text: name	path	content
  string	string	string
  meta title=True	meta	meta
  Commissioning of security systems and infrastructure cns-tast-gd-4.4	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Commissioning of security systems and infrastructure cns-tast-gd-4.4.pdf	" Title of document 
   OFFICIAL 
   ONR GUIDE 
   COMMISSIONING OF SECURITY SYSTEMS AND INFRASTRUCTURE 
   Document Type: 
   Nuclear Security Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   CNS-TAST-GD-4.4 Revision 0 
   March 2017 
   Review Date: 
   March 2020 
   Approved by: 
   David Pascoe 
   Professional Lead 
   Record Reference: 
  Revision commentary: 
   TRIM Folder 4.4.2.19074. (2017/104173) 
  New document issued 
   TABLE OF CONTENTS 
   1. 
  INTRODUCTION ................................................................................................................. 2 
  2. 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  3. 
  RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION ......................... 2 
  4. 
  RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE ...................................... 2 
  5. 
  RELATIONSHIP TO NATIONAL POLICY DOCUMENTS ................................................... 3 
  6. 
  ADVICE TO INSPECTORS ................................................................................................. 3 
  7. 
  THE COMMISSIONING PROCESS .................................................................................... 4 
  8. 
  COMMISSIONING AND PERSONNEL ............................................................................... 5 
  9. 
  COMMISSIONING AND MAINTENANCE ........................................................................... 5 
  10. COMMISSIONING AND TRAINING .................................................................................... 6 
  11. REFERENCES .................................................................................................................... 7 
  12. GLOSSARY AND ABBREVIATIONS .................................................................................. 8 
   © Office for Nuclear Regulation, 2017 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 03/17 
   Template Ref: ONR-DOC-TEMP-002 Revision 1 
   OFFICIAL 
   Page 1 of 8 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   1.2 
   2. 
   2.1 
   3. 
   3.1 
   3.2 
   4. 
   4.1 
   4.2 
   INTRODUCTION 
   OFFICIAL 
   The Office for Nuclear Regulation (ONR) has established a set of Security Assessment 
  Principles (SyAPs) (Reference 7). This document contains Fundamental Security 
  Principles (FSyPs) that dutyholders must demonstrate have been fully taken into 
  account in developing their security arrangements to meet relevant legal obligations. 
  The security regime for meeting these principles is described in security plans prepared 
  by the dutyholders, which are approved by ONR under the Nuclear Industries Security 
  Regulations (NISR) 2003 (Reference 1).  
   The term ‘security plan’ is used to cover all dutyholder submissions such as nuclear site 
  security plans, temporary security plans and transport security statements. NISR 
  Regulation 22 dutyholders may also use the SyAPs as the basis for Cyber Security and 
  Information Assurance documentation that helps them demonstrate ongoing legal 
  compliance for the protection of Sensitive Nuclear Information (SNI). The SyAPs are 
  supported by a suite of guides to assist ONR inspectors in their assessment and 
  inspection work, and in making regulatory judgements and decisions.  This Technical 
  Assessment Guidance (TAG) is such a guide. 
   PURPOSE AND SCOPE 
   This TAG contains guidance to advise and inform ONR inspectors in exercising their 
  regulatory judgment during assessment activities relating to a dutyholder’s 
  arrangements to ensure their security systems are subject to appropriate 
  commissioning. It aims to provide general advice and guidance to ONR inspectors on 
  how this aspect of security should be assessed. It does not set out how ONR regulates 
  the dutyholder’s arrangements.  It does not prescribe the methodologies for dutyholders 
  to follow in demonstrating they have addressed the SyAPs. It is the dutyholder’s 
  responsibility to determine and describe this detail and for ONR to assess whether the 
  arrangements are adequate.  
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION 
   The term ‘dutyholder’ mentioned throughout this guide is used to define ‘responsible 
  persons’ on civil nuclear licensed sites and other nuclear premises subject to security 
  regulation, a ‘developer’ carrying out work on a nuclear construction site and approved 
  carriers, as defined in NISR. It is also used to refer to those holding SNI.  
   NISR defines a ‘nuclear premises’ and requires ‘the responsible person’ as defined to 
  have an approved security plan in accordance with Regulation 4. It further defines 
  approved carriers and requires them to have an approved Transport Security Statement 
  in accordance with Regulation 16. Persons to whom Regulation 22 applies are required 
  to protect SNI. ONR considers supply chain management to be an important component 
  of a dutyholder’s arrangements in demonstrating compliance with relevant legislation.   
   RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE 
   The essential elements of a national nuclear security regime are set out in the 
  Convention on the Physical Protection of Nuclear Material (CPPNM) (Reference 4) and 
  the IAEA Nuclear Security Fundamentals (Reference 3). Further guidance is available 
  within IAEA Technical Guidance and Implementing Guides. 
   Fundamental Principle J of the CPPNM refers to quality assurance and states that a 
  quality assurance policy and quality assurance programmes should be established and 
  implemented with a view to providing confidence that specified requirements for all 
  activities important to physical protection are satisfied. The importance of issues relating 
   Doc Ref: CNS-TAST-GD-4.4 Revision 0 
  TRIM Ref: 2017/104173 
   OFFICIAL 
   Page 2 of 8 
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   to quality assurance is also recognised in the Nuclear Security Fundamentals, 
  specifically: 
    
   Essential Element 12: Sustaining a Nuclear Security Regime – 3.12 A nuclear 
  security regime ensures that each competent authority and authorised person 
  and other organisations with nuclear security responsibilities contribute to the 
  sustainability of the regime by: 
   a) 
   h) 
   Developing, implementing, and maintaining appropriate and effective 
  integrated management systems including quality management 
  systems; and, 
   Routinely performing assurance activities to identify and address 
  issues and factors that may affect the capacity to provide adequate 
  nuclear security, including cyber security, at all times.  
   A more detailed description of the quality assurance is provided in Recommendations 
  level guidance, specifically Nuclear Security Series (NSS) 13, Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5) 
  (Reference 2). This document states “The quality assurance policy and programmes for 
  physical protection should ensure that a physical protection system is designed, 
  implemented, operated and maintained in a condition capable of effectively responding 
  to the threat assessment or design basis threat and that it meets the State’s regulations, 
  including its prescriptive and/or performance based requirements.” 
   RELATIONSHIP TO NATIONAL POLICY DOCUMENTS 
   The SyAPs provide ONR inspectors with a framework for making consistent regulatory 
  judgements on the effectiveness of a dutyholder’s security arrangements.  This TAG 
  provides guidance to ONR inspectors when assessing a dutyholder’s submission 
  demonstrating they have effective processes in place to achieve SyDP 4.4 – 
  Commissioning, in support of FSyP 4 – Nuclear Supply Chain Management.  The TAG 
  is consistent with other TAGs and associated guidance and policy documentation. 
   The HMG Security Policy Framework (SPF) (Reference 5) describes the Cabinet 
  Secretary’s expectations of how HMG organisations and third parties handling HMG 
  information and other assets will apply protective security to ensure HMG can function 
  effectively, efficiently and securely. The security outcomes and requirements detailed in 
  the SPF have been incorporated within the SyAPs. This ensures that dutyholders are 
  presented with a coherent set of expectations for the protection of nuclear premises, 
  SNI and the employment of appropriate personnel security controls both on and off 
  nuclear premises. 
   The Classification Policy (Reference 6) indicates those categories of SNI, which require 
  protection and the level of security classification to be applied. 
   ADVICE TO INSPECTORS 
   Commissioning is the activity of setting to work systems and associated infrastructure, 
  including assuring all systems and components are designed, installed, tested, 
  operated, and maintained according to the Operational Requirements (ORs) of the 
  owner. A commissioning process may be applied to new projects and existing systems, 
  subject to modifications or significant maintenance. The scale of the commissioning 
  activity should be proportionate to the level of complexity and degree of impact that the 
  project will have on the site or facility’s ability to meet its security outcome as defined in 
  Annexes C and D of SyAPs.  
   4.3 
   5. 
   5.1 
   5.2 
   5.3 
   6. 
   6.1 
   Doc Ref: CNS-TAST-GD-4.4 Revision 0 
  TRIM Ref: 2017/104173 
   OFFICIAL 
   Page 3 of 8 
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   6.2 
   6.3 
   6.4 
   7. 
   7.1 
   7.2 
   This TAG is aimed at providing guidance to the inspector when assessing the adequacy 
  of the commissioning arrangements demonstrated through the performance of the 
  equipment (and those personnel who will manage, operate and maintain it) and the 
  adequacy of the procedures to support the operation of that equipment. As part of this 
  process, early engagement with dutyholders is essential in order to fully understand 
  their proposals, assess the quality and completeness of the activities and measure the 
  compliance of the plant and systems with the Physical Protection System (PPS) 
  outcome and postures. This engagement should have been on-going throughout the 
  development of the project. The commissioning activity is the first opportunity to confirm 
  the performance of the installation and its contribution to meeting relevant security 
  objectives.  
   This TAG should also be used to consider circumstances when security equipment is 
  being removed at a dutyholder’s site, when the site is being progressively being 
  decommissioned. 
   Regulatory Expectation 
   The regulatory expectation is that dutyholders demonstrate in the security plan how they 
  implement proportionate commissioning plans which should include clear definition of 
  roles and responsibilities, performance indicators, availability of resources and clearly 
  defined decision points (to be met prior to moving to the next phase), as appropriate. 
  Where the plant and systems form a part of an existing infrastructure, the inspector 
  should expect to identify that a risk assessment has been undertaken to review the 
  potential impact on security caused by the commissioning of the new (or refurbished) 
  equipment. Planned mitigation of any associated risks should also be evidenced. 
   FSYP 4 - Reliability, 
  Resilience and 
  Sustainability 
   Commissioning 
   SyDP 4.4 
   Before bringing into operation or returning to service any facility, system or process 
  that may affect security it should be subject to testing and a commissioning plan 
  defined in the security plan. 
   THE COMMISSIONING PROCESS 
   Commissioning activity should be much more than simply setting plant and equipment to 
  work. The effectiveness of security equipment to meet PPS postures and outcomes 
  described in SyAPs, requires the integration of a wider range of assets to support the 
  operation of security equipment. This may include uninterruptable and possibly 
  alternative power supplies such as diesel generators, to secure reliable performance. 
  Commissioning should provide evidence and demonstrate that all aspects of the wider 
  infrastructure operate as planned in both normal and fault conditions to confirm 
  operational resilience. 
   Commissioning is typically broken into two parts usually termed ‘cold’ and ‘hot’ 
  commissioning. The former usually demonstrates the completeness of the plant and 
  systems. It confirms that all components are installed, connections made and plant 
  labelled. Evidence should be available to show this process has been undertaken and 
  appropriate ‘snagging’, to put things right, has been expedited. 
   7.3 
   ‘Hot’ commissioning refers to a phase when the plant and systems are energised. It is 
  when the actual performance of the individual plant components is demonstrated 
   Doc Ref: CNS-TAST-GD-4.4 Revision 0 
  TRIM Ref: 2017/104173 
   OFFICIAL 
   Page 4 of 8 
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   7.4 
   7.5 
   7.6 
   7.7 
   7.8 
   8. 
   8.1 
   9. 
   9.1 
   against their specified performance. This is followed by component integration into 
  systems together with the human response elements.  The final combination of the 
  different systems into the overall infrastructure should prove the overall effectiveness of 
  the installation and whether it meets the intent and success criteria described in the 
  ORs. 
   Integral to this ‘hot’ commissioning phase is the record of commissioning activities. The 
  inspector should expect comprehensive records to be kept of this phase of the 
  programme. This captures the settings for plant components to deliver the system 
  performance and may need to correlate with the ‘as tested’ settings in the case of 
  Centre for the Protection of National Infrastructure approved security equipment for 
  example. These base settings are important in confirming equipment remains fit for 
  purpose and to enable straightforward fault finding and system re-commissioning later in 
  its life. A package of information should be delivered which also includes a set of ‘as 
  built’ drawings, operating and maintenance procedures and requirements, a 
  recommended spares holding and other pertinent information. 
   Commissioning plant represents the penultimate step towards operation. The inspector 
  should seek evidence from the dutyholder that the original ORs are met throughout the 
  different phases of commissioning. Evidence of any changes (and associated 
  justifications to support them), should be available from the dutyholder. 
   The introduction of new or revised security equipment and systems, impacts the 
  approved security plan in that it represents a change to the approved arrangements. It 
  would be expected that these changes are captured in any Security Improvement 
  Schedule (SIS), itself a part of the approved security plan. 
   The inspector should ensure that the dutyholder is preparing the appropriate submission 
  to modify the security plan (and the SIS) in order to reflect the changes to the 
  arrangements delivered by the new plant and systems 
   The introduction of new plant and systems should be subject to extant local facility 
  modification procedures to ensure the impact of this new equipment on both existing 
  safety and security systems is understood and approved. The inspector should seek 
  evidence of this being done prior to ‘hot commissioning’ being undertaken. 
   COMMISSIONING AND PERSONNEL 
   Plant and equipment are material parts of the security infrastructure.  However, 
  personnel and associated processes are similarly important. Accordingly, the 
  identification of Suitably Qualified and Experienced (SQEP) human resource to manage 
  and operate this new equipment is necessary to deliver the capability. It is essential, 
  therefore, to seek evidence that all these aspects are being addressed in the 
  commissioning programme. 
   COMMISSIONING AND MAINTENANCE 
   Security infrastructure should provide an effective and reliable system to deliver the 
  required PPS posture and outcome.  Accordingly, the long-term reliability of systems 
  must be underpinned by an appropriate maintenance regime and spares holdings. This 
  is supported by the provision of operating and maintenance manuals to describe those 
  activities required to support system performance and the schedule for component 
  replacement. Often the manufacturer will provide a recommended spares holding to 
  support system reliability.  
   Doc Ref: CNS-TAST-GD-4.4 Revision 0 
  TRIM Ref: 2017/104173 
   OFFICIAL 
   Page 5 of 8 
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   9.2 
   The dutyholder should be able to demonstrate a maintenance strategy has been 
  developed and is in place. It may include provision of in-house resources or contracted 
  services to support the strategy. The inspector should seek confirmation that the 
  dutyholder has the appropriate funding identified to support the long term operation and 
  maintenance of the equipment or plant being commissioned. 
   10. 
   COMMISSIONING AND TRAINING 
   10.1 
   Where appropriate, the training of staff linked to delivery of security outputs associated 
  with the plant, equipment and systems being commissioned, should also be 
  demonstrated. The ‘cold’ commissioning phase offers a good opportunity to review the 
  adequacy of the training of operational personnel, the availability of operating 
  procedures and the proposed integration of the plant and systems into the existing 
  security infrastructure. This can be considered as a ‘readiness review’. The inspector 
  should expect a positive decision point within the dutyholder’s plan to allow a move to 
  the next phase of commissioning and written justification of such a decision. 
   Inspectors should consider: 
    
    
    
    
    
    
    
    
    
   Does the new equipment enable the dutyholder to achieve the required PPS 
  outcome? 
   Is the commissioning process underpinned by appropriate levels of internal and 
  external stakeholder engagement and adequate ORs? 
   Are all appropriate stakeholders involved during the actual commissioning 
  process? 
   Are there appropriate plans and procedures in place to support the 
  commissioning process and the introduction of any new or amended processes 
  or procedures? 
   Is the commissioning process supported by adequate numbers of SQEP 
  personnel? (managers, operators and maintainers) 
   Have whole life maintenance and training requirements been adequately 
  considered during the commissioning process? 
   Are there contingency plans if security equipment is not commissioned on 
  schedule? 
   Has security equipment being commissioned been incorporated within security 
  plans? 
   Does the commissioned equipment meet defined performance requirements and 
  if it does not what is the response of the dutyholder? 
    
   Is commissioned equipment appropriately reliable and resilient? 
   Doc Ref: CNS-TAST-GD-4.4 Revision 0 
  TRIM Ref: 2017/104173 
   OFFICIAL 
   Page 6 of 8 
    
    
    
    
    
   Office for Nuclear Regulation  
   11. 
   REFERENCES 
   OFFICIAL 
   1. 
   2. 
   3. 
   4. 
   5. 
   6. 
   7. 
   Nuclear Industries Security Regulations 2003.  Statutory Instrument 2003 No. 403 
   IAEA Nuclear Security Series No. 13.  Nuclear Security Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5).  January 2011.  www-pub.iaea.org/MTCD/Publications/PDF/Pub1481_web.pdf. 
   IAEA Nuclear Security Series No. 20.  Objective and Essential Elements of a State’s 
  Nuclear Security Regime. http://www-
  pub.iaea.org/MTCD/Publications/PDF/Pub1590_web.pdf 
   Convention on the Physical Protection of Nuclear Material (CPPNM) 
   https://ola.iaea.org/ola/treaties/documents/FullText.pdf 
   HMG Security Policy Framework. Cabinet Office.  
   https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/316182/S
  ecurity_Policy_Framework_-_web_-_April_2014.pdf 
   NISR 2003 Classification Policy – Trim Ref. 2012/243357. 
   Security Assessment Principles – Trim Ref. 2017/121036   
   Note: ONR staff should access the above internal ONR references via the How2 Business 
  Management System. 
   Doc Ref: CNS-TAST-GD-4.4 Revision 0 
  TRIM Ref: 2017/104173 
   OFFICIAL 
   Page 7 of 8 
    
    
    
    
    
    
    
    
    
    
    
     
    
    
    
    
   Office for Nuclear Regulation  
   12. 
   GLOSSARY AND ABBREVIATIONS 
   OFFICIAL 
   CPPNM 
  FSyP 
  IAEA 
  NISR 
  NSS 
  ONR 
  OR 
  PPS 
  SIS 
  SNI 
  SPF 
  SQEP 
  SyAP 
  SyDP 
  TAG 
   Convention on the Physical Protection of Nuclear Material 
  Fundamental Security Principle 
  International Atomic Energy Agency 
  Nuclear Industries Security Regulations 
  Nuclear Security Series 
  Office for Nuclear Regulation 
  Operational Requirement 
  Physical Protection System 
  Security Improvement Schedule 
  Sensitive Nuclear Information 
  Security Policy Framework 
  Suitably Qualified and Experienced 
  Security Assessment Principle 
  Security Delivery Principle 
  Technical Assessment Guide 
   Doc Ref: CNS-TAST-GD-4.4 Revision 0 
  TRIM Ref: 2017/104173 
   OFFICIAL 
   Page 8 of 8 
    
    
    
    
    
  "
  Construction Assurance ns-tast-gd-076	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Construction Assurance ns-tast-gd-076.pdf	" Title of document 
   ONR GUIDE 
   Construction Assurance 
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   Approved by: 
   Record Reference: 
   Revision commentary: 
   NS-TAST-GD-076 Revision 4 
   September 2015 
   Review Date:             February 2020
   T Allmark 
   Superintending Inspector 
   TRIM Folder 1.1.3.978. (2019/113164) 
   Review date extended to February 2020. 
   A replacement TAG will be produced in due course. 
   © Office for Nuclear Regulation, 2019 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 08/19 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 1 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Contents 
   1.0  Purpose and scope 
  2.0  Relationship to licence and other relevant legislation 
  3.0  Relationship to SAP’s, IAEA safety standards, etc 
  4.0  General advice to inspectors 
  5.0  Development and Design Phase 
  6.0  Construction Phase 
  Appendix 1  - Areas of Construction and Expectations 
  References 
   1.0  
   Purpose and scope 
   1.1 
  This TAG contains general guidance and advice to ONR Inspectors on 
  aspects of civil engineering construction assurance.  
   1.2 
  Civil engineering construction assurance encompasses the processes/ 
  procedures and cultural aspects necessary to provide the level of confidence that the 
  works are constructed in accordance with the design intent and as required by the 
  safety case and that the materials used and construction methodologies adopted 
  have not undermined the design assumptions made. 
   1.3 
  This document is not intended to provide detailed guidance on either the 
  design or construction process, but is produced to highlight certain salient areas for 
  consideration as part of the regulatory process and may be relevant to planned 
  interventions throughout the construction process.  
   1
    
    
    
    
    
   1.4 
  It should be read in conjunction with other relevant TAG’s including but not 
  limited to ‘The management for safety ‘ T/AST/0391; Design safety assurance, 
  T/AST/0572 ; Structural integrity, Civil Engineering aspects, T/AST/0173 ; 
  Procurement of nuclear safety related items or services , T/AST/0774
  . 
   1.5 
  This guide is neither prescriptive nor all encompassing. The intention is to 
  highlight typical construction assurance items that a licensee would be expected to 
  address during the design and construction phases of a construction project. 
  Appendix 1, identifies some typical aspects, which an ONR inspector may wish to 
  consider, or seek further specialist opinion on.  
   1.6 
  It is to be expected that further assurance may be sought throughout the 
  commissioning, handover and operational phases of a facility.  However, this TAG 
  only considers construction assurance up to ‘practical completion’ by the civil 
  engineering contractor of its works. 
   1.7 
  General reference has been made within this guide to issues relating to both 
  quality and design assurance during the design and construction phases, however 
  further information is contained in the following guides for these subject areas:- 
    
   
   
   T/INS/17, quality assurance;  
  T/INS/19, construction or installation of new plant;  
  T/AST/57, design safety assurance.  
   1.8 
  The principles described within the above guides are considered ‘relevant 
  good practice’ to ensure that within the life cycle of a construction project, what is 
  constructed is indeed the physical form of the design intent, and further that both 
  have been executed to a suitable standard, thus ensuring the quality of the product 
  is right for the categorisation and classification of the structure and/or component 
  being considered. 
   1.9 
  It is important for the assumptions made by the designer, incorporated within 
  the justification of the design within a safety case, to be properly carried through the 
  construction phase. The final construction of the works is thus as much a part of the 
  safety case as the design. 
   2.0 
   Relationship to licence and other relevant legislation 
   2.1 
  Licence conditions 14; 17; 19; 20; 22 are the principal relevant licence 
  conditions requiring the licensee to make and implement adequate arrangements.  
   2.2 
  Licence condition 14, relating to safety documentation, requires that the 
  licensee “shall make and implement adequate arrangements for the production and 
  assessment of safety cases consisting of documentation to justify safety during the 
  design, construction, manufacture, commissioning, operation and decommissioning 
  phases of the installation.” 
   2.3 
  Licence condition 17, relating to management systems, requires the licensee 
  to “make and implement adequate quality management arrangements in respect of 
  all matters which may affect safety”. 
   2
    
   2.4 
  Licence condition 19, relating to construction or installation of new plant, 
  requires that “Where the licensee proposes to construct or install any new plant 
  which may affect safety the licensee shall make and implement adequate 
  arrangements to control the construction or installation.” 
   2.5 
  Licence condition 20, relating to modification to design of plant under 
  construction, requires that “The licensee shall ensure that no modification to the 
  design which may affect safety is made to any plant during the period of construction 
  except in accordance with adequate arrangements made and implemented by the 
  licensee for that purpose.” 
   2.6 
  Licence condition 22, relating to modification or experiment on existing plant,  
  requires that “The licensee shall make and implement adequate arrangements to 
  control any modification or experiment carried out on any part of the existing plant or 
  processes which may affect safety.” 
   2.7 
  By the very nature of the subject and potential effect on safety there are many 
  other possible relevant licence conditions  including LC 26 - control and supervision 
  of operations; LC 25 operational records; LC 12 duly authorised and other suitably 
  qualified and experienced persons. 
  2.8 
  The general duties under the health and safety at work act7, sections S2(1) ; 
  S3(1); S4(1); S4(2) and S6(1)a , impose statutory duties.  
  2.9 
  The Construction (Design and Management) Regulations 20078, places duties 
  on designers to have “adequate regard to the need:–  
  “(i) to avoid foreseeable risks to the health and safety of any person at work carrying 
  out construction work or cleaning work in or on the structure at any time, or of any 
  person who may be affected by the work of such a person at work take due 
  recognition of health and safety in the design and implementation process.”  
  2.10 
  Section 8(2)a of the Ionising Radiation Regulations9 also make specific 
  reference to engineering controls and design features, to achieve the restriction of 
  exposure to ionising radiation. 
   3.0  
   Relationship to SAP’s, IAEA safety standards, etc 
   3.1 
  Reference should be made to the HSE’s safety assessment principles 
  (SAPs)11 for nuclear facilities together with other relevant technical assessment 
  guides (TAGs) when assessing such design and construction arrangements, 
  processes and procedures.  The most relevant safety assessment principles for 
  construction related activities are the civil engineering principles ECE.16 –ECE.19.  
   3.2 
  ECE.16: Civil construction materials should be compliant with the design 
  methodologies used, and shown to be suitable for the purpose of enabling the 
  design to be constructed, operated, inspected and maintained throughout the life of 
  the facility. 
   3.3 
  ECE.17: The construction should use appropriate materials, proven 
  techniques and approved procedures to minimise the occurrence of defects that 
  might affect the required integrity of structures. 
   3
    
   3.4  
  ECE.18: Provision should be made for inspection during construction to 
  demonstrate that the required standard of workmanship has been achieved, 
   3.5 
  ECE.19: Where construction non conformities are judged to have a 
  detrimental effect on integrity or significant defects are detected, remedial measures 
  should achieve the original design intent. 
   3.6 
  Other relevant SAP’s are, Leadership and management for safety,  
  MS 1-4;Safety classification and standards: ECS 1-3 and Decommissioning: DC 1, 6  
   3.7 
  The 2006 SAPs were also benchmarked against the extant IAEA Safety 
  Standards and their main principles are encompassed within the SAPs11. 
   3.8 
  The IAEA Safety Standards GS-R-3 and GS-G-3.1 provide advice on quality 
  management and assurance aspects applicable to construction activities. 
   3.9 
  Other relevant guidance can be found in NS-R-1, safety for NPP design; NS-
  R-3 Site evaluation for nuclear installations , section 6 on quality control; NS-G-3.6 
  Geotechnical aspects of site evaluation and foundation for NPP. 
  WENRA reactor safety reference levels18 relating to:- 
  3.10 
  A) Safety policy, S1 Issuing and Communication of a Safety policy (S1.1, 1.5); B) 
  Operating Organisation, S1 Organisational Structure (S1.2,1.3), S2 Management of 
  Safety and Quality (S2.6) , S3 Sufficiency and Competency of Staff (S3.6);   
  C) Management System, S5 Process Implementation (S5.5, 5.6, 5.7,5.8), S6 
  Measurement, Assessment and Improvement (S6.4,6.5);  
  D) Training and Authorisation of NPP staff, S2 Competence and Qualification (S2.1), 
  S3 Training Programmes and Facilities (S3.6), S4 Authorisation (S4.3);  
  G) Safety classification of structures, systems and components S1 objective (S1.1) , 
  S2 Classification Process (S2.2) , S3 Ensuring Reliability (S3.1), S4 Selection of 
  materials and qualification of equipment (S4.2);   
  H) Operational Limits and Conditions S1 Purpose (S1.1), are all relevant. 
   4.0 
   General advice to inspectors 
   4.1 
  This section provides general advice on ONR expectations and potential 
  areas to target during inspection/assessment. More specific advice on some features 
  associated with construction assurance is then given, firstly during the development 
  and design phases of the project (Section 5.1) and then during the construction 
  phase (Section 5.2). 
   4.2 
  During both the design and the construction phase’s of a project, quality 
  assurance and design assurance are inextricably linked to the issues surrounding 
  construction assurance.  A number of existing technical assessment guides are 
  relevant to these specific subject areas and the Inspector should consider the latest 
  available information. 
   4
    
   4.3 
   The following guides are useful initial reference points:- 
   T/INS/017 – Quality Assurance 
  T/AST/017 – Structural integrity, civil engineering aspects3 
  T/AST/039 – Management for safety1 
  T/AST/057 – Design safety assurance2 
   4.4 
  Whilst it is recognised that design organisations may not be the licence 
  holder, both the design and construction process should be under the control of the 
  appropriate licensee acting as an “intelligent customer”. SAP’s11 (paragraph 56). 
   4.5 
  ONR expects that for construction of a nuclear facility the standards employed 
  are commensurate with the magnitude and nature of the hazard presented by the 
  facility, and are higher than for general industrial design and construction works. 
  Suitable safety categorisation and classification by the licensee should set the 
  requirements for the extent of control and assurance that the design and 
  construction of a facility is subject to. 
   4.6 
  Prior to the submission of the Pre Construction Safety Report (PCSR) by the 
  licensee, ONR assessment is more likely to focus on standards and principles being 
  employed, the visibility of optioneering to demonstrate ALARP, and the adequacy of 
  the design process and associated arrangements.  
   4.7 
  ONR inspectors need to satisfy themselves that the licensee understands the 
  importance of construction assurance, that appropriate processes have been put in 
  place and that aspects which will provide construction assurance are being given 
  appropriate consideration during the development and design phases of the project.  
   4.8 
  The inspector should seek assurance that between: the safety case claims; 
  the civil design substantiation; the specification of the design details and the 
  construction competency of the contractors that the licensee chooses to employ, 
  there is a consistency of purpose.   
   4.9 
  In addition confidence needs to be gained that the licensee’s construction 
  assurance processes are targeted at achieving an acceptable outcome, so far as 
  can be established during the development and design phases of the project.  In 
  particular confidence needs to be gained that the civil engineering designer’s 
  intentions will be specified in a manner that can be realised by competent SQEP 
  contractors.  
   4.10 
  Following submission of the PCSR but prior to permissioning, the licensee’s 
  processes should be fully documented. In addition, activities subject to a permission 
  by ONR should be fully defined.  ONR focus at this stage will be towards the 
  technical details, but the licensees systems and procedures must be seen to be 
  capable of delivering the requirements of the design and safety case. 
   4.11 
  Following permissioning and commencement of construction ONR focus is 
  more likely to be on management and technical control in order to ensure that the 
  completed installation conforms to the specified requirements.  Firstly, to confirm the 
  suitability and sufficiency of all that has been documented as the input to an assured 
  construction process.  Secondly, to ascertain those organisations responsible for 
   5
    
   construction activities fully understand the documented construction information.  
  Thirdly, to confirm by observation that construction is proceeding in a controlled and 
  validated manner, and lastly to gain confidence that the civil engineering structures 
  are being constructed as specified without undermining of any of the design 
  assumptions. 
   4.12 
  On-site inspections of construction activities should focus on areas of highest 
  nuclear safety significance where high standards are required and/or on any novel 
  techniques being employed.  
   4.13  
  Appendix 1 outlines some specific aspects of civil engineering where 
  inspectors may wish to focus their attention during the construction phase of a 
  project.  This is included as an aide memoire for Inspectors but the list is not 
  considered in any way to be definitive or exhaustive.  
   5.0  
   5.1  
   Development and Design Phase 
   Quality during the design phase 
   5.1.1‘  Quality assurance and quality control are aspects of good management’5, in 
  this respect, areas relating to design and subsequent construction need to be 
  appropriately managed to achieve the required quality of the product.  
   5.1.2  
  Areas for consideration during the design phase may include, but not be 
  limited to: - 
    
   
   
   
   
   Organisations and the communications between them  
  Staffing and training , including SQEP evaluation 
  Document control, including preparation, review , approval and change control  
  Design control, including interfaces, verification, validation  and changes  
  Procurement control, including supplier evaluation and selection, control of 
  items and services purchased  
   Reference should be made to T/INS /017 on Quality Assurance. 
   5.2  
   Design categorisation and classification 
   5.2.1  
  Structures, systems and components (SSC) should be designed and specified 
  to provide the required engineering functionality. This functionality will have an 
  influence on safety and so requires an appropriate safety category to be assigned.  
   5.2.2  
  ONR expectation is that the processes and procedures considered should be 
  to an appropriate level dependent upon the categorisation and classification being 
  applied.  
   5.2.3  
   Categorisation and classification will affect:-   
    
   
   
   
   
   the design methods used and their extent;  
  the standards to be used; 
  the material selections made;  
  the procurement processes used;  
  the methods of fabrication and installation;  
   6
    
    
   the extent and type of inspections as well as maintenance requirements and 
  in- service inspections proposed.  
   5.3  
   Codes and standards 
   5.3.1  
  Whilst BS and Euro EN codes, (including nationally determined annexes) may 
  not be specifically written with nuclear facility designs in mind, it is noted that they 
  may form the base understanding of the contractor in terms of control of materials, 
  workmanship, durability, tolerances, testing and inspection regimes. 
   5.3.2  
  It is customary in the UK nuclear industry for designers to utilise other 
  international or USA codes as part of the design process. These may also be 
  supplemented or replaced entirely by the licensees own standards. Differences in 
  dimensional or other units may emanate from foreign designs and this aspect may 
  well require further consideration. 
   5.3.3  
  It is therefore important to recognise that codes may set standards and 
  requirements for construction details, workmanship, concrete mix design, 
  reinforcement and fixing details, material specifications and in the case of the EN 
  codes, options for control of construction which may be unfamiliar to a UK 
  construction work force.  
   5.3.4  
  Care needs to be exercised at the detailed design stage that appropriate 
  account is taken of these aspects ensuring that the design intent is carried through 
  as anticipated during the construction process. Appendix 1 provides some examples 
  where the design intent may not be met unless the requirements are clearly 
  communicated by the designer to the contractor. 
   5.3.5  
  The contract drawings, schedules and construction specification should 
  include all design, workmanship, inspection and testing requirements to be fulfilled 
  during the construction process.  However, it would also be expected that the 
  designer highlights areas to the contractor that might not represent ‘normal’ practice 
  in order to establish the practicality of the proposal and ensure the contractor 
  understands the full requirements. 
   5.3.6  
  In addition the licensee should have sufficient capability to understand such 
  issues and their bearing on safety and fulfil the role of an intelligent customer. Refer 
  to T/AST/04921. 
   5.4  
   Material use 
   5.4.1  
  International codes tend to base design on the materials available within the 
  country of origin. These materials may not be the standard / readily accepted / 
  readily available norms in the UK, for example reinforcing bar yield strengths.  
   5.4.2  
  Useful information may be obtained from the relevant industry bodies such as 
  CARES22 for rebar, BCSA31 for steel construction, IMS32 for masonry. 
   5.4.3  
  The designer needs to specify materials (for instance reinforcement bars) that 
  will meet the relevant structural requirements in a manner that is acceptable to the 
  contractor.  Failure to communicate and agree with the contractor these 
  requirements will lead to formal design change requests later.  Changes in materials 
   7
    
   subsequent to the completion of the design should be kept to a minimum as 
  determining the implications for the design can require multi disciplinary specialist 
  knowledge and if there are numerous design changes there is a risk that the 
  specialists may not be aware of all the changes when making a decision. 
   5.5  
   Codes and testing requirements 
   5.5.1  
  International / USA codes13,23,24,25  such as American Institute of Steel 
  Construction (ANSI/AISC 360) Specification for structural steel buildings23 or 
  American Concrete Institute (ACI 349)13 Code requirements for nuclear safety 
  related concrete structures, may base the design on differing forms of test results 
  and requirements . For example the use of cylinder compressive strengths instead of 
  cube compressive strengths (see also Appendix 1).   
   5.5.2  
  ONR expectation is that the principal contractor / contractor should be fully 
  conversant with the relevant codes used and further that suitably qualified and 
  experienced personnel (SQEP) are employed in the relevant site supervisory roles. 
  An Inspection and Test Plan (ITP) should be agreed with the licensee. 
   5.6  
   Alignment of the civil engineering design and safety case  
   5.6.1  
  The PCSR should document how operational and safety functional 
  requirements have been derived and communicated to the civil engineering designer 
  in a clear manner. 
   5.6.2  
  The designer’s requirements are generally communicated to the contractor 
  through the contract drawings, schedules and construction specification.  It is 
  expected that these documents would include all design, workmanship, inspection 
  and testing requirements to be fulfilled during the construction process. 
   5.6.3  
  It is an ONR expectation that the designer and contractor engage in early 
  dialogue regarding the methods to be used, the design intent and possible contractor 
  ‘optioneering’. This is considered an important stage in the early communication of 
  both the design and the assumptions made during the design to fulfil the safety case 
  justification. 
   6.0  
   6.1  
   Construction Phase 
   Quality during the construction phase 
   6.1.1  
  The general information on quality assurance and quality control presented in 
  section 5.1.1 during the design is also applicable during the construction phase.  
  Areas for consideration during the construction phase may include, but not be limited 
  to: - 
    
    
    
   
   
   Site control, including identification and control of materials, parts and 
  components, handling storage and shipping  
  Process control; including planning, procedures, permits, hold points, method 
  statements 
  Inspection, monitoring  and testing  
  Non conformance control  
  Corrective actions, including close out and verification 
   8
    
    
   Records, including as designed and as constructed, maintenance and 
  operational manuals 
   6.2  
   Forms of contract 
   6.2.1  
  It is an ONR expectation that criteria should have been set by the licensee for 
  selection of the most appropriate form of contract33.  The selection criteria should 
  take into account the potential impact of administering and applying the contract on 
  the quality of the outputs from the contract where such outputs affect nuclear safety.   
   6.2.2  
   Some factors affecting the quality of outputs may include:   
    
    
   
   Commercial pressures (for example in fixed price lump sum contracts, 
  particularly in the delivery of complex safety related designs or components) 
  Impact of the prescription of an overly-challenging contract programme  
  Suitability of the contract in relation to the maturity of the data that is to be 
  used as input to the contract. 
   6.3  
   Supply chain management 
   6.3.1  
  Control and monitoring of contractors may be made more difficult by 
  increases in the length of a supply chain. Even with ‘back to back ‘contracts the 
  original design philosophy and assumptions can be lost or misunderstood through 
  distance from the original intent.  
   6.3.2  
  A further complication may exist in the control / verification of SQEP 
  personnel and the overall quality by the licensee of the manufacture and supply of 
  safety related components or designs. For example, when significant design is 
  included in ‘design and build’ forms of contract the design element of the contract 
  may be further subcontracted thus becoming increasingly more remote within a 
  supply chain.   
   6.3.3  
  It is an ONR expectation that a similar standard of quality assurance as 
  applied by the licensee is evident and verifiable throughout the supply chain for 
  nuclear safety related items. It is also expected that supply chain lengths are 
  minimised as much as practicable. 
   6.3.4  
  Safety culture and safety awareness is as important as verifiable documentary 
  form filling. Contractors would also be expected to exhibit a safety culture and safety 
  awareness with a ‘questioning attitude’ similar to that of the licensee. 
   6.4  
   Design assumptions – verification 
   6.4.1  
  During the design certain assumptions may be made. For example, 
  assumptions based on ground investigation data obtained. However, site conditions 
  in actuality may vary. Examples such as: 
    
   
   
    
   Varying ground water levels 
  Settlement 
  Anomalies in ground conditions from those expected from ground 
  investigations 
  Unforeseen Services 
   9
    
   It is important therefore that the design team are apprised of site conditions found 
  during the construction.   
   6.4.2  
  The use of approved contractor method statements, hold point control plans, 
  permits to dig can also be a useful means of reviewing design assumptions. 
   6.4.3  
  It is an ONR expectation that a comprehensive quality management system 
  should be implemented that allows the full implications of site issues to be 
  considered against the original design assumptions, ensuring the design intent is 
  carried through the construction process. 
   6.4.4  
  Of particular importance is a process whereby it is demonstrated that the 
  contractor’s methods and materials are capable of delivering the designer’s 
  intentions, especially when nuclear safety is dependent on non-standard 
  construction methods and materials.  Construction assurance and the necessity to 
  demonstrate ALARP means that there should be a culture of continuous 
  improvement and to this end it would be expected that construction reviews would be 
  undertaken during the construction process. 
   6.5  
   Suitably qualified and experienced people SQEP  
   6.5.1  
  The importance of utilising the ‘right’ people, with the ‘right’ level of 
  understanding and knowledge at the ‘right’ time should not be underestimated.  
   6.5.2  
  It is an ONR expectation that suitably qualified and experienced personnel 
  (SQEP) in accordance with licence condition LC 12 are used at every level and that 
  pre- training prior to contract is considered where appropriate. Reference should also 
  be made to ONR guidance T/INS/01217, DAP’s and SQEP’s. 
   6.5.3  
  It is an ONR expectation that all SQEP records should be kept up-to-date 
  throughout the duration of a project and at all levels throughout the supply chain.  
   6.6  
   Communication 
   6.6.1  
  Good, clear, timely communication between individuals, teams and 
  companies is important. Clear lines of communication and expectations are all part 
  of a quality culture. Good communication is vital and it is an ONR expectation that a 
  construction project should have systems in place that reflect this requirement. This 
  requirement should extend to all parties involved and at all levels including 
  communications between the contractor and the designer. Co- located project offices 
  should be considered as a means of facilitating communication. 
   6.7  
   Design changes 
   6.7.1  
  It is recognised that changes to the design may arise from various sources 
  and for a variety of reasons during the construction process.  It is ONR‘s expectation 
  that the licensee, together with the design and construction teams, should operate 
  rigorous systems to capture, record, justify and implement any proposed changes, 
  however they are initiated. 
   10
    
   6.7.2  
  The systems and procedures used should allow a suitably qualified and 
  experienced person (SQEP) to decide on the implications of each proposal and 
  permit them to be fed back to the relevant members of the design team for 
  consideration and agreement to the change, as necessary. 
   6.7.3  
  Construction on a licensed site is subject to LC 20 – modification to design of 
  plant under construction, and appropriate safety classification arrangements are 
  required. 
   6.8  
   Non conformances 
   6.8.1  
  During the construction process non-conformances may occur. It is important 
  that there are appropriate procedures and processes within the project team to 
  record non-conformances and confirm the actions taken through the design team to 
  address any issues resulting from a non-conformance. 
   6.8.2  
  It is ONR’s expectation that the licensee, designer and contractors should 
  have a suitable system for recording and dealing with all non- conformances.  
   6.8.3  
  A site culture should be engendered, such that contractors are positively 
  encouraged to report openly any potential non-conformances no matter how they 
  have arisen.  Generally, a ‘questioning attitude’ should be fostered within the 
  construction team.  
   6.9  
   Certification of materials 
   6.9.1  
  In a modern global market, materials and components may not originate in the 
  EU but may be sourced from around the world. Whilst this brings with it certain 
  benefits it can also bring challenges ranging from the provision of false certification 
  covering dubious quality control in manufacture to a lack of real auditable / 
  traceability of components through to counterfeit parts entering the supply chain. 
  This lack of an auditable quality trail means that the specification may be 
  compromised, threatening any claims made in the safety case. 
   6.9.2  
  It is ONR’s expectation that batch traceability of all materials should be 
  available and for high integrity items, component traceability should also be 
  available.  The licensee should also consider verification testing by third party of 
  certain high safety significance items. 
   6.10  
   Contractor self certification 
   6.10.1 “Certification by the work originator of the design and construction of 
  structures whose failure would not have high consequences can give adequate 
  assurance of structural safety provided there are appropriate systems in place for 
  ensuring competence”14.  
   6.10.2 However, for safety critical items of plant or nuclear related construction 
  processes whose failure would have high consequences, third party independent 
  certification should be used to give added assurance of structural / nuclear safety. 
  An appropriate level of checks and certification should be found within these two 
  extremes. 
   11
    
   6.10.3 Whilst quality cannot be inspected into the construction process it is an ONR 
  expectation that the licensee’s arrangements should include additional supervision 
  and management systems to control the construction activity of nuclear related 
  construction and reduce risks to nuclear safety.  
   6.10.4 It is an ONR expectation therefore that the certification of structural nuclear 
  safety related work should thus only be entrusted to appropriately qualified and 
  experienced people. 
   6.10.5 Reference to licence condition LC 12 concerning duly authorised and other 
  suitably qualified and experienced persons should also be made. 
   6.11  
   Third party assurance 
   6.11.1 ONR’s expectation is that appropriate quality systems should be applied as 
  necessary throughout all levels of a project supply chain in accordance with licence 
  condition LC17. Refer also to T/INS/01728. 
   6.11.2 Given the potential scale of some projects it is possible that construction 
  consortiums may be envisaged. This process may lead to project teams working to a 
  conglomerate of systems. Whilst parts may be familiar to certain members of the 
  team, other parts are not. This interface needs to be recognised, understood, 
  planned and managed such that an effective, efficient quality plan is produced. 
   6.12  
   Contractor selected materials  
   6.12.1 It is ONR’s expectation that a suitable contractor proposed material approval 
  system should be implemented by the licensee.  Material selection by the 
  construction team within the specification should be verified by the original designer 
  against the original design intent as translated into the specification and hence 
  against any claims on the safety case and validated as such. 
   Reference should also be made to the Construction (Design and Management) 
  Regulations and associated ACoP29 in relation to designers. 
   6.13  
   Testing, monitoring and inspection 
   6.13.1 It is ONR’s expectation that the use of hold points for certain testing and or 
  inspections should be considered. Requirements should be clearly stated in the 
  specification and should incorporate standards appropriate to the categorisation and 
  classification of the structure, system or component. The requirements should be 
  incorporated into agreed test and inspection plans, and hold point control plans, 
  which have been integrated within the risk management process and programme.  
  The use of approved contractor method statements may also act as a hold point and 
  control over works on site. Refer also to IAEA NS-G-3.630 ; Section 2, site 
  investigation; Section 4, consideration for foundations; Section 7, monitoring of 
  geotechnical parameters, for further details relating specifically to site investigation. 
   12
    
