADJUNCT PROGRAM The MCA adjunct program supports the CM program objective of maintaining the basic relationships among the design requirements, the physical configuration, and the documentation. Through the process of aging degradation, the performance capabilities of physical structures and other equipment could deteriorate to the point that they can no longer meet their design requirements. For example, pressure vessel aging caused by many years of radiation could create embrittlement of the material to the point that the vessel no longer meets its design requirements for toughness and nil ductility temperature. If this were to occur, the physical configuration would no longer be consistent with the design requirements and, therefore, the CM program basic relationships would be compromised. A fundamental goal of the MCA program is to prevent this type of equipment failure and the associated impact on the facility.

In addition, the MCA adjunct program provides important input to the CM program planning by estimating the facility remaining lifetime, which is an important factor in determining the appropriate level of implementation for the overall CM program. The MCA adjunct program also supports the periodic equipment performance monitoring function of the CM assessments element. The MCA adjunct program develops practical monitoring techniques that can measure the material condition of important equipment and can be used periodically to monitor and trend aging degradation. The MCA program develops life extension techniques that can be applied to achieve the lifetime desired by DOE. The MCA program also develops analytical methods and practical testing techniques that can be used to support preventive and predictive maintenance activities so that important facility equipment continues to meet its design requirements. Equipment Failure. When equipment is no longer capable of meetingiIts design requirements, it is considered to have failed. A primary objective of a configuration management program is compromised when the physical configuration does not conform to the design requirements. Facility SSCs can fail for a variety of reasons. In some cases, especially with electrical equipment or electronic compounds, equipment can fail spontaneously. In other cases, the failure is the result of progressive degradation. Some forms of degradation (such as that from normal wear) have long been recognized. Aging, due to fatigue or stress corrosion cracking causes other forms of degradation that can lead to equipment failures. In a few situations, facility operations might be continued until the equipment failure actually occurs and action is initiated. However, in most cases, the objective is to avoid failures that interrupt operations or jeopardize operational safety. In some cases, especially those involving important equipment that is in standby service without actual operation for long periods, the equipment is tested periodically to confirm that it remains operable or to identify whatever failure might have occurred. When failures are detected, different actions might be taken. One such action is to repair the equipment and thereby restore it to operable status. Another is to replace the failed equipment with new equipment. Still another is to terminate facility operation. In most cases, after a failure is discovered, repair or replacement actions would be taken to restore the equipment to an operable status. In some cases, the total cost to repair or replace equipment, including the direct safety impact of the failure itself and the costs associated with facility down time (involving, among other things, the time for fabrication, shipment, or installation and testing of a replacement), could be so great that it DOE–STD–1073–93 I-B-17 might be more prudent to terminate operations rather than to repair or replace the equipment. In other cases, the replacement of an item is not technically feasible. If the failure of an SSC might result in a decision to terminate facility operations, that equipment is potentially life-limiting for the facility. Avoidance of a facility life-limiting failure is highly desirable, and therefore, understanding the cause of such failures and estimating the remaining lifetime are important. Predicting the end of facility life can avoid catastrophic failure and can allow an orderly shutdown.

Desired and Remaining Lifetime. The design of any facility SSC carries with it a finite lifetime. In other words, the equipment, either active or passive, specified by the design can be expected to operate under a particular set of conditions for some period of time before failure. Figure I-B-3 depicts the general concept of lifetimes for a facility across its various life-cycle phases. After the design phase and the construction phase, the facility enters the operational phase of its life-cycle, which has a finite length. At any point during the operational phase, only a certain amount of the operating lifetime remains available. Remaining lifetime is the time still available for operation without applying life extension techniques. Several components within a facility could be potentially life-limiting for the facility. The first life-limiting component to actually fall would signal the end of the operational lifetime for the facility. The facility remaining lifetime is determined by the current material condition of life-limiting equipment and by the stresses of the subsequent operation of that equipment. If the current material condition can be determined accurately, it might not be necessary to determine the stresses or operating cycles that previously occurred. While the facility remaining lifetime is indicated by the current material condition, the desired lifetime is the period specified by DOE as necessary to fulfill the programmatic mission of that facility. Figure I-B- 3 depicts two situations regarding remaining lifetime relative to the desired lifetime. In the first situation, the desired lifetime of the facility is shorter than its remaining lifetime. In the latter situation, the desired lifetime is greater than the remaining lifetime. In this situation, if that desired lifetime is to be achieved, life extension techniques need to be developed and applied. In some cases, DOE has directed the contractor to continue operating the facility for a specified period or only until a specified date. In those cases, the facility desired lifetime is known. In other cases, DOE has not specified a desired lifetime. DOE may determine the facility desired lifetime based, in part, on the remaining lifetime estimated by the contractor and on the estimated costs of life extension techniques for additional years. Life Extension Techniques. Life extension techniques are those actions that would extend the lifetime of potentially life-limiting components for a facility to achieve the desired facility lifetime. The life of a particular component might be extended by actions such as reducing the number of operating cycles, reducing the speed of each operating cycle, reducing vibrations, and lowering the ambient temperature for the equipment. To develop life extension techniques, the potentially life-limiting components are identified, aging degradation mechanisms are evaluated, and actions are identified that would reduce the stresses on the equipment to prolong its lifetime. While life extension techniques focus on extending the lifetime of a component, aging management focuses on controlling aging degradation to the extent of ensuring reliable operation and avoiding failure before the expected lifetime expires. DOE–STD–1073–93 I-B-18 DOE–STD–1073–93 CONCLUDING MATERIAL Review Activities: Preparing Activity: DOE Field Offices DOE-EH-63 DP AL EH CH Project Number : EM ID NE NV CMAN-0001 NS OR RW RL ER SR CE SF AD Fernald PR FE Area Offices OE Amarillo SA Brookhaven Kansas City National Laboratories Kirtland Golden ANL Princeton BNL Rocky Flats LBL LLNL METC LANL PNL Sandia FOREWORD CONTENTS FIGURES GLOSSARY ACRONYMS BIBLIOGRAPHY CHAPTER 1 Operational Configuration Management Program Principles 1.1 PROGRAM OBJECTIVE 1.2 FUNCTIONAL MODEL 1.3 PROGRAM CRITERIA 1.3.1 PROGRAM MANAGEMENT ELEMENT 1.3.2 DESIGN REQUIREMENTS ELEMENT 1.3.3 DOCUMENT CONTROL ELEMENT 1.3.4 CHANGE CONTROL ELEMENT 1.3.5 ASSESSMENTS ELEMENT 1.3.6 DESIGN RECONSTITUTION ADJUNCT PROGRAM 1.3.7 MATERIAL CONDITION AND AGING MANAGEMENT A