   6.14  
   As-constructed records 
   6.14.1 “As-constructed records have in the past received various levels of attention 
  at the end of a project.  Records management and retention is often found to be an 
  area for poor practice or sometimes records not available due to the time delays in 
  their production”8. 
   6.14.2 It is ONR’s expectation that as-constructed records should provide a fully 
  referenced account of the work actually constructed and should be produced in a 
  timely manner as the information becomes available throughout the contract. 
   6.14.3 General progress photographs may be useful during the construction phase 
  but will generally be inadequate for more detailed recording of ‘as-constructed’ items.  
   6.14.4 However, for the purposes of verification of construction detail, particularly 
  areas which cannot be readily inspected, will become inaccessible, concealed or 
  covered once complete, it is ONR’s expectation that detailed referenced 
  photographs should be retained and used as part of the as-constructed records.  As-
  constructed records are an important aspect of future verification and maintenance 
  and as such suitable and adequate provision should be made for their retention. 
   6.15  
   Modular design elements 
   6.15.1 The use of modular design elements and precast units manufactured off site 
  can have benefit in terms of quality, time/ programme but bring with them potential 
  problems. There is an increasing tendency to make such elements as large as 
  possible. Problems of long periods in storage; haulage; transport across site; 
  craneage; and incorporation details should all be considered both in the design and 
  within the risk management plan and be part of an agreed and considered 
  construction philosophy and methodology.  
   6.15.2 It is ONR’s expectation that early dialogue between the designer and 
  contractor should occur to discuss elements of the construction process and how this 
  can be best achieved. 
   6.16  
   Barriers to understanding 
   6.16.1 Barriers to understanding may arise through foreign companies entering the 
  UK market. This could include both design houses or design teams working abroad 
  and foreign contractors working in the UK. 
   6.16.2 “With construction companies carrying fewer of their own operatives, there 
  tends to be a heavy reliance on labour only (LO) subcontract organisations. 
   Many of these organisations have a diverse workforce. Language barriers are 
  common within these workforces, giving challenges in the communication of health 
  and safety requirements during site induction and toolbox safety talks”15. 
   6.16.3 The use of global workforces may reduce the level of ownership and 
  commitment, fragmenting the quality culture ethos that is necessary within the 
  workforce. 
   13
    
   6.16.4 It is ONR expectation that a robust system of checks to understanding should 
  be incorporated into both induction and toolbox talks relating to health, safety and 
  construction quality issues and that relevant SQEP supervisory staff are employed. 
   6.17  
   Performance indicators 
   6.17.1 The selection of inappropriate performance indicators either key performance 
  indicators (KPI’s) or safety performance indicators (SPI’s) can produce a negative 
  culture.  
   6.17.2 It is ONR’s expectation that careful consideration should be given to the 
  selection and use of relevant indicators and their effect on the drivers for the project. 
  Evidence of monitoring the effects of KPI’s / SPI’s over time should be used.  
   6.18  
   Demolition / decommissioning 
   6.18.1 Reference should be made to the Safety Assessment Principles (SAP’s)11, 
  Safety principles DC 1-8 together with the relevant guidance. 
   6.18.2 CIRIA report T 30.001 Demolition, Dismantling and Decommissioning 
  Rev 03 [Jan 09]19 may also be a useful guide on aspects of demolition.  
   6.18.3 It is ONR’s expectation that decommissioning and demolition of structures 
  should be considered during the planning, design, construction and operational 
  stages and in line with licence Condition LC 35 and the CDM regulations8.
   14
    
   Appendix 1  - Areas of Construction and Expectations  
   The following table provides areas of civil engineering related to new construction works, which inspectors may wish to use as a prompt for 
  further consideration and thought.  This list is not meant to be exhaustive. 
   Area for consideration 
   Concrete 
   Attribute 
   Strength 
   Additives, including cement 
  replacement 
   Joints (Construction / Movement)
   Shrinkage, construction 
  sequence (related Issues) 
   Shielding (high density concrete) 
   Concrete 
   Surface finish 
   Seismic Gaps 
   Certification 
   Seismic gap dimensions should 
  be set so that the gap dimension  
  is not smaller than the specified 
  dimension 
   Importance 
   Design based on specified 
  strength. Excessive over or 
  under strength will affect 
  performance 
  May affect long term strength, 
  change performance and affect 
  durability 
  Affect load transfer. Affect 
  containment. Affect shielding 
   Can affect shear performance. 
  Cracks may need to be sealed to 
  prevent contamination 
  ingress/transfer 
  Placing and  compaction 
  difficulties 
  May be important for control of 
  contamination/ application of 
  decontaminable surfaces. 
  Durability, Location of form ties 
  Long term records for verification 
  of construction standards. Will be 
  relevant also for PRS as well as 
  initial licensing 
  Affects seismic performance. 
  pounding 
   Additional Notes 
   Specifications to set limits 
   Specification to set limits and 
  types. Refer to Line to Take 
   Specify appropriate detail. 
  Specification to reflect design 
  code requirements on 
  workmanship 
  Designer to specify or contractor 
  to agree with designer 
   Designer to specify or contractor 
  to agree with designer 
  Specification to set standards 
   LC 6 arrangements 
   Specification 
   15 
    
    
   Area for consideration 
   Shielding 
   Attribute 
   The faces of the seismic gap 
  should not have protrusions 
  which will reduce its 
  effectiveness . There should be 
  no debris in the gap and 
  horizontal gaps should be 
  capped to prevent entry of debris 
  in the future 
  Where gap filling material is 
  specified , no alternative should 
  be allowed without agreement of 
  the designer 
  Complimentary shielding 
   Cracks, joints 
   Concrete density 
   Service penetrations 
   Reinforcement 
   Placing ,tying 
   Importance 
   Affects seismic performance of 
  structure 
   Additional Notes 
   Detailed within the design . 
  Reiterated  in the Maintenance 
  manuals 
   LC 20 . 
  Specification 
  Reiterated  in the Maintenance 
  manuals 
  Carefully considered design 
  detailing and early contractor 
  involvement in buildability issues 
   Specification . Agreement of 
  remedial actions with design 
  team 
  Specification. Workmanship 
  supervision, testing 
   Carefully considered design 
  detailing 
   Specification . Code 
  requirements 
   Affects designed performance of 
  the structure 
   Can be difficult to support / fix in 
  shutter. Can affect reinforcement 
  cover/ placement unless detailed 
  correctly 
  Cracking and joints can 
  compromise shielding 
   Inadequate compaction concrete 
  materials can affect specified 
  requirement 
  Can compromise shielding. 
  Complimentary shielding may 
  also be required 
  Reinforcement needs to be 
  placed and tied in accordance 
  with the requirements of the 
  code. If the design is in 
  accordance with the ACI codes 
  then detailing and workmanship 
  requirements will be in 
  accordance with that code, or 
  more onerous code 
   16 
    
   Area for consideration 
   Attribute 
   Couplers 
   Reinforcement 
   Cover 
  Laps bends and links 
   Earthing 
   Storage 
   The provision of additional 
  reinforcing bars ( or oversized 
  bars) 
  Use of galvanized or epoxy 
  coated rebar 
   Corrosion protection 
   Welding of reinforcement 
   Site investigation / confirmation 
  of data, ground preparation, 
  insitu testing. Piles / rock anchor 
  testing 
   Foundations 
   Importance 
   Note specific requirements for 
  couplers to meet ACI codes. 
  Including fixing and inspection 
  Critical to durability 
  To meet requirements of design 
  codes 
  Reinforcing bars may form part 
  of a Faraday Cage or other 
  earthing system. These 
  requirements may be more 
  onerous than the normal 
  workmanship requirement for 
  tying a cage 
  Storage of reinforcement should 
  be carefully considered. 
  Tolerances, bar type and 
  reinforcement quality should be 
  verified 
  Can affect seismic performance 
  of structure 
   Galvanized rebar prohibited 
  within ACI 349  
   Effects of chlorides. Deicing 
  chemicals  
   Codes and Standards having 
  varying requirements 
  Cannot inspect therefore highest 
  standards of construction, testing 
  and record keeping appropriate 
   Additional Notes 
   Code specification. Refer to line 
  to take. 
   Code specification 
  Code, Specification 
   Specification and relevant Codes 
   Quality Assurance and testing of 
  materials on site 
   Specification- change control. 
  Supervision 
   Adequate performance of epoxy 
  coated rebar and concrete 
  should be demonstrated. Refer 
  to code. 
  Refer ACI committee 201 and 
  222. Pavix / Silane not now 
  recommended 
  Specification and Codes 
   LC 28, LC 14 
   17 
    
   Area for consideration 
   Fluid retaining structures 
   Encast Items 
   Temporary openings 
   Attribute 
   Contamination 
  Unidentified services 
   Water bar, joint preparation, 
  waterproof membranes 
  Inspectablity, repairability,  
   Proprietary items. Halfen type 
  channels 
  Post drilled fixings 
   Use of resin anchors 
   Material compatibility 
   Purpose designed encast 
  anchorages 
   Reinforcement, compaction, 
  voids, staggered laps 
   Interface with Mechanical, 
  Electrical and C&I architectural 
   Interface impacts on justification 
  of the safety case 
   Roads , Drainage and 
  Infrastructure 
   Safety issues, interaction with 
  SR service load capacity of live 
  service ducts 
   Importance 
   Recognition, testing, disposal 
  Surveys, site location and 
  marking 
  Long term durability 
  Crack control 
  Long term durability of structure. 
  Control of contamination 
  Dynamic response 
   Additional Notes 
   Specification, SAP’s 
  Permit to dig 
   Good detailing, LC28  
   LC28 
   Refer to line to take  
   Dynamic response, failure mode, 
  rebar 
  Failure mode. Justification 
   Selection of materials  
  Prevention of negative reactions 
   Material properties. Design 
  Codes Manufacturing records, 
  QA, SQEPs, positioning, welding 
  Subsequent construction needs 
  to reflect requirements of design 
  to support safety case. Process 
  of making good to be of 
  appropriate standard 
  Use of appropriate technology 
  for  modelling of service 
  interfaces within the design 
  stage 
  Access, emergency escapes. 
  Control of flooding, power and 
  emergency supplies 
   Code requirements on degree of 
  clustering . Refer to line to take 
  Consider conditions and 
  Location . Refer to line to take 
  Zinc reaction with alkaline 
  materials in concrete. Galvanic 
  reactions. Hydrogen generation 
  and potential for hydrogen 
  enbrittlement. 
  Refer to line to take 
   Involvement of designer. 
  Specification Codes 
   Involvement of the designer to 
  ensure compliance with safety 
  case requirements. 
   18 
    
    
    
   Area for consideration 
   Construction Cranes 
   Attribute 
   Stability, ground conditions, 
  adjacent plant 
   Correct/ Full Design Brief 
   Transfer of information 
   Importance 
   Issues associated with working 
  adjacent to SR plant. Crane 
  collapse 
  Licensee has full understanding 
  of facility usage and 
  requirements. These need to be 
  transferred to a workable ‘brief’ 
   Optimisation of design through 
  Co-ordinated discipline teams 
   Lack of coordination through 
  disciplines leads to late 
  alterations 
   Late changes leading to lack of 
  clarity and rushed decisions 
   Implications of use of certain 
  codes & Standards – More 
  rigorous & unusual to contractor 
  and sub contractors 
   Contractor works to a normal 
  industrial standard  
   Unacceptable Quality Control 
   Additional Notes 
   Crane design, Crane platform , 
  Lifting Coordinator, testing 
  inspection 
  Licensee will work with design 
  house. Good communication 
  facilitated by co-location of 
  design team and licensee’s 
  project team. Regular Interfaces 
  Optioneering record sheet; 
  development of design 
  Co-ordinated design discipline 
  reviews 
   Appropriate modelling for areas 
  of tight service interfaces/ 
  penetrations 
  Design complete prior to 
  construction 
  Design peer reviews  
  Contractor checked for SQEP 
  (prior to award, following award 
  and throughout contract) – 
  Assurance sought that people 
  proposed at tender are available 
  & subsequently used. Similar 
  SQEP issue with sub contractors 
  and sub- sub contractors staff 
  and QA procedures 
  Rigorous Site control with Design 
  Input as required 
   19 
    
    
    
    
    
    
    
    
    
    
    
    
    
   Area for consideration 
   Design specification leaves 
  contractor scope to define 
  alternative materials (“ or similar 
  approved”) 
   Attribute 
   Contractor specifies unsuitable 
  materials as he is not fully aware 
  of design requirements 
   Importance 
   Materials do not fully justify 
  safety case 
   Additional Notes 
   Thorough and complete 
  checking by designer of 
  contractors proposed materials.  
   Design is difficult for the 
  contractor to construct 
   Contractor finds it time 
  consuming or costly to construct 
   Non-conformances 
   Inevitable 
   Contractor either cuts corners or 
  proposes changes to design at 
  late stage 
  Can adversely affect design  
   Design Changes 
   Time / Availability 
   Procurement  Availability 
  Contractor Proposals 
  Errors/ mistakes- Non 
  Conformances 
  Oversights from original design 
   Use of material acceptance/ 
  proposal forms. Hold point 
  approval 
  Early involvement of contractor . 
  – buildability input incorporated 
  into design 
  Recording of non conformances 
  (No blame Culture) 
  Understanding of issue in 
  relation to safety case and 
  specification 
  Closing out of issues including 
  up dating of as built records 
  Clear limits of authority to accept 
  changes & non conformances on 
  behalf of licensee by others 
  (Design House) 
  A robust design change system 
  of recording and acceptance 
   20 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Area for consideration 
   Records 
   Attribute 
   Appropriate records developed 
  and maintained 
   Importance 
   Timely records developed to 
  show continuity from design 
  through construction in order to 
  justify operational safety case 
   Contractor methodology 
   Contractor methods in some 
  circumstances need to be 
  validated against design 
  assumptions 
   Contractors methods may not 
  align with original design 
  assumptions 
   Additional Notes 
   Verification of design brief and 
  specification are aligned 
  (including codes, standards etc) 
   Verification of appropriateness of 
  codes/ standards to be adopted  
  Certification of materials 
  Verification of testing for 
  proprietary items 
  Verification that contractor 
  selected materials are compliant 
  with design intent 
  Timely ’as constructed’ drawings 
  including appropriate referencing 
  to design changes 
  Early engagement of contractor . 
  – buildability input incorporated 
  into design 
   21 
    
    
    
    
    
    
    
    
    
    
    
   References 
   1. 
  2. 
  3. 
  4. 
  5. 
   6. 
  7. 
  8. 
  9. 
  10. 
  11. 
  12. 
  13. 
   14. 
  15. 
   16. 
  17. 
  18. 
   19. 
   20. 
  21. 
   22. 
  23. 
   24. 
   25. 
   T/AST/039 ; Management for Safety 
  T/AST/057 ; Design Safety Assurance 
  T/AST/017 ; Structural Integrity, Civil Engineering Aspect  
  T/AST/077 ; Procurement of nuclear safety related items or services ,  
  Quality Assurance for Safety in Nuclear Power Plants and other Nuclear 
  Installations, Codes and Safety Guides Q1-Q14, Safety Series No 50-
  C/SG Q, IAEA, Vienna 2001  
  Nuclear Installations Act 1965 (as amended)  
  Health and Safety at Work Act 1974 (as amended) 
  The Construction (Design and Management) Regulations 2007 
  Ionising Radiation Regulations 1999  
  IAEA guidance DS349, Management System for Nuclear Facilities 
  Safety Assessment Principles for Nuclear Facilities, 2006 rev 1. HSE 
  Not Used 
  American Concrete Institute (ACI 349/06) Code requirements for Nuclear 
  Safety Related Concrete Structures. 
  Thirteenth report of SCOSS , The standing committee on Structural Safety 
  Construction workers for whom English is not their first language (Reg 13, 15 
  of The management of Health and Safety at work Regulations 1999 as 
  amended) 
  Not Used 
  T/INS/012 ; technical inspection guide LC12 DAP’s and SQEP’s 
  Western European Nuclear Regulators Association (WENRA) Reactor 
  harmonisation working group, reference levels, Jan 2008. 
  CIRIA report T 30.001 Demolition, Dismantling and Decommissioning 
  Rev 03 [Jan 09] , Designing to make management of hazards in Demolition, 
  Dismantling and Decommissioning easier. 
  Not used 
  T/AST/049 , Technical Assessment Guide, Licensee use of Contractors and 
  Intelligent Customer capability 
  UK CARES; url www.ukcares.com 
  American Institute of Steel Construction (ANSI/AISC 360-05) Specification for 
  structural steel buildings. 
  American Institute of Steel Construction (ANSI/AISC 341-05) Seismic 
  Provisions for Structural Steel Buildings. 
  American Institute of Steel Construction (ANSI/AISC N690-06 Specification 
  for Safety Safety related structures for nuclear facilities. 
   22
    
   26. 
  27. 
  28. 
   29. 
   30. 
   31. 
  32. 
  33. 
   Not Used 
  Not Used. 
  T/INS/017; Site Inspection and enforcement guidance:LC17 Quality 
  Assurance. 
  Managing health and Safety in Construction – Construction (Design and 
  Management ) Regulations 2007 Approved Code of Practice.  
  IAEA, NS-G-3.6; Geotechnical aspects of site evaluation and foundations for 
  nuclear power plants. 
  British Construction Steelwork Association, BCSA,  www.steelconstruction.org 
  International Masonry Society, IMS,  www.masonry.org.uk 
  IAEA Safety Standard GS-R-3 The Management Systems for Facilities and 
  Activities Safety Requirements 
   23
    
    
  "
  Control of processes involving nuclear matter ns-tast-gd-023	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Control of processes involving nuclear matter ns-tast-gd-023.pdf	" Title of document 
   OFFICIAL 
   ONR GUIDE 
   CONTROL OF PROCESSES INVOLVING NUCLEAR MATTER (SAP – ENM. 
  1 TO 8) 
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document 
  ID and Revision 
  No: 
  Date Issued: 
   NS-TAST-GD-023  Revision 5   
   August 2019 
   Review Date: 
   August 2022 
   Approved by: 
    Peter Donnelly 
    Professional Lead 
  Chemistry/chemical engineering 
   Record 
  Reference: 
   Revision 
  commentary: 
   CM9 Folder 1.1.3.776. (2019/250250) 
   Routine update incorporating changes in IRRs, Safeguards 
  legislation and the introduction of the Environmental 
  Authorisations (Scotland) Regulations 
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
   5. 
  6. 
  7. 
  8. 
   INTRODUCTION ................................................................................................................. 2 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION ......................... 3 
  RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ADDRESSED ............................................................................................... 4 
  ADVICE TO INSPECTORS ................................................................................................. 5 
  REFERENCES .................................................................................................................. 10 
  GLOSSARY AND ABBREVIATIONS ................................................................................ 11 
  APPENDICES.................................................................................................................... 12 
   © Office for Nuclear Regulation, 2019 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 08/19 
   OFFICIAL 
   Report  NS-TAST-GD-023 
   Page 1 of 14 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   2. 
   2.1 
   2.2 
   OFFICIAL 
   INTRODUCTION 
   ONR has established its Safety Assessment Principles (SAPs) which apply to 
  the assessment by ONR specialist inspectors of safety cases for nuclear 
  facilities that may be operated by potential licensees, existing licensees, or 
  other duty-holders where ONR is the Enforcing Authority.  The principles 
  presented in the SAPs are supplemented by a suite of guides to further assist 
  ONR’s inspectors in their technical assessment work in support of making 
  regulatory judgements and decisions.  This Technical Assessment Guide (TAG) 
  is one of these guides. 
   PURPOSE AND SCOPE 
   This Technical Assessment Guide provides guidance on ONR’s approach to 
  the control of nuclear matter, the relevant legislative constraints and definitions 
  and on the application of relevant ONR Safety Assessment Principles (SAPs) 
  [1], as described in section 4.1 below. 
   Nuclear matter must be controlled to protect people from harm and to protect 
  the environment, safeguard fissile material and to secure hazardous 
  installations and materials. Harm may result from the radioactive properties of 
  nuclear matter, or by combination of its radioactive properties with toxic, 
  explosive or other hazardous properties. Recognition of the impact that? 
  nuclear matter may have on safety is implicit throughout the SAPs. 
   2.3 
   The principal definition of nuclear matter used by ONR is that given in the 
  glossary to the SAPs, based on the definition used in the Nuclear Installations 
  Act (NIA): 
   Installations 
   Subject 
  to any exceptions prescribed 
  in NIA and 
  the Nuclear 
  (Excepted Matter) Regulations 2017[2], nuclear matter is: 
  1 
  any 
  fissile 
  material 
  in 
  the 
  form 
  of 
  uranium 
  metal, 
  alloy 
  or 
  chemical 
  compound 
  (including 
  natural 
  uranium), 
  or 
  of 
  plutonium 
  metal, 
  alloy 
  or 
  chemical 
  compound, 
  and 
  any 
  other 
  fissile 
  material 
  which may be prescribed;  
  2 
  any 
  radioactive 
  material 
  produced 
  in, 
  or 
  made 
  radioactive 
  by 
  exposure to the radiation incidental to, the process of producing or 
  utilising any such fissile material as aforesaid. 
   It should be noted that following the commencement of the Nuclear Safeguards 
  Act 2018 the definition of “qualifying nuclear material” overlaps the definition of 
  excepted matter arising through NIA and as such, material that may meet the 
  criteria to be considered as excepted matter may still be qualifying nuclear 
  material for safeguards purposes.  In any case involving such material, ONR 
  Safeguards should be consulted. 
   This guidance therefore applies to all types of nuclear matter, including 
  excepted matter (see the Appendix) unless the wording makes it clear that 
  limited application was intended, or unless it can be shown that the total 
  amount of nuclear matter concerned is sufficiently small or is in such a 
  chemical or physical form as to make it unnecessary to apply to any one or 
  more of the SAPs. The SAPs require the identification of “all initiating faults 
   having the potential to lead to ….. a significant quantity of radioactive 
  material escaping from its designated place of residence or confinement” 
   (fault analysis principle FA.2). 
   2.4 
   2.5 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 2 of 14 
   OFFICIAL 
    
    
    
    
   Office for Nuclear Regulation  
   2.6 
   OFFICIAL 
   Interpretation of “control” should not be restricted to the need for control and 
  instrumentation (C&I) systems. In this context, control relates to the ability to 
  manage a hazardous material. However, the legislation does not define fully the 
  type of control required, for example, Licence Condition (LC) 4 states only that 
  “adequate arrangements” should exist for nuclear matter brought onto site. 
   2.7 
   The nature of the control required can be determined from a number of 
  sources, including (in no particular order): 
   and 
   Technical 
   Assessment 
    
   
   
   
   Principles 
   Legislation, primary and secondary. 
  the nuclear site licence conditions . 
  Published standards. 
  ONR’s 
  Safety 
  Assessment 
  Guides. 
  Comparison with relevant good practice in the UK and abroad. 
  Good design and analysis of appropriate systems and equipment. 
  Legal Guidance from ONR’s solicitors or legal advisory service. 
  For 
  material 
  meeting 
  the 
  criteria 
  to 
  be 
  “qualifying 
  nuclear 
  Safeguards requirements. 
  This guidance covers the key concepts of inventory control. In this context, 
  control should be applied proportionately and according to the meanings of 
  relevant ONR guidance, for example on limits and conditions [3] and functional 
  safety systems [4]. 
    
   
   
   
   matter”, 
   2.8 
   2.9 
   Nuclear matter has to be managed through all stages in the life-cycle of a 
  facility and most of the SAPs will apply to nuclear matter at some stage.  Many 
  specific principles in other sub-sections are particularly relevant, e.g. 
  containment and ventilation [SAP-ECV.1 to 10] and other guidance should be 
  consulted for the assessment of equipment designs or specific operations. 
   2.10 
   On civilian sites, responsibilities for ensuring the security and safeguards of 
  nuclear material are regulated by ONR Civil Nuclear Security and Safeguards 
  (CNSS) Division1. 
   3. 
   3.1 
   3.2 
   3.3 
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION 
   Explicit reference to nuclear matter is found in LC 4 and 5. 
   LC 4 is concerned with the necessity of “adequate arrangements” for bringing 
  nuclear matter onto a licensed site and for its storage there. Arrangements 
  covering issues addressed by the relevant SAPs and this guidance should be 
  consistent with any relevant information in a Safety Case, and the advice herein 
  will be useful in addressing such arrangements as well as other relevant 
  aspects of safety cases as a whole. 
   LC 5 is concerned with the regulatory control of consignments from a licensed 
  site and the records required to be kept. Its main purpose is to ensure that 
  HSE/ONR can identify destination sites for which a new licence might be 
  needed. 
   1 Subject to the final position post-Brexit the period of shadow regulation may continue for a period. 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 3 of 14 
   OFFICIAL 
    
    
    
                                           
            
   Office for Nuclear Regulation  
   3.4 
   3.5 
   3.6 
   4. 
   4.1 
   4.2 
   4.3 
   4.4 
   OFFICIAL 
   Other laws and regulations affecting nuclear installations define the materials 
  within their scope in slightly different ways. The appendix to this guide expands 
  on the definitions. Since all the legislation described in the appendix requires 
  some control over radioactive/nuclear material, this guidance is relevant to all 
  nuclear legislation in varying degrees. 
   LC 34 requires that licensees ensure, so far as is reasonably practicable, that 
  radioactive material and radioactive waste on the site is at all times controlled 
  or contained so that it cannot leak or otherwise escape. Assessment of 
  arrangements to comply with this licence condition should therefore also take 
  account of this guidance. Arrangements made under LCs 23 and 27 on 
  operating rules and safety mechanisms may also be relevant in this respect. 
  Arrangements for the periodic review of safety cases under LC 15 will also be 
  relevant as such reviews should address aspects of control and containment, 
  shortfalls against modern standards and the relevant overall site strategies for 
  the control of nuclear matter. 
   As described in section 2 above, qualifying nuclear material for safeguards 
  purposes may also be nuclear matter, as such, the views of ONR Safeguards 
  should be sought wherever it is appropriate to do so. 
   RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA 
  SAFETY STANDARDS ADDRESSED 
   SAPS 
   This TAG provides guidance on SAPs ENM.1 to ENM.8 and their relationship 
  with other parts of the SAPs.  The SAPs in the ENM section specify control at 
  increasing levels of detail, starting at ENM.1 (highest level) with planning and 
  the management strategy for the site. ENM.2 then covers facilities and their 
  safety cases, ENM.3 covers the design, implementation and operation of those 
  facilities and ENM.4 covers the administration of those operations. The 
  desirable attributes of material in facilities are defined in principles ENM.5 and 
  6. Finally, principles ENM.7 and ENM.8 are concerned with retrieval/inspection 
  and accountancy of nuclear material. 
   Additional applications of this guidance include: fuel handling on research 
  reactors, waste handling on power reactors and reprocessing activities. Nuclear 
  matter is subject to specific controls whilst in the core of a reactor [SAP ERC]. 
  Reactor coolant must also be controlled to prevent damage to the core [SAP 
  EHT, ERC.3 and ESS para 340]. SAPs ENM.2-8 also apply to radioactive 
  waste and contaminated land where they present an equivalent hazard. For 
  these materials, principles in the sections on radioactive waste management 
  [RW.1 to 7] and contaminated land also apply [RL.1 to 8].  
   Western 
  levels 
   European 
   Nuclear 
   Regulators 
   Association 
   (WENRA) 
   Reference 
   There are no specific WENRA reference levels relevant to this TAG, although 
  those under Appendix E of the report of the Reactor Harmonisation Working 
  Group on the Design Basis Envelope for Existing Reactors [5] are relevant to 
  the associated engineering design provisions. The reference levels for Waste 
  and Spent Fuel Storage are explicitly addressed in other TAGs (NS-TAST-GD-
  024 and NS-TAST-GD-081) but the advice given in this TAG is consistent with 
  this position. 
   IAEA Standards 
   The concept of control in IAEA safety standards and guides covers all 
  regulated radioactive material and not just nuclear material, but in general the 
   OFFICIAL 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 4 of 14 
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   control of materials necessary for safety is not made explicitly in most IAEA 
  documents. The Requirements Document on the Safety of Fuel Cycle Facilities 
  [6] sets out relevant engineering design requirements and the Safety Guide 
  which covers fire protection [7], provides relevant guidance where a failure to 
  control may lead to a fire or explosion hazard. 
   5. 
   ADVICE TO INSPECTORS 
   5.1 
   5.2 
   5.3 
   5.4 
   Overall strategy 
   ENM.1 states that a strategy should exist, to ensure that unwanted material is 
  not generated and that matter is controlled to prevent harm and to ensure 
  control can be maintained. The strategy should be consistent with current 
  Government policy (such as Cmd. Paper 2919 and ref [8]) on such matters and 
  comply with relevant statutory and applicable provisions, including relevant 
  Licence Conditions as outlined above. The strategy should be compatible with 
  individual safety cases and take a holistic view, especially with regard to 
  inherent safety [EKP.1] [1]. The strategy should identify all routes for nuclear 
  material both into and out of the site or facility. The latter should also comply 
  with relevant legislation for transfers and disposals (the latter regulated by the 
  EA and SEPA, see Annex 1 to the SAPs). The strategy should cover all 
  relevant nuclear material irrespective of whether it has been declared to be 
  nuclear waste. 
   The strategy will take account of the lifetimes of plant and requirements for 
  control consistent with safety cases. The strategy or safety cases should 
  demonstrate any prolonged storage is safer than disposal, where a disposal 
  route is available. In some circumstances, the radioactive matter will present a 
  hazard long after the current facilities have reached the end of their useful life. 
  The strategy should deal with this possibility and include appropriate 
  cognisance of requirements during the “period of responsibility” [9] which may 
  apply long after a site or facility ceases normal operations. Finally, strategy 
  documents should be live documents, taking account of changes to 
  circumstances. The following guidelines, together with other relevant SAPs 
  [e.g. SC.6, DC.1 to 9], can be used in assessing this strategy. Some radioactive 
  waste is also nuclear matter and the principles in the SAPs sub-sections on 
  Radioactive Waste and Contaminated Land could also be relevant.  
   Management Control 
   SAP ENM.2 covers control at the level of organisational control over activities 
  on a nuclear licensed site by a combination of engineered systems and 
  managerial control procedures. The control will be justified in safety cases for 
  all the relevant operations on the site, which define the safe operating envelope 
  for the material. 
   All activities involving nuclear matter are included and ENM.2 is not just 
  restricted to the processing of nuclear matter. Control must be exercised when 
  raw nuclear materials or intermediates are stored or moved on a site, while 
  nuclear material is being processed and after treatment, prior to transport off-
  site for further treatment or disposal. There is no distinction between the 
  standards of control required for radioactive feedstock or radioactive waste. 
  The level of control will be related to the hazard, reliability demanded and the 
  consequences of loss of control of any such material on workers and others. 
   5.5 
   In order to control processes involving hazardous substances it is necessary to 
  understand the objectives of the process, the limits and conditions required to 
  maintain safety and the physical and chemical properties of the substances 
  being processed. 
   OFFICIAL 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 5 of 14 
    
    
    
   Office for Nuclear Regulation  
   5.6 
   5.7 
    
    
    
   5.8 
   5.9 
   OFFICIAL 
   The need for control should be identified early in the safety case [particularly 
  SC.3] and the SAPs specifically demand identification of faults leading to loss 
  of control [FA.2]. 
   The safety case should review the options for process selection; to eliminate 
  hazards by minimising the inventory [SAP EKP.1 & Para 152] or prevention 
  (i.e. minimisation or reduction of the frequency of the fault) or by mitigation of 
  the consequences, in order of preference. This should be clearly identified in 
  the options studies that are carried out at the time of process selection and 
  should form part of the safety justification, usually at the preliminary stage. The 
  effects of scale-up from experiments or different conditions during operation of 
  earlier plant should be allowed for. There should be adequate provision to 
  ensure that under normal and fault conditions nuclear matter is: 
   Cooled, 
  monitored 
  and 
  controlled 
  where 
  chemical reaction may be significant;  
  Managed 
  so 
  that 
  chemical 
  reactions, 
  radiolysis, 
  precipitation, 
  kept within the specified limits (see ECH.1 – ECH.4); 
  Segregated appropriately [see ENM.5]. 
   from 
   the 
   heat 
   radioactive 
   decay 
   or 
   acidity 
   etc. 
   are 
   The safety case should be developed (see [10]) through a structured analysis 
  [SAP FA.2, EKP.4] including fault studies supported by probabilistic safety 
  analysis where appropriate, see ONR guidance [11] on “Deterministic Safety 
  Analysis and the Use of Engineering Principles in Safety Assessment”.  
   The safety case should clearly identify the operating parameters [SAP-
   SC.6] which define the operating envelope and safety significant parameters 
  which define the (LC 23) safety envelope and how each is derived; other ONR 
  guidance applies. Specific consideration should be given to process transients 
  due to start-up, shutdown, maintenance and foreseeable faults [FA.6]. This is to 
  ensure that conditions during such phases are adequately covered by the 
  control / safety system or administrative procedures. Such consideration may 
  indicate the requirement for additional control during these phases. 
   5.10 
   Although the preference would be for passive then engineered control at all 
  times, where this is not reasonably practicable, administrative safety measures 
  may suffice, see EKP.5. 
   5.11 
   5.12 
   5.13 
   Control Features of Plant 
   Inventories should be low enough to avoid adverse effects due to runaway 
  reactions and buffer storage should be sufficient to eliminate process 
  perturbations with safety implications, as recognised by ENM.2. Buffer storage 
  that reduces sensitivity to faults should not be used for the prolonged storage of 
  nuclear matter and its inventory of potentially harmful materials should be 
  minimised consistent with the required functionality. There is a balance 
  between achieving a robust process and minimising the inventory in buffer 
  storage. 
   The site arrangements, layout and plant design should aim to avoid 
  unnecessary movements of nuclear matter [EKP.3 and ELO.3] 
   Occasions when it is necessary to temporarily re-route nuclear matter include 
  pressure relief and sampling. Continuous monitoring instrumentation may 
  provide necessary data but in certain circumstances samples of the actual 
  material may have to be taken. 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 6 of 14 
   OFFICIAL 
    
    
    
    
   Office for Nuclear Regulation  
   5.14 
   5.15 
   OFFICIAL 
   Monitoring of plant parameters should rely as far as is practicable on 
  instrumentation that does not require nuclear matter to be diverted outside the 
  main containment. 
   If samples are needed, adequate consideration should be given to ensuring 
  that samples are representative of the process to allow accurate measurement 
  (ECH.4), whether or not routine control depends on the on-line or the off-line 
  instruments. Account should be taken of potential problems due to phase 
  separation, sample line deposition, condensation from gas streams, blockages, 
  temperature and chemical changes, which may affect the composition of the 
  sample being taken. 
   5.16 
   Where material must be re-routed, provision should be made to ensure the safe 
  handling of the material [ECV.3 and 4] and its return to safe containment by: 
   5.17 
   5.18 
   5.19 
   5.20 
   5.21 
   1  Return to the process after use, or 
  2  Treatment, or 
  3  Storage, or 
  4  Disposal. 
  Whilst sampling should be avoided as a means for controlling dynamic 
  systems, it may still be necessary to periodically retrieve smaller amounts of 
  material over a longer timescale, in order to demonstrate compliance with a 
  safety case. Whilst ENM.3 discourages sampling as a means of controlling 
  dynamic processes, ENM.7 is a reminder that some sampling from longer-term 
  storage may be necessary. 
   Facilities should be designed in a way that facilitates bulk recovery of material 
  before they reach the end of their operational or design life or earlier if required 
  by site strategies [e.g.: ENM.1 & RW.1]. ENM.7 states that facilities should be 
  designed and operated so that material can be retrieved within an appropriate 
  period of time, including intervention in the event of unexpected faults, 
  accidents or degradation of packaging. (See also SAP-RW.5.) 
   The scope of SAP ENM.3 is broad; including not only systems for materials 
  accountancy but also the design and operation of the facilities that control 
  nuclear matter. Essentially, it builds on ENM.2 by considering the systems 
  needed to provide control. 
   In some cases, adequate control may depend on the use of robust and 
  auditable operating instructions and procedures.  Accountancy measurements 
  may provide further support. There is ONR guidance [12] on centralised 
  systems to monitor materials movements and process conditions. 
   The fundamental principles SAP EKP.1 to 5 are relevant to design and 
  operation of processes controlling nuclear matter. ONR expects systems 
  providing safety functions to possess appropriate levels of redundancy, 
  diversity and segregation from systems used for normal control [EDR.2], see 
  ONR guidance on functional safety systems [12].  It should be shown that 
  safety-related components can be operated and controlled within a safe 
  operating envelope throughout their operating life. The parameters of the 
  envelope should be consistent with the type of construction, potential modes of 
  failure and operational considerations. 
   5.22 
   Monitoring and recording systems are necessary to detect problems that may 
  develop in processes due to leakage, changes in temperature, chemical 
   OFFICIAL 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 7 of 14 
    
    
    
   Office for Nuclear Regulation  
   5.23 
   5.24 
   5.25 
   5.26 
   5.27 
   5.28 
   5.29 
   OFFICIAL 
   reaction and other effects.  The ESR and ESS sections of SAPs expand on the 
  requirements for these systems. As well as leakage, effects including 
  segregation, deposition and condensation can cause problems, see ENM.8. 
   Where practicable, safety systems, safety-related instrumentation and 
  engineered controls should be designed to fail-safe. Failure should be revealed 
  to the operator by alarms or other means. There may be a requirement for high 
  levels of redundancy and diversity dependent on the reliability of each system. 
  The problems associated with single failure criteria should be considered 
  [EDR.4]. 
   The maintenance requirements of any monitoring and control equipment should 
  be clearly identified [LC28] and in accordance with the arrangements made 
  under the licence conditions. These should include calibration and ensure that 
  the control system is always available when required. Similar maintenance is 
  required for safety systems and safety related instrumentation [13] and this is 
  addressed by ONR guidance. 
   Attributes of Nuclear Material 
   ENM.5 and 6 outline physical and chemical characteristics that nuclear material 
  should possess, for control to be achievable. Together with the process 
  characteristics, these determine the precautions that need to be taken to 
  ensure adequate control arrangements are in place. These should be 
  documented e.g.: in flowsheets, safety functional requirements and the basis of 
  design. These documents should be identified in the safety case. Such 
  information will help to define the safety envelope within which the process is 
  managed. 
   In some circumstances the identification and quantification of the materials 
  being handled may not be possible. When this is the case, the arrangements 
  should allow for the level of uncertainty and identify additional levels of control 
  to maintain safety margins as required by the safety analysis. 
   Arrangements should be made and implemented (which may include 
  examination, testing and auditing) to ensure that incoming material meets the 
  acceptance criteria.  Arrangements should also be established for the safe 
  management of any incoming material that fails to meet the acceptance criteria.  
   Segregation in SAP paragraph 789 includes segregation both from 
  incompatible materials and according to physical and chemical form, 
  flammability, specific radioactivity, half-life, fissile nature and type of radiation 
  emitted where subsequent storage, processing, conditioning and disposal 
  would otherwise be adversely affected. 
   Passively safe conditions for storage should be used where reasonably 
   practicable. Storage of material in a passively safe state still requires a safety 
  case that identifies operational limits and conditions required for safety. Many of 
  the paragraphs in SAP RW.5 also apply to ENM.6 and 7 for nuclear material. 
  Where fissile material is present, no external controls should be relied upon to 
  prevent criticality, see ECR.1 and ECR.2.  The safety case should demonstrate 
  acceptable sub-criticality margins for stores taking account of the uncertainties 
  that may exist. Relevant factors may include: 
    
   
   form of the material; 
  environmental 
  conditions, 
  contaminants; 
   including 
   temperature, 
   humidity, 
   and 
   OFFICIAL 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 8 of 14 
    
    
    
   Office for Nuclear Regulation  
    
   
   
   OFFICIAL 
   heat generation (from individual items and the whole store); 
  gas generation (pressurisation, flammable mixtures, deformation); and 
  radiological 
  hazards, 
  taking 
  account 
  of 
  on-site 
  storage 
  and 
  long 
  term 
  management, which may include disposal. 
   5.30 
   In some circumstances, the inherent safety characteristics of the process 
  reduce the potential hazard such that the control arrangements can be 
  appropriately simplified. 
   5.31 
   5.32 
   5.33 
   5.34 
   Accountancy & Display Systems 
   Principle ENM.4 expects records of nuclear matter to be generated and kept, 
  this is also a fundamental Safeguards requirement in the case of qualifying 
  nuclear material. ENM.8 requires this information to be processed and 
  analysed in a timely manner in order to prevent any significant deviations from 
  environmental, security or safety case criteria. 
   The arrangements for monitoring and relaying control and safety information to 
  relevant staff should be clearly identified in the safety case. Thus the safety 
  case should specify the periodicity of gathering and displaying such data. 
  Display systems should be configured to provide an overview of the condition of 
  the process including, where appropriate, mass and volumetric balance 
  summaries. 
   Where plant safety must be maintained by appropriate and timely response to 
  system alarms [EHF.7], the response should be automatic where reasonably 
  practicable; however, where it is not, proportionate robust managerial control 
  should be exercised. 
   The actions to be taken on failure of safety systems, safety related 
  instrumentation and engineered control equipment should be clearly identified 
  in the safety case and in instructions to workers. This advice should be 
  incorporated in any on-site, off-site emergency or contingency instructions. In 
  some circumstances the safety case may have to consider the need for local 
  field control stations for normal control and in the event that the main control 
  centre is not tenable. 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 9 of 14 
   OFFICIAL 
    
    
    
    
   Office for Nuclear Regulation  
   6. 
   REFERENCES 
   OFFICIAL 
   1. 
   6. 
  7. 
   8. 
   Revision 
   10. 
   2. 
  3. 
  4. 
  5. 
   Safety 
  Assessment 
  Principles 
  for 
  Nuclear 
  Facilities. 
  2014 
  Edition 
  ONR. November 2014 . http://www.onr.org.uk/saps/index.htm 
  The Nuclear Installations (Excepted Matter)Regulations 2017 (c920) 
  ONR, The Limits and Conditions for Nuclear Plant Safety, T/AST/035. 
  ONR, Safety Systems, T/AST/003. 
  Http://www.wenra.org/media/filer_public/2014/09/19/wenra_safety_reference_l
  evel_for_existing_reactors_september_2014.pdf 
  IAEA Safety of Fuel Cycle Facilities; NS-R-5. 
  IAEA Protection Against 
  Internal Fires and Explosions 
  in 
  the Design of Nuclear 
  Power Plants; Safety Guide Safety Standards Series; NS-G-1.7. 
  UK 
  Strategy 
  for 
  the 
  Management 
  of 
  Solid 
  Low 
  Level 
  Waste 
  from 
  Industry February 2016 
  9. 
  Nuclear Installations Act 1965 (c57) 
  10. ONR, Purpose and Scope of Nuclear Safety Cases, T/AST/051. 
  11. ONR, 
  Deterministic 
  Safety 
  Analysis 
  and 
  the 
  Use 
  of 
  Engineering 
  Safety Assessment Guidance, T/AST/006. 
  12. ONR, Computer Based Safety Systems, T/AST/046. 
  13. ONR, Safety Related Instrumentation, T/AST/031. 
   Principles 
   the 
   Nuclear 
   in 
   Note: 
  ONR 
  staff 
  should 
  access 
  internal 
  ONR 
  references 
  via 
  the 
  How2 
  Business 
  Management 
  System and external 
  references via Westlaw or Redgrave’s Online. 
   At no 
  time should 
  reliance 
  be placed upon printed copies or the links above unless these are confirmed to be current. 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 10 of 14 
   OFFICIAL 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   7. 
   GLOSSARY AND ABBREVIATIONS 
   BSL 
  BSL(LL) 
  BSO 
  C&I 
  CNS 
  EA 
  FA 
  HSE 
  IRR17 
  LC 
  NIA 
  ONR 
  SAP 
  SEPA 
  TAG 
  UKSO 
  WENRA 
   Basic Safety Level 
  Basic Safety Level (legal limit) 
  Basic Safety Objective 
  Control and Instrumentation 
  Civil Nuclear Security (Office for Nuclear Regulation) 
  Environment Agency 
  Fault Analysis 
  Health and Safety Executive 
  Ionising Radiation Regulations (2017) 
  Licence Condition 
  Nuclear Installations Act 
  Office for Nuclear Regulation 
  Safety Assessment Principle(s)  
  Scottish Environment Protection Agency  
  Technical Assessment Guide(s) 
  United Kingdom Safeguards Office (Office for Nuclear Regulation)
  Western European Nuclear Regulators’ Association 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 11 of 14 
   OFFICIAL 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   8. 
   APPENDICES 
   OFFICIAL 
   APPENDIX 1: EXCEPTED MATTER, THE NIA AND OTHER LEGISLATION 
   A1.1 
   It 
  is 
  a 
  fundamental 
  premise 
  that 
  terms 
  defined 
  in 
  the 
  regulatory 
  framework 
  should 
  be 
  used 
  consistently within 
  and our guidance. 
   law 
  underpinning 
  our 
  our 
  licence 
  conditions 
   Nuclear Matter and Radioactive Material are terms defined in law.  
   A1.2 
  Nuclear site Licence Condition 1 states: 
   “nuclear matter” has the meaning assigned thereto in the Nuclear Installations 
  Act 1965; 
  “qualifying nuclear material” has the meaning assigned thereto in the Nuclear 
  Safeguards Act 2018; 
  For England and Wales : 
   material” 
   “radioactive 
   has 
  the 
  meaning, 
  disregarding 
  the 
  exceptions 
  in 
  paragraph 
  9 
  (contaminated 
  articles 
  or 
  substances) 
  and 
  9A 
  of 
  Part 
  2 
  of 
  Schedule 23 
  to 
  the Environmental Permitting 
  (England and Wales) Regulations 
  2016 
  (and 
  amendments), 
  given 
  in 
  paragraph 
  3 
  of 
  that 
  Part 
  of 
  that 
  Schedule 
  to 
  those regulations.  
  and 
  Part 
  2 
  of 
  Schedule 
  Regulations 2016 
  For Scotland : 
   has 
  the 
  meaning 
  assigned 
  thereto 
  in 
  paragraph 
  3 
  of 
  to 
  the 
  Environmental 
  Permitting 
  (England 
  and 
  Wales) 
   “radioactive 
   waste” 
   23 
   waste” 
   material” 
   “radioactive 
   “radioactive 
   have 
  the 
  meanings 
  given 
  in 
  Environmental 
  Authorisations 
  (Scotland) 
  definition 
  of 
  Radioactive 
  Waste 
  is 
  broader 
   and 
  Schedule 
  8 
  Part 
  (1)(5) 
  of 
  the 
  Regulations 
  2018, 
  noting 
  that 
  the 
  than that given in EPR(E&W)2016. 
  The 
  differences 
  between 
  several 
  of 
  these 
  definitions 
  are 
  expanded 
  in 
  Annex 
  1 
  of 
  NS-INSP-GD-005 
  Revision 
  3 
  and 
  are 
  further 
  explained 
  (for 
  England 
  and 
  Wales) 
  in 
  the 
  guidance 
  document 
  “Scope 
  of 
  and 
  Exemptions 
  from 
  the 
  Radioactive Substances Legislation in England, Wales and Northern Ireland” 
   It 
  is 
  important 
  to 
  note 
  that 
  not 
  all 
  definitions 
  are 
  aligned 
  and 
  Inspectors 
  must 
  therefore satisfy 
  themselves 
  that 
  they have 
  correctly 
  identified which 
  legislation 
  and 
  hence 
  which 
  definitions 
  are 
  applicable 
  when 
  operating 
  in 
  England 
  and 
  Wales, or in Scotland, and be guided as appropriate. 
   A1.3 
   A1.4 
   Definitions 
  of 
  radioactive 
  material 
  have 
  appeared 
  in 
  UK 
  legislation 
  and 
  international treaties since 
  the Paris Convention was signed by 
  the UK 
  in 1960. 
  Since 
  then, 
  the 
  Nuclear 
  Installations 
  Act 
  and 
  other 
  legislation 
  covering 
  radioactive 
  waste, 
  nuclear 
  security 
  and 
  emergencies 
  have 
  defined 
  radioactive 
  materials 
  in 
  slightly 
  different 
  ways. 
  To 
  avoid 
  over-regulation 
  in 
  areas 
  where 
  parliament 
  did 
  not 
  intend, 
  the 
  legislation 
  also 
  specifies 
  a 
  number 
  of 
  exceptions 
  to 
  terms 
  such 
  as 
  nuclear 
  matter. 
  Whilst 
  this 
  may 
  seem 
  complicated, 
  such 
  differences 
  rarely 
  impact 
  on 
  the 
  work 
  of 
  nuclear 
  inspection 
  because 
  there 
  is 
  considerable 
  consistency 
  in 
  practice. 
  This 
  appendix 
  covers 
  the 
  main 
  distinguishing features and exceptions to the legislation. 
  The 
  1960 
  Paris 
  Convention 
  on 
  nuclear 
  liability 
  uses 
  the 
  terms 
  and 
  and 
  seeks 
  to 
  identify 
  responsibilities 
   “radioactive 
   or waste” 
   “nuclear 
   product 
   fuel” 
   and 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 12 of 14 
   OFFICIAL 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   liabilities 
  damage 
  caused 
  by 
  defines its subject matter as: 
   OFFICIAL 
   occurrences 
   involving 
   such 
   material. 
   The 
   NIA 
   Installations 
   Subject 
  to any exceptions prescribed 
  in NIA and 
  the Nuclear 
  (Excepted Matter) Regulations 2017, nuclear matter is: 
  any 
  fissile 
  material 
  in 
  the 
  form 
  of 
  uranium 
  metal, 
  alloy 
  or 
  chemical 
  compound 
  (including 
  natural 
  uranium), 
  or 
  of 
  plutonium 
  metal, 
  alloy 
  or 
  chemical 
  compound, 
  and 
  any 
  other 
  fissile 
  material 
  which 
  may 
  be 
  prescribed; and 
  any 
  radioactive material produced 
  in, or made 
  radioactive by exposure 
  to 
  the radiation 
  incidental 
  to, 
  the process of producing or utilising any such 
  fissile material as aforesaid. 
  “excepted matter” means 
   nuclear matter 
   consisting 
   only 
   one 
   or 
   of 
   In 
  the NIA, 
  more of the following, that is to say: 
   1 
   2 
  3 
  4 
   agricultural, 
   isotopes 
  prepared 
  for 
  use 
  for 
  industrial, 
  commercial, 
  medical [scientific or educational] purposes; 
  natural uranium; 
  any uranium in which the isotope 235 forms not more than 0.72%; 
  nuclear 
  matter 
  of 
  such 
  other 
  description, 
  if 
  any, 
  in 
  such 
  circumstances 
  as 
  may 
  be 
  prescribed 
  (or, 
  for 
  the 
  purposes 
  of 
  the 
  application 
  of 
  this 
  Act 
  to 
  a 
  relevant 
  foreign 
  operator, 
  as 
  may 
  be 
  excluded 
  from 
  the 
  operation 
  of 
  the 
  relevant 
  international 
  agreement by the relevant foreign law). 
   “relevant 
   foreign 
   Radiation 
   practice” 
   “radiation 
   operator”, 
   Substance” 
   “Radioactive 
   Excepted 
  matter 
  is 
  nuclear 
  matter. 
  The 
  Excepted 
  Matter 
  Regulations 
  provide 
  certain exemptions which apply outside of nuclear licensed sites. For definitions 
  of 
  terms 
  such 
  as 
  etc., 
  inspectors are referred to the source legislation. 
  The 
  definition 
  of 
  in 
  the 
  Ionising 
  Regulations (2017) is a much broader term than “Nuclear Matter”. 
  Under 
  IRR17, 
  where 
  a 
  radioactive 
  substance 
  is 
  used 
  in 
  a 
  practice, 
  (where 
  a 
  practice 
  means 
  work 
  involving 
  the 
  production, 
  processing, 
  handling, 
  disposal, 
  use, 
  storage, 
  holding 
  or 
  transport 
  of 
  radioactive 
  substances), 
  its 
  activity 
  should 
  never be disregarded 
  for 
  the purposes of 
  radiation protection where 
  the activity 
  concentrations exceed 
  specified 
  values as defined 
  in 
  the 
  regulations. 
  If 
  further 
  information 
  is 
  required 
  regarding 
  the 
  interpretation of 
  IRR17, please 
  refer 
  to an 
  ONR radiation protection specialist inspector. 
  The 
  term 
  “sealed 
  source” 
  means 
  a 
  source 
  containing 
  any 
  radioactive 
  substance 
  whose 
  structure 
  is 
  such 
  as 
  to 
  prevent, 
  under 
  normal 
  conditions 
  of 
  use, 
  any 
  dispersion 
  of 
  radioactive 
  substances 
  into 
  the environment, but 
  it does 
  not 
  include 
  any 
  radioactive 
  substance 
  inside 
  a 
  nuclear 
  reactor 
  or 
  any 
  nuclear 
  fuel element. 
  Nuclear Safeguards 
  legislation defines nuclear material as 
  fissionable material, 
  source material or ore. 
   Source material means material 
  containing 
  the mixture 
  of isotopes occurring in nature.  
  as 
  defined 
  in 
  the 
  NI 
  of 
  as 
  defined 
  by 
  the 
  RSA, 
  or 
  as 
  defined 
  in 
  IRR17. 
  The 
  environmental 
  legislation 
  (EPR 
  2016 
  and 
  EASR 
  2018) 
  makes 
  a 
  clear 
  distinction 
  between 
  radioactive 
  material 
  and 
  radioactive 
  waste. 
  The 
  term 
  in 
  the RSA 
  should not 
  be 
  equated with 
  the 
  same 
  phrase 
   radioactive material 
   Nuclear 
  material 
   radioactive 
   radioactive 
   substance 
   Act 
   covers 
   a 
   matter, 
   subset 
   1 
   2 
   A1.5 
   A1.6 
   A1.7 
   A1.8 
   A1.9 
   A1.10 
   A1.11 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 13 of 14 
   OFFICIAL 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   A1.12 
   OFFICIAL 
   in 
  the NIA 
  to conclude 
  that waste 
  is not nuclear matter. 
   Radioactive waste can 
  be nuclear matter if the definition for nuclear matter is fulfilled. 
  Inspectors should be able 
  to 
  identify situations where additional advice may be 
  needed. 
  The 
  purpose 
  of 
  including 
  the 
  above 
  definitions 
  and 
  exceptions 
  is 
  to 
  explain 
  how 
  the 
  legislation 
  avoids 
  obvious 
  traps 
  associated 
  with 
  materials 
  that 
  could 
  cause 
  little 
  damage 
  in 
  human 
  or 
  environmental 
  terms, 
  whilst 
  still 
  achieving its aims. 
   Report  NS-TAST-GD-023 
  CM9 Ref: 2019/0250250 
   Page 14 of 14 
   OFFICIAL 
    
    
    
    
  "
  Decommissioning ns-tast-gd-026	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Decommissioning ns-tast-gd-026.pdf	" Title of document 
   appe
   ndix 
   ONR GUIDE 
   DECOMMISSIONING 
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   Approved by: 
   Record Reference: 
   Revision commentary: 
   NS-TAST-GD-026 Revision 5  
   September 2019 
   Review Date: 
   September 2022 
   Nicholas Blackburn 
   Nuclear Liabilities Regulation 
  Professional Lead 
  CM9 1.1.3.978. (2019/144943 ) 
  Major rewrite of Sections 1 to 4 to reflect modern regulatory 
  language and developments in decommissioning good practice. 
  Restructuring of Section 5 to align with WENRA’s Safety 
  Reference Levels. Incorporation of Checklists and Appendices 
  into main body of the document 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 31 
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
   5. 
  6. 
  7. 
  8. 
   INTRODUCTION ................................................................................................................. 3 
  PURPOSE AND SCOPE ..................................................................................................... 3 
  RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION ......................... 3 
  RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ADDRESSED ............................................................................................... 5 
  ADVICE TO INSPECTORS ................................................................................................. 7 
  REFERENCES .................................................................................................................. 27 
  ABBREVIATIONS .............................................................................................................. 30 
  APPENDICES .................................................................................................................... 31 
   © Office for Nuclear Regulation, 2019 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 09/19 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 2 of 31 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   2. 
   2.1 
   2.2 
   2.3 
   2.4 
   2.5 
   INTRODUCTION 
   The Office for Nuclear Regulation (ONR) has established its Safety Assessment 
  Principles for Nuclear Facilities (SAPs) [1] which apply to the assessment by ONR 
  Inspectors of safety cases for nuclear facilities that may be operated by potential 
  licensees, existing licensees, or other duty-holders. The outcome of an assessment by 
  ONR is to reach an independent and informed judgement on the adequacy of a 
  nuclear safety case [2]. The principles presented in the SAPs are supported by a suite 
  of guidance to further assist ONR’s Inspectors in their technical assessment work in 
  support of making regulatory judgements and decisions. This Technical Assessment 
  Guide (TAG) is one such guide [3]. 
   PURPOSE AND SCOPE 
   This TAG provides guidance to ONR Inspectors to advise and inform their regulatory 
  judgements in relation to decommissioning at nuclear licensed sites. The TAG 
  supplements the guidance in the SAPs [1], in particular principles DC.1 to DC.9 on 
  decommissioning. The TAG has been written with due cognisance of relevant 
  International Atomic Energy Agency (IAEA) safety standards for the decommissioning 
  of nuclear facilities [4] and the Western European Nuclear Regulators’ Association 
  (WENRA) Safety Reference Levels (SRL) for decommissioning [5]. 
   Duty holders may refer to the TAG as a source of good practice, although the TAG 
  should not be interpreted as a set of prescriptive legal requirements. 
   The IAEA defines decommissioning as, “the administrative and technical actions taken 
  to remove all or some of the regulatory controls from an authorised facility so the 
  facility and its site can be reused” [6]. For the purposes of this guidance, delivery of 
  decommissioning is assumed to start on cessation of operations and continues until 
  the defined end-state has been demonstrably achieved. 
   In the UK, decommissioning is carried out under the same legislative framework as the 
  preceding steps in the lifecycle. The general legal duties and principles of nuclear 
  safety, control of nuclear matter, radiological protection and conventional safety 
  continue to apply to decommissioning. Consequently, the general advice provided in 
  other TAGs continues to be relevant when a plant enters into decommissioning. This 
  TAG focusses on the specific factors that are particularly important to consider in 
  decommissioning, with references to the general advice where appropriate. 
   Licensees may assign particular terms to stages of decommissioning, such as Post 
  Operational Clean Out (POCO), Care and Maintenance (C&M), Surveillance and 
  Maintenance (S&M) and Final Site Clearance. As ONR’s objectives in regulating 
  decommissioning are outcome-focussed, this TAG is not prescriptive in respect of the 
  terminology licensees may use. However, it is important for a licensee to provide clear 
  definitions of the terms it applies, to ensure a common understanding of the intended 
  approach amongst both its own staff and other stakeholders. 
   3. 
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION 
   Licence Conditions 
   3.1 
   All 36 standard Licence Conditions (LCs) [7] apply during decommissioning and are 
  relevant to activities involving decommissioning on nuclear licensed sites. However, a 
  number of LCs are of particular relevance: 
    
   
   
   
   4 
  6 
  15 
  17 
   Control of nuclear matter 
  Documents, records, authorities and certificates 
  Periodic review 
  Management systems 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 3 of 31 
    
    
    
    
   Office for Nuclear Regulation  
    
   
   
   
   
   
   
   
   
   
   18 
  22 
  23 
  25 
  28 
  32 
  33 
  34 
  35 
  36 
   Radiological protection 
  Modifications 
  Operating rules 
  Operational records 
  Examination, inspection, maintenance and testing 
  Accumulation of radioactive waste 
  Disposal of radioactive waste 
  Leakage and escape of radioactive material and radioactive waste 
  Decommissioning 
  Organisational capability 
   3.2 
   3.3 
   3.4 
   In addition to NIA65, the licensee must continue to comply with all other relevant 
  statutory provisions arising under the Health and Safety at Work etc. Act 1974 and 
  subordinate legislation, including the Ionising Radiations Regulations 2017, Lifting 
  Operations and Lifting Equipment Regulations 1998, and Control of Asbestos 
  Regulations 2012. Some particularly important legislation in the context of 
  decommissioning is highlighted below. 
   Nuclear Reactors (Environmental Impact Assessment for Decommissioning) 
  Regulations 1999 (EIADR) 
   EIADR applies to decommissioning of all nuclear reactors that had a continuous 
  thermal load above 1kW whose decommissioning started after the regulations came 
  into force on 19th November 1999. 
   EIADR can also apply to reactor decommissioning projects that commenced prior to 
  19th November 1999, in the event of a change or extension to the project that may 
  have a significant adverse environmental impact. In the event of such a change, the 
  licensee must apply to ONR for a determination as to whether a new environmental 
  impact assessment is required and if so, the regulations apply thereon. 
   3.5 
   Specific guidance on EIADR is available at www.onr.org.uk/eiadr  
   Ionising Radiations Regulations 2017 
   3.6 
   3.7 
   The Ionising Radiations Regulations 2017 (IRR17) apply to the use of ionising 
  radiation in the workplace, with the intent of restricting exposure and limiting dose to 
  the workforce and the public and apply throughout the lifecycle of a nuclear facility. 
   Radiological protection has particular importance during decommissioning, due to the 
  range of activities undertaken, inherent uncertainties and personnel entries into 
  controlled areas when systems that provided protection during the operational phase 
  have been retired. Specific regulations of particular relevance to decommissioning 
  include, but are not limited to: 
    
   
   
   Regulation 8 
  (radiation risk assessments) 
  Regulation 9  
  (restriction of exposure) 
  Regulation 12  (dose limitation) 
   3.8 
   Further guidance is provided in NS-TAST-GD-038 (Radiological Protection) [3] and the 
  Approved Code of Practice [8]. 
   Construction Design and Management Regulations 2015 (CDM) 
   3.9 
   Decommissioning typically gives rise to significant challenges of a conventional safety 
  nature, such as working at height, work in confined spaces, work with high 
  temperatures, demolition of civil structures and export of large heavy items. 
   3.10 
   The CDM regulations provide the main legislative requirements in respect of the 
  management of health, safety and welfare during construction projects. The relevance 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 4 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   of CDM to decommissioning is derived from the CDM definition of ‘construction work’ 
  which includes: 
    
   
    
   The decommissioning, demolition or dismantling of a structure 
  Removal of a structure, or of any product or waste resulting from demolition or 
  dismantling of a structure, or from disassembly of prefabricated elements which 
  immediately before such disassembly formed such a structure; 
  Removal of mechanical, electrical, gas, compressed air, hydraulic, 
  telecommunications, computer or similar services which are normally fixed 
  within or to a structure 
   3.11 
   Specific guidance on CDM is available at www.hse.gov.uk/pubns/books/l153  
   Environmental Legislation 
   3.12 
   3.13 
   3.14 
   4. 
   4.1 
   Decommissioning results in significant quantities of radioactive wastes, which then 
  need to be managed to the point of disposal. 
   The relevant environmental regulator – the Environment Agency (EA) in England, the 
  Scottish Environment Protection Agency (SEPA) in Scotland, or Natural Resources 
  Wales (NRW) in Wales – have responsibility for permitting the disposal of radioactive 
  and non-radioactive wastes arising from site activities, and for regulating the site 
  against the corresponding permit limits and conditions. 
   Inspectors on sites undertaking decommissioning should familiarise themselves with 
  ONR’s Memoranda of Understanding with the environmental regulators [9] and 
  supporting guidance [10], as well as the joint guidance document, “Basic Principles of 
  Radioactive Waste Management” [11]. 
   RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ADDRESSED 
   The SAPs [1] provide ONR’s nuclear inspectors with a framework for making 
  consistent regulatory judgements on the safety of activities, and include the legal duty 
  to reduce risk so far as is reasonably practicable (SFAIRP). The SAPs are split into 
  sections relating to different aspects of nuclear safety. One section of the SAPs is 
  dedicated to decommissioning and those principles are summarised here: 
    
    
    
    
    
    
    
   DC.1 – this principle relates to consideration of decommissioning during the 
  planning, design construction and operation of a new facility, or modification to 
  an existing facility to facilitate safe decommissioning. 
  DC.2 – this principle relates to preparation and maintenance of a 
  decommissioning strategy that is appropriately integrated with other relevant 
  strategies. 
  DC.3 – this principle relates to timing of decommissioning and justification of 
  the continuing safety of the facility for the period prior to its decommissioning, 
  with identification of any necessary remedial and operational measures to 
  reduce the risk where this cannot be underpinned. 
  DC.4 – this principle relates to preparation of a decommissioning plan that sets 
  out how the facility will be safely decommissioned. 
  DC.5 – this principle relates to facilities being passively safe before entering a 
  care and maintenance phase. 
  DC.6 – this principle relates to identification, preparation, update, retention and 
  ownership of documents and records required for decommissioning purposes. 
  DC.7 – this principle relates to arrangements for establishing and maintaining 
  the decommissioning organisation to ensure safe and effective 
  decommissioning. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 5 of 31 
    
    
    
    
   Office for Nuclear Regulation  
    
    
   DC.8 – this principle relates to periodic review and modification to the 
  management system prior to and during decommissioning. 
  DC.9 – this principle relates to preparation of the decommissioning safety case 
  to demonstrate the safety of the decommissioning plan and its associated 
  decommissioning activities, which is to be kept up to date as the work 
  progresses. 
   4.2 
   In addition to principles DC.1-DC.9, the following may also be of relevance to 
  decommissioning assessments: 
    
    
    
    
    
    
    
    
   RW.1 to RW.7 – these principles relate to the management of radioactive 
  waste at all stages of the lifecycle of a facility. 
  RP.1 to RP.7 – these principles relate to radiation protection and control of 
  areas to limit spread of radioactive contamination. 
  MS.1 to MS.4 – these principles relate to effective leadership and management 
  which is crucial to maintain during decommissioning which is a dynamic state 
  leading to progressive reduction in resource on the site. 
  EAD.2 – this principle relates to provision of adequate margins to allow for 
  ageing and degradation of SSCs. 
  EMT.2 – this principle relates to frequency of examination, inspection, 
  maintenance and testing of SSCs, which may need re-examination during 
  decommissioning. 
  ECE.26 – this principle relates to consideration of decommissioning at the 
  design stage to ensure incorporation of features to facilitate decommissioning. 
  RL.1 to RL.9 – these principles relate to land quality management which will 
  likely become more prominent as decommissioning progresses towards final 
  site clearance and release from regulatory control. 
  FP.1 to FP.8 – these are the fundamental principles which underpin the SAPs 
  and outline ONR’s expectations regarding responsibility, leadership and 
  management for safety, optimisation of protection measures, safety 
  assessment, limitation of risks to individuals and protection of present and 
  future generations. 
   4.3 
   4.4 
   4.5 
   The SAPs form a complete document and Inspectors should consider them as a 
  whole. Inspectors are advised to base their judgements not only on the 
  decommissioning principles (DC.1 - DC.9) and the additional SAPs suggested above, 
  but to consider the specific case under assessment and which other SAPs and 
  associated TAGs may be relevant. 
   This TAG therefore provides advice to inform assessments of licensees’ early 
  considerations of decommissioning, in addition to the practical delivery of 
  decommissioning that takes place after operations have ceased. 
   NS-TAST-GD-005 [3] identifies the Western European Nuclear Regulators' Association 
  (WENRA) Safety Reference Levels (SRL) as a source of Relevant Good Practice 
  (RGP) for operating reactors, facilities in decommissioning and facilities for storage of 
  radioactive waste and spent nuclear fuel. This TAG has therefore been benchmarked 
  against the Decommissioning SRLs [5] and the guidance in Section 5 is structured in 
  accordance with the SRL topic areas: 
    
   
   
   
   Safety Management System  (SRLs D-01 to D-14) 
  Decommissioning Strategy and Planning  (SRLs D-15 to D-29) 
  Conduct of Decommissioning  (SRLs D-30 to D-49) 
  Safety Verification  (SRLs D-50 to D-62) 
   4.6 
   The most relevant IAEA [4] documents to decommissioning are: 
    
   Fundamental Safety Principles (SF-1) 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 6 of 31 
    
    
    
    
   Office for Nuclear Regulation  
    
   
    
    
   
   Decommissioning of facilities (GSR part 6) 
  Safety Assessment for the Decommissioning of Facilities Using Radioactive 
  Material (WS-G-5.2) 
  Decommissioning of Nuclear Power Plants, Research Reactors and Other 
  Nuclear Fuel Cycle Facilities (SSG-47) 
  Decommissioning of Medical, Industrial and Research Facilities (SSG-49) 
  Application of the Concepts of Exclusion, Exemption and Clearance (RS-G-1.7) 
   5. 
   ADVICE TO INSPECTORS 
   SAFETY MANAGEMENT SYSTEM   
   5.1 
   5.2 
   5.3 
   5.4 
   5.5 
   5.6 
   5.7 
   Responsibility during decommissioning (WENRA SRLs D-01 – D-04) 
   The site licensee retains prime responsibility for safety throughout the lifetime of 
  facilities and activities. This responsibility cannot be delegated, as stated in SAP FP.1 
  [1]. This fundamental principle applies equally to decommissioning as it does to 
  operations, therefore licensees are expected develop their organisation, resource 
  levels, capabilities, strategies and administrative arrangements to ensure safety 
  throughout the entire lifecycle. 
   When a facility enters decommissioning the licensee may need to broaden its base of 
  decommissioning skills, knowledge and capability, which may result in an increase in 
  deployment of specialist contractors. Inspectors should refer to NS-TAST-GD-049 
  (Licensee use of contractors and intelligent customer capability) [3] for general 
  guidance and note the relevant requirements of the CDM Regulations, especially the 
  responsibilities of the nominated Client and Principal Designer. 
   At all times, the licensee must ensure that it has sufficient in-house expertise and 
  resource to manage and make informed decisions on issues affecting nuclear safety, 
  and be able to demonstrate that it is an intelligent customer for any bought-in items or 
  services as well as exercising adequate control and supervision of contractors working 
  on the licensed site. 
   Decommissioning can give rise to new safety challenges, which might require pre-
  existing systems to be augmented or reconfigured (e.g. ventilation). Inspectors should 
  be mindful that delivery of decommissioning often requires elements of construction 
  work and modifications to the existing plant, including the identification and 
  management of any asbestos containing materials. Decommissioning arrangements 
  therefore need to link with all relevant arrangements made under licence conditions 
  other than LC35, for example LC22 (Modification or Experiment on Existing Plant). 
   The UK Government expects all nuclear operators should take the steps necessary to 
  ensure that adequate funds are in place to meet their decommissioning liabilities. 
  Whilst ONR does not directly regulate financial provisions, ONR provides advice to 
  other organisations and the government on the adequacy of the plans on which the 
  financial provisions are based. Further information is provided in Appendix 1. 
   Organisational Structure (WENRA SRLs D-5 – D-8) 
   A licensee should retain adequate suitably qualified and experienced personnel 
  (SQEP) to ensure nuclear safety throughout the full range of its business. In general 
  this is achieved by developing a Nuclear Baseline, against which ONR’s overall 
  expectations can be found in NS-TAST-GD-65 (Function and Content of the Nuclear 
  Baseline) [3]. 
   Decommissioning gives rise to cultural challenges with potential to undermine 
  workforce morale, such as a high rate of staff turnover, loss of operational knowledge, 
  widespread changes in role, a need to develop new skills, loss of employment, 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 7 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   increasing use of contractors and a constantly changing workface environment. It is 
  therefore important for licensees to maintain a robust safety culture to underwrite the 
  increased reliance on human performance that typically occurs when a plant 
  transitions into decommissioning. 
   5.8 
   Inspectors should also refer to SAPs MS.1 to MS.4 [1] and TAGs NS-TAST-GD-061 
  (Staffing levels and task organisation), NS-TAST-GD-048 (Organisational capability) 
  and NS-TAST-GD-080 (Challenge Culture, Independent Challenge Capability 
  (including an Internal Regulation function) and the Provision of Nuclear Safety Advice) 
  [3 for general guidance. 
   5.9 
   Inspectors may consider whether a licensee’s organisational structure is robust to the 
  challenges that typically occur in respect of decommissioning, such as: 
    
   
    
   
   
   
   
    
   Loss of operational knowledge 
  Quantification and retention of sufficient in-house resources, at a time of 
  uncertain future employment prospects 
  Management of uncertainties 
  Pressures to achieve rapid hazard reduction 
  Requirements for new skills, to progress decommissioning projects 
  A need for greater flexibility as the workface undergoes significant change 
  Increased reliance on administrative measures to deliver safety and a reduced 
  extent of engineered protection 
  Ensuring the licensee’s Nuclear Safety Committee exercises sufficient 
  independent challenge of the overall decommissioning strategy in addition to 
  scrutinising individual activities 
   5.10 
   The licensee’s organisational structure should clearly identify: 
    
   
    
    
    
    
    
    
   Responsibilities for ensuring decommissioning is conducted safely 
  An intelligent customer capability for decommissioning wherever reliance is 
  placed on contractors 
  Recognition of the increased prevalence of conventional health and safety risks 
  as decommissioning progresses 
  Recognition of the importance of maintaining radiological protection standards 
  throughout decommissioning 
  Priorities for hazard reduction, which should be based on addressing the 
  highest hazards and risks in a timely manner 
  Project management arrangements, noting the scale and nature of 
  decommissioning projects may vary considerably from those in the operational 
  phase 
  A reporting hierarchy, to allow any conflicts that could compromise safety 
  during decommissioning to be resolved  
  Adequate integration of all parts of the licensee’s organisation that contribute to 
  decommissioning and management of the resulting wastes 
   5.11 
   Inspectors may consider whether the licensee’s organisational structure is sufficiently 
  flexible to ensure safety as the anticipated progressive (and often rapid) change in 
  plant status occurs during decommissioning, noting this should allow a precautionary 
  approach to any inherent uncertainties. 
   5.12 
   Inspectors should also seek assurance that the licensee maintains adequate focus on 
  the following throughout decommissioning: 
    
   
   Its leadership function, to provide adequate direction and oversight. 
  An internal challenge function is sustained and appropriate to 
  decommissioning. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 8 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.13 
   5.14 
   5.15 
   5.16 
   5.17 
   5.18 
   5.19 
   5.20 
    
   Safety culture, to identify signs of deterioration (e.g. patterns of events or near-
  misses) and measures to address this should it be identified. 
   Record and Knowledge Keeping (WENRA SRLs D-9 & D-10) 
   Licensees are required to make adequate provision for recording and preserving all the 
  data and information that may be required in the future to ensure safe 
  decommissioning on nuclear licensed sites for as long as such information may be 
  required. 
   It is particularly important for licensees to recognise the value to decommissioning of 
  accurate information on nuclear facilities, their radioactive inventory and the Systems, 
  Structures and Components (SSCs) that contribute to safety. Licensees should ensure 
  this data is kept up-to-date and maintained in a readily available format, which should 
  align with the relevant decommissioning strategy and plan. In considering the scope of 
  information to be retained, licensees should be cognisant of the unique objectives of 
  decommissioning and how delivery of those objectives may drive different information 
  needs to those of the operational phase. 
   LC 6 requires licensees to make adequate records to demonstrate compliance with 
  each condition of the site licence, and to ensure that such records are preserved for a 
  further 30 years. LC 25 requires licensees to ensure that adequate records are made a 
  kept of the operation, inspection and maintenance of nuclear facilities, which will 
  include the decommissioning phase of the lifecycle of a facility. 
   The record preservation period of 30 years reflects the requirements of NIA65 with 
  respect to third party liability. This period starts from the time when decommissioning 
  or decontamination of the plant is complete and all radioactive waste has been 
  transferred to another location or disposed of. 
   Inspectors should seek evidence that licensees have put arrangements in place to 
  ensure knowledge of its facilities and inventory are maintained in a secure and 
  accessible form, noting the potentially long timescales over which decommissioning 
  can take place. 
   For general guidance, Inspectors should refer to NS-TAST-GD-027 (Training and 
  assuring personnel competence), NS-TAST-GD-79 (Licensee design authority 
  capability), NS TAST-GD-061 (Staffing levels and task organisation) and NS-TAST-
  GD-033 (Dutyholder management of records) [3. 
   The joint ONR/EA/SEPA/NRW guidance on management of higher activity radioactive 
  wastes [12] provides further guidance on managing information and records relating to 
  radioactive waste, some of which may be relevant to decommissioning.  
   Inspectors should confirm that the licensee has recognised the need to capture 
  information of relevance to decommissioning, starting from the design stage and 
  continuing through the whole life-cycle. The most valuable information to 
  decommissioning typically includes: 
    
   
   
    
    
    
   Design and construction records describing the as-built situation. 
  Material choices and process criteria. 
  Operational history (e.g. use of the facility, historic events and incidents, 
  radionuclide fingerprint). 
  Radiological characterisation data (e.g. radionuclide inventories, dose rates 
  and contamination levels). 
  Physical condition of the facility, including examination, maintenance, 
  inspection and testing records. 
  Underground services. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 9 of 31 
    
    
    
    
   Office for Nuclear Regulation  
    
   
   
   
    
   
   
   Reinforcing arrangements. 
  Established degradation mechanisms (e.g. corrosion, embrittlement). 
  Asbestos surveys to inform an appropriate management strategy. 
  Any instances of partial decommissioning or POCO, the end state that was 
  achieved and when (e.g. capped off pipework). 
  Waste inventory and location. 
  Significant plant modifications. 
  Location and function of any concealed (eg buried) systems. 
   5.21 
   In considering the timeframe for record retention the licensee should recognise that 
  some records may need to be maintained beyond the completion of decommissioning.  
   5.22 
   5.23 
   5.24 
   Implementation of a management system (WENRA SRLs D-11 – D-14) 
   An organisational structure should be in place for the management and implementation 
  of decommissioning, with clear responsibilities for ensuring that decommissioning is 
  conducted safely. 
   Further guidance on ONR’s expectations for an effective management system is 
  provided in NS-INSP-GD-017 (Management Systems) [13], NS-TAST-GD-048 
  (Organisational capability) and NS-TAST-GD-065 (Function and Content of the 
  Nuclear Baseline) [3]. 
   In response to events of significance to safety at any point during the lifecycle, 
  arrangements should be in place to conduct reviews as soon as practicable, in 
  accordance with LC7. Inspectors should be aware that a significant radiological 
  release may require amendment to the extant decommissioning strategy or undermine 
  the ability of a site to meet the previously assumed end state. 
   5.25 
   The arrangements for controlling any modifications to the decommissioning strategy, 
  methodology, programme or procedures should include an assessment of the safety 
  implications associated with any such changes. 
   5.26 
   5.27 
   5.28 
   5.29 
   DECOMMISSIONING STRATEGY AND PLANNING   
   Facilitating decommissioning during design, construction and operational phase 
  (WENRA SRLs D-15 & D-16) 
   The requirements for decommissioning should be considered at all phases in the 
  overall lifecycle of the facility, starting at the planning and design phase. 
   Although the practical delivery of decommissioning is the last stage of a nuclear 
  facility’s lifecycle, planning and preparation for decommissioning should occur with an 
  appropriate level of detail from the moment design commences. 
   Targeted consideration of decommissioning during the preceding lifecycle stages can 
  significantly reduce the risks and costs of delivering decommissioning. Throughout the 
  steps of design, construction, commissioning, maintenance and operation, the 
  evaluation of options should consider the potential impacts on future decommissioning 
  – licensees should take the opportunity to reduce the challenges and risks of future 
  decommissioning wherever it is reasonably practicable to do so. 
   Licensees should take steps to secure a smooth transition out of the operational phase 
  into decommissioning, which firstly requires development of a clear and 
  comprehensive decommissioning strategy and plan. The safety case should be 
  proactively managed, initially to avoid breaches of operating rules and the 
  maintenance schedule as plant runs down. Adequate safety margins will need to be 
  sustained as the engineered systems that provided protection during the operational 
  phase are taken out of service and removed. Decommissioning can also require 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 10 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.30 
   5.31 
   5.32 
   development of new capabilities, such as large-scale waste stores, an enhanced 
  scope of characterisation and a process of exemption and clearance to address large 
  volumes of demolition waste and spoil. 
   Therefore before entering into decommissioning, licensees should carefully consider 
  the choreography between; cessation of operations; characterisation of the facility and 
  its inventory; removal of the inventory; a precautionary approach to any inherent 
  uncertainties; determination of the target end state and any preceding interim states, 
  and; deployment of reasonably practicable measures to ensure the safety of workers 
  as decommissioning tasks are delivered. 
   National and international experience has shown that many of the challenges and risks 
  of decommissioning legacy nuclear facilities could have been significantly reduced or 
  avoided, had the initial design and operational philosophy given greater thought to the 
  needs of future decommissioning. 
   In the case of new facilities, Inspectors should check that the licensee’s arrangements 
  and processes recognise the need to challenge the design in order to reduce the risks 
  of future decommissioning to as low as reasonably practicable (ALARP). Practical 
  examples include: 
    
    
   
    
    
    
    
   
    
    
    
   Selection of materials and surface finishes that minimise activation and the 
  ingrowth of radioactivity while aiding decontamination. 
  Provision of lay down areas and temporary storage. 
  Accommodate the needs of decommissioning into the scope of downstream 
  waste management facilities, to avoid bottlenecks, logistical delays and 
  unnecessary double handling. 
  The design of civil structures should provide for long-term stability over the 
  timescales envisaged for decommissioning to be completed. 
  Minimise the use of embedded piping and the potential for chronic leaks and 
  escapes, for example by routing piping in accessible areas and using double 
  containment for pipes that have to traverse concrete walls or floors. 
  Construction methods should take cognisance of the fact that the facility will 
  ultimately have to be decommissioned, noting that some modern techniques 
  are not easily reversible.  
  Use of building information modelling (BIM) where appropriate. 
  Incorporation of design features to aid the decommissioning sequence, for 
  example egress routes for removal of large heavy items and provision of 
  cranes with sufficient lifting capacity to deal with the largest expected loads 
  from decommissioning. 
  Provision of extra space and localised ventilation points around process 
  vessels, to simplify the logistics of size reduction and export at the end of life. 
  Use of easily removable modular plant, which may benefit both 
  decommissioning and preceding maintenance. 
  Development of robust asset management arrangements, ideally in accordance 
  with the relevant international standard, and of appropriate systems for 
  monitoring the condition and health of facilities. 
   5.33 
   5.34 
   Further guidance on ONR’s expectations for the demonstration of ALARP is provided 
  in NS-TAST-GD-05 [3]. 
   Inspectors should ensure the licensee has undertaken adequate site baseline surveys 
  to inform the proposed strategy and end-state for decommissioning, including but not 
  limited to: the radiological conditions, presence and condition of asbestos bearing 
  materials, and condition of civil structures. Baseline surveys should consider both 
  surface and subsurface conditions as well as groundwater. For existing sites without 
  such survey data, then data from analogous, undisturbed areas with similar 
  characteristics should be used. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 11 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   Decommissioning strategy (WENRA SRLs D-17 & D-18) 
   5.35 
   Each UK nuclear operator is expected to produce and maintain a decommissioning 
  strategy and plan for each site it is responsible for. Such strategies and plans should 
  take into account the views of stakeholders (including relevant local authorities and the 
  public). The strategy should be to a level of detail commensurate with the type and 
  status of the facility, the hazards presented and the stage in the lifecycle. 
   5.36 
   Strategies should consider all ‘relevant factors’, presenting them in a transparent way 
  and demonstrating objectively how each has been reflected in the adopted approach. 
  Examples of ‘relevant factors’ are listed in UK government policy and include: 
    
   
   
   
   
    
   
   
   
   
    
   Ensuring worker and public safety. 
  Maintaining site security. 
  Minimising the generation of radioactive wastes. 
  Effective and safe management of the radioactive wastes that are created. 
  Minimising environmental impacts including reusing or recycle materials 
  whenever practicable. 
  Maintaining adequate site stewardship. 
  Using resources effectively, efficiently and economically. 
  Providing adequate funding. 
  Maintaining access to an adequate skills and knowledge base. 
  Conducting research and development (R&D) to develop necessary knowledge 
  or capability. 
  Consulting appropriate public and stakeholder groups on the options 
  considered and the contents of the strategy. 
   The future intended use of the site is a significant factor in determining the scope and 
  end state for decommissioning.  
   Inspectors should be aware of relevant government strategies and policies, in 
  conjunction with this TAG and other regulatory expectations, when considering the 
  adequacy of a licensee’s decommissioning strategy. Although ONR does not enforce 
  government policy, inspectors should regulate in accordance with the framework of 
  government policy whilst ensuring that national law and regulatory requirements are 
  met.  
   Inspectors should assess whether the licensee’s decommissioning strategy is 
  consistent with relevant national policies and strategies. Management of radioactive 
  wastes and nuclear decommissioning are devolved matters, so government policy can 
  vary between England, Scotland and Wales. Licensees should identify and justify any 
  differences. 
   The licensee is expected to review its strategies periodically, and in response to any 
  significant change in circumstances. An up-to-date decommissioning strategy is an 
  established regulatory expectation of a robust periodic review of safety (NS-TAST-GD-
  050 and SRL D72).  
   Inspectors should consider whether the licensee’s decommissioning strategies, 
  programmes and plans adequately demonstrate a systematic and progressive 
  reduction of hazard. This does not mean that hazards must reduce year on year, but 
  that in the long term hazards progressively reduce to a level where decommissioning 
  can be considered complete in terms of reaching the defined end state for the relevant 
  facility or site. 
   5.37 
   5.38 
   5.39 
   5.40 
   5.41 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 12 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.42 
   Inspectors should consider whether the strategy is sufficiently integrated at facility and 
  site levels, if and when appropriate, for example:  
    
    
    
    
    
   The decommissioning strategy should be linked to, or integrated with, the 
  strategy for the management of existing radioactive waste from the site(s) and 
  radioactive waste that will be produced during decommissioning.   
  Key interactions and interdependences are taken into account within the 
  planning process, e.g. any shared reliance on equipment, services and 
  infrastructure.  
  Where decommissioning is reliant on, or affected by, work at other sites (for 
  example treatment, storage or disposal of radioactive waste) then the strategy 
  should address these interdependences. 
  Fleet considerations may also be appropriate if the Licensee operates multiple 
  site licenses. 
  Consideration of factors external to the licensee should also be evident, such 
  as confirmation that wastes anticipated to be generated meet the relevant meet 
  for the intended waste route, or that suitable transport packages have been 
  identified. 
   5.43 
   Inspectors should consider whether the licensee has examined an adequate range of 
  options for decommissioning and confirm that these form the basis of the licensees 
  decommissioning strategy. The optioneering process should be based on appropriate 
  assessment criteria. The assessment criteria should be defined and developed by the 
  licensee, but inspectors may want to make a comparison with the list of relevant 
  factors in the SAPs under principle DC.3 (timing of decommissioning).  
   5.44 
   In particular inspectors should also consider whether the following factors are included 
  in the option selection criteria: 
    
   
   
   How options deliver longer-term risk reduction. 
  The dis-benefits of not pursuing any particular option. 
  Avoiding the foreclosure of options for later decommissioning stages, 
  particularly where there are uncertainties associated with the possible success 
  of options. 
   5.45 
   5.46 
   Inspectors should consider how the option selection process addresses the major 
  assumptions and uncertainties relevant to the decommissioning task or project being 
  considered. Sensitivity analysis and contingency planning should be considered for 
  any areas of significant uncertainty. 
   The licensee’s strategy and plans need to be in evidence, but should be at a level of 
  detail commensurate to the current stage in the lifecycle. These should deliver the 
  desired outcome of risk-reduction. Hence, prioritisation of activities should be in line 
  with achievement of risk reduction. 
   5.47 
   However, prioritisation should take account of other considerations where relevant and 
  justified. Examples might include: 
    
    
    
    
   Enabling tasks may be required to facilitate future risk reduction, e.g. in the 
  installation of decommissioning infrastructure. 
  In some cases dismantling of lower risk systems/facilities may be required or 
  beneficial in creating the space and access necessary for other 
  decommissioning operations, or to provide training and experience. 
  Where age limiting features dictate the early removal of a lower risk system or 
  facility in preference to a higher risk one. 
  Value and cost-benefit arguments, i.e. efficiency. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 13 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.48 
   5.49 
   5.50 
   5.51 
   5.52 
   5.53 
   5.54 
   5.55 
   5.56 
   5.57 
   Licensees may have their own prioritisation process, but inspectors should look to see 
  that key prioritisation decisions have been appropriately justified, whichever process 
  the licensee has adopted. 
   Decommissioning strategies may take account of the benefits of radioactive decay 
  (e.g. cobalt in reactor steelwork) while taking due cognisance of any dis-benefits, such 
  as ingrowth of longer-lived or higher dose-rate daughter radionuclides and potential for 
  deterioration of containment barriers. They should seek to avoid the creation of 
  radioactive wastes in forms that may reduce the number of options for safe and 
  effective long-term waste management.  
   The timescales over which decommissioning will take place should be defined in a 
  decommissioning programme . Decommissioning programmes should deliver the 
  desired outcome of risk-reduction and prioritisation of activities should be in line with 
  achievement of this principle. The licensee should explain the timescales for these 
  programmes / projects. 
   When assessing such justifications inspectors should take into account the relevant 
  factors listed in the SAPs [1] under principle DC.3 which may be influencing the 
  licensees proposed strategy. This list of factors is applicable to all types of nuclear 
  facilities.  
   When justifying the timing of decommissioning it is good practice for the licensee to 
  undertake appropriate stakeholder engagement. 
   Decommissioning tasks typically lead to the generation of radioactive waste in solid, 
  liquid or gaseous forms and may result in short-term increases in discharges of some 
  radionuclides. In such circumstances, the licensee will need to demonstrate to the 
  relevant environmental regulator that the adopted strategy represents an optimal 
  approach and reflects the application of Best Available Techniques (BAT), as required 
  by the relevant environmental legislation. 
   Decommissioning may proceed as a continuous activity, or as a series of sequential 
  stages, the end result of each stage being a significant reduction in hazard. The order, 
  timing and extent of each stage will be influenced by the hazard posed by a particular 
  facility on a site. Licensees should adequately justify of the order and timescales over 
  which it proposes to address each hazard.  
   In general, Inspectors should expect the licensee to prioritise the removal and/or 
  immobilisation of the most active or mobile material to be carried out on the shortest 
  practicable timescale, with further actions following with timescales appropriate to the 
  remaining hazards they address. In some circumstances, actions may be required that 
  temporarily increase risk to enable hazard reduction to take place. In such 
  circumstances the licensee should justify its overall approach and ensure that risks are 
  reduced ALARP across all stages. 
   Inspectors should recognise the risks associated with particular decommissioning 
  tasks can be increased due to the presence of uncertainty or specific safety 
  challenges, e.g. accessibility or confined space working. 
   Adequate arrangements should include the production and maintenance of strategies, 
  programmes and plans for the decommissioning of all nuclear facilities for which the 
  licensee is responsible, including the future management and disposal of all the 
  radioactive waste arising from the site. These should take into account government 
  policy and related national strategies, for example on decommissioning or radioactive 
  waste management and disposal.  
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 14 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.58 
   5.59 
   There are inherent uncertainties in decommissioning. Inspectors should look to see 
  that a licensee’s arrangements, strategies and safety cases adequately take account 
  of these, with appropriate mitigation and contingencies put in place. 
   Inspectors should give careful consideration to assessing arrangements, strategies, 
  programmes and safety cases involving facilities where the risks are intolerable, close 
  to becoming intolerable, or may soon become intolerable. In addition to the guidance 
  given throughout this TAG, inspectors should particularly consider the following:   
    
    
    
    
    
    
    
    
   How the Licensee’s longer-term strategy and plans should deliver the desired 
  outcome of large-scale hazard and risk reduction over an appropriate period of 
  time. 
  How short-term hazard and risks will be managed and longer-term hazard and 
  risk reduction achieved.   Regulatory monitoring of enabling milestones is 
  required to provide evidence that projects are progressing as agreed, given that 
  projects may run over many years to reach the desired outcome. 
  The Licensee should have a clearly defined, robust, but not overly bureaucratic 
  process for managing risk-reducing projects. This should focus on delivering 
  safe and timely remediation of high-risk hazards. 
  The principle of defence-in-depth with a suitable number of barriers should be 
  applied. Inspectors should acknowledge that some levels of defence-in-depth 
  will not be available in certain circumstances, and that mitigation will have to be 
  strengthened where protection is missing or rudimentary. 
  The worst-case accident scenarios need to be identified to allow adequate 
  protection or mitigation and recovery measures to be developed. 
  Simultaneous high-risk activities on the same facility or related facilities should 
  be avoided so far as is reasonably practicable, i.e. to prevent the occurrence of 
  one fault leading to the initiation and progression of another(s).  This should 
  include consideration of any foreseeable beyond-design-basis fault 
  progression, as illustrated by the Fukushima incident.   
  Clear mitigation/contingency measures need to be provided and developed to 
  an appropriate level against fault sequences assigned a high probability of 
  occurrence.  However, for some legacy facilities it needs to be recognised that 
  emergency response/contingency measures will be an essential part of the 
  safety demonstration, given the absence of some of the levels of protection that 
  would be in place in a modern plant. These should not be the sole safeguard 
  against identified fault scenarios, so far as is reasonably practicable. 
  Operating and emergency procedures/instructions should recognise and 
  address key issues and identified fault sequences related to the implementation 
  of a proposed modification to ensure measures are tailored to specific 
  circumstances. 
   Review of Decommissioning Strategies 
   5.60 
   5.61 
   5.62 
   In 1995 the UK Government issued a policy statement [14] that introduced a 
  responsibility on ONR (the then Nuclear Installations Inspectorate of HSE) to review 
  the decommissioning strategy of each UK licensee at least every 5 years, which 
  became known as the Quinquennial Review process (QQR). 
   In recognition of the creation of NDA, the UK Government revised its decommissioning 
  policy in 2004 [15] and therein supported continuance of the QQR process, except 
  where “equivalent arrangements” are made, e.g. by the NDA. 
   The Energy Act 2004 requires NDA to review its strategy at least every 5 years and to 
  undertake statutory consultation with the public and regulators. ONR has therefore 
  scrutinised each revision of NDA’s strategy to date and interprets this to be an 
  ‘equivalent arrangement’ to QQR for the licensed sites owned by NDA. As a 
  consequence, individual QQRs are no longer carried out at sites in the NDA estate. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 15 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.63 
   5.64 
   5.65 
   The operators of sites owned by NDA are required through their contracts with NDA to 
  produce and maintain detailed plans to a prescribed format that covers the whole site 
  lifecycle, including decommissioning. These plans are reviewed regularly and 
  summaries of the extant plans are made available on NDA’s website. 
   A range of other bodies now have interests in decommissioning strategies across 
  portfolios of sites outside the NDA estate (e.g. the Nuclear Liabilities Fund in respect of 
  EdF; the Nuclear Liabilities Funding Assurance Board in respect of new build, and; 
  MoD in respect of its liabilities on the defence sites). Each of these bodies has 
  bespoke expectations for licensees within its remit, some of which have a formal basis 
  in law (e.g. the requirement of the Energy Act 2008 for an operator of a new nuclear 
  power station to have a Funded Decommissioning Programme approved by the 
  Secretary of State prior to construction). 
   In judging whether alternative approaches constitute an ‘equivalent arrangement’ to 
  QQR, Inspectors should consider whether ONR has exercised sufficient oversight of 
  the decommissioning strategy in question to discharge the responsibility placed upon 
  ONR in Government policy without recourse to an additional formalised review. This 
  judgement should take account of outcomes from other regulatory interventions, such 
  as compliance inspections against the requirements of LC15 and LC35 or 
  assessments for the purposes of EIADR. 
   Facility decommissioning plan during design, construction and operational 
  phases (WENRA SRLs D-19 – D-25) 
   5.66 
   Initial strategies, programmes and plans should: 
    
    
   
   
    
    
    
    
    
   Demonstrate that decommissioning can be feasibly and safely conducted using 
  proven techniques or ones being developed. 
  Take into account expected hazards and health & safety issues. 
  Incorporate design for decommissioning features. 
  As far as practicable, the design should take account of features which may 
  assist future decommissioning, including contamination and activation control, 
  and aim to avoid features which will introduce unnecessary decommissioning 
  hazards, e.g. construction techniques which would be difficult to reverse. 
  The key decommissioning measures and design features should be described 
  and justified by the Licensee.  Such measures may need to be considered on 
  balance with construction and operational safety considerations. 
  Include waste management and environmental aspects of decommissioning, 
  such as management of waste and radioactive effluents. 
  Inform the design process and vice versa. ALARP considerations should also 
  be apparent (appropriate to the design stage). 
  Be used to inform the development of the construction arrangements and the 
  operational and maintenance regimes where appropriate.  These should take 
  due account of the needs of decommissioning, including features to facilitate 
  decommissioning, providing for the early acquisition and maintenance of the 
  records most important for decommissioning, and adoption of physical and 
  procedural methods to prevent the spread of contamination. Building 
  information modelling can be a very useful tool for this purpose. 
  Be used to provide a basis to assess the costs of the decommissioning work 
  and the means of financing it. 
   5.67 
   Inspectors should expect to see initial plans developed at the planning phase of a new 
  site or facility. These should be commensurate with the scale of the facility, the type of 
  the inventory, and the stage in the facility’s development i.e. proportionate and fit for 
  purpose. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 16 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.68 
   Some legacy facilities may not have had strategies in place from this early stage. In 
  these cases, inspectors should expect these to be produced based upon sufficient 
  characterisation of the site / facility and the challenges which decommissioning will 
  need to address, i.e. an appropriate understanding of the start point condition. 
   5.69 
   Generally, inspectors should expect an increase in the level of detail presented in the 
  decommissioning strategies and plans as the facility or site nears the end of its 
  operational life and approaches the decommissioning phase. 
   5.70 
   Examples of how this may apply in looking at safety cases are: 
    
    
   Inspectors should recognise that application of the engineering hierarchy and 
  substantiation of safety measures to a level required for modern operating 
  plants may not be practicable or desirable for aged facilities due to undergo 
  decommissioning.  Therefore, there is likely to be reliance on multi-legged 
  arguments and managerial safety measures.  These should be proportionate to 
  the hazards.   
  The principle of defence–in-depth with a suitable number of barriers should be 
  applied (as appropriate to the risks involved). Inspectors should acknowledge 
  that some levels of defence-in-depth will not be available in certain 
  circumstances and that mitigation will have to be strengthened where 
  protection is missing or rudimentary. 
   Optimisation is the term used by the IAEA in its Fundamental Safety Principles: Safety 
  Fundamentals [3] where principle 5 states, “Protection must be optimised to provide 
  the highest level of safety that can reasonably be achieved.” 
   In order to comply with UK legislation, licensees are required to apply the concept of 
  “optimisation” in order to reduce risks to health and safety so far as is reasonably 
  practicable (SFAIRP) in addition to utilising Best Available Techniques (BAT) in 
  respect of environmental protection. ONR’s guidance on the demonstration ALARP 
  (NS-TAST-GD-005) [3] and its supporting references contain ONR’s general 
  expectations in respect of a licensee’s demonstration that it has met the requirement to 
  reduce risks SFAIRP, which is frequently expressed in terms of reducing risks ALARP. 
   In respect of decommissioning, there are some specific aspects of optimisation that 
  ONR might expect to be addressed as part of a licensee’s arrangements to comply 
  with LC35. The precautionary principle should be applied to the uncertainties that often 
  need to be managed during decommissioning. NS-TAST-GD-005 [3] provides detailed 
  guidance on this topic. Another important aspect relates to the potentially long 
  timescales involved, and hence the increased importance of economic, social and 
  environmental factors such as sustainable development and long-term environmental 
  damage. 
   5.71 
   5.72 
   5.73 
   Final decommissioning plan (WENRA SRLs D-26 – D-28) 
   5.74 
   Strategies, programmes, plans and safety cases should be well developed and in 
  place before decommissioning starts. Inspectors should check that there is no gap 
  between the operational and decommissioning arrangements and that there is an 
  appropriate interface between the two, where this is relevant. 
   5.75 
   Inspectors should consider whether the decommissioning strategy proposes 
  appropriate end state conditions for the facility or site that are consistent with national 
  policies and regulatory expectations.   
   5.76 
   One possible end state is where all licensable activity has ceased, the licence is 
  revoked or handed back and the period of responsibility under NIA1965 has been 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 17 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   ended. This is referred to as de-licensing and inspectors are referred to ONR’s 
  separate guidance on this [20].  
   5.77 
   5.78 
   However this is not a mandatory requirement and other end states are possible in 
  which some restriction on future use and continued legal responsibilities under nuclear 
  legislation continue.  
   In some cases interim states may be identified. These should be treated as milestones 
  within the overall decommissioning plan and are not end states as covered by this 
  section of the guidance. The overall strategy/programme should show how 
  decommissioning will progress safely beyond such interim states.   
   5.79 
   The precise format of the decommissioning programme is for the Licensee to propose 
  and justify, but Inspectors should expect the following aspects to be adequately 
  considered: 
    
    
   
   
    
    
    
   
   
    
    
    
    
    
   A defined inventory of the plants and liabilities, e.g. radiological inventory, (or a 
  predicted inventory for those plants not at the end of their operational life). 
  The rationale for selecting the chosen decommissioning option. 
  The rationale for the proposed timing of decommissioning.  
  Defined end state criteria (and the methodology for subsequently confirming 
  that these criteria have been achieved).  
  A description of the decommissioning activities (including the content of the 
  individual stages), if a staged approach is applied.  
  Where appropriate decommissioning should be divided into stages, in which 
  case ONR may specify where consent is required to commence a stage or to 
  proceed from one stage to the next.   
  A Post Operational Clean Out (POCO) strategy. 
  Arrangements for asset management during the decommissioning process.  
  If the plans include a deferment of decommissioning with an associated care 
  and maintenance period, the arrangements should include procedures and 
  plans to maintain safety during the care and maintenance period. Such 
  arrangements must include plans to manage any risks arising to the health and 
  safety of workers, such as those arising from asbestos containing materials. 
  Appropriate technical underpinning of the decommissioning methodology, 
  including any key assumptions.   
  Identification of any relevant Research and Development (R&D) requirements 
  or opportunities, e.g. technology developments.  
  Identification of the need for facilities to carry out decommissioning and waste 
  management, including potential use of supply chain capabilities for treatment. 
  A safety case justification, including the identification of safety and radiation 
  protection measures/strategies.  The overarching strategy for safety 
  management systems should also be evident, and will identify existing facilities 
  and equipment that will be used during decommissioning and any necessary 
  changes to the existing safety systems, or the need for replacement or new 
  plant or equipment to carry out decommissioning operations. 
  The management arrangements to ensure safe delivery of the 
  decommissioning projects, including arrangements for the management of 
  change within the organisation during decommissioning. 
   Decommissioning plan update during decommissioning operations (WENRA 
  SRL D-29) 
   5.80 
   Inspectors should assess whether arrangements for decommissioning include 
  appropriate review and change control procedures for the decommissioning 
  programmes, plans, safety cases and procedures. Reviews should take place at least 
  as frequently as the periodic safety review as required under LC15, but an increased 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 18 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   frequency may be necessary to reflect the progressive change in plant status, hazards 
  or decommissioning approach as decommissioning progresses. 
   5.81 
   Changes which could warrant a review and subsequent modification of plans and 
  programmes may include (but are not limited to): 
   o 
  o 
  o 
   o 
  o 
    
    
    
    
   
    
   
   
   
   Significant changes to the facility (physical, ageing, inventory, etc), including 
  changes resulting from the decommissioning operations. 
  Improved plant characterisation data, resulting from plant characterisation 
  tasks. 
  Significant changes to the decommissioning processes or strategy adopted; 
  e.g. those that 
  Significantly affect the safety of the overall decommissioning programme; 
  Significantly affect the time in which decommissioning will be completed 
  Significantly affect the way in which decommissioning will be carried out, e.g. 
  the use of new, untried or significantly different methods to those assessed 
  previously; 
  Significantly affect the way in which radioactive waste will be dealt with, e.g. 
  different disposal options or new methods of waste treatment; or 
  Change the proposed end state 
  Major deviations from the scheduled programme. 
  Major deviations in the assumed status of the facility, e.g. in light of new 
  characterisation data.  In particular the identification of new hazards or 
  significant changes to the assessed consequences of hazards.  
  Relevant operational feedback, or changes in relevant good practice. 
  New or revised legislative or regulatory requirements. 
  Significant technological developments or opportunities. 
  Availability of anticipated external resources such as transport flasks, storage 
  facilities or available disposal routes. 
   CONDUCT OF DECOMMISSIONING   
   Safety classification (WENRA SRL D-30) 
   5.82 
   As decommissioning progresses, there may be a change in the importance of 
  designated SSCs to safety. It may therefore be appropriate to declassify or downgrade 
  SSCs not required post-operations, or as decommissioning transitions between 
  phases, provided this is justified in an update of the safety case. Conversely, some 
  SSCs may become more important, or new SSCs may even potentially be required to 
  support decommissioning operations. 
   5.83 
   Inspectors should consider the sufficiency and appropriateness of any remaining SSCs 
  to the operations planned during subsequent phases of decommissioning. It is 
  desirable for the licensee to minimise its reliance on active safety systems to maintain 
  adequate safety margins during any C&M phase(s).  
   5.84 
   Further guidance is contained within NS-TAST-GD-094 (Categorisation of safety 
  functions and classification of structures and components) [3]. 
   On-site emergency preparedness (WENRA SRLs D-31 – D-34) 
   5.85 
   The licensee’s emergency planning arrangements should be updated to reflect the 
  changing hazard as the site transitions from operations through the various stages of 
  decommissioning, such that the arrangements remain appropriate to the current state 
  of the plant. 
   5.86 
   Amendments to the emergency plan associated with decommissioning typically result 
  in a reduced scope of available on site resource, with increasing call for off-site 
  responders to support the emergency organisation.  
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 19 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.87 
   Guidance on licensee’s arrangements for emergency preparedness are covered 
  elsewhere under specific guidance, such as NS-INSP-GD-011 (LC11 Emergency 
  arrangements) [16] and the new Approved Code of Practice (ACoP) to the Radiation 
  (Emergency Preparedness and Public Information) Regulations 2019 [17]. 
   5.88 
   5.89 
   5.90 
   5.91 
   5.92 
   5.93 
   Decommissioning experience feedback (WENRA SRLs D-35 – D-37) 
   The licensee’s arrangements should include procedures to identify, screen, analyse, 
  and document events, at the facility and from external sources, in a systematic way to 
  improve and ensure safe decommissioning. Inspectors should ensure that operational 
  feedback is appropriately considered within the decommissioning safety case. 
   This feedback may come from events during decommissioning, or from other facilities 
  operated by the licensee. Inspectors should look to see that feedback from events prior 
  to decommissioning is included, for example findings of differences between “as built” 
  plant and the design drawings, past plant modifications, incidents, spillages etc. 
  Learning from post-project reviews should also be considered and incorporated as 
  appropriate. Additional feedback can be sourced from other operators and wider 
  industry organisations, both national and international.  
   The licensee’s duties under LC7 are unchanged during the decommissioning phase of 
  the lifecycle, to notify record and investigate incidents on the site. Where learning 
  points are identified following investigation of an event with significance for safety, 
  appropriate corrective actions should be implemented to prevent reoccurrence of 
  similar events or address other developments adverse to safety. 
   Waste management (WENRA SRLs D-38 – D-40) 
   Decommissioning generally results in a broader range of wastes than the preceding 
  phases of the lifecycle, in terms of physical characteristics, radiological contents, 
  chemo-toxic properties and the volumes arising. The licensee should therefore 
  consider the need to strengthen its waste management infrastructure and processes 
  prior to undertaking decommissioning, to ensure all the anticipated wastes will be 
  managed in accordance with regulatory expectations such as LC32 and the Joint 
  Guidance on management of Higher Activity Wastes. 
   The licensee should adopt a precautionary approach to any inherent uncertainties in 
  respect of its decommissioning wastes and put in place contingency arrangements 
  against potential cliff-edge effects (e.g. a lack of characterisation data may preclude an 
  accurate assessment of a waste stream’s categorisation as LLW or ILW). 
   The licensee’s decommissioning strategy and plan should identify the types of waste 
  that are expected to be generated and demonstrate that the chosen decontamination 
  and dismantling techniques meet regulatory expectations with respect to the waste 
  management hierarchy [11]. 
   5.94 
   The hierarchy encourages adoption of options for managing waste in the order of: 
   - 
  - 
  - 
  - 
  - 
   Prevent waste from arising in the first place 
  Minimise the quantity of waste produced 
  Reuse of those wastes that cannot be prevented 
  Recycling of waste into a form that allows it to be reclaimed 
  Disposal should only occur when waste cannot be prevented, reused or 
  recycled and must be implemented in a manner that is compliant with the 
  environmental legislation 
   5.95 
   An essential first step in implementation of the hierarchy is for a licensee to 
  appropriately characterise and then segregate its wastes, to enable optimised waste 
  management through to the point of disposal. The licensee’s system of 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 20 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.96 
   5.97 
   5.98 
   5.99 
   characterisation and segregation should enable the wastes arising to be disposed of at 
  the lowest practicable categorisation. This should include exemption and clearance of 
  those decommissioning wastes that have potential to be disposed of as non-
  radioactive material. Further guidance may be found in IAEA Safety Guide RS-G-1.7 
  [4]. 
   LC32 imposes the duty upon licensees to minimise the total quantity, and rate of 
  production of radioactive waste, so far as is reasonably practicable [3], which is 
  particularly pertinent to decommissioning given the potential to generate large 
  quantities of waste.  
   The licensee’s radioactive waste management arrangements should therefore be 
  updated to reflect the changing nature of the radioactive waste being generated, 
  including consideration of appropriate characterisation and segregation to enable 
  optimised management and minimise the volumes of radioactive waste requiring 
  disposal, so far as is reasonably practicable. This may be captured in an Integrated 
  Waste Strategy and/or the Waste Management Plan that is formally required by the 
  environmental regulators. 
   The SAPs state that radiological hazards should be reduced systematically and 
  progressively, with radioactive waste generated processed into a passive safe state, 
  as soon as is reasonably practicable (RW.6), and stored in accordance with good 
  engineering practice (RW.5) [1].  
   Information that might be needed for the current and future safe management of 
  radioactive waste should be recorded and preserved (RW.7). This is particularly 
  important for any radioactive wastes generated during decommissioning which do not 
  yet have an available waste route and will therefore be stored for an extended period 
  prior to disposal. The records should capture necessary information to enable the 
  continued safe management of that waste whilst in storage, and also support the future 
  disposability case, as defined in the waste management and decommissioning plans. 
   5.100 
   NS-TAST-GD-024 [3] and the joint regulatory guidance The Management of Higher 
  Activity Radioactive Waste on Nuclear Licensed Sites [12] provide further general 
  guidance on management of radioactive waste management. 
   5.101 
   5.102 
   5.103 
   On-site and off-site monitoring (WENRA SRL D-41) 
   Licensees normally implement an on- and off-site monitoring programme to 
  demonstrate effective management of its operations and protection the public. This 
  monitoring should include on plant monitoring for the purposes of demonstrating 
  compliance with LC34 (Leakage and escape of radioactive material and radioactive 
  waste), as well as environmental monitoring. 
   As a facility transitions into decommissioning, the type of operations conducted on the 
  site and the hazards they pose will naturally differ to those during operations. As such 
  the licensee should review and modify its monitoring programme to ensure it remains 
  appropriate and takes due account of the changes to the facility, any specific hazards 
  arising, and the effluents associated with each phase of decommissioning. 
   One key aspect of environmental monitoring relates to land quality management 
  (LQM). Whilst this is an area of regulation which requires joint working with colleagues 
  at the relevant environmental regulator, it should be recognised by the Inspector that 
  ONR has lead responsibility for regulation of radioactively contaminated land on 
  nuclear licensed sites.  
   5.104 
   The joint regulatory guidance Regulatory Expectations for Successful Land Quality 
  Management at Nuclear Licensed Sites [18] advocates licensees implement LQM 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 21 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   throughout the lifetime of the facility. However, as a site moves into decommissioning 
  and implements plans to reach its desired end state, LQM will take on greater 
  importance. Further guidance is provided in NS-TAST-GD-083 (Land Quality 
  Management) [3]. 
   Maintenance, Testing and Inspection (WENRA SRLs D-42 – D-44) 
   5.105 
   Structures, systems and components should be capable of delivering their required 
  safety function until the associated hazards have been removed or mitigated. There 
  should therefore be adequate consideration of continued maintenance, testing and 
  inspection of SSCs during decommissioning until the SSC is no longer required, as 
  justified within the safety case. 
   5.106 
   Maintenance schedules should take into account operational limits and conditions as 
  required in the decommissioning safety case, and re-evaluated in light of operational 
  experience and continuous changes to the plant throughout decommissioning.  
   5.107 
   Adequate asset management is required to ensure the facility remains safe and does 
  not degrade to an unacceptable state. Major issues can arise if decommissioning 
  programmes are delayed and as such the maintenance, testing and inspection of 
  SSCs and important assets, which may not necessarily be claimed within the safety 
  case, must therefore address ageing and consider the future decommissioning plan 
  timescales, as appropriate. Inspectors should ensure appropriate consideration of 
  asset management plans should decommissioning programmes be delayed to ensure 
  this does not lead to unacceptable degradation of plant or buildings. 
   5.108 
   Inspectors should consider whether the licensee’s plans adequately address the 
  following: 
    
    
    
    
    
    
    
    
    
   Appropriate baseline characterisation of the assets and the hazards that they 
  protect against. 
  Programmes for the identification, examination, maintenance, testing, 
  surveillance and inspection of SSCs important to safety, which take into 
  account operational limits and conditions. 
  Consideration of ageing, deterioration mechanisms, and obsolescence of 
  SSCs, and the inspection and monitoring of such factors, particularly where 
  decommissioning is expected to take place over long timescales. 
  Periodic review (e.g. inspections or tests) of SSCs to determine whether they 
  are still acceptable. 
  Systems to ensure the prompt repair of SSCs, prioritised to take account of the 
  relative importance to safety of the defective SSC. 
  Systems to ensure the appropriate remedial action following any abnormal 
  event which is significant for the safety of decommissioning activities, including 
  inspection, testing, maintenance and repair of SSCs, as appropriate. 
  Arrangements to review, as necessary, the examination and maintenance and 
  testing program, to take account of the rapid changes to the facility during 
  decommissioning. 
  Similar arrangements to those listed above for any key building structures, 
  services or other systems which are not designated as SSCs but do perform 
  important functions. 
  In taking account of the above factors, plans should adequately address any 
  risks to workers arising from access to buildings, facilities, and structures. 
   5.109 
   Further general guidance on expectations relating to maintenance is contained in NS-
  TAST-GD-009 (Examination, Inspection, Maintenance and Testing of Items Important 
  to Safety) and NS-TAST-GD-098 (Asset Management) [3]. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 22 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.110 
   5.111 
   5.112 
   Control of decommissioning activities (WENRA SRLs D-45 – D-47) 
   Licensees are required to control activities it undertakes during decommissioning that 
  may impact upon safety through use of suitable processes and procedures approved 
  by the licensee as part of its management system. Given the dynamic state of a facility 
  during decommissioning, the licensee should review and update its processes and 
  procedures used during operations, as necessary, to ensure they remain adequate 
  and applicable to decommissioning activities. 
   The arrangements should ensure that no decommissioning activity is undertaken 
  without a prior assessment of its impact on safety, taking into account the postulated 
  initiating events with internal causes included in the safety case for decommissioning. 
  Such arrangements should give due consideration to different decommissioning 
  activities executed in parallel, which might adversely affect safety of each other. 
   Modifications, to the plant and of planned decommissioning activities, should be 
  controlled by the licensee, as per its LC22 arrangements, according to the safety 
  significance through application of an adequate categorisation scheme; ensuring 
  appropriate focus is retained on those activities which may have a significant impact 
  upon safety. The LC22 arrangements should also take into account the cumulative 
  effects of changes to procedures, modifications to the facility and the decommissioning 
  organisation, technical developments, decommissioning experience accumulated and 
  ageing of safety systems and components, to ensure there is no overall degradation in 
  safety standards. 
   5.113 
   As facilities are decommissioned and redundant safety systems removed, there may 
  be increased reliance on administrative controls over engineered controls. Where this 
  is the case, the inspector should consider whether the licensee has adequately 
  considered human factors when determining the appropriate controls. The inspector 
  may also deem it necessary to seek specific assessment by a Human Factors 
  specialist, depending upon the significance of any change. Further guidance is 
  available in NS-TAST-GD-058 (Human Factors Integration) and NS-TAST-GD-063 
  (Human Reliability Analysis) [3].  
   5.114 
   Additional Human Factors specialist support may be relevant where the licensee 
  intends to deploy new equipment during decommissioning, to ensure its design 
  appropriately considers the human-machine interface. Further guidance is available in 
  NS-TAST-GD-059 (Human Machine Interface) [3]. 
   Period of Deferment (WENRA SRLs D-48 – D-49) 
   5.115 
   In the UK, care and maintenance (C&M) refers to a specific period of planned 
  quiescence on the site or in the facility between decommissioning phases, usually after 
  POCO or de-planting with deferred dismantling and final site clearance. 
   5.116 
   During the C&M period the facility should be maintained in a passively safe 
  configuration, so far as it is reasonably practicable, minimising the need for active 
  safety systems, monitoring, and human intervention. This approach may necessitate 
  removal or downgrading of existing SSCs associated with operations, where 
  appropriate, if justified by an update of the safety case. 
   5.117 
   If the licensee proposes a prolonged deferral strategy then the C&M requirements 
  should be developed, prior to the deferral commencing. These should be justified 
  within a C&M programme that ensures continued safety of the facility, and this 
  programme should ensure the ability to decommission the facility safely in the future. 
   5.118 
   When assessing the adequacy of the C&M arrangements inspectors should consider 
  whether the licensee has adequately: 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 23 of 31 
    
    
    
    
   Office for Nuclear Regulation  
    
    
    
   minimised, so as far as reasonably practicable, the hazards presented by the 
  radiological inventory prior to entering the C&M phase; 
  addressed ageing, deterioration and obsolescence for safety systems that will 
  be required to remain operational, including potential for upgrade or 
  replacement and that this is included within the plan; and 
  specified the maintenance and examination regime. 
   5.119 
   The licensee should record clear decisions regarding whether a period of C&M is 
  appropriate, taking account of the status of the facility, the decommissioning strategy, 
  timescales, etc. Inspectors should expect a robust safety case that takes account of 
  long-term safety as opposed to just renewing the short-term safety case underpinning 
  such decisions.  
   5.120 
   The Licensee should demonstrate that they can ensure long-term safety by ensuring 
  and monitoring a safe plant configuration and maintaining an appropriate organisation, 
  supporting infrastructure and corporate memory. The safety case should define a limit 
  to the period of proposed deferment. 
   5.121 
   The safety case should justify and demonstrate safety for the proposed period of 
  deferral. The Inspector may choose to assess whether the following is adequately 
  considered in the safety case: 
    
    
    
    
   
   any cliff-edge effects, e.g. those associated with infrastructure availability, 
  degradation of the structures or obsolescence of systems; 
  the effects of deferral should not impact upon the ability to conduct future 
  decommissioning in a safe way where risks are ALARP; 
  the whole lifecycle radiation doses associated with C&M and decommissioning 
  should be ALARP; 
  interdependences of different facilities on a site; and 
  knowledge management and retention of necessary skills and expertise.  
   5.122 
   Notwithstanding a justified period of deferral, licensees should adopt decommissioning 
  programmes which are sufficiently flexible to facilitate acceleration of the programme, 
  should this be necessary for safety reasons. 
   SAFETY VERIFICATION   
   5.123 
   5.124 
   Contents, review and update of the safety case for decommissioning (WENRA 
  SRLs D-50 – D-56) 
   Inspectors should refer to NS-TAST-GD-051 (The purpose, scope and content of 
  nuclear safety cases) [3] for general guidance on safety cases. The following provides 
  additional guidance to inspectors regarding the assessment of safety cases for the 
  decommissioning of facilities on nuclear licensed sites. 
   A decommissioning safety case should demonstrate how the licensee will manage 
  short-term risks and achieve longer-term risk reduction over the full term of the 
  decommissioning programme. The safety case should include assessment of any 
  planned new installations, facilities or systems to necessary to support the 
  decommissioning programme, and include the final decommissioning of such 
  infrastructure itself. 
   5.125 
   Specific radiological hazards that are of particular importance in the case of 
  decommissioning include, for example, cutting of activated and contaminated material, 
  modification of safety barriers, entry into areas of the plant that were previously 
  inaccessible, decontamination of large items, dispersion of contamination during 
  demolition. This is not an exhaustive nor exclusive list, and licensees should 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 24 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   demonstrate that its hazard identification process has adequately considered all 
  relevant hazards and fault conditions. 
   5.126 
   The safety case should incorporate learning from experience of operating the facility, 
  as well as learning from relevant decommissioning projects elsewhere, whether in the 
  UK or internationally. 
   5.127 
   5.128 
   During decommissioning, the risks associated with conventional health and safety 
  hazards arising from de-planting and demolition activities (eg asbestos, confined 
  spaces), will inevitably increase. As such, the safety case should adequately consider 
  the appropriate management of conventional health and safety risks where these have 
  the potential to impact upon nuclear safety. 
   The safety case should be appropriately underpinned by knowledge of the risk and 
  balanced assessment of associated uncertainties, particularly in the case of legacy 
  facilities. This should be supported by the examination of records and conducting of 
  surveys and measurements to verify the inventory and locations of radioactive, fissile 
  or other hazardous materials in the facility, and the surrounding potentially affected 
  areas. 
   5.129 
   Where the licensee identifies additional research is required to underpin its 
  decommissioning proposals, or to mitigate uncertainties, this should be recognised in 
  the safety case, and appropriate plans put in place to deliver the necessary work. 
   5.130 
   5.131 
   5.132 
   5.133 
   5.134 
   Inspectors should consider the licensee’s arrangements to maintain the safety case(s) 
  when significant changes occur, according to the safety relevance of such changes 
  and licensee’s categorisation. These might include modifications to the facility, plan or 
  decommissioning practice at major steps in the decommissioning project, or new 
  relevant regulatory requirements.   
   Licensees should periodically review the safety case to confirm the decommissioning 
  activities and states are, and will continue to be in accordance with regulatory 
  expectations and legal requirements. Such reviews should also identify and evaluate 
  the safety significance of any deviations from applicable current safety standards and 
  relevant good practice, and ensure an adequate plan to address such deviations are 
  implemented.  
   The review should also take into account the cumulative effects of, for example, 
  changes to procedures, modifications to the facility or the decommissioning 
  organisation, and ageing of safety systems and components. Additionally, the review 
  should consider technical developments and decommissioning experience 
  accumulated to update the safety case accordingly. 
   In determining the frequency of reviews, the licensee should consider aligning periodic 
  reviews with any major changes in the facility or hazard(s) which may arise well before 
  an otherwise planned periodic review, notwithstanding the general expectation that the 
  interval between periodic safety reviews (PSR) should not exceed 10 years. General 
  guidance on PSRs is provided in NS-TAST-GD-050 (Periodic safety reviews) [3]. 
   Decommissioning reporting and Licence termination conditions (WENRA SRLs 
  D-57 – D-62) 
   The decommissioning plan and associated programme(s) should include sufficient 
  short and long term milestones and deliverables to enable progress to be monitored. 
  These milestones will usually coincide with major step changes hazard profile of the 
  site, as associated with the transition from one stage of decommissioning to the next. 
  The licensee should develop suitable metrics to facilitate monitoring and reporting 
  against the identified decommissioning milestones. 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 25 of 31 
    
    
    
    
   Office for Nuclear Regulation  
   5.135 
   ONR may specify that the licensee may not move from one stage to the next without 
  the consent of ONR (LC35). Examples may include transition into a period of care & 
  maintenance, or commencement of final dismantling and demolition. 
   5.136 
   The licensee should identify those records to be available after the completion of 
  decommissioning, how they will be kept and the necessary retention period. This can 
  be done either by the licensee or under quality controlled arrangements for the 
  information to be kept by a third party, eg at the Nucleus Archive in Caithness. 
   5.137 
   ONR’s publication Licensing Nuclear Installations [19] explains the circumstances in 
  which a nuclear site licence may be revoked by ONR or surrendered by the licensee. 
  However a licensee’s “period of responsibility” can only end when: 
    
   
   
   a new licence has been granted for the site 
  the site is used by the Crown and does not require a licence, or 
  ONR has given written notice that in its opinion there has ceased to be any 
  danger from ionising radiations from anything on the site. 
   5.138 
   5.139 
   5.140 
   Before issuing such a notice, ONR will assess whether the site has been 
  decommissioned to the point where the remaining risks satisfy the “no danger” criterion 
  derived from sections 3(12)(b) and 5(15)(a) of NIA65. Consideration of a licensee’s 
  case for demonstrating “no danger” should be carried out against ONR’s dedicated 
  guidance [20]. Until such time as the licensee can provide an adequate demonstration 
  of compliance with the “no danger” criterion, it will retain responsibility for safety on the 
  site. 
   As decommissioning progresses towards its final stages and the nuclear hazard is 
  progressively reduced, the hazard profile will tend to change towards conventional 
  safety and environmental protections issues. The continued application of the nuclear 
  licensing regime to these final stages of decommissioning was subject to a 
  government consultation on alternative approaches [21].  
   The UK Government is seeking to amend the regulatory framework that applies to the 
  final stages of nuclear site decommissioning to by adopting the 2014 Paris Convention 
  Decommissioning Exclusion [22]. Under this Exclusion, the nuclear liability regime will 
  cease to apply for nuclear sites that meet the qualifying criteria; third party damage or 
  injury will then be covered by ordinary law third party liability.  
   5.141 
   ONR will continue to provide effective and proportionate regulation of the delicensing 
  of nuclear sites through amendment of the delicensing criteria, should the Exclusion be 
  adopted into UK legislation.  
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 26 of 31 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   6. 
    1  
   2  
   3  
   4  
   5  
   6  
   REFERENCES
   NS-TAST-GD-009 
   NS-TAST-GD-024 
   NS-TAST-GD-027 
  NS-TAST-GD-033 
  NS-TAST-GD-038 
  NS-TAST-GD-048 
  NS-TAST-GD-049 
  NS-TAST-GD-050 
  NS-TAST-GD-051 
  NS-TAST-GD-058 
  NS-TAST-GD-059 
  NS-TAST-GD-061 
  NS-TAST-GD-063 
  NS-TAST-GD-065 
  NS-TAST-GD-079 
  NS-TAST-GD-080 
   Safety Assessment Principles for Nuclear Facilities, 2014 Edition Revision 0, 
  November 2014. Office for Nuclear Regulation. www.onr.org.uk/saps 
  Purpose and Scope of Permissioning, NS-PER-GD-014 Revision 6, November 2016. 
  Office for Nuclear Regulation. www.onr.org.uk/operational/assessment/ns-per-gd-
  014.pdf  
  Nuclear Safety Technical Assessment Guides, Office for Nuclear Regulation. 
  www.onr.org.uk/operational/tech_asst_guides 
  NS-TAST-GD-005 
  Guidance on the Demonstration of ALARP (As Low As 
  Reasonably Practicable) 
  Examination, Inspection, Maintenance and Testing of Items  
  Important to Safety 
  Management of Radioactive Materials and Radioactive Waste  
  on Nuclear Licensed Sites 
  Training and assuring personnel competence 
  Duty Holder Management of Records 
  Radiological Protection 
  Organisational Change 
  Licensee Core Safety and Intelligent Customer Capabilities 
  Periodic Safety Reviews (PSR) 
  The Purpose, Scope and Content of Nuclear Safety Cases 
  Human Factors Integration 
  Human Machine Interface 
  Staffing Levels and Task Organisation 
  Human Reliability Analysis 
  Function and Content of the Nuclear Baseline 
  Licensee Design authority Capability 
  Challenge Culture, Independent Challenge Capability (including  
  an Internal Regulation function) and the Provision of Nuclear  
  Safety Advice 
  Land Quality Management 
  Categorisation of Safety Functions and Classification of  
  Structures and Components 
  NS-TAST-GD-098 
  Asset Management 
  IAEA Safety Standards Series, International Atomic Energy Agency, Vienna. 
  www.iaea.org/resources/safety-standards  
  Fundamental Safety Principles, SF-1. 2006 
  Decommissioning of facilities, General Safety Requirements (GSR) Part 6. 2014 
  Safety Assessment for the Decommissioning of Facilities Using Radioactive Material, 
  Safety Guide WS-G-5.2. 2008 
  Decommissioning of Nuclear Power Plants, Research Reactors and Other Nuclear 
  Fuel Cycle Facilities, Specific Safety Guide SSG-47. 2018 
  Decommissioning of Medical, Industrial and Research Facilities, Specific Safety Guide 
  SSG-49. 2019 
  Application of the Concepts of Exclusion, Exemption and Clearance, Safety Guide  
  RS-G-1.7. 2004 
  Western European Nuclear Regulators’ Association. www.wenra.org  
  Decommissioning Safety Reference Levels, Working Group on Waste and 
  Decommissioning (WGWD), Version 2.1, March 2012. 
  IAEA Safety Glossary 
   NS-TAST-GD-083 
  NS-TAST-GD-094 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 27 of 31 
    
    
    
    
    
     
    
    
     
    
    
     
    
    
     
    
    
     
    
    
     
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
    7  
   8  
   9  
   10  
   11  
   12  
   13  
   14  
   15  
   16  
   17  
   18  
   19  
   Licence Condition Handbook. February 2017. Office for Nuclear Regulation. 
  www.onr.org.uk/silicon.pdf  
  Work with Ionising Radiation. Ionising Radiations Regulations 2017 Approved Code of 
  Practice and Guidance. L121 Second Edition, 2018. Health and Safety Executive. 
  www.hse.gov.uk/pUbns/priced/l121.pdf   
  Agreements with Others, Office for Nuclear Regulation. www.onr.org.uk/agency-
  agreements-mou.htm 
  Memorandum of Understanding between the Office for Nuclear Regulation and the 
  Environment Agency on matters of mutual interest in England, August 2015 
  Memorandum of Understanding between the Office for Nuclear Regulation and the 
  Natural Resources Body for Wales on matters of mutual interest in Wales, December 
  2014. 
  Memorandum of Understanding between the Office for Nuclear Regulation and the 
  Scottish Environment Protection Agency on matters of mutual interest in Scotland, 
  January 2019 
   Additional Technical Inspection Guides, HOW2, Office for Nuclear Regulation. 
  Guidance to support the joint regulatory memorandum of understanding between ONR 
  and EA on matters of mutual interest in England, ONR-INSP-GD-061 Revision 1, 
  March 2018. 
  Guidance to support the joint regulatory memorandum of understanding between ONR 
  and SEPA on matters of mutual interest in Scotland, ONR-INSP-GD-062 Revision 1, 
  June 2019. 
  Guidance to support the joint regulatory memorandum of understanding between ONR 
  and NRW on matters of mutual interest in Wales, ONR-INSP-GD-063 Revision 1, 
  June 2019. 
  Basic principles of radioactive waste management. Joint guidance from ONR, EA, 
  SEPA and NRW to nuclear licensees. Revision 2, 2015. 
  www.onr.org.uk/wastemanage/basic-principles.pdf  
  The management of higher activity radioactive waste on nuclear licensed sites. Joint 
  guidance from ONR, EA, SEPA and NRW to nuclear licensees. Revision 2, 2015. 
  www.onr.org.uk/wastemanage/waste-management-joint-guidance.pdf  
  Nuclear Safety Technical Inspection Guides, Office for Nuclear Regulation. 
  www.onr.org.uk/operational/tech_insp_guides 
  NS-INSP-GD-017 
  Licence Condition 17: Management Systems 
  Review of Radioactive Waste Management Policy: Final Conclusions. UK Government 
  Cm2919, July 1995 
  The Decommissioning of the UK Nuclear Industry's Facilities. Amendment to Cm2919. 
  UK Government, and Devolved Administrations. September 2004. 
  Nuclear Safety Technical Inspection Guides, Office for Nuclear Regulation. 
  www.onr.org.uk/operational/tech_insp_guides  
  Approved Code of Practice and Guidance for The Radiation (Emergency 
  Preparedness and Public Information) Regulations 2019. Office for Nuclear 
  Regulation. www.onr.org.uk/documents/2019/reppir-19-acop-and-guidance.pdf   
  Regulatory Expectations for Successful Land Quality Management at Nuclear 
  Licensed Sites. Joint guidance from ONR, EA, SEPA and NRW to nuclear licensees. 
  Revision 1, 2014. www.onr.org.uk/documents/2014/land-quality-management.pdf  
  Licensing Nuclear Installations, 4th edition, January 2015. Office for Nuclear 
  Regulation. www.onr.org.uk/licensing-nuclear-installations.pdf  
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 28 of 31 
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
    20  
   21  
   22  
   Delicensing of nuclear sites, Office for Nuclear Regulation. 
  www.onr.org.uk/delicensing.htm  
  Discussion paper on: Regulation of Nuclear Sites in the Final Stages of 
  Decommissioning. Department for Business, Energy & Industrial Strategy. November 
  2016.  
  Decision and Recommendation of the Steering Committee Concerning the Application 
  of the Paris Convention to Nuclear Installations in the Process of Being 
  Decommissioned, NEA/SUM(2014)2 , 30 October 2014, Nuclear Energy Agency. 
  www.oecd-nea.org/law/decommissioning-exclusion  
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 29 of 31 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   7. 
   ABBREVIATIONS 
   ACoP 
  ALARP 
  BAT 
  BDP 
  CDM 
  C&M 
  EA 
  EIADR 
   EDF 
  FDP 
  GSR 
  HSE 
  IAEA 
  LC 
  LQM 
  MOD 
  MoU 
  NDA 
  NEA 
  NLF 
  NLFAB 
  NRW 
  OPEX 
  ONR 
  POCO 
  PSR 
  QQR 
  RGP 
  SAP 
  SFAIRP 
  SEPA 
  SQEP 
  SRL 
  SSC 
  TAG 
  WENRA 
   Approved Code of Practice 
  As low as reasonably practicable 
  Best Available Technique 
  Baseline Decommissioning Plan 
  The Construction Design and Management Regulations 2015 
  Care & Maintenance 
  Environment Agency 
  Nuclear Reactors (Environmental Impact Assessment for Decommissioning) 
  Regulations 1999 
  Électricité de France 
  Funded Decommissioning Plan 
  General Safety Requirements (IAEA) 
  Health and Safety Executive 
  International Atomic Energy Agency 
  Licence Condition 
  Land Quality Management 
  Ministry of Defence 
  Memorandum of Understanding 
  Nuclear Decommissioning Authority 
  Nuclear Energy Agency 
  Nuclear Liabilities Fund 
  Nuclear Liabilities Funding Assurance Board 
  Natural Resources Wales 
  Operational Experience 
  Office for Nuclear Regulation 
  Post Operational Clean Out 
  Periodic Safety Review 
  Quinquennial Review 
  Relevant Good Practice 
  Safety Assessment Principle(s) (ONR) 
  So far as is reasonably practicable 
  Scottish Environment Protection Agency 
  Suitably Qualified and Experienced Personnel 
  Safety Reference Level (WENRA) 
  Structure, System and Component 
  Technical Assessment Guide(s) (ONR) 
  Western European Nuclear Regulators’ Association 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 30 of 31 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   8. 
   APPENDICES 
   8.1 
   8.2 
   8.3 
   8.4 
   8.5 
   8.6 
   8.7 
   APPENDIX 1 – DECOMMISSIONING FUNDING  
   The UK Government expects all nuclear operators should take the steps necessary to 
  ensure that adequate funds are in place to meet their decommissioning liabilities. 
   In practice ONR does not directly scrutinise the financial provisions made by licensees, 
  but provides its view to other organisations who give relevant assurance to the UK 
  Government. In such cases, ONR’s advice is based on an assessment of whether the 
  decommissioning strategy and plan on which the financial provisions are based aligns 
  with UK regulatory expectations. 
   Sites owned by the Nuclear Decommissioning Authority (NDA) are subject to statutory 
  financial arrangements made in accordance with the Energy Act 2004, which assure 
  the provision of funds by the UK government. In addition to setting out the purposes, 
  constitution, staffing and proceedings of the NDA, the Energy Act 2004 identified ONR 
  as a statutory consultee on NDA’s Strategy. 
   The UK Government established the Nuclear Liabilities Fund (NLF) in 1996 with the 
  key purpose of funding the costs of decommissioning the eight nuclear power stations 
  (7 AGR and 1 PWR) currently operated in the UK by EdF Energy (EdF). The UK 
  Government also agreed to fund decommissioning of the eight power stations to the 
  extent that the liability might exceed the assets of the NLF. In order to draw down on 
  the NLF, EdF must apply to NDA with a demonstration that the intended spend is 
  against a qualifying liability. EdF is also required to submit to NDA a baseline 
  decommissioning plan (BDP), on which NDA seeks ONR’s views. 
   The UK Government further legislated, in the Energy Act 2008, to ensure operators of 
  any proposed new nuclear power stations built in the UK will have secure finance in 
  place to meet the full costs of future decommissioning. Under the Act, any such 
  operator is required to have a Funded Decommissioning Programme (FDP) approved 
  by the Secretary of State in place before construction of its power station begins, and 
  to comply with the FDP thereafter. To ensure the operator makes prudent financial 
  provisions, the FDP is expected to: 
    
    
   Identify all the steps necessary to decommission the power station and manage 
  and dispose of all associated wastes, including spent nuclear fuel 
  Give due recognition to the government’s ‘Base Case’ of key strategic 
  assumptions  
   Financial aspects of FDPs are scrutinised by the dedicated Nuclear Liabilities Funding 
  Assurance Board (NLFAB) and ONR is recognised as a statutory consultee. Therefore 
  ONR would expect to provide advice to the Government on the technical content of an 
  FDP in respect of its alignment with UK regulatory expectations. 
   The government published detailed guidance on the principles that the Secretary of 
  State will expect to see satisfied in a duty holders’ FDP prior to granting an approval: 
  https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
  nt_data/file/70214/guidance-funded-decommissioning-programme-consult.pdf 
   NS-TAST-GD-026 Revision 5  
  Ref: 2019/144943  
   Page 31 of 31 
    
    
    
    
  "
  Design Safety Assurance ns-tast-gd-057	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Design Safety Assurance ns-tast-gd-057.pdf	" Title of document 
   ONR Guide 
   Design Safety Assurance 
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   Approved by: 
   Record Reference: 
   Revision commentary: 
   NS-TAST-GD-057 Revision 5 
   November 2017 
   Review Date: 
   November 2020 
   Gavin Smith 
   Mechanical Engineering Professional 
  Lead 
  TRIM Folder 1.1.3.776. (2017/456576) 
  Minor update to reference the Ionising Radiation Regulations 
  2017. Updated November 2018. 
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
  5. 
  6. 
  7. 
  8. 
   INTRODUCTION ................................................................................................................. 2 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  RELATIONSHIP TO LICENCE CONDITIONS .................................................................... 3 
  LEGISLATION AND REGULATORY INTEREST ................................................................ 3 
  BMS GUIDANCE ................................................................................................................. 4 
  ADVICE TO ASSESSORS .................................................................................................. 4 
  SUMMARY ........................................................................................................................ 16 
  BIBLIOGRAPHY AND FURTHER READING .................................................................... 16 
   © Office for Nuclear Regulation, 2017 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 11/17 
   Template Ref: ONR-DOC-TEMP-002 Revision 2 
   Page 1 of 16 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   2. 
   2.1 
   2.2 
   2.3 
   2.4 
   2.5 
   2.6 
   2.7 
   2.8 
   2.9 
   INTRODUCTION 
   ONR has established its Safety Assessment Principles (SAPs) which apply to the 
  assessment by ONR specialist inspectors of safety cases for nuclear facilities that may 
  be operated by potential licensees, existing licensees, or other duty-holders.  The 
  principles presented in the SAPs are supported by a suite of guides to further assist 
  ONR’s inspectors in their technical assessment work in support of making regulatory 
  judgements and decisions.  This technical assessment guide is one of these guides. 
   PURPOSE AND SCOPE 
   This Technical Assessment Guide (TAG) discusses ONR’s approach to the 
  assessment of design arrangements and processes for nuclear facilities, and how 
  safety is integrated into the design production process.  In particular, the design 
  arrangements should demonstrate how integration with procurement, site 
  construction/installation and final commissioning is achieved, leading into operations 
  and associated maintenance and inspection, as well as the safety case development 
  process.  This TAG does not specifically address a single Licence Condition or group 
  of Safety Assessment Principles, but concerns an area of activity which is of regulatory 
  interest. 
   It should be noted that the Nuclear Installations Act 1965 (as amended) makes specific 
  reference to design as an activity which may be subject to licence conditions. 
   Licence Condition 14 requires that the licensee “shall make and implement adequate 
  arrangements for the production and assessment of safety cases consisting of 
  documentation to justify safety during the design, construction, manufacture, 
  commissioning, operation and decommissioning phases of the installation.” 
   Licence Condition 19 requires that “Where the licensee proposes to construct or install 
  any new plant which may affect safety the licensee shall make and implement 
  adequate arrangements to control the construction or installation.” 
   Licence Condition 20 requires that “The licensee shall ensure that no modification to 
  the design which may affect safety is made to any plant during the period of 
  construction except in accordance with adequate arrangements made and 
  implemented by the licensee for that purpose.” 
   Licence Condition 21 requires that “The licensee shall make and implement adequate 
  arrangements for the commissioning of any plant or process which may affect safety.” 
   Licence Condition 22 requires that “The licensee shall make and implement adequate 
  arrangements to control any modification or experiment carried out on any part of the 
  existing plant or processes which may affect safety.” 
   This TAG contains general guidance to advise and inform ONR Inspectors in the 
  exercise of their professional regulatory judgement.  This document is not intended to 
  provide detailed guidance on the design process for nuclear facilities, but is produced 
  to highlight certain key areas for consideration as part of an assessment process. 
   It is therefore essential that comprehensive reference is made to the ONRs Safety 
  Assessment Principles (SAPs) for Nuclear Facilities and other TAGs when assessing 
  such design arrangements and processes.  References to the ONR SAPs and the 
  WENRA Reactor Safety Reference Levels are included in the text of this document. 
   2.10 
   Comments on this guide, and suggestions for future revisions, should be recorded on 
  the appropriate registry file.  
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 2 of 16 
    
    
    
    
    
   Office for Nuclear Regulation  
   3. 
   RELATIONSHIP TO LICENCE CONDITIONS 
   3.1 
   The following licence conditions have relevance in terms of design safety assurance: 
   4. 
   4.1 
     LC6 Documents, Records, Authorities and Certificates  
    LC12 Duly Authorised and other Suitably Qualified and Experienced Persons  
    LC14 Safety Documentation  
    LC15 Periodic Review  
    LC17 Quality Assurance  
    LC19 Construction or Installation of New Plant  
    LC20 Modification to Design of Plant Under Construction  
    LC21 Commissioning  
    LC22 Modification or Experiment on Existing Plant  
    LC23 Operating Rules  
    LC24 Operating Instructions  
    LC25 Operational Records  
    LC27 Safety Mechanisms, Devices and Circuits  
    LC28 Examination, Inspection, Maintenance and Testing  
    LC29 Duty to carry out Tests, Inspections and Examinations  
    LC34 Leakage and Escape of Radioactive Material and Radioactive Waste  
    LC35 Decommissioning  
    LC36 Control of Organisational Change  
   LEGISLATION AND REGULATORY INTEREST 
   The general duties under the Health and Safety at Work etc Act 1974 (HSWA) impose 
  statutory requirements as follows: 
   2 (1)  It shall be the duty of every employer to ensure, so far as is reasonably 
  practicable, the health, safety and welfare at work of all his employees. 
   3 (1)  It shall be the duty of every employer to conduct his undertaking in such a way 
  as to ensure, so far as is reasonably practicable, that persons not in his employment 
  who may be affected thereby are not thereby exposed to risks to their health or safety. 
   6 (1)  It shall be the duty of any person who designs, manufactures, imports or supplies 
  any article for use at work or any article of fairground equipment – 
   (a)  to ensure, so far as is reasonably practicable, that the article is so designed and 
  constructed that it will be safe and without risks to health at all times when it is being 
  set, used, cleaned or maintained by a person at work; 
   In addition, the Construction (Design and Management) Regulations 2015 place duties 
  on designers to take due recognition of health and safety in the design process.  The 
  Ionising Radiations Regulations 2017 also make specific reference to engineering 
  controls and design features as the primary means of restricting exposure to ionising 
  radiation.  Other regulations under the HSWA also impose duties on designers for 
  specified engineering features. Environmental Legislation, Security Legislation and 
  International Treaties also impose legal duties on designers. 
   4.2 
   It should be recognised that design organisations may not be licensees themselves, 
  but should be under the control of the appropriate licensee; therefore acting as 
  Responsible Designers to the licensee Design Authority, who also acts as an 
  Intelligent Customer (see NS-TAST-GD-079 Licensee Design Authority Capability).  
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 3 of 16 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   4.3 
   4.4 
   5. 
   5.1 
   Nevertheless, the statutory legislation noted above, plus the licence conditions 
  themselves, provide the ONR with the necessary vires to regulate design activity, 
  through coordination with the licensee. 
   This regulatory interest equally applies to the early stages of the design process, at the 
  optioneering stages.  However, a clear balance needs to be struck between the 
  benefits of leverage which can be achieved by early guidance/intervention, and the 
  potential negative, disruptive effects which can occur due to detailed questioning of 
  early concepts.  Furthermore, caution is necessary to ensure that an impression that a 
  design has been approved is not given. 
   In particular, the ONR should focus on standards and principles, the visibility of 
  optioneering to demonstrate ALARP plus the adequacy of the design process and 
  associated arrangements.  
   BMS GUIDANCE 
   The assessor needs to be aware of ONR’s expectations more generally for Licensees’ 
  safety cases and how they are produced, which are set out elsewhere within other 
  BMS Guidance documentation. 
   A number of other Technical Assessment Guides will be relevant to the subject of 
  Design Safety Assurance and the assessor should review the latest available 
  information on the BMS. 
   5.2 
   In particular, NS-TAST-GD-079 addresses ONR’s expectations for existing and 
  prospective licensees’ Design Authority capability. It considers the licensee’s approach 
  to: 
     Identification and implementation of organisational arrangements and core 
  competencies to understand and manage the design of its plant and the safety 
  functions that need to be provided;  
     The use of contractors as ‘Responsible Designers’ to provide authoritative advice to 
  the Design Authority; 
     The retention of design knowledge in a form that is practically and easily available to 
  the licensee over the full lifetime of the plant until the plant is decommissioned. 
   5.3 
   In particular, NS-TAST-GD-077 informs regulatory assessment of supply chain 
  arrangements which are particularly important to the supply of items or services 
  significant to nuclear safety designated for use in the UK. It also provides guidance for 
  regulatory inspection during the manufacturing stages. 
   6. 
   ADVICE TO ASSESSORS 
   Introduction 
   6.1 
   6.2 
   This guide is concerned with the assessment of arrangements for the production of 
  design for structures, systems and components for nuclear facilities.  These 
  arrangements should demonstrate that safety considerations are integral to the design 
  process, and that the formal safety justification as evidenced by the relevant safety 
  case, is fully coordinated with the design activity and should evolve in parallel.  
   The purpose of ONR assessment of design safety assurance is to establish whether 
  the design arrangements, including interfaces with procurement and 
  construction/installation, leading into the operations and associated maintenance and 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 4 of 16 
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   inspection, are adequate to fulfil the required safety functions, and to establish that the 
  hazards created by such arrangements are both tolerable and ALARP, in compliance 
  with legal requirements. 
   Engineering background 
   6.3 
   6.4 
   All structures, systems and components are specified and designed to provide a 
  required engineering functionality.  This functionality will have an influence on safety 
  and so requires an appropriate safety categorisation / classification to be assigned.  
  This categorisation / classification (or grading) will affect the design methods and 
  standards, material selection, procurement process, fabrication and installation 
  inspections as well as maintenance requirements and in service inspections. 
   In any engineering process, the resource available (whether it be in time or budget) 
  relating to required activities such as design is always limited.  It is therefore 
  appropriate that such resource is targeted at areas which have the greatest potential 
  for danger.  This is the basis for all engineering safety categorisation / classification 
  systems. 
   Design requirements and regulation  
   6.5 
   Design requirements arise generally for the following reasons: 
     The licensee wishes to design, construct, install and commission a facility on a new 
  site, or within an existing site.  Licence conditions 19, 20 and 21 are specifically 
  applicable to this scenario, as well as the requirements for site licensing for new sites. 
     The licensee wishes to undertake a modification to an existing facility.  Licence 
  condition 22 is specifically applicable to this scenario.  
     The licensee is conducting an assessment of structures, systems and components 
  for a periodic safety review.  Licence condition 15 is specifically applicable to this 
  scenario. 
     The licensee wishes to decommission a facility.  Licence condition 35 is specifically 
  applicable to this scenario. 
   Early regulatory involvement in the design process can provide assurance that the 
  necessary arrangements are in place to ensure safety, as well as provide preliminary 
  indications as to whether the final design solution will be satisfactory. 
   For new build it may be a vendor who is responsible for design development and 
  control prior to the appointment of a licensee.  Under these circumstances the vendor’s 
  design management process may still be subject to regulatory review, and a regulatory 
  strategy should be developed for this which should take cognisance of the guidance 
  provided in this document. 
   Design process 
   6.6 
   The design process can be a complex undertaking, involving parties from different 
  disciplines who contribute to the overall design product.  This design process will vary 
  between disciplines, but issues of key importance are listed as follows, with discussion 
  in the subsequent paragraphs: 
    
   
   Design Phases (5.7)  
  Hazard Identification (5.8)  
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 5 of 16 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
    
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   Optioneering (5.9)  
  Safety Functional Requirements and Design Parameters (5.10)  
  Design Planning and Organisation (5.11)  
  Design Standards (5.12)  
  Design Verification and Validation (5.13)  
  The Interface with Procurement (5.14)  
  The Interfaces between Design Disciplines (5.15)  
  Information Control and Document Management (5.16)  
  Change Control (5.17)  
  Competency (5.18)  
  The Interface with Construction/Installation (5.19)  
  The Interface with Commissioning (5.20)  
  The Interface with Maintenance and Inspection (5.21)  
  Safety Case Production and Interface (5.22)  
  Design Review (5.23)  
  Design Instructions (5.24)  
  Fault Recording and Corrective Action Systems (5.25)  
  Intelligent Customer and Design Authority (5.26)  
  Human Factors (5.27)  
  Design Quality Assurance (5.28)  
  Design for Decommissioning (5.29)  
   Design phases 
   6.7 
   A well structured design process is the starting point for a successful design output.  
  The design process should clearly integrate with the safety case production process.  
  There must be a regular two way interaction with the safety case authors such that the 
  designers recognise the need for risks associated with design solutions to be ALARP, 
  with clear evidence of optioneering.  Early input from facility operators and 
  maintenance organisations is also necessary.  It is important to recognise the safety 
  significance of elements of the design to determine the rigour of the safety review.  It 
  must be recognised that the design process is generally iterative, and the key 
  requirement is that the risk associated with the overall functional solution is ALARP.  
  Attempts to justify individual ‘building blocks’ of the overall design solution to ALARP 
  criteria may not be helpful.  The safety case authors need to keep abreast of the 
  developing design solutions and associated detail to ensure that the claims made in 
  the safety case remain valid and accurate.  A typical design process and integrated 
  safety justification should proceed as follows: 
     Inception and initial brief  
    Feasibility studies and optioneering  
    Conceptual design → Preliminary Safety Report  
    Scheme design → Design freeze  
    Detailed design → Design freeze → Pre Construction Safety Report  
   It is necessary that key research and development outputs are available at an early 
  stage in the process in order to allow the design to evolve in a logical progression. 
   The concept of design freeze is an important control tool in the design process, 
  although it should be recognised that it does not, and should not impose absolute 
  constraints on changes beyond this point.  However, any such changes to frozen 
  information should be formally justified and the implications assessed, particularly from 
  a safety perspective, and thoroughly integrated into the modified design if the change 
  is adopted.  The degree of rigour required in the assessment of proposed changes and 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 6 of 16 
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   6.8 
   the associated implementation should be commensurate with their associated safety 
  significance. 
   It should be noted in the above description that when the Pre Construction Safety 
  Report is produced, the detailed design would generally be ‘frozen’, making changes 
  difficult from a time and cost perspective.  This reinforces the need for early regulatory 
  interest in the design process.  It is essential that the regulator is made aware of 
  design changes subsequent to the issue of a licence instrument, as part of the 
  regulatory process. 
   The design process will also integrate into the overall project management process 
  and project sanctioning process.  A number of project ‘gates’ may need to be 
  successfully negotiated for the project to proceed, requiring specific design and safety 
  case deliverables.  Continuity of design resource may be an issue as a result of this 
  process. 
   The design process should also incorporate features known to promote high reliability 
  within organisational due processes, such as diversity and redundancy. 
   Hazard identification 
   Early hazard identification is an important part of design safety assurance and can 
  utilise many different inductive and deductive techniques that are undertaken at 
  appropriate project design stages.  One standard format is a ‘structured brainstorm’ to 
  identify hazards, followed by a risk assessment process to quantify the worst credible 
  consequence and associated likelihood, usually expressed as a frequency for 
  cumulative risk.  Consequential risks, after the application of safeguards, are then 
  assessed and determined to be either intolerable, within the ALARP region, or in the 
  broadly acceptable region.  It is important that identified safeguards, plus other 
  measures subsequently developed following the hazard identification process are 
  recorded and tracked through to conclusion, to ensure adequate implementation.  A 
  hazard schedule, which should be treated as a live document, is generally a good way 
  to achieve this. 
   Fundamentally hazards should be eliminated and reduced by design where 
  practicable, and most benefit in this respect is usually achieved at the early conceptual 
  design stage. 
   It should be recognised however that although beneficial, document based hazard 
  identification studies are limited in that they sometimes fail to recognise complex 
  interactions between structures, systems and components.  They should therefore be 
  complemented by other methods of hazard identification such as virtual plant 
  walkdowns, plus actual walkdowns during construction/installation and commissioning. 
   It is important that the hazard identification process provides a high degree of 
  confidence that it can identify all credible postulated initiating events. 
   As the process develops, further risk assessments should be undertaken in an 
  appropriate format to maintain the safety integrity of the design solutions. 
   The SAPs FA series (Fault analysis) and WENRA reference level E (Design Basis 
  Envelope for Existing Reactors) are applicable to Hazard Identification. 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 7 of 16 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Optioneering 
   6.9 
   Optioneering is an essential early part of any design process, in order to ensure and 
  demonstrate that solutions are ALARP.  Optioneering is a very common project 
  management technique, but can often focus on issues of cost, functionality and 
  programme without specifically addressing safety.  The legal requirement to satisfy the 
  ALARP principle means that options related to safety should be addressed as part of 
  the overall design solution.  However, optioneering needs to be controlled from a 
  design management perspective during the later detailed design phases in order that 
  the activity can be focused and moved forward, without each step being excessively 
  challenged in detail.  Furthermore, it should be recognised that optioneering at a 
  microscopic level can be counterproductive and may not generally yield the best 
  macroscopic solution, with a practical economy of effort. 
   The SAPs NT series (Numerical targets and legal limits) is applicable to Optioneering. 
   Safety functional requirements and design parameters 
   6.10 
   Safety functional requirements are deterministic rules which are generated during the 
  start of the design activity, which are considered necessary to ensure safety by 
  identifying the specific safety requirements associated with structures, systems and 
  components important to safety.  These can cascade from high level safety 
  requirements, to a larger number of lower level functional demands on individual 
  structures, systems and components.  The design should follow these requirements 
  and update them as necessary as part of the process.  These requirements should be 
  confirmed during commissioning and then feed in to the operating rules and 
  instructions as described by licence conditions 23 and 24. 
   Associated with safety functional requirements is the process whereby design 
  parameters are established, to define the design duty of the structures, systems and 
  components under consideration.  In addition to categorising / classifying designs in 
  accordance with SAPs, physical parameters should be established to define design 
  duties, such as temperature, load combinations, damage and aging mechanisms, 
  environmental considerations, design life considerations etc.  This links to the overall 
  consideration of equipment qualification. 
   The SAPs ECS series (Safety classification and standards) and WENRA reference 
  level G (Safety Classification of Structures, Systems and Components) are applicable 
  to Safety Functional Requirements and Design Parameters. 
   Design Planning and Organisation 
   6.11 
   A well structured and resourced delivery plan/programme is a key part of a well 
  executed design process.  As such it leads directly to ensuring that safety is 
  incorporated into the design output, by identifying safety process requirements, such 
  as Hazops and safety case integration for example, as well as by facilitating a well 
  organised, coordinated process, without which safety cannot be demonstrated and 
  indeed may not be achieved.  This plan should identify key inputs, formal design 
  outputs, interdependencies, timescales plus resource requirements, generally in terms 
  of design effort.  The resource considerations should also address internal design 
  skills, internal facilities, external skills and facilities (if consultants are used) plus the 
  overall design organisation.  A well structured, up to date and well communicated 
  design organisation, evidenced through an organisation chart is a prerequisite for an 
  effective process. 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 8 of 16 
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Design activities tend to be organised as either dedicated project teams, with 
  personnel mixed from different technical disciplines, or as small project 
  management/engineering groupings drawing on effort from functional teams, 
  organised on a discipline basis.  Often organisations operate with a mixture of both 
  characteristics.  Functional characteristics can bring significant safety assurance 
  benefits in terms of providing collective functional knowledge, robust verification 
  processes, collective competency and standardisation, but can have the disadvantage 
  of discouraging good communication within the project leading to a ‘silo’ mentality.  
   The design programme should be integrated into the overall project and safety case 
  programmes, with specific links to procurement and construction/installation to ensure 
  an effective overall project is achieved.  It is also important that suitable checks are in 
  place for the review and questioning of input information, such that it is not blindly 
  incorporated into the design when it might be erroneous.  This contributes to the 
  defence in depth, which is an inherent feature of a highly reliable process. 
   Where design is undertaken at various levels of detail by different organisations, it is 
  important to recognise that the Design Authority resides at the highest level, with 
  overall responsibility for the functionality of the completed design product.   
   It is important that the licensee Design Authority should participate in all interactions 
  between Responsible Designers and the ONR, in order to ensure that the licensee 
  develops and maintains this Design Authority capability. 
   The design facility makes a significant contribution to an effective design process, and 
  support resource in terms of personnel and equipment are important factors.  Access 
  to technical information is also very important, including availability of historical 
  information. 
   Overall design resource numbers, as well as continuity, turnover, training and morale 
  are significant issues in terms of design safety assurance.  Training is a particularly 
  important issue, and should cover not only introduction to new issues, but refresher 
  training to maintain the ‘conscious competence’ mode of operation.  Training should 
  also cover physical appreciation of the designed structures, systems and components, 
  and application within the intended facility. 
   The SAPs MS series (Leadership and management for safety) and WENRA reference 
  level B (Operating Organisation) are applicable to Design Planning and Organisation. 
   Design Standards 
   6.12 
   Establishing appropriate technical standards to underpin the design process is an 
  essential early activity, which clearly has significant safety implications.  A range of 
  standards exists for nuclear design application, including IAEA standards, 
  International, European and British standards as well as in house developed 
  standards, (some with accepted general application with the UK nuclear industry).  It is 
  important that the design organisations have an up to date knowledge of the range of 
  available standards, and are able to demonstrate a mature selection process for the 
  specific design application.  Selected standards must be effectively communicated 
  within the design organisation, with training requirements identified and implemented 
  as necessary.  Changes to standards must also be effectively assessed, 
  communicated and implemented, (although a design standards freeze may also be put 
  in place). 
   The SAPs ECS series (Safety classification and standards) and WENRA reference 
  level C (Quality Management) are applicable to Design Standards. 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 9 of 16 
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   6.13 
   Design verification and validation 
   Design verification is the process whereby each stage of the design is confirmed as 
  correct against the requirements from the previous stage.  This generally entails a 
  process of checking and approval.  Two standard checking methods are usually 
  applied, either a direct check of the calculation or design method, following the original 
  philosophy, or alternatively a check by a parallel method or calculation.  Generally the 
  parallel method provides for a higher level of assurance, preventing a purely 
  arithmetical check being undertaken for example, on what may be an erroneous 
  philosophy.  However, a parallel check does not check intermediate results in detail 
  and so caution must be applied if these values are subsequently used.  A 
  complementary method of verification is by comparison with existing, proven design, 
  although if this is used as the sole method of verification then the process must be 
  extremely rigorous.  The assurance of design verification can be categorised by 
  assigning a checking category level, ranging from checks within the originating design 
  teams, to independent checks undertaken by external organisations. 
   The hierarchy of verification is generally undertaken in a three tier structure, with an 
  originator, checker and approver.  The function of the approver from a verification 
  perspective is to confirm there are no obvious errors, to ensure that the design output 
  is consistent with other design elements, and to confirm the competency of the 
  originator and checker and that the correct level of checking has been applied.  Further 
  tiers in the verification process can be counterproductive in diluting the level of 
  individual responsibility and ownership.  Notwithstanding the above, a culture of self 
  verification, i.e. ‘checking your own work’, is evident in the most effective design 
  organisations. 
   Design validation ensures that the overall intent of the design is achieved, and 
  prevents failure of this objective by incremental deviation or dilution.  This is achieved 
  by a combination of independent technical assessment, peer review, design review, 
  staged testing and commissioning plus operating trials. 
   Where software applications are used in the design process, rigorous software 
  validation requirements must be in force, including for well structured version control.  
  Design packages can be bought in externally or developed internally, using a range of 
  software platforms, but the fundamental validation requirements are unchanged.  
  Where commercial design software is used, it may be appropriate to run separate 
  design codes as a form of validation.  Challenges to the safety assurance of the design 
  process can readily evolve from the uncontrolled growth and use of small, bespoke 
  software routines, which have not been formally validated or controlled.  Software 
  should only be used for analyses within the bounds of its specified application and 
  associated validation, and the results subjected to sanity checks by simplified 
  calculations as necessary.  
   The interface with procurement 
   6.14 
   The interface with procurement is key to ensuring that the delivered structures, 
  systems and components match the design intent.  This requires robust systems for 
  identifying products and materials in the first instance, and inspection systems to 
  ensure that the material specified is correctly delivered by the supplier (see NS-TAST-
  GD-077 Procurement of Nuclear Safety Related Items or Services).  Inspection 
  systems are also required to verify the engineering functionality and can include type 
  tests, batch sample tests plus routine tests (including proof tests).  Tests can be 
  undertaken at the factory (Factory Acceptance Tests, FATs) and on site (Site 
  Acceptance Tests, SATs), as well as suitable tests on civil structures during the 
  construction phases (e.g. concrete cube tests). Tests may be destructive or non 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 10 of 16 
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   destructive, and samples from the destructive process should be fully destroyed to 
  prevent inadvertent re-use.  It is very important that such tests are well designed such 
  that they mimic as closely as practicable the duties imposed on the structures, systems 
  and components on which the design has been based, and meet specified standards 
  as necessary.  It should also be noted that there is considerable scope for 
  misunderstanding regarding terminology associated with testing, and the specifications 
  and arrangements for testing should be given a commensurate degree of technical 
  effort to prevent this, in addition to quality assurance requirements. 
   Arrangements are also required to ensure that non conformances in respect of 
  equipment and materials are adequately assessed and sentenced as appropriate.  
  These arrangements should ensure that the potential non conformance is adequately 
  recognised, categorised in terms of its safety significance, assessed at the correct 
  level of technical competence and the resulting sentencing adequately implemented.  
  The aggregate of a series of non conformances should also be captured within the 
  process, both as evidence of potential systemic process problems, as well as 
  identifying the cumulative effect on safety. 
   The SAPs EQU series (Equipment qualification) and WENRA reference level C 
  (Quality Management) are applicable to the Interface with Procurement. 
   The interfaces between design disciplines 
   6.15 
   6.16 
   The interfaces between design disciplines are important from a safety perspective, 
  specifically where design covers multidisciplinary areas.  Some form of interdisciplinary 
  check would be a firm expectation as part of any design process.  Furthermore, in 
  addition to processes to control detailed interfaces, it is important that suitably 
  competent engineers have an overview of the whole designed system to ensure key 
  issues are not missed. 
   Information control and document management 
   Information control, configuration control and document management are critical 
  requirements where large numbers of design documents are produced as part of the 
  process. Licence condition 17 requires adequate arrangements to be made in respect 
  of Quality Assurance, QA. Licence condition 6 also requires adequate records to be 
  made in respect of compliance to any licence condition.  Documentation, whether in 
  hard copy or electronic format is the fundamental output of any design process and a 
  significant effort is required to ensure that such information is clear, comprehensive 
  and unambiguous.  The following issues are relevant to this subject from a safety 
  perspective: 
     Document identification  
    Version control  
    Presentation format including use of colours  
    Projection methods and orientation  
    Terminology  
    Symbols  
    Distribution  
    Retention and availability of access to lifetime records  
    Production of ‘as fitted/as built’ records  
   WENRA reference level C (Quality Management) is applicable to the issue of 
  Information Control and Document Management. 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 11 of 16 
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Change control 
   6.17 
   The management of change is a key part of the design process, from the early stages 
  when the process may still be highly iterative, to the later stages where the volume of 
  design information may be substantial.  An understanding of the way in which the 
  design information is structured or configured is also important in recognising the 
  practical way that agreed changes should be implemented through the design system.  
  The general principles of design change control and associated configuration 
  management are as follows: 
     Recognition of change  
    Understanding the safety impact of change  
    Agreement of change at the correct authority level  
    Controlled implementation and communication of change  
    Update of necessary documentation  
   As the design matures, agreement and authorisation of change is generally 
  undertaken at more senior levels within the organisation.  Once the procurement and 
  construction cycles have commenced, the impact of potential changes from the design 
  process are greatly magnified, as are the difficulties in correctly implementing such 
  changes that are agreed.  However, a mindset which automatically resists change due 
  to its inherent difficulty will have a negative effect on safety assurance by the possibility 
  of failing to recognise and sentence changes which are required. 
   The potential impact on safety can be substantial due to incorrect management of 
  changes, which are consequently inadequately conceived and/or executed. 
   Competency 
   6.18 
   Licence condition 12 requires that only Suitably Qualified and Experienced Persons, 
  (SQEPs), should perform any duties that may affect safety.  This requirement also 
  affects designers and so the design resource should be subject to a competency 
  management system.  This system should recognise the skills, technical discipline and 
  experience of the designers and design management should ensure that activities are 
  only undertaken by suitably qualified and experienced personnel. 
   WENRA reference level B (Operating Organisation) is applicable to the issue of 
  Competency. 
   The interface with construction/installation 
   6.19 
   The design process should clearly link to the construction/installation process, such 
  that adequate information is provided to the construction teams, and a process should 
  be established whereby queries raised by these teams can be fed back and assessed 
  by the designers.  The use of field engineers with design office experience is 
  recommended to fulfil this interface function.  Recognition of changes requiring design 
  review is fundamental.  Licence conditions 19 and 20 have particular relevance to this 
  issue. Arrangements are necessary in this area to ensure that non conformances are 
  recognised, assessed at the correct level and duly sentenced by a controlled process. 
   The interface with commissioning 
   6.20 
   The design process should also link to the commissioning process, such that adequate 
  information is provided to the commissioning teams, and a process should be 
  established whereby queries raised by these teams can be fed back and assessed by 
  the designers. The use of commissioning engineers with design office experience is 
  recommended to fulfil this interface function, with suitable input from future operators 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 12 of 16 
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   as part of the process. Recognition of changes requiring design review is fundamental.  
  Licence condition 21 has particular relevance to this issue. Arrangements are 
  necessary in this area to ensure that non conformances are recognised, assessed at 
  the correct level and duly sentenced by a controlled process.  
   The commissioning process should confirm the assumptions made and requirements 
  identified through the design process. 
   The SAPs ECM series (Commissioning) is applicable to the Interface with 
  Commissioning. 
   The Interface with Maintenance and Inspection 
   6.21 
   The design process should identify the requirements for examination, inspection, 
  maintenance and testing of structures, systems and components as necessary to 
  assure their continued safe operation.  Due regard should be made during the design 
  process to visibility and accessibility of structures, systems and components to meet 
  this requirement. Specific attention should also be paid to facilitate the replacement of 
  items which are intended to be renewed within the design life of the overall facility.  
  Licence condition 28 has particular relevance to this issue. 
   The SAPs EMT series (Maintenance, inspection and testing) and WENRA reference 
  level K (Maintenance, In-service inspection and Functional Testing) are applicable to 
  the Interface with Maintenance and Inspection. 
   Safety case production and interface 
   6.22 
   The design process must lead to production of safety documentation that achieves the 
  necessary level of assurance and reference should be made to the relevant BMS 
  guidance. 
   Generally the safety case format should follow the claim, evidence, argument logical 
  justification chain, whereby the design process should seek to primarily provide 
  evidence in terms of design information and parameters. 
   Where existing facilities are subject to upgrade programmes, then establishing a firm 
  understanding of the present state of the facility and original design intent is an 
  important input into the design and safety case production activities.  Where this 
  information is not readily available, this can be achieved as part of formalised 
  engineering substantiation processes. 
   The SAPs SC series (Safety cases) and WENRA reference level N (Contents and 
  updating of Safety Analysis Report) are applicable to Safety Case Production and 
  Interface. 
   Design review 
   6.23 
   Design review is a core requirement of any quality management system.  At suitable 
  planned stages, formal reviews should be undertaken to confirm the validity of the 
  design, to act as a forum for information transfer and to identify problem areas and to 
  give direction to solutions.  It is important that such reviews are given a high level of 
  support and importance, with participation from procurement and 
  construction/installation disciplines where practicable.  Typically a design review 
  should ensure the following: 
     The requirements of the brief have been identified and are being met  
    Appropriate design acceptance criteria have been established and are being met  
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 13 of 16 
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
     The safety justification process is integrated into the design process  
    Correct design parameters have been established  
    The design identifies appropriate materials and products  
    Appropriate and referenced design documentation is being produced  
    The design identifies suitable limits and conditions of operation and safety  
   Design instructions 
   6.24 
   Formal procedures should be in place to ensure that design instructions, including 
  those issued to installation teams which are not captured by other suitable documents, 
  are put in place.  Such instructions are often generated from the need for direction in 
  advance of formal incorporation into other design generated documentation.  
  Nevertheless, these instructions should be formally generated, verified as appropriate 
  and adequately controlled and distributed.  It would be expected that they be 
  incorporated into other formal documentation at an appropriate stage. 
   Fault Recording and Corrective Action Systems 
   6.25 
   Formal processes should be in place to ensure that design associated faults and 
  potential improvements identified from procurement, construction, installation, 
  commissioning plus final operation and maintenance are fed back to the designers for 
  consideration.  This process is sometimes termed a Fault Recording and Corrective 
  Action System.  This consideration should generally follow the following model: 
     Record and understand the fault  
    Identify what action is required for existing designs/materials/installations on the 
  project  
    Identify what action is required for future designs/materials/installations on the 
  project  
    Identify what changes to design processes may be necessary for the future in 
  general  
   From an overall perspective, ‘lessons learned’ workshops can provide a valuable 
  learning format to ensure that difficulties are minimised for the future.  These 
  workshops should also identify positive features, as well as areas for improvement, to 
  ensure that good practice is repeated in the future. 
   WENRA reference level J (System for Investigation of Events and Operational 
  Experience Feedback) is applicable to the issue of Fault Recording and Corrective 
  Action Systems. 
   Intelligent Customer and Design Authority 
   6.26 
   The design knowledge should be retained in a form that is practically retrievable and 
  understandable for the lifetime of the facility’s operational and decommissioning 
  periods.  The licensee Design Authority responsibility includes maintaining the 
  necessary engineering skills and knowledge, implementation of appropriate research, 
  and dealing with intellectual property issues as necessary.  
   Where design is contracted out, it is important that the licensee retains the role of 
  Design Authority, including Intelligent Customer capability, so as to correctly specify 
  the design requirements, monitor the design delivery process and validate the output.  
  Retention of corporate knowledge is closely associated with this issue.  This role of 
  Design Authority and Intelligent Customer capability extends to the review of third party 
  design consultants where they are used by the non licensee design house 
  (Responsible Designer), as well as the interfaces with procurement and 
  construction/installation. 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 14 of 16 
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Reference should be made to NS-TAST-GD-079, which addresses ONR’s 
  expectations for existing and prospective licensees’ Design Authority capability. 
   WENRA reference level C (Quality Management) is applicable to the issue of 
  Intelligent Customer and Design Authority. 
   Human factors 
   6.27 
   Human factors are an important consideration for the design process.  The designed 
  structures, systems and components should pay due recognition to human factors in 
  terms of installation, subsequent operation and maintenance.  Designers can 
  sometimes create assemblies which only ‘work’ in their final configuration, without due 
  recognition of how they can be safely assembled or maintained.  Furthermore, since 
  the mindset is generally one of ensuring that configurations do successfully work, 
  designers sometimes fail to question how they could be misused or fail, in terms of 
  systematically assessing what could go wrong at a detailed level. 
   Human factors input should be made to the design process to ensure that demands on 
  operators to operate the equipment, maintain it and respond to failures are adequately 
  assessed.  Physical as well as theoretical models can play an important part in linking 
  the design concepts to human factors issues, in terms of the final configuration. 
   Where necessary, guidance should be sought from specialist human factors 
  practitioners. 
   The SAPs EHF series (Human factors) is applicable to the issue of Human Factors. 
   Design quality assurance 
   6.28 
   Design activities must be internally regulated by current and controlled quality 
  assurance procedures which are accessible to all users.  These procedures should be 
  enforced by a visible internal auditing regime, with evidence of observations and 
  corrective action requirements as appropriate.  As with all quality assurance auditing 
  processes, there should be evidence of effective action and close out of issues to 
  demonstrate a robust process. 
   WENRA reference level C (Quality Management) is applicable to Design Quality 
  Assurance. 
   Design for decommissioning 
   6.29 
   Design solutions should take due recognition of the need for future decommissioning 
  of facilities and equipment.  This may include the need to replace equipment which 
  becomes life expired, within the overall facility design life, in addition to 
  decommissioning the facility as a whole.  It should be recognised that the attributes 
  which may provide straightforward decommissioning may run counter to those which 
  are necessary to ensure safety during the operational lifetime of the facility, e.g. 
  seismic capability may require substantial structural engineering solutions, which are 
  challenging to decommission.  Recognition of the future requirement however at the 
  design stage will allow the optimum solution to be achieved, whilst ensuring safety at 
  all stages.  Licence condition 35 has specific relevance to this issue. 
   The SAPs DC series (Decommissioning) is applicable to the issue of Design for 
  Decommissioning. 
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 15 of 16 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   7. 
   7.1 
   SUMMARY 
   This guidance has been produced to advise the reader of key elements within a design 
  process for items important to safety, primarily for application within the nuclear 
  environment. 
   The detailed features of the design process itself will vary between disciplines and 
  projects, but this document addresses the key elements which should be present in an 
  effective design organisation that produces design solutions that will be demonstrably 
  safe.  The elements can be sampled, assessed and inspected to the necessary degree 
  of rigour, as part of the regulatory process, to provide assurance of nuclear safety. 
   8. 
   BIBLIOGRAPHY AND FURTHER READING 
   1  Nuclear Installations Act 1965 (as amended).  
  2  Health and Safety at Work etc. Act 1974.  
  3  Construction (Design and Management) Regulations 2007.  
  4  Ionising Radiations Regulations 2017.  
  5  Office for Nuclear Regulation – Licence Condition handbook, ONR website.  
  6  The Tolerability of Risk from Nuclear Power Stations, Revised 1992.  
  7  Reducing risk, protecting people, HSE’s decision-making process, 2001.  
  8  Quality management systems – Requirements, BS EN ISO 9001:2008.  
  9  Quality Assurance for Safety in Nuclear Power Plants and other Nuclear. 
  Installations, Codes and Safety Guides Q1-Q14, Safety Series No 50-C/SG-Q, IAEA, 
  Vienna 2001.  
  10  Safety of Nuclear Power Plants: Design Specific Safety Requirements, SSR-2/1,  
  2012: IAEA Safety Standards Series. 
  11  Design management systems, BS 7000. 
  BS 7000-1:2008 Guide to managing innovation 
  BS 7000-2: 2015 Guide to managing the design of manufactured products  
  BS 7000-4: 2013 Guide to managing design in construction  
  BS 7000-10: 2008 Vocabulary of terms used in design management 
    
   
   
   
   12  DOE Standard Configuration Management, US Department of Energy website, ref 
  DOE-STD-1073-2003.  
  13  Maintaining the Design Integrity of Nuclear Installations throughout their Operating 
  Life, INSAG-19, IAEA, 2003.  
  14  Licensing Nuclear Installations, 4th Edition: January 2015.The Office for Nuclear 
  Regulation.  
  15 Safety Assessment Principles for Nuclear Facilities, 2014 Edition, Office for Nuclear 
  Regulation.  
  16  WENRA Reactor Safety Reference Levels for Existing Reactors, Western 
  European Nuclear Regulators’ Association, September 2014.  
   Report  NS-TAST-GD-057 
  TRIM Ref: 2017/456576 
   Page 16 of 16 
    
    
    
    
    
    
    
    
  "
  Fundamental Principles ns-tast-gd-004	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Fundamental Principles ns-tast-gd-004.pdf	" Title of document 
   ONR GUIDE 
   Fundamental Principles  
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   Approved by: 
   Record Reference: 
   Revision commentary: 
   NS-TAST-GD-004 Revision 7 
   April 2019 
   Review Date: 
   April 2022 
   Professional Lead 
   Susan McCready-
  Shea 
  TRIM Folder 1.1.3.978. (2019/0101578) 
  Minor editorial changes made and additional advice to 
  assessors relating to ‘reasonably practicable’ added as part of 
  planned review. Updated April 2019. 
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
   5. 
  6. 
   INTRODUCTION ........................................................................................................... 2 
  PURPOSE AND SCOPE ............................................................................................... 2 
  RELATION TO LICENCE AND OTHER RELEVANT LEGISLATION ........................... 2 
  RELATION TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ................................................................................................................. 4 
  ADVICE TO ASSESSORS ............................................................................................ 6 
  REFERENCES .............................................................................................................. 8 
   © Office for Nuclear Regulation, 2019 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 04/19 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 8 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   2. 
   2.1 
   2.2 
   3. 
   3.1 
   INTRODUCTION 
   ONR has established its Safety Assessment Principles (SAPs) which apply to the 
  assessment by ONR specialist inspectors of safety cases for nuclear facilities that may 
  be operated by potential licensees, existing licensees, or other duty-holders. The 
  principles presented in the SAPs are supported by a suite of guides to further assist 
  ONR’s inspectors in their technical assessment work in support of making regulatory 
  judgements and decisions. This technical assessment guide is one of these guides. 
   PURPOSE AND SCOPE 
   This Guide gives guidance to ONR inspectors on ONR’s use of its eight fundamental 
  safety assessment principles, in the assessment of licensees’ safety cases, as set out 
  in ONR Safety Assessment Principles for Nuclear facilities (SAPs) FP.1-FP.8 [1]. These 
  are high-level principles, and the demonstration that they have been met can be shown 
  by meeting the more detailed SAPs. This Guide does not itself aim to summarise or 
  reproduce material in the Guides relating to the more detailed SAPs, but it indicates 
  the broad intentions of the fundamental principles and some background 
  considerations. Assessors should also take account of the general guidance in the 
  Introduction to SAPs.  
   As with all guidance, inspectors should use their discretion in the depth and scope to 
  which they apply this guidance in the exercise of their professional judgement in 
  reaching regulatory decisions. 
   RELATION TO LICENCE AND OTHER RELEVANT LEGISLATION 
   Site licence conditions 
   As the Fundamental Principles are overarching principles to be applied throughout the 
  SAPs then the 36 conditions attached to the standard site licence will be relevant. 
  However, seven are of particular relevance to the SAPs covered in this guide. 
  These are: 
   1. 
  2. 
  3. 
   4. 
  5. 
  6. 
  7. 
   LC 10 (Training),  
  LC 11 (Emergency Arrangements),  
  LC 12 (Duly Authorised and other Suitably Qualified and Experienced 
  Persons), 
  LC 14 (Safety Documentation),  
  LC 23 (Operating rules), 
  LC 26 (Control and supervision of Operations),  
  LC 36 (Control and Organizational Change).  
   3.2 
   The Health and Safety at Work etc. Act 1974 (HSWA) 
   The Health and Safety at Work etc. Act 1974 (HSWA) [2] sets out fundamental legal 
  requirements concerning health and safety related to work activities in the UK. HSWA 
  places duties on employers to ensure the health, safety and welfare of their employees 
  (Section 2) and to conduct their operations so that persons not in their employment are 
  not exposed to risks to their health and safety (Section 3). The employer is required to 
  ensure that these duties are met ""so far as is reasonably practicable"". This principle, 
  abbreviated to SFAIRP, is therefore the basic legal requirement with which employers 
  must comply. ALARP (As Low As Reasonably Practicable) and SFAIRP require the 
  same tests to be applied and are effectively the same thing, though the terms are not 
  interchangeable in legal proceedings which must employ the wording in the legislation.  
   Report : NS-TAST-GD-004 Revision 7 
  CM9 Ref: 2019/0101578 
   Page 2 of 8 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   3.3 
   Ionising Radiations Regulations 2017 and Approved Code of Practice (ACoP) 
   The Ionising Radiations Regulations 2017 [3] (IRR17) specify the statutory 
  requirements for the protection of persons against ionising radiation and are supported 
  by an ACoP and guidance [4]. A facility must be designed, operated and 
  decommissioned in compliance with these legal provisions. Aspects of particular 
  relevance to the Fundamental Principles are highlighted in the following regulations 
  and associated ACoP & Guidance in L121.  
   Reg 8 – Radiation risk assessments – before work is undertaken every employer 
  must carry out a risk assessment to identify the hazards and evaluate the risks to the 
  workforce and to others. It should be noted that regulation 3 of the Management of 
  Health and Safety at Work Regulations 1999 
  (MHSWR) [5] requires the risk 
  assessment to be reviewed and kept up-to-date. 
   Reg. 9 - Restriction of exposure – this requires every employer, in relation to any 
  work with ionising radiation that he undertakes, to take all necessary steps to restrict 
  so far as is reasonably practicable the extent to which his employees and other 
  persons are exposed to ionising radiation. The means of achieving this is the primary 
  objective of the safety submission on radiological protection and all SAPs are relevant 
  to judging the extent to which exposures are restricted by the licensee. 
    Reg. 13 – Contingency Plans – this requires the employer, where an assessment 
  made in accordance with regulation 8 shows that a radiation accident is reasonably 
  foreseeable, to prepare a contingency plan designed to secure, so far as is reasonably 
  practicable, the restriction of exposure to ionising radiation and the health and safety of 
  persons who may be affected by such accident. 
    
    
    
   3.4 
   Radiation (Emergency Preparedness and Public Information) Regulations 2001 
  (REPPIR) and its Guide [6]. 
   REPPIR 2001establishes a framework for the protection of the public by means of 
  emergency preparedness for radiation accidents with the potential to affect members 
  of the public at premises and during specified transport operations. It also specifies 
  requirements for the provision of information to the public: in advance in situations 
  where a (REPPIR 2001) radiation emergency might arise; and in the event of any kind 
  of radiation emergency (however it may arise). 
   Note that REPPIR 2019 is expected to come into force during 2019. 
   3.5 
   The Energy Act 2013 (TEA13). [7]. 
   The Energy Act 2013 (TEA13), http://services.parliament.uk/bills/2012-13/energy.html, 
  which established the Office for Nuclear Regulation and specified its functions, came 
  into force on 1st April 2014. The Nuclear Installations Act 1965 (as amended) (NIA) [8] is 
  a Relevant Statutory Provision (RSP) under TEA13.  
   3.6 
   The Nuclear Installations Act 1965 (as amended) (NIA) [8]. 
   The NIA prohibits the operation of certain facilities unless such facilities are licensed 
  under the terms of the Act. It allows for the attachment of Licence Conditions that may 
  be necessary or desirable in the interests of safety. The standard Nuclear Site Licence 
  has 36 conditions; under TEA13 these are now applicable provisions. The duties in 
  various Licence Conditions to make and implement adequate arrangements are 
  absolute and not qualified by SFAIRP. 
   Report : NS-TAST-GD-004 Revision 7 
  CM9 Ref: 2019/0101578 
   Page 3 of 8 
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   4. 
   RELATION TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS  
   Relevant SAPs 
   4.1 
   4.2 
   4.3 
   4.4 
   4.5 
   4.6 
   4.7 
   The SAPs covered by this TAG are FP.1 to FP.8 and the supporting paragraphs 47-52. 
   FP.1, ‘Responsibility for safety’ - The prime responsibility for safety must rest with the 
  person or organisation responsible for the facilities and activities that give rise to 
  radiation risks. This principle reflects the need for there to be a clear responsibility for 
  safety in any workplace. For nuclear installations the main responsibility rests with the 
  licensee, as defined in the Nuclear Installations Act 1965 (as amended) (NIA65). It 
  should however be borne in mind that other persons in relation to nuclear licensed 
  sites, tenants or the owners of sites, may have responsibilities for safety under the 
  provisions of HSWA. For facilities not on nuclear licensed sites, it rests with the 
  employer/dutyholder. 
   FP.2, ‘Leadership and management for safety’ - Effective leadership and management 
  for safety must be established and sustained in organisations concerned with, and 
  facilities and activities that give rise to, radiation risks. This principle is further 
  developed in the SAPs section with that title and in corresponding ONR guidance. It 
  follows from FP.1 and recognises the crucial importance of leadership and 
  management, including safety management systems, in achieving and maintaining a 
  safety culture for positive safety outcomes. 
   FP.3, ‘Optimisation of protection’ - Protection must be optimised to provide the highest 
  level of safety that is reasonably practicable. This principle is directly related to the 
  fundamental requirement of HSWA that risks must be controlled and reduced SFAIRP. 
  ‘Protection’ in the present context means measures to reduce the exposure of persons 
  (workers and public) to ionising radiation, from both normal operation of facilities and 
  accidents, including consideration of future generations. The principles in the SAPs are 
  always subject to ALARP considerations. 
   FP.4, ‘Safety assessment’ - Dutyholders must demonstrate effective understanding 
  and control of the hazards posed by a site or facility by means of a comprehensive and 
  systematic approach to safety assessment. This relates to the dutyholder’s processes 
  for the generation of safety cases. These are the means by which dutyholders 
  demonstrate an understanding of the hazards associated with their facilities and the 
  means by which they are to be controlled. The principles for safety cases are 
  developed in the SAPs section on ‘the regulatory assessment of safety cases’. 
   FP.5, ‘Limitation of risk to individuals’ - Measures for controlling radiation risks must 
  ensure that no individual bears an unacceptable risk of harm. This reflects the basic 
  aim of those parts of IRR17 which set statutory limits on the exposure of individuals to 
  ionising radiation. In addition, there are non-statutory limits targeted at limiting the risk 
  to people. See for example SAPs paragraphs 698-700 and 706-709. 
   FP.6, ‘Prevention of accidents’ - All reasonably practicable steps must be taken to 
  prevent and mitigate nuclear or radiation accidents. This is assessed against the SAPs 
  relating to design and operation, and demonstrated in safety cases on system 
  robustness and accident analysis. Many of the SAPs, for example EKP.3 ‘Defence in 
  depth’, are aimed at this objective. Mitigation covers both the on-site response to make 
  safe any plant involved in an accident, and measures taken to protect individuals on 
  and off-site. 
   4.8 
   FP.7, ‘Emergency preparedness and response’ - Arrangements must be made for 
  emergency preparedness and response in case of nuclear or radiation incidents. This 
   Report : NS-TAST-GD-004 Revision 7 
  CM9 Ref: 2019/0101578 
   Page 4 of 8 
    
    
    
    
    
   Office for Nuclear Regulation  
   relates to the requirements of the Radiation (Emergency Preparedness and Public 
  Information) Regulations 2001 (REPPIR01) for the protection of people on and off-site 
  in the event of an emergency with the potential to give rise to radiation doses above a 
  certain threshold. It also considers responses made under IRR17 regulation 13. 
   4.9 
   FP.8, ‘Protection of present and future generations’ - People, present and future, must 
  be adequately protected against radiation risks. This principle recognises that the 
  hazard from radioactivity may be long-lived and widespread. This means that the 
  possible consequences, now and in the future, of current actions have to be taken into 
  account in judging the adequacy of measures taken to control radiation risks. In 
  addition it recognises that there may be risks of genetic detriment to future 
  generations, as well as somatic detriment to exposed individuals. 
   4.10 
   Satisfying the fundamental principles is the main aim of all other principles in the SAP. 
  These fundamental principles should therefore be kept in mind when assessing all 
  safety submissions because they establish the overall framework and underlying 
  philosophy for safety that should be used in ONR safety assessment. 
   WENRA safety reference levels 
   4.11 
   The objective of the Western European Nuclear Regulators Association (WENRA) is to 
  develop a common approach to nuclear safety in Europe by comparing national 
  approaches to the application of IAEA safety standards. Their Safety Reference Levels 
  (SRL) [9], which are primarily based on the IAEA safety standards, represent good 
  practices in the WENRA member states and also represent a consensus view of the 
  main requirements to be applied to ensure nuclear safety in operating facilities. The 
  SRL are not set at the fundamental principle level, so there is no one-to-one 
  correspondence with them and this guide, however, this guidance is generally 
  consistent with them. 
   IAEA safety standards 
   4.12 
   The IAEA Safety Standards, Fundamental Safety Principles, Safety Fundamentals No. 
  SF-1 [10] and supporting documents are relevant to the Fundamental Principles in the 
  SAPs. The objective of SF-1 is to establish the fundamental safety objective, safety 
  principles and concepts that provide the bases for the IAEA’s safety standards and its 
  safety-related programme. Related requirements are established in the General Safety 
  Requirements publications. Guidance on meeting these requirements is provided in 
  the related Safety Guides. 
   4.13 
   The IAEA have established 10 safety principles. Of these 7 are relevant to the SAPs 
  Fundamental Principles. The relation between the Fundamental Principles in the SAPs 
  and those in SF-1 are as follows: 
   FP.1 relates to IAEA Principle 1, 
  FP.2 relates to IAEA Principle 3, 
  FP.3 relates to IAEA Principle 5, 
  FP.4 relates to IAEA Principle 5, 
  FP.5 relates to IAEA Principle 6, 
  FP.6 relates to IAEA Principle 8, 
  FP.7 relates to IAEA Principle 9, and 
  FP.8 relates to IAEA Principle 7. 
   4.14 
   It should be noted that IAEA Fundamental Safety Principles 2 (legal framework), 4 
  (justification) and 10 (unregulated radiation risks) are outside the scope of the SAPs. 
   Report : NS-TAST-GD-004 Revision 7 
  CM9 Ref: 2019/0101578 
   Page 5 of 8 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   5. 
   5.1 
   5.2 
   5.3 
   5.4 
   5.5 
   ADVICE TO ASSESSORS 
   Duties predicated on the ‘reasonably practicable’ test in HSWA and its relevant 
  statutory provisions are open to interpretation by dutyholders and regulators alike. This 
  is because it is a test that is not expressly defined in criminal law but rather a 
  determination made in accordance with relevant case law when proceedings are 
  brought before a court in this matter. In this regard, courts are strongly directed by a 
  legal precedent established in 1949 in “Edwards V. The National Coal Board” which, 
  on appeal, led to the following verdict on the meaning of ‘reasonably practicable’: 
   “Reasonably practicable is a narrower term than ‘physically possible’ and implies that a 
  computation must be made... in which the quantum of risk is placed in one scale and 
  the sacrifice involved in the measures necessary for averting the risk (whether in time, 
  trouble or money) is placed in the other and that, if it be shown that there is a great 
  disproportion between them – the risk being insignificant in relation to the sacrifice – 
  the person upon whom the obligation is imposed discharges the onus which is upon 
  him.” 
   It should be noted that the standard of proof that courts apply in such cases is the civil 
  law test of ‘balance of probability’ rather than the test of ‘beyond all reasonable doubt’ 
  and that the burden of proof rests with the defendant rather than the prosecution. 
   SAPs paragraphs 9-18 give general guidance on the philosophy of ‘reasonably 
  practicable’, which underlies the HSWA phraseology SFAIRP and the effectively 
  equivalent term ALARP. The term As Low As Reasonably Achievable (ALARA) is used 
  internationally and is taken to be equivalent to ALARP allowing for social and 
  economic factors. Assessors should be familiar with the SAPs general guidance and 
  the documents referred to therein. Aspects specific to nuclear safety are developed 
  further in NS-TAST-GD-005 supported by; Reducing Risks, Protecting People: HSE’s 
  decision making process (R2P2) [11] and the 6 ALARP guides published on the HSE 
  website.  
   The FPs are drafted as requirements, using the word ‘must’, reflecting their relation to 
  legal requirements. Most of the other SAPs use ‘should’ or similar (exceptions being 
  those SAPs which contain statutory requirements). The use of ‘should’ reflects the 
  flexible nature of health and safety law where ‘reasonably practicable’ takes account of 
  the nature and scale of hazards and risks. This also allows the possibility of different 
  equivalent or better alternatives to the safety provisions indicated in SAPs and 
  guidance. See SAPs Introduction, paragraphs 14-18 and 27-30 regarding ALARP and 
  proportionality. 
   Guidance on FP.1 regarding dutyholder responsibilities is given in the document 
  ‘Licensing Nuclear Installations’. 
   In the application of FP.2, Leadership and management for safety, the assessor should 
  take account of the Principles MS.1 to MS.4 and the guidance given in paragraphs 53-
  78 of the SAPs. Additional guidance can be found in the TAG related to Leadership 
  and Management for safety NS-TAST-GD-093 Revision 1 Guidance for undertaking 
  Leadership and Management for Safety Reviews. 
   FP.4 emphasises the need for the dutyholder (i.e. licensee on nuclear licensed sites) 
  to understand the hazards and their control, and to demonstrate such understanding. 
  This includes evidence that the dutyholder is an ‘intelligent customer’ for any 
  information supplied by another party which is relevant to a safety case. Guidance on 
  ‘intelligent customer’ is given in NS-TAST-GD-049 Licensee Core and Intelligent 
  Customer Capabilities. 
   Report : NS-TAST-GD-004 Revision 7 
  CM9 Ref: 2019/0101578 
   Page 6 of 8 
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   5.6 
   5.7 
   5.8 
   5.9 
   5.10 
   In order to demonstrate an effective understanding of the hazards of a facility and their 
  control, and thus satisfy FP.4, the safety assessment in the safety case should include 
  both deterministic and probabilistic analyses as complementary approaches to the 
  demonstration of safety. 
   An apparent adherence to the quantitative risk criteria is not sufficient on its own to 
  establish that a situation is acceptably safe. Similarly, cost/benefit analysis may help to 
  support a case, but very careful scrutiny is needed if it is invoked to support non-
  adherence to well-established good practice. In general, probabilistic and cost/benefit 
  arguments are easier to accept when the variation from current good practice is also 
  evidently safer according to deterministic analysis. The Design Basis Analysis (DBA) 
  would be used to guide the engineering requirements of the design. However, DBA 
  may not be sufficient, on its own, to demonstrate the adequacy of the safety of a facility 
  and should be complemented by suitable and sufficient Probabilistic Safety Analysis 
  (PSA) and Severe Accident Analysis (SAA) to give a comprehensive demonstration of 
  facility safety performance. Further information can be found in NS-TAST-GD-051 The 
  Purpose, Scope and Content of Nuclear Safety Cases.  
   In meeting FP5, IRR17 provides statutory limits on radiation doses that correspond to 
  the upper limit in the three-zone approach to risk judgements as set out in The 
  tolerability of risks from nuclear power stations (TOR) [12] and R2P2 [11] (see SAPs 
  paragraphs 9-11). FP.3 on ‘Optimisation of protection’ should be applied to reduce 
  potential dose levels below the dose limits and to demonstrate ALARP. The SAPs 
  section on Radiation Protection, and associated guidance, indicate what is expected 
  for such optimisation. 
   In relation to FP.5 and FP.8 it should be noted that off-site doses from authorised 
  disposals of radioactive waste from nuclear sites, including discharges to air and to 
  bodies of water, are regulated by the Environment Agency (England), Natural 
  Resources Wales (Wales) and Scottish Environment Protection Agency (Scotland). 
  Appropriate liaison should be done in accordance with HSE/ONR’s memoranda of 
  understanding with such bodies.  
   To satisfy FP.5, limitation of risks to individuals, the SAPs paragraphs 695-758 contain 
  several types of numerical dose and risk criteria, mostly expressed as ‘Basic Safety 
  Levels’ (BSL) and ‘Basic safety Objectives’ (BSO) and presented as Targets rather 
  than Principles. Where the ‘levels’ are IRR17 statutory limits on doses to the workforce 
  and the public they are designated ‘Legal Limits’ (LL). Dose limits and risk targets at 
  the BSL/LL level represent an upper bound that ONR expects a new facility or activity 
  to meet. However, they are insufficient in themselves to ensure the best reasonably 
  practicable protection in any given circumstances. They therefore need to be 
  complemented by optimisation of protection as required by FP.3. Thus both limitation 
  of dose and optimisation of dose below that limit, for normal operations, are necessary 
  to achieve the required level of safety. 
   5.11 
   Principle FP.6 addresses both accident prevention and mitigation. Mitigation is 
  regarded as the last level of defence-in-depth, discussed in ‘engineering principles: key 
  principles Defence in depth, EKP.3’ of the SAPs; but it should not be invoked to justify 
  a relaxation or reduced benefit from earlier levels. The safety assessment (FP.4) 
  should include analysis of potential accidents to indicate a basis for the planning of 
  accident management and emergency response (FP.7). 
   5.12 
   In respect of FP.7, the assessor is referred to SAPs paragraphs 768ff and principle 
  AM.1 together with its supporting paragraphs. Generally speaking the arrangements 
  required by FP.7 are addressed through various licence conditions, especially LC11. 
   Report : NS-TAST-GD-004 Revision 7 
  CM9 Ref: 2019/0101578 
   Page 7 of 8 
    
    
    
    
    
   Office for Nuclear Regulation  
   5.13 
   5.14 
   Relevant to FP.8 are the criteria in SAPs paragraphs 712-758 relating to accidents 
  which includes in paragraph 756, that stochastic health effects from long-term doses 
  should be integrated up to a time of 100 years and be restricted to the UK population. 
  The SAPs on radioactive waste management, decommissioning and land quality 
  management are also relevant to the long-term protection of people. 
   The other SAPs are aimed at ensuring that the fundamental principles are satisfied. If it 
  is judged that the totality of SAPs relevant to a particular installation have been met, 
  this should be sufficient to satisfy inspectors that the installation meets the 
  fundamental principles. For example, if a plant is adequately robust (that is, the 
  technical principles are satisfied SFAIRP, so giving suitable and sufficient defence in 
  depth) and if the plant is operated safely (that is, in accordance with the FP.2 
  requirements plus the site licence requirements) then the ‘accident prevention’ part of 
  FP.6 is deemed to have been satisfied. 
   6. 
   REFERENCES 
   1. Safety Assessment Principles for Nuclear Facilities, 2014 Edition Revision 0, 
  http://www.onr.org.uk/saps/saps2014.pdf  
  2. The Health and Safety at Work etc. Act 1974. 
  3. The Ionising Radiations Regulations 2017, The Stationery Office, 2017.  
  4. Work with Ionising Radiation, Approved Code of Practice, L121, HSE Books 2018. 
  5. Management of Health and Safety at Work Regulations 1999. 
  6. A guide to the Radiation (Emergency Preparedness and Public Information) 
  Regulations 2001, L126, ISBN 0 7176 2240 1. 
  7. The Energy Act 2013 (TEA) 
  8. The Nuclear Installations Act 1965 (as amended). 
  9. Western European Nuclear Regulators’ Association (WENRA) - Reactor 
  Harmonisation Working Group: Reactor Safety Reference Levels. September 2014 
  http://www.wenra.org/media/filer_public/2014/09/19/wenra_safety_reference_level_for
  _existing_reactors_september_2014.pdf 
  and Working Group on Waste and Decommissioning: Waste and Spent Fuel Storage 
  Safety Reference Levels Report, Version 2.2 April 2014 
  http://www.wenra.org/media/filer_public/2014/05/08/wgwd_storage_report_final.pdf 
  10. IAEA Safety Standards, Fundamental Safety Principles, Safety Fundamentals No. 
  SF-1. http://www-pub.iaea.org/MTCD/Publications/PDF/Pub1273_web.pdf 
  11. Reducing risks, protecting people: HSE’s decision making process, HSE Books 
  2001, ISBN 0 7176 2151 0, Web version.  
  12. The tolerability of risk from nuclear power stations, The Stationery Office 1992, 
  ISBN 0 11 886368 1 Web version. 
   Report : NS-TAST-GD-004 Revision 7 
  CM9 Ref: 2019/0101578 
   Page 8 of 8 
    
    
    
    
    
    
    
    
    
    
  "
  Guidance on the Demonstration of ALARP ns-tast-gd-005	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Guidance on the Demonstration of ALARP ns-tast-gd-005.pdf	" Title of document 
   ONR GUIDE 
   Guidance on the Demonstration of ALARP (As Low As Reasonably Practicable) 
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   Approved by: 
   Record Reference: 
   Revision commentary: 
   NS-TAST-GD-005 Revision 10 
   December 2019 
   Review Date: 
   December 2022 
   S Turner 
   Principal Inspector, ALARP WG Chair 
   CM9 2019/315236 
  This document has been updated to add a new appendix on 
  relevant good practice and correct references to IRRs.   
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
   INTRODUCTION ................................................................................................................. 2 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION ......................... 2 
  RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ADDRESSED ............................................................................................... 5 
  5. 
  ADVICE TO INSPECTORS – GENERAL POINTS ............................................................. 6 
  6. 
  ADVICE TO INSPECTORS – DETAILED REQUIREMENTS ............................................. 8 
  7. 
  ALARP AND REGULATORY DECISIONS ........................................................................ 18 
  8. 
  CHECKLIST ....................................................................................................................... 19 
  9. 
  REFERENCES .................................................................................................................. 20 
  10. GLOSSARY AND ABBREVIATIONS ................................................................................ 21 
  11. APPENDICES .................................................................................................................... 22 
   © Office for Nuclear Regulation, 2019 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 12/19 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 29 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   1.2 
   1.3 
   1.4 
   2. 
   2.1 
   3. 
   3.1 
   INTRODUCTION 
   This Technical Assessment Guide (TAG) represents specific guidance for ONR 
  inspectors on what they should expect of a nuclear licensee or dutyholder1 in meeting 
  its legal requirement to reduce risks so far as is reasonably practicable (SFAIRP).  The 
  concept of SFAIRP is normally expressed in terms of reducing risks to “As Low As 
  Reasonably Practicable” (ALARP), the terms SFAIRP and ALARP being synonymous 
  in guidance documents. 
   This TAG is part of a sequence of documents, headed by “Reducing Risks, Protecting 
  People” [R2P2] and the series of ALARP Guides for use by health and safety 
  inspectors published on our websites. It is intended that ONR inspectors make use of 
  all these documents when considering licensees' cases or arguments. 
   The requirement for risks to be ALARP is fundamental and applies to all activities 
  within the scope of the Health and Safety at Work (etc) Act 1974 [HSWA]. It is 
  important that inspectors in whatever role are aware of the need to ensure that 
  licensees meet this requirement where it applies. In simple terms it is a requirement to 
  take all measures to reduce risk where doing so is reasonable. In most cases this is 
  not done through an explicit comparison of costs and benefits, but rather by applying 
  established relevant good practice and standards. The development of relevant good 
  practice and standards includes ALARP considerations so in many cases meeting 
  them is sufficient. In other cases, either where standards and relevant good practice 
  are less evident or not fully applicable, the onus is on the licensee to implement 
  measures to the point where the costs of any additional measures (in terms of money, 
  time or trouble – the sacrifice) would be grossly disproportionate to the further risk 
  reduction that would be achieved (the safety benefit). 
   To aid use of this TAG in regulatory activities, a checklist is provided in Annex 1 which 
  references back to the appropriate text in the main body of the TAG. It is recognised 
  that it is unlikely that all of the check points in Annex 1 will apply in any single case – 
  inspectors will need to select those that are appropriate to the specific circumstances. 
   PURPOSE AND SCOPE 
   The purpose of this Technical Assessment Guide (TAG) is to provide advice to ONR 
  inspectors to help them judge whether a licensee has met the requirement to reduce 
  risks to ALARP. As such, the TAG is intended to be used for all ONR regulatory 
  functions relating to nuclear safety falling within the remit of the HSWA.  
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION 
   HSWA provides the basic legislation for health and safety related to work activities. 
  The HSWA places duties on employers to ensure the health, safety and welfare of 
  their employees (Section 2) and to conduct their operations so that persons not in their 
  employment are not exposed to risks to their health and safety (Section 3). The 
  employer is required to ensure that these duties are met ""so far as is reasonably 
  practicable"". This principle, abbreviated to SFAIRP, is therefore the basic legal 
  requirement to which an employer needs to conform. ALARP (the term used in 
  HSE/ONR guidance) and SFAIRP require the same tests to be applied and are 
  effectively the same thing, though the terms are not interchangeable in legal 
  proceedings (which must employ the wording in the legislation). 
   1 Hereafter, in the interests of brevity, “licensee” should be interpreted as meaning licensee or dutyholder as 
  appropriate to the circumstances 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 2 of 29 
    
    
    
    
                                           
            
   Office for Nuclear Regulation  
   3.2 
   3.3 
   3.4 
   3.5 
   3.6 
   The parts of the Nuclear Installations Act we are concerned with became Relevant 
  Statutory Provisions of the Energy Act 2013, rather than HSWA, on 1 April 2014; the 
  impacts of this and related changes do not affect the guidance in this TAG.  
   It is important to recognise that not all the legal duties licensees need to meet are 
  qualified by SFAIRP – so ONR’s ALARP guidance should only be applied where this 
  qualification is in place.  For example, the duties in various Licence Conditions, which 
  are now applicable provisions of the Energy Act 2013, to make and implement 
  adequate arrangements are not qualified by SFAIRP. 
   Nevertheless, the demonstration of ALARP will normally be made within the licensee’s 
  safety case required under Licence Condition 23.  The need to demonstrate ALARP 
  also arises in other legislation.  For instance, specific legal requirements in relation to 
  radiation protection are contained in the Ionising Radiation Regulations 2017 [IRR], 
  which put into UK law the 2013 Basic Safety Standard Directive. IRR Regulation 9 
  requires that exposure should be restricted SFAIRP. Other relevant legislation is 
  contained in the Management of Health and Safety at Work Regulations 1999, which 
  requires a suitable and sufficient risk assessment, and in the Control of Major Accident 
  Hazards Regulations 1999 [COMAH]. 
   This TAG is written against the background of R2P2
   [1] and the supporting 
  documents published on the Internet which give guidance to health and safety 
  inspectors on ALARP. This TAG extends the wider guidance to specific aspects of how 
  ONR operates, the use of a licensing regime and other ONR guidance on inspection 
  and assessment. Thus R2P2, the Internet guides (listed below) and this TAG taken 
  together represent ONR guidance to our inspectors on ALARP.  
   This document assists in implementing Council Directive 2014/87/Euratom of 8 July 
  2014 amending Directive 2009/71/Euratom, by highlighting ONR’s regulatory 
  expectations regarding the achievement of nuclear safety and as reference for the 
  timely implementation of reasonably practicable safety improvements (see Articles 
  below) by nuclear site licence holders and, in particular, demonstrating that the IAEA 
  and WENRA Safety Objectives and Reference Levels underpin the UK’s regulatory 
  oversight of nuclear safety (See Section 4 and paragraph 4.6.)  
   Article 8a Nuclear safety objective for nuclear installations  
   8a 
   (1) Member States shall ensure 
  that 
  the national nuclear safety 
  framework 
  requires 
  that 
  nuclear 
  installations 
  are 
  designed, 
  sited, 
  constructed, 
  commissioned, 
  operated 
  and 
  decommissioned 
  with 
  the 
  objective 
  of 
  preventing 
  accidents 
  and, 
  should 
  an 
  accident occur, mitigating its consequences and avoiding:  
   (a) 
  early 
  radioactive 
  releases 
  that 
  would 
  require 
  but with insufficient time to implement them;  
   off-site 
   emergency 
   measures 
   (b) large radioactive releases that would require protective measures that could 
  not be limited in area or time. 
   8a (2) Member States shall ensure that the national framework requires that the 
  objective set out in paragraph 1:  
   (a) applies to nuclear installations for which a construction licence is granted for 
  the first time after 14 August 2014;  
   (b) is used as a reference for the timely implementation of reasonably 
   practicable safety improvements to existing nuclear installations, including in 
  the framework of the periodic safety reviews as defined in Article 8c(b). 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 3 of 29 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   3.7 
   3.8 
   3.9 
   3.10 
   3.11 
   3.12 
   3.13 
   3.14 
   3.15 
   3.16 
   R2P2 sets out HSE's overall framework for decision-making to aid consistency and 
  coherence across the full range of risks falling within the scope of the HSWA. This 
  framework represents our risk management policy and is based on ""The Tolerability of 
  Risks from Nuclear Power Stations"" (TOR)
   published in 1992 [2]. TOR defines risks 
  which are so high they are unacceptable unless there are exceptional circumstances, 
  and risks which are so low that they may be considered broadly acceptable so that in 
  most cases it would be disproportionate to apply regulatory time to reduce them 
  further. Between these levels inspectors should consider whether risks have been 
  reduced to ALARP, while recognising that the legal duty for risks to be ALARP is not 
  limited to this range.  
   R2P2 explains our decision making process rather than providing guidance to 
  individual dutyholders. The approach is essentially risk-based and R2P2 addresses the 
  qualitative and quantitative role of risk assessment and the key role of good practice in 
  determining control measures. Based on legal precedent, R2P2 considers risk to 
  include the ""possibility of danger"", though the terminology used in our guidance calls 
  things that present the possibility of danger “a hazard”. 
   The HSE ALARP guides published on the Internet (colloquially known as “the ALARP 
  six-pack”) are: 
   PRINCIPLES AND GUIDELINES TO ASSIST HSE IN ITS JUDGEMENTS THAT 
  DUTYHOLDERS HAVE REDUCED RISK AS LOW AS REASONABLY PRACTICABLE [3] 
   This paper defines ALARP and SFAIRP and sets out in plain terms what HSE believes 
  the law requires. 
   ASSESSING COMPLIANCE WITH THE LAW IN INDIVIDUAL CASES AND THE USE OF 
   GOOD PRACTICE [4] This paper defines what HSE means by good practice and lists 
  the responsibilities of Operating Directorates (which includes ONR) in respect of 
  identifying and maintaining records of good practice. 
   POLICY AND GUIDANCE ON REDUCING RISKS AS LOW AS REASONABLY 
   PRACTICABLE IN DESIGN [5]. This paper recognises the importance of taking account 
  of health and safety in design and sets out HSE's intervention policy with respect to 
  design. At licensed sites, intervention in the design is controlled by licence conditions 
  attached under the powers of the NIA, and is a well established process (see 
   [6]).  For Authorised 
  Sites, HSWA Section 6 and the Construction, Design and Management Regulations 
  2007 [CDM] should be used. 
   T/AST/051 [25] and Nuclear Site Licensees Notes for Applicants
   HSE PRINCIPLES FOR COST BENEFIT ANALYSIS IN SUPPORT OF ALARP DECISIONS 
   [7]. This paper explains the uses and limitations of CBA and is particularly concerned 
  with the correct use of CBA as part of ALARP decisions. 
   HSE - RISK MANAGEMENT: ALARP AT A GLANCE [8]. This document summarises many 
   of the key terms and concepts. 
   HSE - RISK MANAGEMENT: COST BENEFIT ANALYSIS (CBA) CHECKLIST [9]. This 
   document summarises HSE's view of what should and should not be considered in a 
  dutyholder's CBA for health and safety ALARP determinations. 
   NIA provides for ONR to attach Licence Conditions to a site licence in the interests of 
  safety and with respect to the handling, treatment, and disposal of nuclear matter. 
  Licence Condition 14 requires arrangements to ""produce and assess safety cases .... 
  to justify safety"" and Licence Condition 23 requires an adequate safety case be 
  produced and that the facility is then operated in accordance with that safety case. 
  These safety cases still need to address the duty to reduce risks to ALARP from 
  HSWA. 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 4 of 29 
    
    
    
    
   Office for Nuclear Regulation  
   3.17 
   3.18 
   4. 
   4.1 
   4.2 
   4.3 
   Under the IRRs, the licensee has to carry out a risk assessment prior to commencing 
  work with ionising radiation, review progress during the job (for example tracking a 
  dose budget) and consider plant, procedures and training aspects.  A prime aim of 
  these prior risk assessments, along with demonstrating legal limits on exposure etc. 
  will be complied with, should be to ensure the risks, particularly those due to expected 
  radiological exposures from the planned activities, will be reduced to ALARP. 
   Many decisions on what is needed to meet ALARP for conventional (i.e. non-
  radiological) safety are made at the time regulations are being written and judgements 
  of acceptability can therefore often be made directly against the requirements of those 
  regulations (although the legal duty to reduce risks SFAIRP still remains). 
   RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ADDRESSED 
   The SAPs [10] were developed against the background of the legal requirements and 
  the TOR philosophy, and have been benchmarked against the IAEA Safety Standards. 
  They contain engineering and operational principles, safety analysis requirements and 
  numerical targets and legal limits. The need to demonstrate risks are ALARP is an 
  overriding and all-embracing requirement. Paragraph 16 of the SAPs emphasises that 
  ""The principles are used in helping to judge whether reducing risks to ALARP is 
  achieved.......”. This has not been stated in each case to avoid excessive repetition"". 
  Furthermore it is also a requirement of SAPs that ""priority should be given to achieving 
  an overall balance of safety rather than satisfying each principle or making an ALARP 
  judgement against each principle"". The expectation from SAPs is that a safety case 
  (see T/AST/051 [25]) should provide an analysis of normal operation, potential faults 
  and accidents, and of the engineering design and operations, and demonstrate the 
  risks from all these perspectives have been reduced to ALARP. 
   The TOR philosophy has been translated into nine Numerical Targets in the form of 
  Basic Safety Levels (BSLs) and Basic Safety Objectives (BSOs) (see SAPs para 
  695ff). It is however, essential that these are applied against a background of good 
  engineering and operational practice. The BSOs represent broadly acceptable levels 
  below which regulatory resources will generally not be used to seek further 
  improvements, and where assessors should confine themselves to considering the 
  validity of the arguments presented (SAPs para 701). This is a pragmatic approach to 
  enable targeted and proportionate use of our resources; it is not a green light for 
  licensees to forego ALARP considerations at such levels. 
   It is ONR policy that a new facility or activity should at least meet the BSLs (note that in 
  a few cases the BSLs are legal limits derived from IRRs - these are designated as 
  BSL(LL) in SAPs). All the other Targets are policy guidance for inspectors and are not 
  mandatory. Older facilities may have been designed and constructed to different safety 
  standards and deterioration over time now means that BSLs are exceeded. In these 
  cases, provided the BSL is not a legal limit, it may be reasonable for operation to 
  continue if:  
   i) it has been shown that no reasonably practicable options are available to reduce 
  risks further in the short term; and  
   ii) a clear longer-term plan to manage and reduce risks within as short a period as 
  reasonably practicable is in place.  
   4.4 
   The criteria for determining whether an explicit ALARP demonstration is required in 
  relation to the Engineering SAPs, which represent ONR's views of relevant good 
  practice, are not set out in numerical terms. Instead, if the relevant SAP is evidently 
  well satisfied, then the facility should be considered to be meeting the equivalent of the 
  TOR broadly acceptable criterion on that particular point and therefore there is unlikely 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 5 of 29 
    
    
    
    
   Office for Nuclear Regulation  
   4.5 
   4.6 
   5. 
   5.1 
   5.2 
   to be a need for further assessment against ALARP.  Conversely, any non-
  conformance with relevant good practice should be explicitly highlighted and then 
  justified as reducing risks to ALARP within the safety case. 
   The hierarchy of safety measures set out in the Engineering Key Principles (EKP 1-5 
  and supporting guidance, particularly SAPs para 155) will usually be a key part of the 
  ALARP analysis. Essentially the SAPs approach is to seek solutions as near to the top 
  of the following list as possible: avoid the hazard; design to achieve fault tolerance; 
  maintain safe conditions by passive means rather than active systems; initiate 
  protection automatically in preference to manually; and mitigate fault consequences. 
  This philosophy is also embodied in para 8 of HSE's ALARP in Design paper [5].  
   In addition to SAPs, the IAEA Safety Standards and the Safety Reference Levels 
  developed by WENRA for reactors, decommissioning, and the storage of radioactive 
  waste and spent fuel [21] should be considered to be UK relevant good practice. IAEA 
  Safety Standards are developed by international consensus and were used to 
  benchmark the  SAPs [10]  The WENRA Reference Levels for reactors are much more 
  specific and only apply to existing civil nuclear reactors. However, the 
  decommissioning safety reference levels are relevant good practice for all types of 
  nuclear facilities and cover all stages in the lifecycle.  The storage reference levels 
  apply to facilities where radioactive waste or spent fuel is stored for a significant period 
  of time.  The UK, as a member of WENRA, has formally signed on to the Reference 
  Levels and, in line with ONR’s enforcement policy [22] in relation to relevant good 
  practice, we expect them to be followed. WENRA’s safety objectives for new nuclear 
  power plants [26] and guidance on timely implementation of reasonably practicable 
  improvements to existing nuclear power plants [27] are also considered to be UK 
  relevant good practice.    
   ADVICE TO INSPECTORS – GENERAL POINTS 
   To aid use of this TAG in regulatory activities, a checklist is provided in Annex 1 which 
  references back to the appropriate text in the main body of the TAG. It is recognised 
  that it is unlikely that all of the check points in Annex 1 will apply in any single case – 
  inspectors will need to select those that are appropriate to the specific circumstances. 
   Our current advice [3] is that the essence of a demonstration that risks have been 
  reduced ALARP is to show that the ""costs"" (sacrifice) of improving safety any further 
  would be grossly disproportionate to the safety benefits that would accrue from 
  implementing any identified improvement compared to the status quo. This does not 
  mean that a detailed analysis is necessary: the emphasis must be on an analysis 
  which is fit for purpose. Neither does it mean that a quantitative argument based on 
  risk estimates is always necessary, as qualitative features such as applying 
  deterministic engineering principles may be sufficient in making a case. However, ONR 
  inspectors should seek suitable and sufficient Probabilistic Safety Analysis (PSA) in 
  addition to deterministic analysis for systems where there are significant hazards and 
  complexity. Assessing an ALARP demonstration is essentially a consideration of 
  whether an adequate argument has been made that a further reduction in risk would 
  not be feasible at a reasonable cost, given the magnitude of the risk. However where 
  there are several risks which interact, whether arising from a single hazard or from 
  different connected hazards, there may be a need for balancing to achieve the best 
  overall solution. 
   5.3 
   Demonstration of ALARP requires the licensee to evaluate the risks and to consider 
  whether it would be reasonably practicable to implement further safety measures 
  beyond the initial proposals or what is currently in place. This ought to include the 
  consideration of a number of options to identify which is the reasonably practicable 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 6 of 29 
    
    
    
    
    
   Office for Nuclear Regulation  
   option or collection of options that give the best safety benefit, and making this 
  consideration transparent. In reality there may only be a limited number of options for 
  dealing with a particular health and safety issue. However, features such as: good 
  practice that HSE may have accepted as relevant good practice; an option adopted 
  elsewhere in similar circumstances; and the extent to which this option has worked in 
  practice, often provide strong indications of what the ALARP solution might be. 
   5.4 
   The following represent principles which are likely to need addressing in most cases: 
   1 
   2 
   3 
  4 
   5 
   6 
   7 
   8 
   to 
  fund 
  improvements, 
  is not a 
  the 
  cost 
  of 
  implementing 
  the 
   The application of ALARP can only be to risks which the licensee controls (e.g. it is 
  not 
  a 
  requirement 
  for 
  nuclear 
  power 
  plant 
  operators 
  to 
  consider 
  other 
  forms 
  of 
  electrical generation).  
  Affordability, 
  i.e. whether a company 
  is 
  in a position 
  legitimate 
  factor 
  in 
  the 
  ALARP 
  argument, 
  though 
  improvement is. 
  ALARP cannot be used to argue against fulfilling statutory duties. 
  The ALARP 
  argument 
  needs 
  to 
  consider 
  all 
  the 
  types 
  of 
  risk 
  that 
  are 
  relevant, 
  not 
  just 
  the 
  nuclear 
  / 
  radiological 
  ones, 
  and 
  where 
  these 
  conflict 
  with 
  one 
  another, 
  ensure 
  that 
  an 
  appropriate 
  overall 
  balance 
  is 
  achieved 
  in 
  regard 
  to 
  their 
  management. 
  ALARP 
  demonstrations 
  ought 
  to 
  consider 
  all 
  the 
  various 
  options 
  which 
  could 
  realistically 
  improve 
  safety, 
  and 
  then 
  implement 
  the 
  option 
  or 
  combination 
  of 
  options which achieves 
  the 
  lowest 
  level of 
  residual 
  risk provided 
  this 
  is 
  reasonably 
  practicable (para 50 of the HSE ALARP Principles [3]). It is not adequate to start with 
  the cheapest option first.  
  Similarly, 
  inspectors 
  should 
  be 
  alert 
  to 
  disproportionate 
  consideration 
  of 
  ‘deluxe’ 
  options 
  that 
  involve 
  excessive 
  cost 
  being 
  used 
  to 
  argue 
  that 
  there 
  are 
  no 
  reasonably 
  practicable 
  improvements. 
  The 
  timescale 
  for 
  implementation may 
  be 
  a 
  factor 
  in 
  the 
  choice 
  of 
  the ALARP 
  option, 
  so 
  due 
  consideration 
  should 
  be 
  given 
  to 
  less effective options that might be 
  implemented with shorter lead times, especially 
  where the risks are high or the resultant hazard reduction is significant.  
  In 
  more 
  complex 
  situations, 
  licensees 
  will 
  have 
  to 
  select 
  an 
  option 
  taking 
  cognisance 
  of 
  all 
  relevant 
  legislation 
  such 
  as 
  safety, 
  environmental 
  and 
  security. 
  Section 
  6.6.4 
  provides 
  guidance 
  on 
  developing 
  an 
  optimised 
  solution 
  where 
  there 
  are both safety and environmental duties to be met.  
  Existing 
  facilities 
  should 
  be 
  compared 
  against 
  relevant 
  modern 
  standards, 
  including 
  those 
  not 
  in 
  force 
  when 
  they 
  were 
  designed 
  / 
  constructed. 
  The 
  safety 
  case 
  should 
  consider 
  the 
  importance 
  of 
  any 
  shortfalls 
  and 
  what 
  options 
  exist 
  for 
  improvement, 
  again 
  starting 
  with 
  the 
  safest, 
  and 
  then 
  consider 
  the 
  reasonable 
  practicability 
  of 
  implementing 
  them. 
  Older 
  facilities 
  may 
  meet 
  the 
  ALARP 
  requirement 
  at 
  higher 
  risks 
  than 
  new 
  ones 
  (para 
  52 
  of 
  the 
  [3]). 
  The 
  ALARP 
  case 
  should 
  be 
  fit 
  for 
  purpose. 
  If 
  the 
  risks 
  are 
  high 
  then 
  the 
  demonstration 
  of 
  ALARP 
  needs 
  to 
  be more 
  rigorous 
  than 
  if 
  the 
  risks 
  are 
  low. 
  The 
  degree 
  of 
  rigour 
  should 
  also 
  depend 
  on 
  the 
  consequence 
  level. 
  For 
  higher 
  consequence 
  situations 
  the 
  consequences 
  should 
  weigh 
  more 
  heavily 
  than 
  the 
  frequency 
  estimates. 
  Furthermore, 
  thought 
  should 
  be 
  given 
  to 
  the 
  robustness 
  of 
  the 
  conclusions with 
  respect 
  to 
  uncertainties 
  and 
  to 
  any 
  assumptions 
  employed 
  in 
  the demonstration. 
  If 
  the 
  ALARP 
  demonstration 
  employs 
  a 
  comparison 
  of 
  costs 
  and 
  risk 
  reduction 
  benefits 
  to 
  rule 
  out 
  an 
  improvement, 
  then 
  based 
  on 
  our 
  current 
  guidance 
  [3], 
  it 
  must 
  be 
  shown 
  that 
  the 
  costs 
  (sacrifice) 
  of 
  the 
  improvement 
  would 
  be 
  ""grossly 
  disproportionate"" 
  (see 
  [7]). 
  The 
  law 
  does 
  not 
   Principles 
   HSE 
   ALARP 
   Principles 
   Cost 
   Benefit 
   Analysis 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 7 of 29 
    
    
    
    
   Office for Nuclear Regulation  
   recognise an acceptable 
  region other 
  than when ALARP 
  has 
  been met 
  so 
  there 
  is 
  unlikely 
  to 
  be 
  any 
  sympathy 
  in 
  the 
  courts 
  for 
  parity 
  of 
  costs 
  and 
  benefits, 
  even 
  at 
  the 
  TOR 
  Broadly 
  Acceptable 
  level. 
  Advice 
  from 
  HSE 
  lawyers 
  is 
  that, 
  provided 
  the 
  risk 
  is more 
  than 
  fanciful, 
  the courts would still seek ""gross disproportion"". It 
  is also 
  true 
  that, 
  depending 
  on 
  circumstances, 
  future 
  health 
  and 
  safety 
  court 
  cases 
  may 
  lead 
  to 
  a 
  change 
  in 
  interpretation 
  of 
  SFAIRP 
  and 
  subsequently 
  HSE 
  and 
  ONR 
  guidance 
  on 
  this 
  matter. 
  However 
  until 
  such 
  time 
  we 
  will 
  continue 
  to 
  follow 
  our 
  existing guidance. 
  i) 
  There 
  is 
  however, 
  no 
  precise 
  legal 
  factor 
  or 
  HSE 
  algorithm 
  for 
  gross 
  disproportion. 
  For 
  the 
  purposes 
  of 
  this 
  TAG, 
  it 
  is 
  suggested 
  that 
  the 
  evidence 
  given 
  by 
  John 
  Locke, 
  then 
  Director 
  General 
  of 
  HSE, 
  at 
  the 
  Sizewell 
  B 
  Public 
  Inquiry 
  provides 
  a 
  starting 
  point. 
  Although 
  this 
  evidence 
  was 
  produced 
  some 
  time 
  ago, 
  no 
  subsequent 
  legal 
  proceedings 
  or 
  public 
  inquiries 
  have 
  countered 
  these 
  views 
  or 
  provided 
  alternatives. 
  In 
  his 
  evidence, 
  Locke 
  suggested 
  a 
  gross 
  disproportion 
  factor 
  of 
  up 
  to 
  3 
  for 
  workers. 
  For 
  risks 
  to 
  the 
  public, 
  he 
  added 
  that 
  the 
  factor 
  would 
  depend 
  on 
  the level of risk, and where the risks were low (consequence and likelihood) 
  a 
  factor 
  of 
  about 
  2 
  was 
  suggested, 
  whereas 
  for 
  higher 
  risks 
  the 
  factor 
  should be about 10. 
  The Health Protection Agency 
  (HPA, now Public Health England) produced 
  guidance 
  relating 
  to 
  the 
  dose 
  saved 
  resulting 
  from 
  routine 
  exposure 
  or 
  minor 
  accidents 
  i.e. 
  stochastic 
  effects, 
  up 
  to 
  about 
  100 
  mSv. 
  This 
  recommends 
  that 
  an 
  increasing 
  multiplier 
  is 
  used 
  as 
  the 
  dose 
  increases 
  and 
  comparison 
  of 
  licensees 
  submissions 
  with 
  this 
  approach 
  may 
  be 
  valuable as part of our assessments [11]. 
  In 
  view 
  of 
  these 
  precedents, 
  it 
  is 
  suggested 
  that 
  a 
  factor 
  of 
  less 
  than 
  10 
  in 
  the 
  vicinity 
  of 
  a 
  BSL 
  is 
  unlikely 
  to 
  be 
  acceptable 
  and, 
  for 
  hazards 
  that 
  can 
  cause large consequences, the factor may need to be larger still. 
   iii) 
   ii) 
   6. 
   ADVICE TO INSPECTORS – DETAILED REQUIREMENTS 
   Relevant Good Practice 
   6.1 
   6.2 
   6.3 
   ALARP demonstrations should consider first and foremost factors relating to 
  engineering, operations and the management of safety. These expectations are often 
  referred to by the general term ""relevant good practice"".  Based on HSE [4], relevant 
  good practice is ""… those standards for controlling risk which have been judged and 
  recognised by HSE as satisfying the law when applied to a particular relevant case in 
  an appropriate manner."" In nuclear safety applications, where the potential 
  consequences of accidents can be very serious, the best practice identified as 
  appropriate to the application would normally be required for new designs. Annex 2 
  contains further guidance on the application of ALARP for new civil nuclear reactors in 
  the context of Generic Design Assessment [20]. Annex 3 contains responses to a 
  number of RGP frequently asked questions.  
   For an existing facility, relevant good practice is established by using the standards 
  that would be applied to a new design as a benchmark and then subjecting any 
  shortfalls to the test of reasonable practicability. Unless the sacrifice entailed in moving 
  towards the benchmark is grossly disproportionate to the safety benefit, the licensee 
  should make that move. 
   What is accepted as relevant good practice may change over time because of 
  technological innovation which improves the degree of control, cost impact of 
  improvements or knowledge about the hazard. For existing facilities in Periodic Safety 
  Reviews (PSRs), the facility should be compared with the benchmark of modern 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 8 of 29 
    
    
    
    
    
   Office for Nuclear Regulation  
   6.4 
   6.5 
   6.6 
   6.7 
   standards (see T/AST/050 [23] on PSRs for more information). Due account should 
  then be taken when considering compliance and the reasonable practicability of 
  improvements, of aspects such as the age of the facility, its future lifetime, future 
  operations and the degree and importance of any shortfall. 
   In terms of specific sources of relevant good practice for the nuclear industry there are 
  several legal requirements which must be met and in some cases ACoPs (Approved 
  Codes of Practice) and Guidance have been issued (e.g. the ACoP to the IRRs [12]) to 
  assist the licensee in achieving compliance. 
   Standards exist for many engineering and operational features and it is a feature of 
  new designs that licensee proposals may be based on non-UK standards. Such 
  standards should be subject to assessment to ensure they represent appropriate 
  relevant good practice in a UK context. There are also several international bodies 
  which produce standards or guidance documents: where the UK is tied by international 
  agreements, e.g. EU, the standards have the same status as UK ones; where such 
  agreements do not exist, the guidance may be considered as authoritative, but 
  subsidiary to UK requirements.  In a nuclear context, IAEA Safety Standards and the 
  Safety Reference Levels developed by WENRA for reactors, decommissioning, and 
  the storage of radioactive waste and spent fuel [21] should be considered to be 
  relevant good practice. 
   ONR inspectors should use the SAPs together with the associated TAGs to judge 
  whether licensees' claims for relevant good practice are justified. As the TAGs are 
  revised they will be updated in line with the SAPs and will also include explicitly the 
  WENRA Reference Levels that are relevant to the TAG in question. Similarly ONR 
  guidance on inspection (TIGs) provides the means by which many day-to-day relevant 
  good practice decisions are made, e.g. in regard to operational safety.  
   Another important source of relevant good practice in the nuclear industry is what is 
  done on similar facilities. Many licensees have established their own standards 
  reflecting good practice that are acceptable to ONR. However in invoking past practice 
  it is important to be clear whether the practice remains relevant and whether it was 
  implemented for safety reasons. In reaching a decision to implement measures to 
  reduce risks, licensees sometimes take into account additional factors that are not 
  directly safety related (e.g. lower insurance premiums, enhanced commercial 
  reputation etc). It is important that inspectors do not take such factors into account 
  when considering whether licensee precedents represent relevant good practice (see 
  para 19 of R2P2
   appendix 3). 
   6.8 
   In many cases licensees will claim that the implementation of a particular relevant 
  good practice or standards is sufficient to demonstrate ALARP. In assessing such 
  claims inspectors should apply SAPs ECS.3 to ECS.5 and EQU1 (paras 169 to 177) 
  and in particular may consider: 
    
    
    
    
   be 
   relevant 
   to 
   the 
   specific 
   application, 
   the 
  good 
  practice 
  or 
  standard 
  should 
  plant, facility or industry in question. 
  the 
  good 
  practice 
  or 
  standard 
  should 
  be 
  up-to-date, 
  taking 
  account 
  of 
  the 
  current 
  state-of-the-art: 
  any 
  practice 
  or 
  standard more 
  than 
  a 
  few 
  years 
  old, 
  or 
  not 
  subject 
  to 
  active 
  ongoing 
  monitoring 
  and 
  review 
  or 
  not 
  written 
  by 
  acknowledged experts may be suspect. 
  the 
  good 
  practice 
  or 
  standard 
  should 
  requirement.  
  where 
  a 
  good 
  practice 
  or 
  standard 
  allows 
  for 
  more 
  than 
  one 
  option, 
  should be tested to determine those which are reasonably practicable. 
   minimum 
   these 
   be 
   in 
   not 
   the 
   form 
   of 
   a 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 9 of 29 
    
    
    
    
   Office for Nuclear Regulation  
    
    
   the 
  good 
  practice 
  or 
  standard 
  should 
  include 
  explicitly 
  all 
  relevant 
  factors, 
  particularly 
  relating 
  to 
  assumptions 
  on 
  the 
  standards 
  of 
  contingent 
  systems 
  or 
  inputs/outputs. 
  Standards 
  and 
  good 
  practice 
  may 
  relate 
  to 
  single 
  Systems, 
  Structures and Components and 
  further consideration may need 
  to be given 
  to 
  possible interactions. 
  there 
  should 
  be 
  no 
  doubt 
  about 
  standard to the case in point. 
   applicability 
   good 
   practice 
   or 
   the 
   of 
   the 
   Explicit Comparisons 
   6.9 
   6.10 
   6.11 
   6.12 
   6.13 
   Deciding what is reasonably practicable involves the exercise of judgement and 
  enforcing authorities will generally expect relevant good practice to be followed. Where 
  relevant good practice in particular cases is not clearly established, health and safety 
  law effectively requires dutyholders to establish explicitly the significance of the risks to 
  determine what action needs to be taken. Where it is not possible to demonstrate 
  ALARP by good practice features and risk estimates alone, the benefits of risk 
  reducing measures should be compared with their costs. Sometimes it is helpful to use 
  a common unit, which is generally money, so that the analysis may become a form of 
  Cost Benefit Analysis (CBA). The degree of quantification is case dependent, but must 
  be sufficient to make the case fit for purpose. In particular, a CBA is unlikely to be 
  considered an adequate argument on its own that a situation is ALARP [14]. The 
  following paragraphs give further brief guidance on quantitative approaches, on 
  numerical estimation of risks, and on the application of CBA and other quantitative 
  approaches. Further guidance to inspectors is provided in HSE's generic Principles for 
  CBA [7] the CBA Checklist [9]; HSE's policy in regard to CBA is summarised in 
  Appendix 3 of R2P2
   [1] and paragraphs 101-108 of its main text. 
   Risk Estimation 
   The outline of a quantitative case is relatively straightforward. The benefit requires two 
  estimates of risk: one before the implementation of the improvement and one after. 
  The safety benefit of the improvement is the incremental difference in risk between the 
  two estimates in terms of the detriments (i.e. all the adverse consequences) and their 
  likelihoods, summed over the remaining life of the facility. It is anticipated that a broad 
  comparison of these benefits and the costs of the improvement can in many cases 
  lead to a decision without needing to translate the risk reduction into monetary terms. 
  In other cases the detriments may need to be expressed in terms of money to compare 
  with the costs of the improvement.  
   The level of risk without the improvement sets the starting point on the risk scale and 
  so influences the gross disproportion factor (see para 5.4 (8) and [9]). The selection of 
  an appropriate gross disproportion factor will also depend on the robustness of the 
  analysis and so should be one of the parameters varied in sensitivity studies.  
   Where a CBA is employed, inspectors should verify that the scope of the CBA is 
  sufficient and comprehensive. In particular, there should be a process of systematic 
  identification and assessment of benefits and detriments, supported by a suitable 
  sensitivity analysis.  
   The use of CBA for comparing the sacrifice from making improvements against the 
  safety benefits gained is part of the regulatory process followed during the production 
  of new regulations by HSE and other government departments. Less well developed is 
  the use of CBA in decision making within the type of goal-setting regulation which ONR 
  uses. TOR
   [2] Appendix 3 considers the application of CBA to nuclear safety 
  assessment and concludes that whilst it may be useful in some circumstances (e.g. 
  where quantification can be obtained without disproportionate effort or excessive 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 10 of 29 
    
    
    
    
    
   Office for Nuclear Regulation  
   uncertainty), it was not feasible, at the time of writing to develop a CBA ""rule book"" 
  approach that can be applied mechanistically. Principles for CBA [7] further 
  acknowledges that HSE has no algorithm to determine this factor, which needs to be 
  set on a case-by-case basis.  Subsequent regulatory experience (since TOR) suggests 
  there would be little benefit in ONR developing such a “rule book” in view of the types 
  of safety case arguments we normally see and the overriding need for licensees to 
  consider relevant good practice as the starting point for their risk assessments. Cost 
  screening can be a useful aid to help decide if more needs to be done; justified risk 
  estimates are used together with reasonable accident cost estimates, to provide an 
  indication of the amount worth spending to remove the risk. If this amount is low, even 
  taking account of potential uncertainties and gross disproportion, compared with the 
  cost of any realistic risk reduction measures, then it can be a useful indicator that no 
  further risk reduction is needed.   
   In calculating the accident risk it is important that all the changes in risks due to the 
  potential modification are accounted for (see also para 17 of the HSE ALARP Principles 
  [3]). It is important to be sure that licensees do not understate the value of the benefit 
  from the improvement by limiting the analysis to only the most severe of risks.  
  Assessors should therefore check that licensees have not masked potential 
  improvements which would affect non-dominant risks by considering only changes to 
  the overall risk: all possible risk reductions should be viewed on their own merits. 
   TOR
   Some quantitative arguments may involve balancing risks, for example 
  implementation 
  of 
  a 
  modification 
  to 
  reduce 
  risk 
  to 
  the 
  public 
  might 
  lead 
  to 
  a 
  dose 
  uptake 
  during 
  the 
  work, 
  and 
  hence 
  a 
  transfer 
  of 
  risk. 
  Although 
  [2] 
  gives 
  the 
  tolerable 
  individual 
  risk 
  to 
  a worker 
  as 
  ten 
  times 
  higher 
  than 
  that 
  to 
  the 
  general 
  public, 
  this 
  should 
  not 
  be 
  interpreted 
  to 
  imply 
  that 
  risks 
  to 
  different 
  groups 
  should 
  be 
  valued 
  differently 
  for 
  ALARP 
  purposes 
  (see 
  paras 
  37 
  & 
  38 
  of 
  the 
  [3]). 
  The 
  issue 
  of 
  balancing 
  risks 
  may 
  also 
  need 
  to 
  involve 
  cooperation 
  with 
  other 
  agencies 
  (e.g. 
  the 
  Environment 
  Agency 
  & 
  Scottish 
  Environment 
  Protection 
  Agency 
  (SEPA)) 
  if 
  some 
  of 
  the 
  risks 
  are 
  associated 
  with 
  authorised 
  discharges, 
  protecting 
  the 
  environment 
  or 
  disposal 
  of 
  radioactive waste. 
  The Environment 
  Agency 
  employs 
  the 
  concept 
  of 
  “Best 
  Available 
  Techniques” 
  (BAT) 
  to 
  establish 
  the 
  appropriate 
  levels 
  of 
  protection 
  and 
  SEPA use “Best Practical Means” BPM. In reality BAT and BPM require dutyholders to 
  follow 
  a 
  very 
  similar 
  process 
  of 
  balancing 
  to 
  that 
  used 
  in 
  ALARP 
  determinations. 
  This 
  is discussed further in para 6.36.  
   Principles 
   HSE 
   ALARP 
   Valuation of Detriments 
   Valuation of detriments is still a subject of much discussion and research. HSE uses a 
  figure [9] of £1.5million (2009) for the Value of Preventing a statistical Fatality (VPsF). 
  In the case of death caused by cancer, HSE has taken the view that people are 
  prepared to pay a premium and R2P2 says that a higher figure, twice the above should 
  be used. It is suggested here that this premium is also appropriate for all radiation 
  deaths. However, continuing research has questioned the validity of applying a 
  premium, and so it is possible that the premium may be removed at some future date.  
  Noting that in most cases a factor of 2 will not have any material effect on what is / is 
  not reasonably practicable given the uncertainties generally prevalent in CBA, this 
  aspect will not normally be important.  However, in the unlikely case that including this 
  factor is the pivotal aspect in determining whether an improvement reduces risks to 
  ALARP, inspectors should seek the advice of the relevant ONR Professional Lead as 
  to the current status of the research into this area. 
   6.14 
   6.15 
   6.16 
   6.17 
   Accidental releases of radioactive material may lead to widespread contamination off 
  and within the facility or site. Off-site it will lead to other safety-related detriments such 
  as evacuation, relocation, land interdiction and food bans. Attempts to cost all of these 
  have been made by licensees both for reactors and for chemical plant, based on the 
  HPA (now Public Health England) model COCO-1 [15].  An updated model, COCO-2 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 11 of 29 
    
    
    
    
    
   Office for Nuclear Regulation  
   6.18 
   6.19 
   6.20 
   6.21 
   6.22 
   [16], published in 2008, takes account of the current UK economic structure, considers 
  some of the economic effects of an accident in more detail and includes some 
  additional sources of loss.  COCO-2 now represents the benchmark when the costing 
  of detriments is part of the ALARP demonstration.   
   Costs of Implementation 
   A more difficult area for assessment may well be estimating the costs (sacrifice) of the 
  modification as these may require a knowledge of both the engineering design and the 
  costs of components etc. It is likely that the full engineering details of the modifications 
  will not be available so that accurate costings will be difficult.  
   In considering the sacrifice, it is important that only those costs relating to health and 
  safety improvements are included. The costs considered should be only those 
  necessary and sufficient for the purpose of reducing the risk and not be for ""deluxe"" 
  measures where cheaper ""standard"" measures are available. 
   Of all the cost factors, the loss of revenue is particularly problematic as it can lead to a 
  paradox: If a plant shutdown is required to implement an improvement, a high revenue 
  earning plant may be able to show it is not reasonably practicable to implement an 
  improvement which a lower revenue plant would otherwise have implemented. 
  Nevertheless ONR accepts that shutdown costs constitute a legitimate part of the 
  sacrifice and it is valid to include them. To avoid undue influence of this factor, 
  licensees should have considered the phasing of the implementation. For example, it 
  may be reasonable to delay implementation until a planned or other outage. 
  Furthermore, in some circumstances it may be established relevant good practice to 
  shutdown to enable implementation of the improvement, and in such cases these costs 
  will have already been implicitly accounted for. Where this is the case, a CBA-based 
  argument against implementing established good practice is unlikely to be acceptable. 
   Any discounting of costs and benefits into the future should follow standard Treasury 
  rules, with due allowance made for up-rating benefits to take into account predicted 
  future improvement in living standards. For further information relating to the 
  application of discount rates, inspectors are referred to 'The Treasury Green Book' [18], 
  which describes the appraisal and evaluation of Government funded projects. 
   When reviewing proposals to reduce the risks posed by an existing facility, there will 
  often be a delay before implementing improvements, for example arising from the need 
  to design/manufacture equipment. This raises questions regarding how to take this 
  intervening period into account. In such cases, the extent of the original shortfall 
  against ALARP should be based on the future life of the facility etc at the time the 
  safety case is made, and not the (shorter) remaining life following implementation. 
  However, the evaluation of the benefits arising from the improvement may take 
  account of the time to implement. In addition, consideration of the risks during the 
  period prior to implementation should apply the Time at Risk guidance discussed 
  below.  
   Difficult Areas 
   6.23 
   The purpose of this part of the TAG is to consider some of the applications of the 
  ALARP principle which can lead to contentious situations and/or difficult decisions. 
             Uncertainties 
   6.24 
   One of the difficulties in making a robust quantitative argument is that many of the 
  factors, both in determining the sacrifice and safety benefits, are subject to sizeable 
  uncertainties. Hence in making a case, particularly where it uses quantitative methods, 
  sensitivity studies to test the robustness of the arguments should always be provided. 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 12 of 29 
    
    
    
    
     
   Office for Nuclear Regulation  
   Paragraphs 89 to 93 of R2P2
   and appendix 1 of R2P2 recommend the use of a 
  precautionary approach in the face of uncertainty, i.e. assume that precautions should 
  be taken unless there is a good reason to think that the risk is insignificant (see also 
  SAPs para 30). 
   Time at Risk Situations 
   6.25 
   6.26 
   The Numerical Targets set out in SAPs are (mostly) given as frequencies based on 
  annual averages. Circumstances will arise where a higher risk will exist for shorter 
  periods of time that make the use of annualised frequency targets inappropriate. 
   There are three principal situations in which licensees may argue the acceptability of 
  increased risk for a short period to justify not spending resources to improve safety to a 
  level that would be reasonably practicable for continuous, long-term operation: 
   Through 
  Life 
  - 
  Where 
  a 
  short-term 
  increased 
  risk 
  is 
  needed 
  for 
  continued 
  normal 
  operation 
  of 
  the 
  facility. 
  Examples 
  here 
  include 
  undertaking 
  certain 
  maintenance 
  activities, 
  temporary 
  disconnection 
  of 
  safety 
  measures 
  to 
  allow 
  completion 
  of 
  essential 
  tasks or other 
  intermittent activities 
  that are 
  required 
  to 
  sustain production. 
  Residual Facility Life 
  - As a 
  facility ages, 
  its 
  safety margins may be eroded, 
  for 
  example due 
  to ageing effects, or 
  its 
  risks may appear high when compared 
  to 
  newer 
  facilities 
  designed 
  to 
  more 
  modern 
  standards. 
  Licensees 
  may 
  however 
  invoke 
  arguments 
  that 
  these 
  risks 
  are acceptable because 
  the 
  short 
  remaining 
  operating life of the facility means that significant investment is unreasonable. 
  End 
  of 
  Life 
  Legacy 
  – 
  Clean-out 
  and 
  decommissioning 
  may 
  necessitate 
  short 
  periods 
  of 
  increased 
  levels 
  of 
  risk 
  compared 
  to 
  those 
  from 
  previous 
  normal 
  operations. 
  Licensees 
  may 
  argue 
  this 
  is 
  unavoidable 
  if 
  remediation 
  of 
  the 
  facility is to be completed. 
   Through Life Risk – Specific Considerations 
   6.27 
   The guidance below is intended to provide an overall policy against which to assess 
  whether a licensee has made an adequate demonstration that all reasonably 
  practicable measures to control any short-term elevated risk have been taken. Due to 
  the large number of possible reasons for elevated short-term risk, judging whether 
  these requirements have been met for a specific situation however needs to be done 
  on a case to case basis: 
   1. 
   2. 
   3. 
   SAPs 
   (SAPs 
   Principle 
  NT.2 
  states 
  that 
  there 
  should 
  be 
  sufficient 
  control 
  of 
  radiological 
  hazards 
  at 
  all 
  times. 
  Any 
  period 
  in 
  which 
  the 
  risk 
  is 
  elevated, 
  whatever 
  the 
  situation, 
  must 
  be 
  subject 
  to 
  a 
  specific 
  demonstration 
  that 
  risks 
  are 
  controlled 
  ALARP. 
  The 
  period 
  of 
  this 
  elevated 
  risk 
  should 
  be 
  as 
  short as reasonably practicable (SAPs para 762). 
  In 
  considering 
  NT.2, 
  the 
  demonstration 
  of 
  ‘sufficient 
  control 
  of 
  radiological 
  hazards’ 
  should 
  include 
  explicit 
  consideration 
  of 
  defence-in-depth 
  levels 
  1 
  to 
  4 
  Principle 
  EKP.3), 
  and 
  the 
  hierarchy 
  of 
  such 
  measures 
  Principle EKP.5).  
  The 
  short-term 
  risk, 
  when 
  annualised, 
  should 
  not 
  exceed 
  BSLs 
  except 
  in 
  exceptional 
  circumstances. 
  Any 
  case 
  made 
  for 
  carrying 
  out 
  any 
  operation 
  which 
  requires 
  the 
  risk 
  to 
  be 
  in 
  the 
  intolerable 
  region, 
  however 
  briefly, 
  needs 
  to 
  be 
  made 
  very 
  rigorously 
  to 
  show 
  that 
  nothing 
  more 
  can 
  reasonably 
  be 
  done. 
  Such 
  circumstances 
  should 
  be 
  regulated 
  consistent 
  with 
  the 
  guidance 
  set 
  out 
  in 
  paras 
  699-700. 
  Exceptional 
  circumstances 
  may 
  include, 
  for 
  instance, 
  situations 
  not 
  originally 
  foreseen 
   (SAPs 
   SAPs 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 13 of 29 
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   4. 
   5. 
   6. 
   in 
  the 
  design 
  of 
  the 
  facility. 
  It 
  is 
  expected 
  that 
  the 
  licensee 
  will 
  put 
  arrangements in place to prevent a recurrence of the unforeseen situation. 
  The extent of the time for which the risk is increased should not be the sole 
  argument 
  for 
  acceptability 
  that 
  a 
  situation 
  reduces 
  risks 
  to 
  ALARP. 
  The 
  safety 
  case 
  should, 
  drawing 
  from 
  appropriate 
  relevant 
  good 
  practice, 
  consider 
  whether 
  or 
  not 
  additional 
  measures 
  are 
  necessary. 
  As 
  in 
  any 
  consideration 
  of 
  ALARP, 
  the 
  magnitude 
  of 
  the 
  potential 
  consequences 
  should also be a factor, as well as the likelihood of the risk being realised. 
  During 
  operations 
  which 
  impose 
  a 
  planned 
  short-term 
  risk, 
  additional 
  monitoring of the actual plant state should be undertaken to ensure that the 
  mode 
  of 
  operation 
  and 
  the 
  time 
  during 
  which 
  it 
  persists 
  meet 
  the 
  assumptions in the ALARP case. 
  Unexpected failures of plant and equipment may 
  lead to an increase in risk 
  that 
  is 
  so 
  high 
  that 
  BSLs 
  are 
  exceeded 
  and 
  the 
  risks 
  thus 
  judged 
  “intolerable” 
  (see TOR
  [2]). 
  In such cases 
  the 
  licensee should be actively 
  managing 
  and 
  prioritising 
  the 
  situation 
  to 
  reduce 
  the 
  risks 
  back 
  to 
  ALARP 
  as 
  quickly 
  as 
  possible. 
  It 
  certainly 
  should 
  not 
  be 
  the 
  case 
  that 
  a 
  facility 
  is 
  allowed 
  to 
  operate 
  at 
  this 
  level 
  of 
  risk 
  unless 
  there 
  is 
  no 
  alternative 
  (see 
  paras 699-700 of the SAPs). 
   Residual Facility Life – Specific Considerations 
   6.28 
   The SAPs (para 35) note that as a facility ages, its safety margins may be eroded, for 
  example due to the incidence of, or vulnerability to, faults increasing due to wear etc. 
  Reducing the risk level may not be possible, so a judgement then has to be made 
  whether the continued operation of the facility is acceptable at the higher risk. The 
  future planned lifetime of the facility may be a factor in making such judgements. This 
  sort of situation can be difficult where the ageing is gradual and there is no obvious 
  transition from 'safe' to 'not safe'. In such cases, careful monitoring and regular review, 
  as required of licensees through compliance with their LC15 arrangements (particularly 
  short-term reviews – see T/AST/050 [23]), is likely to be needed. 
   6.29 
   The guidance presented here relates to periods that are short in comparison to the 
  total design or operational life of the facility. It also relates to assessment of safety 
  cases either resulting from a Periodic Safety Review or at any time when a significant 
  ageing phenomenon is being considered.  
   6.30 
   The following points should be considered by inspectors in this context: 
   i. 
   ii. 
   iii. 
   The 
  safety 
  case 
  should 
  be 
  updated 
  promptly 
  to 
  take 
  account 
  of 
  any 
  relevant 
  new 
  knowledge 
  or 
  experience 
  and 
  data 
  appropriate 
  to 
  the 
  current 
  and 
  predicted 
  future 
  state 
  and 
  mode 
  of 
  operation 
  of 
  the 
  facility. 
  Comparison 
  with 
  modern 
  standards 
  of 
  engineering 
  and 
  operation 
  and 
  risk criteria should be undertaken. 
  The 
  revised 
  risk 
  assessment 
  must 
  show 
  that 
  the 
  facility 
  is 
  tolerable 
  for 
  future 
  operations. 
  For 
  example 
  the 
  numerical 
  risk 
  estimates 
  should 
  not 
  be 
  greater 
  than 
  BSLs. 
  If 
  the 
  risk 
  is 
  deemed 
  to 
  be 
  intolerable 
  then 
  the 
  guidance in SAPs paras 699-700 should be followed. 
  Proposed 
  limits 
  on 
  remaining 
  lifetime 
  may 
  be 
  invoked 
  in 
  making 
  the 
  ALARP 
  demonstration, 
  but 
  this 
  cannot 
  be 
  used 
  to 
  justify 
  a 
  facility 
  operating 
  in 
  the 
  intolerable 
  region. A 
  case 
  not 
  to make 
  an 
  improvement 
  based 
  largely 
  on 
  limited 
  future 
  lifetime 
  would 
  only 
  be 
  acceptable 
  where 
  the maximum 
  extent 
  of 
  the 
  future 
  operational 
  life 
  is 
  irrevocably 
  fixed. 
  In 
  cases 
  where 
  the 
  planned 
  lifetime 
  is 
  not 
  irrevocably 
  fixed, 
  a 
  minimum 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 14 of 29 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   period 
  of 
  ten 
  years 
  (or 
  the 
  unavoidable 
  necessary 
  life 
  of 
  longer) 
  should 
  be 
  considered 
  for 
  the 
  purposes 
  of 
  demonstration (see SAPs para 35). 
   the 
  facility, 
  if 
  the 
  ALARP 
   End of Life Legacy – Specific Considerations 
   6.31 
   There may be situations, particularly during cleanout and decommissioning, where the 
  risks need to be increased temporarily so that the long-term risks can then be reduced 
  or eliminated (SAPs paras 759-767). Such increased risks need to be balanced against 
  the continuing risks from doing nothing and with due consideration of the alternatives 
  available to address the hazard. Cases arguing for extensive delays to hazard 
  reduction by invoking CBA with significantly discounted future costs need to be 
  guarded against. Concentration on removal of the hazard, or on decreasing its 
  propensity to cause harm should instead be paramount. Arguments based simply on 
  time at risk will not generally be sufficient. 
   6.32 
   During the course of hazard reduction, which may be for a significant time, it is 
  expected that suitable engineering and/or operational arrangements will be made to 
  minimise, so far as is reasonably practicable, both the magnitude and time of the 
  higher risk, balancing e.g. operational doses and the potential for accidental releases.  
  Further details on these aspects are addressed in T/AST/026 on Decommissioning). 
   Arguments for allowing an increase in risk 
   6.33 
   6.34 
   6.35 
   Licensees may argue that moving to a less protected situation meets the ALARP 
  criteria e.g. by suggesting that increases in risk are more than balanced by the gains in 
  reduced operational costs or increased operating profit. Other factors, particularly 
  those relating to good practice and previous experience, would militate against this 
  argument and, in general, ONR would require previous good practice to be upheld.  
   To succeed in an approach where risks appear to increase, the licensee would have to 
  show “changed circumstances”, as noted in para 39 of the HSE ALARP Principles [3], or 
  that the existing situation went well beyond what was required by ALARP. In addition, 
  any case for reducing safety would also have to show that additional safety measures 
  are not reasonably practicable in the new situation. However, where the level of risk is 
  low, and the increase in risk is small and forms part of a package which overall 
  improves health and safety, the licensee’s proposals should be considered in this 
  wider context.  
   Other grounds which may be acceptable are where the risks are low and the measures 
  in place can be shown to be unduly conservative as a result of new knowledge. In 
  other cases a change may be forced due to it being impossible to replace like-for-like 
  components due to obsolescence. Another possibility is where the safety case 
  contains generous margins which can be relaxed without any diminution in the 
  required level of safety. Many people feel uncomfortable about accepting increased 
  risks, which is often referred to as ""reverse"" or ""negative"" ALARP, but in the past ONR 
  has accepted cases which meet the above criteria and HSE's ALARP principles (para 
  39 of the HSE ALARP Principles) anticipate the need to deal with such situations. 
   Regulatory Application of ALARP and BAT/BPM 
   6.36 
   Another area where an increase in risks (on and/or off-site) can occur is where 
  additional measures need to be taken on the site to reduce the quantity of radioactive 
  material permitted to be discharged to the environment in normal operations. This 
  usually results from activities regulated by the Environment Agency and SEPA to 
  reduce discharges to comply with Best Available Techniques (BAT) (or Best Practical 
  Means (BPM) in Scotland). Possible consequences of these additional measures are 
  that on-site accumulation of radioactive waste will increase (unless a disposal route 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 15 of 29 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   6.37 
   6.38 
   exists), or safety risks to workers will rise (e.g. from implementing and/or operating the 
  new measures).   
   Concerns were historically expressed by the nuclear industry that different regulatory 
  application of ALARP and BAT in nuclear safety and environmental protection gave a 
  propensity for conflict. This was a factor that prompted a review of the working 
  relationship between HSE and EA in respect to nuclear sites and development of a 
  Statement of Intent between HSE and EA in 2001. A separate Statement of Intent was 
  also developed for HSE interactions with SEPA.  
   Given the different terminology used in different legislation and the requirement for 
  licensees to meet all their duties, the term “optimisation” is used in T/AST/026 
  ‘Decommissioning Technical Assessment Guide’ to refer to the level of protection that 
  meets all the legal requirements of ALARP, BAT, BPM etc. Optimisation is also the 
  term used in the IAEA Safety Fundamentals [17] where Principle 5 states “Protection 
  must be optimised to provide the highest level of safety that can reasonably be 
  achieved.” 
   6.39 
   Consequently it is important that, during optioneering studies carried out by the 
  licensee to establish the BAT or BPM option, adequate weighting is given to health and 
  safety aspects so that an overall ALARP solution that balances health, safety and 
  environmental aspects is reached in an optimised manner. Such a balance should 
  consider: 
    
   and 
   the 
   public) 
   who 
   may 
   be 
   (workers 
   The 
  number 
  of 
  people 
  exposed to radiation; 
  The likelihood of their incurring exposures; 
  The magnitude and distribution of radiation doses received; 
  Radiation risks arising from foreseeable events; 
  Economic, social and environmental factors. 
  Using good practices and common sense to avoid radiation risks as 
  far as is practical in day to day activities. 
  More guidance on how to achieve ALARP in a decommissioning context is set out in 
  T/AST/026. 
    
   
   
   
   
   6.40 
   Risk Trade-offs 
   6.41 
   If a change to the design or operation of a facility is implemented to reduce a particular 
  risk, it is highly likely that there will be other effects which could alter the risk profile of 
  the facility. Paras 36 to 38 of HSE's ALARP Principles [3] refers to this as Risk Transfer 
  and confirm the importance of considering all of the risks within the licensee's control 
  as part of a balanced decision on how to reduce overall risks to ALARP (see also para 
  26(d)). It has already been emphasised that the full effect of the implementation needs 
  to be considered in terms of the reduction in risks, but it should be borne in mind that 
  risks may also be increased in other areas. For example, risks from radiological 
  hazards may be from accident or normal operational risks; these could affect the public 
  and/or persons on-site; there may be conventional (non-radiological) risks arising from 
  the changes. It is important therefore, when considering implementation of a 
  modification, to consider whether the licensee has analysed all relevant types of risk 
  and that any increase in risk in other areas is not greater than the decrease in the area 
  being analysed.  
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 16 of 29 
    
    
    
    
    
   Office for Nuclear Regulation  
   Dose/Risk Sharing 
   6.42 
    When considering doses that are received in normal operation, a certain degree of 
  dose sharing is acceptable to reduce doses to individual workers and hence their risks. 
  The IRR ACoP [12] says that if a choice between restricting doses to individuals and 
  groups has to be made, priority should be given to keeping individual doses as far 
  below dose limits as reasonably practicable. Dose sharing might reduce individual 
  doses further but should not be used as a primary means of complying with dose 
  limits. Priority should instead be given to changing methods of work, improving 
  engineering controls and adopting other means of restricting exposure. In the case of 
  doses received due to accidental releases, the concept of risk sharing for workers by 
  use of occupancy factors may be questionable; individual risk cannot be made 
  acceptable by using many people for short periods so each only gets a small portion of 
  the total risk.  
   Occupancy Factors 
   6.43 
   In the analysis of an individual fault scenario, the risks and protection measures should 
  be assessed with respect to the potential dose to a worker who is exposed to the 
  consequences of identified faults/events. The likelihood of a particular fault/event 
  should not be judged acceptable on one facility, and not on another, merely because 
  there are more people working within the first facility to ""share"" the risk. When 
  summing risks to an individual worker on a facility from all faults (e.g. for comparison 
  against SAPs Target 5), it is acceptable to consider justified ""occupancy"" factors as not 
  all persons on-site will be exposed to all the risks from the facility.   
   6.44 
   Occupancy claims need to be considered carefully as the occupancy under 
  consideration can mean different things: 
    
    
    
   If 
   the 
   risk 
   being 
   the 
  fraction 
  of 
  time 
  a 
  specific 
  individual 
  is 
  on-site. 
  estimated is to a specific individual this factor is valid. 
  the 
  fraction 
  of 
  risks 
  on 
  a 
  particular 
  facility 
  or 
  site 
  that 
  a 
  specific 
  individual may be exposed to. Again if calculating specific individual risk 
  is the aim, including this factor is valid. 
  the 
  likelihood 
  of 
  a 
  worker 
  being 
  in 
  the 
  vicinity 
  of 
  an 
  accident. 
  Where 
  a 
  worker 
  may 
  be 
  present 
  for 
  part 
  of 
  the 
  time 
  and 
  the 
  fault 
  is 
  random, 
  there 
  are 
  two 
  situations 
  to 
  consider: 
  in 
  assessing 
  the 
  risk 
  in 
  cases 
  where 
  the 
  occupancy 
  is 
  controlled 
  it 
  is 
  valid 
  to 
  consider 
  the 
  occupancy 
  factor, 
  but 
  where 
  the 
  occupancy 
  is 
  uncontrolled 
  (e.g. 
  in 
  a 
  corridor) 
  the 
  dose should be assessed assuming a person is present. 
   In considering SAPs Target 6, which addresses doses from single accidents on site, it 
  is expected that estimates will be made assuming someone is present unless 
  adequate control measures are in force to ensure their absence (see SAPs Annex 2). 
  Should the summed risk to any worker be high however, then justified occupancy 
  claims can be considered, along with any proposals to control exposure etc. 
   Long-Term Risk Assessment 
   There is a growing perception that risks that are imposed, that are unevenly 
  distributed, or that affect future generations should be scrutinised and seen to be 
  justified (R2P2
  , paras 47 & 48). Some projects in the nuclear industry, and 
  particularly those associated with radioactive waste management and 
  decommissioning, run over many years, and the risks that result may affect future 
  generations of workers and the public as well as the present generation. For such 
   6.45 
   6.46 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 17 of 29 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   6.47 
   6.48 
   cases the risks should be assessed in a holistic manner and not restricted to part of 
  the overall time period or part of a process.  
   In general, we should seek to protect future generations at least as well as we seek to 
  protect the present one. Although it could be argued that the next few generations may 
  gain some indirect benefit, the uncertainty of how they will view the risks left to them 
  (and indeed the uncertainty of any benefits further into the future) argues for a 
  precautionary approach  (R2P2
  , paras 89-93) and hence a particularly stringent 
  demonstration that risks are indeed ALARP. We would therefore expect to see 
  particular efforts made to demonstrate that risks to future generations are at least 
  consistent with the levels of risk that would be accepted as adequate protection for the 
  present generation.  
   Given the uncertainties in estimating long-term future risks, good practice and the 
  application of the Engineering Key Principles hierarchy with the emphasis on control of 
  hazard (see SAPs EKP 1-4) are likely to be much more important than numerical risk 
  estimates and CBA in establishing the way forward. In this context it is worth bearing in 
  mind that a 1x10 -4/ yr risk for one year implies a low likelihood of someone being hurt, 
  whereas 1x10 -4/ yr for 10000 years implies a high likelihood of an adverse 
  consequence. 
   SFAIRP and the Requirement for Risk Assessment 
   6.49 
   7. 
   7.1 
   The requirement to carry out a risk assessment and produce a safety case is absolute 
  and cannot be argued against on the grounds that the costs are grossly 
  disproportionate to the risks (see para 26c). Instead, the scope, depth and effort put 
  into the risk assessment / safety case should be proportionate to the level of risk and 
  hazard. 
   ALARP AND REGULATORY DECISIONS 
   Licensees may need to conduct their undertakings in a given way in order to secure 
  certain societal or public interest benefits such as activities in “the interests of national 
  security” or “keeping the lights on”, or because “the priorities for a fixed national 
  (government) budget lie elsewhere”.  Claims related to such “Strategic Imperatives” 
  can sometimes appear in safety cases in the context of “time”, or “trouble” aspects, on 
  the sacrifice side of the ALARP balance.  Inspectors should however, make their 
  judgements on whether the legal duty to reduce risks to ALARP has been met 
  independently of such considerations, as these normally lie beyond the scope of 
  HSWA.  Instead these Strategic Imperatives will normally be a factor informing ONR’s 
  enforcement decisions.  For instance, if risks have not been reduced to ALARP, 
  relevant Strategic Imperatives can and should be taken into account by those with 
  delegated authority when determining proportionate enforcement action, or in 
  decisions whether to grant a permission. Guidance on what to do when dealing with 
  Strategic Imperatives is provided in the following two sections.  
   Enforcement Decisions 
   7.2 
   Enforcement decisions within ONR are made in accordance with the ONR’s 
  Enforcement Policy Statement [22], which sets out the principles, purpose and methods 
  of enforcement.  A spectrum of enforcement options is available depending on the 
  circumstances.  These range from providing verbal or written advice, delaying or 
  refusing to grant a permission for a given activity, issuing Improvement or Prohibition 
  Notices, through to prosecution in the most serious cases.  Reflecting this, HSE has 
  developed the Enforcement Management Model (EMM) to guide regulators in making 
  consistent and proportionate enforcement decisions.   
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 18 of 29 
    
    
    
    
    
   Office for Nuclear Regulation  
   7.3 
   7.4 
   7.5 
   7.6 
   8. 
   8.1 
   ONR guidance on applying the EPS within the framework of the Nuclear Licencing 
  regime is provided in “The Enforcement Management Model in ONR”, NS-ENF-GD-002  
  [19].  In applying the EMM to ALARP decisions, inspectors should establish the 
  seriousness of shortfalls with reference to the risk gap (i.e. between where the licensee 
  is and where they ought to be when complying with the law).  This should then be used 
  to inform ONR’s decision on appropriate enforcement action.  It is at this point in the 
  EMM process that Duty holder and Strategic Factors should be taken in to account, 
  and not when determining legal compliance.  
   Permissioning Decisions 
   Similarly, where the licensee’s ALARP justification is part of a request to grant a 
  permission required under a nuclear site Licence Condition, ONR inspectors should 
  distinguish between wider arguments related to Duty holder and Strategic Factors and 
  the judgement as to whether risks are reduced to ALARP.  Ultimately, consideration of 
  an ALARP shortfall in the context of these wider factors may lead ONR to nonetheless 
  grant permission for the activity, e.g. where it is deemed in the public interest to do so.  
  The supporting audit trail (i.e. the Project Assessment Report, PAR) for such Licence 
  Instruments should clearly define the rationale for the decisions made, and detail why 
  the permission has been granted, despite the evident shortfall(s) in demonstrating 
  ALARP. 
    It must also be recognised that, in accordance with ONR’s regulatory philosophy and 
  irrespective of any claims of Strategic  Factors, there may be situations where the 
  licensee has not adequately demonstrated that risks have been reduced to ALARP, 
  but where the gap is such that it would be disproportionate not to grant a permission.  
  In these cases, inspectors should work with the licensee to bring the situation back into 
  legal compliance, but this process should not (depending on the EMM) necessarily 
  mean that our permission is withheld. 
   ONR’s published guide to risk informed regulatory decision making [28] gives further 
  information on the factors involved in decision making and notes that “There can also 
  be other wider factors (beyond dutyholder and strategic factors), such as ‘in the 
  interests of national security’, that we term strategic imperatives, where we do not have 
  the authority or sufficient knowledge of the considerations involved to judge the 
  significance of such factors. Strategic imperatives would not normally change our 
  regulatory decision, but may require a different course of action. In such 
  circumstances, we would work collaboratively with the dutyholder to ensure the best 
  safety outcome within the constraints of the imperative, but also to ensure that all 
  relevant stakeholders understand the implication of the chosen course of action. Such 
  circumstances have been, and are likely to remain, extremely rare.”  
   CHECKLIST 
   Attached at Annex 1 is a checklist of the main assessment points which will help 
  inspectors decide whether all the key points have been addressed by the licensee in 
  its ALARP assessment. 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 19 of 29 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   9. 
   REFERENCES 
   1. 
  2. 
  3. 
   have 
   Reducing risks protecting people. HSE Books 2001
  HSE. The Tolerability of Risk from Nuclear Power Stations, HMSO, 1992.
  Principles 
  and 
  guidelines 
  to 
  assist 
  HSE 
  in 
  its 
  judgements 
  that 
  dutyholders 
  risk as low as reasonably practicable.  
  Assessing compliance with the law in individual cases and the use of good practice. 
  Policy and Guidance on reducing risks as low as reasonably practicable in design. 
  The Regulation of Nuclear Installations in the UK including Notes for Applicants.
  Principles for Cost Benefit Analysis (CBA) in support of ALARP decision. 
  ALARP ""at a glance"". 
  Cost Benefit Analysis (CBA) Checklist. 
  10. ONR. Safety Assessment Principles for Nuclear Facilities. 2014. 
  11. NRPB - Documents of the NRPB vol. 4(2) 1993 
   4. 
  5. 
  6. 
  7. 
  8. 
  9. 
   reduced 
   12. HSE. Work with Ionising Radiation, Ionising Radiations Regulations 2017, Approved 
   Code of Practice and Guidance,  ISBN 978071766621  
   13. Not Used. 
  14. Harbison, 
  S. 
  A 
  Safety 
  Assessment 
  and 
  Objectives 
  for 
  Plant 
  Designed 
  Ago, Paper presented at ENS Conference, TOPSAFE 95, Budapest 
  15. Haywood 
  S 
  M 
  et 
  al 
  COCO-1: 
  Model 
  for 
  Assessing 
  the 
  Costs 
  of 
  Consequences of Accidental Releases of Radioactivity, NRPB-R243, 1991 
   40 
   Years 
   Offsite 
   16. COCO-2: A model to Assess the Economic Impact of an Accident, HPA-RPD-046, 2008 
   17. IAEA Fundamental Safety Principles: Safety Fundamentals no. SF-1. 
  IAEA Vienna 
  2006 http://www-pub.iaea.org/MTCD/publications/PDF/Pub1273_web.pdf  
   18. HM Treasury Green Book. 
  19. Guidance 
  on 
  the 
  use 
  of 
  the 
   therein to the EMM. 
   Enforcement 
   Management 
   Model 
   NS-ENF-GD-002 
   See 
   links 
   20. Nuclear power station generic design assessment – guidance to requesting parties HSE   
  21. Western European Nuclear Regulators’ Association – WENRA  
  22. ONR’s Enforcement Policy Statement 
  23. T/AST/050 - ND Technical Assessment Guide on Periodic Safety Reviews 
  24. Not used 
  25. T/AST/051 
  - 
  ND 
  Technical 
  Nuclear safety Cases  
   Assessment 
   purpose, 
   content 
   scope 
   Guide 
   on 
   the 
   and 
   of 
   26. WENRA 
  statement 
  on 
  safety 
  objectives 
  for 
  new 
  nuclear 
  power 
  plants 
  2010.  
  http://www.wenra.org/media/filer_public/2012/11/05/wenra_statementonsafetyobje
  ctivesfornewnuclearpowerplants_nov2010.pdf 
  27. WENRA guidance on “Timely Implementation of Reasonably Practicable Safety 
  Improvements to existing Nuclear power plants”. 2017.  
  http://www.wenra.org/archives/wenra-guidance-article-8a-nuclear-safety-directive/ 
  28. ONR, Risk informed regulatory decision making, 2017, 
  www.onr.org.uk/documents/2017/risk-informed-regulatory-decision-making.pdf. 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 20 of 29 
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   10. 
   GLOSSARY AND ABBREVIATIONS 
   ACoP 
  ALARP 
  BSL 
  BSL(LL) 
  BSO 
  CBA 
   EA 
  HPA 
  HSE 
  HSAW 
  IAEA 
  IRR 
  NDA 
  NIA 
  PSA 
  PSR 
  R2P2 
  SAP 
  SFAIRP 
  SEPA 
  TAG 
  TOR 
  WENRA 
   Approved Code of Practice 
  As Low As Reasonably Practicable 
  Basic Safety Level 
  Basic Safety Level (legal limit) 
  Basic Safety Objective 
  Cost Benefit Analysis 
   Environment Agency 
  Health Protection Agency 
  Health and Safety Executive 
  The Health and Safety at Work etc Act 1974 
  International Atomic Energy Agency 
  Ionising Radiation Regulations 2017 
  Nuclear Decommissioning Authority 
  Nuclear Installations Act 1965 (as amended) 
  Probabilistic Safety Analysis 
  Periodic Safety Review 
  Reducing Risk Protecting People 
  Safety Assessment Principle(s)  
  So Far As Is Reasonably Practicable 
  Scottish Environment Protection Agency 
  Technical Assessment Guide(s) 
  Tolerability of Risk 
  Western European Nuclear Regulators’ Association 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 21 of 29 
    
    
    
    
    
     
    
    
    
   Office for Nuclear Regulation  
   11. 
   APPENDICES 
   Annex 1 - ALARP Checklist 
   A1.1 
  The 
  risks 
  must 
  be 
  ALARP. 
  If 
  the 
  engineering 
  and 
  operation 
  of 
  the 
  facility 
  gives 
  no 
  cause 
  for 
  concern, 
  and 
  the 
  risks 
  are 
  adequately 
  demonstrated 
  to 
  be 
  ""broadly 
  acceptable"" 
  (i.e. 
  below 
  all 
  the 
  BSOs) 
  then 
  this 
  is 
  sufficient 
  for 
  ONR 
  assessment 
  purposes. 
  If 
  the 
  risks 
  are 
  above 
  a 
  BSO, 
  then 
  inspectors 
  should 
  consider 
  specifically 
  whether these are reduced to ALARP. 
   A1.2 
  If 
  the 
  risks 
  exceed 
  a BSL 
  or 
  fall 
  significantly 
  short 
  of 
  an 
  accepted 
  relevant 
  good 
  practice, 
  e.g. 
  evidently 
  poor 
  engineering 
  or 
  sub-standard 
  operations 
  (procedures 
  or 
  implementation) 
  then 
  inspectors 
  need 
  to 
  follow 
  the 
  advice 
  set 
  out 
  in 
  paras 
  699-
  700. 
  This 
  includes 
  consideration 
  of 
  whether 
  the 
  facility 
  should 
  be 
  shutdown 
  or 
  the 
  activity curtailed. 
   SAPs 
   A1.3 
  The 
  following 
  checkpoints 
  may 
  be 
  or arguments that the risks are ALARP: 
   relevant 
   in 
   reviewing 
   licensees' 
   safety 
   cases 
   6. 
   7. 
   8. 
   9. 
   risks, 
   1. 
   2. 
   3. 
  4. 
  5. 
   refer 
   only 
   to 
   those 
   including 
   the 
   licensee 
   controls 
   (para 
   risks which 
   risks 
   that underpins 
   fit-for-purpose evaluation of 
   Is 
  there evidence of an adequate and 
  the ALARP case (para 5.3) 
  Does 
  the 
  ALARP 
  argument 
  5.4(1)) 
  Affordability is not a legitimate factor in the assessment of costs (para 5.4(2)) 
  ALARP cannot be used to argue against statutory duties (para 5.4(3)) 
  Does 
  the 
  ALARP 
  argument 
  take 
  adequate 
  account 
  of 
  all 
  types 
  of 
  conventional (i.e. non-radiological) risks (para 5.4(4)) 
  Have 
  all 
  relevant 
  options 
  been 
  considered 
  by 
  the 
  licensee 
  and 
  does 
  the 
  licensee's 
  study 
  of 
  the 
  options 
  begin 
  with 
  the 
  safest 
  (as 
  opposed 
  to 
  the 
  cheapest) 
  option 
  para 
  5.4(5)) 
  If 
  measures 
  are 
  deemed 
  not 
  reasonably 
  practicable, 
  has 
  partial 
  implementation 
  been 
  considered? Inspectors need also to be wary of ""deluxe"" measures unduly 
  inflating the 
  cost para 5.4(5)) 
  Is 
  the 
  rigour of ALARP case made commensurate with 
  under consideration (para 5.4(7)) 
  For 
  measures 
  deemed 
  not 
  reasonably 
  gross disproportion (para 5.4(8)) 
  10. The 
  ALARP 
  arguments 
  should 
  include 
  explicit 
  consideration 
  of 
  qualitative 
  features 
  related to engineering and other types of relevant good practice (para 6.1 – 6.49). 
  11. The 
  ALARP 
  argument 
  should 
  be 
  based 
  on 
  comparisons 
  with 
  relevant 
  good 
  practice, 
  informed 
  as 
  necessary 
  by CBA 
  (para 
  6.13), 
  rather 
  than 
  the 
  other way 
  around. A CBA 
  on its own is not acceptable as an ALARP case.  
  12. Are 
  all 
  of 
  the 
  relevant 
  engineering 
  SAPs 
  met? 
  If 
  not, 
  has 
  the 
  licensee 
  considered any deficiencies from an ALARP perspective (para 6.8) 
  13. ALARP 
  applies 
  at 
  all 
  times 
  and 
  arguments 
  employing 
  Time 
  at 
  Risk may 
  consideration (para 6.24 – 6.31). 
  14. Reverse 
  ALARP 
  arguments 
  for 
  increased 
  risk 
  are 
  only 
  allowable 
  in 
  circumstances’ 
  or 
  where 
  the 
  licensee 
  can 
  show 
  that 
  the 
  existing 
  situation 
  beyond what is required by ALARP (para 6.35).  
   ‘changed 
  goes 
  well 
   in 
   the scenario 
   demonstrated 
   the 
   level of 
   risk 
   practicable, 
   identified 
   need 
   special 
   has 
   the 
   licensee 
   and 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 22 of 29 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   15. Dose 
  sharing: 
  Has 
  the 
  licensee 
  given 
  adequate 
  consideration 
  to 
  changing 
  working 
  methods, 
  engineering 
  controls 
  or 
  other 
  means 
  of 
  dose 
  restriction 
  before 
  proposing 
  dose sharing (para 6.42) 
  16. Have occupancy factors in assessments of worker risk been properly considered (para 
  6.43) 
  17. Have safety and environmental factors been considered in an optimised manner during 
  optioneering 
  studies 
  in 
  order 
  to 
  meet 
  all 
  legislative 
  requirements 
  of 
  ALARP 
  and 
  BAT 
  (para 6.36 – 6.39)  
  18. Have strategic imperatives been used as justification for the activity where risks are not 
  actually reduced ALARP (para 7.1)    
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 23 of 29 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Annex 2 – ALARP for proposed new civil nuclear reactors 
   A2.1 
  In 
  the 
  context 
  of 
  the 
  Generic 
  Design 
  Assessment 
  (GDA) 
  process 
  for 
  new 
  reactor 
  designs 
  ONR 
  has 
  to 
  judge 
  whether 
  the 
  legal 
  duty 
  of 
  controlling 
  and 
  reducing 
  risks 
  so 
  far 
  as 
  is 
  reasonably 
  practicable 
  (SFAIRP), 
  usually 
  referred 
  to 
  within 
  HSE 
  as 
  ALARP 
  (as 
  low 
  as 
  reasonably 
  practicable), 
  will 
  be met. 
  In 
  contrast 
  to 
  the majority 
  of 
  cases 
  we 
  normally 
  deal 
  with 
  at 
  existing 
  licensed 
  sites, 
  the 
  ALARP 
  arguments 
  presented 
  for 
  GDA 
  will 
  not 
  relate 
  to whether additional 
  features should be 
  implemented 
  to an existing design, but will 
  instead 
  involve consideration of 
  the 
  facility’s design as a whole. 
   Thus 
  the position when a 
  new reactor design is presented to us goes beyond the situations considered in other HSE 
  ALARP guidance.   
  A2.2 
  Although 
  nominally 
  at 
  the 
  design 
  stage, 
  all 
  of 
  the 
  proposed 
  designs 
  are 
  essentially 
  complete 
  in 
  terms of 
  the overall concept and major systems, and have 
  reached 
  that stage 
  after 
  many 
  years 
  of 
  development 
  and 
  optimisation 
  in 
  non-UK 
  regulatory 
  environments. 
  However, 
  the 
  essence 
  of 
  the 
  UK 
  system 
  is 
  goal-setting 
  and 
  the 
  main 
  objective 
  is 
  to 
  see 
  whether 
  the 
  reactor 
  designs 
  represent 
  an 
  ALARP 
  outcome 
  rather 
  than 
  to 
  examine 
  the 
  route 
  by 
  which 
  that 
  end 
  was 
  achieved. 
  Similarly, 
  ONR 
  needs 
  to 
  look 
  at 
  the 
  design 
  holistically 
  and 
  be 
  guided 
  by 
  overall 
  safety 
  rather 
  than 
  focussing 
  on 
  incremental 
  changes 
  (e.g. 
  the 
  thickness 
  of 
  a 
  concrete 
  wall, 
  or 
  level 
  of 
  redundancy 
  in 
  a 
  single 
  system) 
  to 
  individual 
  elements 
  of 
  the 
  safety 
  argument 
  in 
  isolation. 
  Hence 
  the 
  intention 
  is 
  not 
  to 
  seek 
  new, UK-specific design features, but to see that the law is met. Furthermore we recognise 
  there 
  are 
  safety 
  benefits 
  in 
  standardisation: 
  a 
  wider 
  pool 
  of 
  experience 
  will 
  inevitably 
  provide 
  better 
  feedback 
  for 
  future 
  improvement 
  in 
  safety 
  and 
  this 
  must 
  be 
  taken 
  into 
  account. 
  It 
  is 
  also 
  worth 
  noting 
  that 
  the 
  intent 
  is 
  to 
  judge 
  whether 
  the 
  individual 
  designs 
  meet the requirement to demonstrate ALARP on their own merits, not to compare them.  
  A2.3 
  For 
  the 
  overall 
  ALARP 
  demonstrations 
  we 
  expect 
  the 
  four 
  main 
  areas 
  below 
  to 
  be 
  addressed: 
  1 
  There 
  is 
  a 
  clear 
  conclusion 
  that 
  there 
  are 
  improvements that could be implemented, and therefore the risk has been reduced to 
  ALARP. 
  2 
  This 
  is 
  the 
  basic 
  requirement 
  for 
  demonstrating 
  that 
  designs 
  meet 
  the 
  law. 
  The 
  Requesting 
  Party 
  (RP) 
  must 
  set 
  out 
  the 
  standards 
  and 
  codes 
  used 
  and 
  justify 
  them 
  to 
  the 
  extent 
  that 
  we 
  can 
  ‘deem’ 
  them 
  relevant 
  good 
  practice 
  when 
  viewed 
  against 
  our 
  SAPs. 
  This 
  justification 
  is 
  expected 
  to 
  include 
  a 
  comparison 
  with 
  other 
  international/ 
  national 
  standards. 
  Clearly 
  the 
  standards 
  and 
  codes adopted by the RP must be shown to have been met. 
  3 
   Options: This will comprise 
  two stages: Firstly an examination of 
  the RP’s 
  rationale 
  for 
  the 
  evolution 
  of 
  the 
  design, 
  using 
  its 
  forerunners 
  as 
  a 
  baseline, 
  looking 
  at 
  why 
  certain 
  features 
  were 
  selected 
  and 
  others 
  rejected 
  and 
  how 
  this 
  process 
  has 
  resulted 
  in 
  an 
  improved 
  design 
  from 
  a 
  safety 
  perspective. 
  Secondly 
  the 
  RP 
  needs 
  to 
  address 
  the 
  question 
  “what more 
  could 
  be 
  done?” 
  and 
  provide 
  an 
  argument 
  of 
  “why 
  they 
  can’t 
  do it” (i.e. why it is not reasonably practicable).  This second element could be done by 
  postulating 
  further 
  options 
  for 
  improvement 
  (previously 
  discarded 
  options 
  may 
  be 
  suitable 
  candidates) 
  and 
  evaluating 
  them. 
  Clearly 
  if 
  an 
  option 
  is 
  shown 
  to 
  be 
  reasonably 
  practicable 
  then 
  that 
  option 
  should 
  have 
  been 
  taken, 
  or 
  where 
  it 
  is 
  found 
  not 
  to 
  be 
  excessively 
  expensive 
  to 
  improve 
  safety, 
  then 
  further 
  avenues 
  for 
  risk 
  reduction should be explored.  
  4  Risk Assessment: The use of risk targets in isolation is not an acceptable means of 
  demonstrating 
  ALARP 
  and 
  we 
  expect 
  to 
  see 
  risk 
  assessments 
  used 
  to 
  identify 
  potential engineering and/or operational improvements as well as confirming numerical 
  levels 
  of 
  safety. 
  The 
  BSOs 
  in 
  the 
  SAPs 
  represent 
  broadly 
  acceptable 
  levels 
  below 
  which 
  we 
  have 
  said 
  that 
  we 
  expect 
  to 
  confine 
  ourselves 
  to 
  considering 
  the 
  validity 
  of 
  the arguments that 
  the BSOs have actually been met. We have also made 
  it clear 
  that 
   reasonable 
   practicable 
   further 
   no 
   Relevant 
   Good 
   Practice: 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 24 of 29 
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   the way in which we apply these numerical targets will depend heavily on the views we 
  form 
  on 
  the 
  engineering 
  (and 
  at 
  a 
  later 
  stage 
  operational 
  practices) 
  and 
  that 
  meeting 
  the 
  BSOs 
  is 
  not 
  a 
  green 
  light 
  for 
  RPs 
  to 
  forego 
  further 
  ALARP 
  considerations. 
  Nevertheless, well-supported numerical 
  risk 
  figures 
  that 
  show BSOs 
  to 
  be met 
  can 
  be 
  an important element of support to the overall ALARP demonstration 
  A2.4 
  In 
  support 
  of 
  these 
  four 
  elements, 
  ONR 
  expects 
  the 
  following 
  in 
  commercial reactor designs: 
   respect 
   new 
   of 
    
    
    
    
    
    
    
   
   of 
  experience 
  of 
  or 
  improved 
  the 
   The level of safety must be no less than a comparable facility already working or being 
  constructed in the UK or somewhere else in the world. 
  As 
  evolutionary 
  designs, 
  which 
  have 
  been 
  designed 
  taking 
  account 
  earlier 
  ones, 
  the 
  RP 
  must 
  show 
  how 
  the 
  evolution 
  has 
  maintained 
  design from a safety perspective. 
  The 
  demonstration 
  should 
  set 
  out 
  how 
  known 
  problem 
  areas 
  (e.g. 
  identified 
  from 
  Operational 
  Experience 
  Feedback 
  (OEF), 
  improved 
  analysis, 
  or 
  improving 
  standards) 
  have been addressed and how and why the particular solution chosen was arrived at. 
  The 
  Engineering 
  Key 
  Principles 
  (EKP) 
  1, 
  2 
  and 
  3 
  of 
  SAPs 
  should 
  be 
  seen 
  as 
  a 
  hierarchy 
  where, 
  all 
  else 
  being 
  equal, 
  the 
  higher 
  up 
  the 
  list 
  the 
  better. 
  Cases 
  where 
  this is not so will need specific justification. 
  Likewise, the hierarchy within EKP 5 should be addressed in a similar manner. 
  There 
  should 
  be 
  clarity 
  to 
  the 
  reasons 
  for 
  the 
  choice 
  of 
  design 
  standards 
  and 
  demonstration that the chosen ones lead to the safest reasonably practicable design. 
  The RP must provide evidence that it has used processes for making design decisions 
  in which safety is clearly considered and has been given the appropriate priority. 
  Risk/CBA 
  type 
  arguments 
  on 
  their 
  own 
  must 
  not 
  be 
  allowed 
  to 
  override 
  established 
  relevant good practice where this results in degradation in safety. 
  A2.5  In addition we might reasonably expect the RP to provide evidence of the following: 
   
  The RP 
  should 
  show 
  how 
  its 
  process 
  is 
  compatible with UK 
  law; 
  specifically 
  how 
  the 
  comparison 
  of 
  sacrifice 
  and 
  risk 
  averted 
  is 
  considered 
  within 
  the 
  design 
  process and what approach is used for determining “gross disproportion”; 
  Where 
  risk-based CBA-type 
  decision-making 
  has 
  been 
  used, 
  the 
  costings 
  should 
  be 
  appropriate 
  to 
  UK 
  conditions, 
  gross 
  disproportion 
  factors 
  justified 
  and 
  adequate 
  sensitivity 
  studies 
  should 
  be 
  included 
  to 
  demonstrate 
  a 
  robust 
  conclusion; 
  The 
  design 
  should 
  be 
  considered 
  holistically 
  so 
  that 
  whilst 
  individual 
  systems 
  could be 
  improved, the 
  impact on the overall risks makes 
  further 
  improvement not 
  reasonably practicable; 
  There 
  is 
  a 
  proper 
  balancing 
  of 
  all 
  risks, 
  worker/public, 
  normal 
  operation/accident, 
  radiological/conventional 
  and 
  the 
  procedures 
  used 
  to 
  ensure 
  this 
  should 
  be 
  clear 
  and adequate; 
  If any numerical targets for risks are used as cut-offs these must be justified either 
  as a whole or in individual applications; 
  In particular, where 
  intermediate 
  targets 
  rather 
  than 
  the effects on people and 
  the 
  environment 
  are 
  used, 
  the 
  RP 
  should: 
  (a) 
  explain 
  why 
  such 
  a 
  target 
  is 
  used; 
  (b) 
  explain 
  how 
  it 
  is 
  used 
  during 
  design 
  and 
  optioneering; 
  (c) 
  justify 
  the 
  specific 
  target; and (d) justify the levels of “gross disproportion” used. 
    
    
    
    
    
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 25 of 29 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Annex 3 
   RGP Common questions and answers 
   Remind me! – What is ALARP? 
   A3.1 
  ALARP stands for “as low as reasonably practicable” and is used when referring to the 
  steps necessary 
  to 
  reduce health and safety 
  risks 
  in order 
  to meet 
  legal duties. 
  It 
  is 
  the 
  term 
  used by ONR, HSE and 
  industry. 
   For almost all purposes 
  it has 
  the same meaning as 
  “so 
  far 
  as is reasonably practicable” (SFAIRP) as used in health and safety legislation.   
  A3.2 
  A 
  risk 
  has 
  been 
  reduced 
  ALARP 
  when 
  a 
  dutyholder 
  can 
  show 
  that 
  further 
  risk 
  reduction 
  is 
  not 
  justified 
  because 
  the 
  sacrifice 
  associated 
  with 
  doing 
  so 
  would 
  be 
  grossly 
  disproportionate in terms of money, time or trouble.  Sections 2 and 3 of the Health and Safety 
  at Work etc. Act 1974 require dutyholders to reduce the risks to their employees and to others 
  from 
  their 
  activities 
  SFAIRP. 
  Similar 
  requirements 
  are 
  also 
  reinforced 
  in 
  more 
  specific 
  applications 
  through 
  other 
  health 
  and 
  safety 
  legislation, 
  such 
  as 
  the 
  Ionising 
  Radiations 
  Regulations 2017. 
  A3.3 
  SFAIRP, 
  and 
  by 
  implication 
  ALARP, 
  are 
  ‘goal-setting’ 
  standards 
  that 
  provide 
  an 
  objective against which a dutyholder must select and then justify its approach to achieving it. 
   Who judges ALARP? 
   risks 
   A3.4 
  Ultimately, 
  whether 
  a 
  dutyholder 
  has 
  complied 
  with 
  its 
  legal 
  duty 
  to 
  reduce 
  ALARP in a particular case may be for a court of law or employment tribunal to decide.   
  A3.5 
  However, 
  in 
  regulating 
  the 
  industry, 
  ONR 
  (and 
  other 
  regulators) 
  effectively 
  make 
  the 
  required day-to-day 
  judgements, e.g. as part of 
  inspecting and assessing dutyholders against 
  their 
  obligations 
  and 
  in 
  deciding 
  whether 
  to 
  take 
  enforcement 
  action. 
  We 
  use 
  a 
  body 
  of 
  knowledgeable 
  and 
  experienced 
  inspectors, 
  assisted 
  by 
  comprehensive 
  guidance, 
  to 
  make 
  these 
  judgements on 
  the basis of 
  the available evidence. 
   ONR also considers ALARP during 
  the 
  assessment 
  of 
  a 
  licensee’s 
  safety 
  case 
  carried 
  out 
  as 
  part 
  of 
  making 
  a 
  permissioning 
  decision.   
  A3.6 
  Note 
  that 
  our 
  regulatory 
  decisions 
  (including 
  those 
  relating 
  to 
  enforcement 
  action 
  or 
  the granting of permission) also take into account broader factors 
  in addition to whether or not 
  legal 
  standards, 
  including 
  that 
  of 
  ALARP, 
  have 
  been 
  achieved. 
  This 
  is 
  described 
  in 
  our Risk 
  Informed Regulatory Decision Making guidance. 
   What is good practice? 
   A3.7 
  ‘Good 
  practice’ 
  is 
  a 
  generic 
  term 
  referring 
  to 
  a 
  wide 
  range 
  of 
  control 
  measures, 
  policies, practices and other aspects pertaining to a particular health and safety issue. 
  A3.8 
  Good 
  practice 
  can 
  refer 
  to 
  physical 
  aspects, 
  including 
  the 
  design 
  of 
  plant 
  and 
  equipment, the fitting of safety mechanisms, mitigating and emergency measures or to the use 
  of 
  particular 
  items 
  of 
  personal 
  protective 
  equipment. 
  It 
  can 
  equally 
  refer 
  to 
  administrative 
  control 
  measures, 
  including 
  things 
  like 
  training 
  practices, 
  maintenance, 
  inspection, 
  testing, 
  decision-making 
  processes 
  or 
  operating 
  instructions. 
  It 
  can 
  also 
  refer 
  to 
  fault, 
  hazard 
  or 
  risk 
  analysis 
  methodologies, 
  strategies, 
  design 
  principles, 
  risk 
  targets 
  and 
  other 
  approaches 
  to 
  safety analysis, substantiation or design.   
   What are the sources of good practice? 
   A3.9 
  While anyone can propose good practice, 
  there 
  is a hierarchy 
  to 
  its significance based 
  on its formal status and pedigree, i.e. the weight it might carry in a potential court case:  
  Approved Codes of Practice (ACoPs) carry the strongest weight and have a 
  special legal status.  If a dutyholder complies with the approach to a health and 
    
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 26 of 29 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
    
    
   safety issue set-out in an ACoP, then it is deemed to have complied with the 
  law.  A dutyholder may choose to follow a different approach, but then must be 
  able to demonstrate why this is equivalent or it will be considered to be below 
  minimum legal compliance.  (Note that an ACoP is usually published as a 
  single document to go with a set of regulations.  This will provide the ACoP text 
  together with accompanying non-statutory guidance.  The accompanying 
  guidance does not however carry the special legal status of the ACoP.) 
   Published regulatory guidance is also a recognised source of good practice.  
  For nuclear and conventional safety, our principal sources of good practice are 
  the Safety Assessment Principles (SAPs) and the additional guidance provided 
  in the Technical Assessment Guides (TAGs) and Technical Inspection Guides 
  (TIGs).   
   Other written sources which may be recognised as good practice include 
  guidance produced by:  
    
   
    
   other government departments; 
  national and international standard-setting bodies, e.g. the British 
  Standards Institute (BSI), International Atomic Energy Agency (IAEA), 
  International Standards Organisation (ISO), the European Committee 
  for Standardisation (CEN) or Western European Nuclear Regulators’ 
  Association (WENRA); 
  industry bodies and professional institutes, e.g. the Safety Directors’ 
  Forum (SDF), Nuclear Engineering Directors’ Forum (NEDF) or World 
  Association of Nuclear Operators (WANO). 
    
   There may be unwritten sources of good practice, for example through well-
  defined and well-established practices across a particular industrial sector.   
   A3.10 
  The 
  mixing 
  of 
  different 
  standards 
  – 
  ‘pick 
  and 
  mix’ 
  – 
  is 
  discouraged 
  where 
  there 
  is 
  an 
  applicable 
  encompassing 
  standard, 
  particularly 
  for 
  standards 
  set-out 
  in 
  regulatory 
  expectations 
  or 
  those 
  from 
  authoritative 
  national 
  and 
  international 
  bodies, 
  such 
  as 
  British 
  Standards or 
  IAEA Safety Standards. 
   However, a case 
  can be made 
  in some 
  circumstances 
  to draw upon standards 
  from different sources 
  if 
  the situation warrants 
  it. 
   The 
  important 
  thing 
  is 
  to 
  consider 
  the 
  overall 
  outcome 
  against 
  the 
  ALARP 
  requirement. 
  It 
  is 
  also 
  important 
  to 
  ensure 
  that 
  we 
  do 
  not 
  apply 
  inappropriate 
  regulatory 
  pressure 
  to 
  ‘gold-plate’ 
  the 
  solution 
  beyond what would be ALARP.  
   What is RGP? 
   A3.11 
  RGP stands 
  for 
  ‘Relevant Good Practice’. 
  It 
  refers 
  to 
  the body of good practice 
  that 
  is 
  specifically 
  relevant 
  to 
  the 
  situation 
  and 
  that 
  which, 
  if 
  implemented, 
  would 
  typically 
  be 
  considered to meet the requirement to reduce risks to as ALARP for a particular situation. 
  A3.12 
  The concept of RGP is used because there is usually well-established good practice in 
  addressing 
  a 
  particular 
  issue 
  and 
  it 
  is 
  usually 
  unnecessary 
  for 
  a 
  dutyholder 
  to 
  revert 
  to 
  a 
  detailed, 
  first-principles 
  ALARP 
  demonstration 
  in 
  most 
  circumstances. 
  RGP 
  is 
  therefore 
  helpful 
  in avoiding unnecessary replicated effort where the standard that would be required by 
  the 
  courts 
  and 
  the 
  regulator 
  is 
  well-recognised. 
  This 
  is 
  often 
  true 
  in 
  areas 
  that 
  are 
  common 
  across 
  industry, 
  including 
  many 
  aspects 
  of 
  conventional 
  health 
  and 
  safety 
  and 
  the 
  more 
  widespread aspects of nuclear and radiological safety.  
  A3.13 
  The 
  concept 
  of 
  RGP 
  is 
  less 
  helpful 
  for 
  unique 
  or 
  unusual 
  circumstances 
  because 
  typical 
  standards 
  and 
  practices 
  are 
  often 
  not 
  fully 
  relevant 
  to 
  the 
  situation. 
  In 
  these 
  cases 
  RGP 
  is 
  only 
  a 
  starting 
  point 
  for 
  a 
  more 
  detailed 
  demonstration 
  against 
  the 
  fundamental 
  ALARP 
  requirement. 
  This 
  is 
  often 
  true 
  for 
  older 
  nuclear 
  facilities 
  which 
  fall 
  short 
  of 
  modern 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 27 of 29 
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   standards 
  developed 
  since 
  they 
  were 
  constructed. 
  This 
  can 
  be 
  exacerbated 
  by 
  age-related 
  degradation, 
  making 
  decommissioning 
  more 
  challenging. 
  Whilst 
  what 
  is 
  RGP 
  elsewhere 
  should still be used as a starting point, 
  the dutyholder may be able 
  to demonstrate an ALARP 
  approach that does not meet all aspects of the usual standard in the specific circumstances. 
  A3.14 
  Remember: 
  for 
  something 
  to 
  be 
  RGP 
  it 
  must 
  be 
  ‘relevant’ 
  in 
  that 
  it 
  has 
  been 
  read-
  across 
  for 
  appropriately 
  similar 
  circumstances. 
  It 
  must 
  also 
  represent 
  ‘good 
  practice’ 
  rather 
  than ‘best practice’ (a practice beyond what the law requires). 
  A3.15 
  Note 
  that ONR 
  also 
  uses 
  the 
  concept 
  of RGP 
  to 
  underpin 
  its 
  judgment 
  of 
  compliance 
  against 
  other 
  goal-setting 
  requirements 
  in 
  addition 
  to 
  those 
  based 
  on 
  ALARP/SFAIRP, 
  such 
  as 
  “suitable 
  and 
  sufficient” 
  and 
  “adequate” 
  as 
  used 
  in 
  the 
  licence 
  conditions. 
  The 
  remaining 
  questions 
  and 
  answers 
  in 
  this 
  document 
  are 
  generally 
  also 
  applicable 
  to 
  these 
  kinds 
  of 
  goal-
  setting requirements as well as ALARP. 
   What is the legal basis of RGP? 
   A3.16 
  RGP 
  does 
  not 
  have 
  a 
  legal 
  basis 
  and 
  is 
  not 
  mentioned 
  in 
  legislation, 
  although 
  regulator’s view on what is considered to be RGP is likely to be persuasive in a court of law. 
  A3.17 
  RGP 
  is 
  based 
  on 
  regulatory 
  policy 
  and 
  refers 
  to 
  the 
  controls, 
  standards 
  and 
  approaches 
  that 
  meet 
  the 
  ALARP 
  requirement 
  based 
  on 
  what 
  has 
  been 
  accepted 
  in 
  similar 
  circumstances. 
  It 
  is 
  used 
  to 
  avoid 
  the 
  need 
  for 
  first-principles 
  ALARP 
  justifications 
  being 
  required 
  for 
  commonly 
  encountered 
  circumstances 
  or 
  to 
  provide 
  a 
  starting 
  point 
  for 
  determining the ALARP position in more complex or bespoke situations.  Adherence to RGP is 
  not a legal requirement: alternative approaches can be used.  
   a 
   Who determines RGP? 
   A3.18 
  As part 
  of demonstrating ALARP, 
  a 
  dutyholder will need 
  to 
  consider 
  and 
  judge what 
  it 
  considers to be RGP in order to be able to make an argument for the reasonable practicability 
  of 
  the 
  approach 
  it 
  has 
  taken. 
  The 
  arguments 
  and 
  evidence 
  supporting 
  ALARP 
  justifications 
  should be included within the safety case. 
  A3.19 
  The 
  regulator 
  also 
  needs 
  to 
  consider 
  and 
  judge 
  RGP, 
  based 
  on 
  the 
  sources 
  listed 
  above, to enable regulatory judgments.  In doing so, it is important to bear in mind that RGP is 
  only 
  regulatory policy, and 
  represents only an 
  interpretation of what 
  is considered 
  to meet 
  the 
  legal requirement based on similar circumstances (although a regulator’s view on what is RGP 
  will be persuasive in a court of law). 
   Are alternatives to RGP acceptable? 
   A3.20 
  Definitely! 
  RGP 
  is 
  not 
  the 
  law: 
  it 
  is 
  a 
  regulatory 
  concept 
  that 
  provides 
  a 
  practical 
  mechanism 
  for 
  day-to-day 
  judgments 
  on 
  what 
  would 
  usually 
  be 
  considered 
  to meet 
  the 
  legal 
  requirements 
  based 
  on 
  what 
  has 
  been 
  judged 
  and 
  accepted 
  in 
  similar 
  circumstances. 
  If 
  the 
  same 
  standards 
  of 
  safety 
  can 
  be 
  achieved 
  through 
  different 
  means 
  then 
  this 
  also 
  complies 
  with the law.  
   Can standards lower than RGP be acceptable? 
   A3.21 
  Yes 
  they 
  can 
  – 
  because 
  it 
  is 
  the 
  overall 
  outcome 
  that matters 
  and 
  lower 
  standards 
  in 
  some areas might be justifiable providing the overall result can be shown in the safety case to 
  be 
  ALARP. 
  However, 
  it 
  can 
  be 
  challenging 
  to 
  argue 
  for 
  lower 
  standards 
  because 
  the 
  RGP 
  (providing 
  that 
  it 
  is 
  relevant 
  and 
  constitutes 
  ‘good’ 
  practice) 
  embodies 
  the 
  approach 
  that 
  has 
  been previously judged to meet the legal standard in similar circumstances.  
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 28 of 29 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   What are the key things I should consider when making regulatory ALARP judgments? 
   ALARP 
   position 
   you 
   should 
   consider 
   the 
   A3.22 
  If 
  you 
  following: 
   are 
   making 
   an 
   assessment 
   of 
   an 
    
    
    
    
    
    
    
    
   Remember that the requirement is to reduce risks to be ALARP and this refers 
  to the overall outcome rather than seeking to narrowly apply ALARP to each 
  individual aspect.   
   RGP refers to those good practices (be they safety measures, standards, etc.) 
  that have been assessed and judged to meet the legal standard in similar 
  circumstances and are applicable to the situation at hand.  Only those good 
  practices that are both relevant and ‘good’ (as opposed to ‘best practice’ or 
  inadequate practice) are RGP:  you must think carefully whether these are 
  relevant to the situation and provide good practice (as opposed to inadequate 
  practice or best practice).  
   ALARP in relation to older facilities and in decommissioning requires especially 
  careful consideration.  RGP on modern design and operational standards is 
  often not fully relevant and it is particularly important to consider the overall 
  outcome, including the long-term safety benefits. 
   Remember that RGP is not mandatory.  It is most applicable to commonly-
  encountered circumstances but is only a starting point in situations that do not 
  fall within the scope of the circumstances under which the RGP has been 
  based.  A dutyholder is free to take an alternative approach providing it can 
  demonstrate that it has achieved an ALARP position. 
   It is important to understand how and why a dutyholder considers its position to 
  be ALARP.  You must avoid making premature judgments until you have seen 
  a dutyholder’s ALARP case, even when you are confident in the authority of the 
  RGP you have identified. 
   It is important to properly document the sources of any RGP which we have 
  identified and to properly record your reasoning, judgement and the application 
  of our decision-making due process. 
   It is important to ensure appropriate cross-discipline working within ONR to 
  ensure we make balanced and proportionate judgements. You should seek 
  appropriate specialist advice, including the appropriate engineering or human 
  factors expectations and fault analysis.  
   It is important that you make use of the ONR ALARP TAG and the HSE ‘6-
  pack’ guidance as appropriate, seeking assistance where necessary – such as 
  from the ONR ALARP Working Group. 
   Report : NS-TAST-GD-005 Revision 10 
  CM9 Ref: 2019/315236 
   Page 29 of 29 
    
    
    
    
    
    
    
    
    
    
    
    
  "
  Management of Radioactive material ns-tast-gd-024	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Management of Radioactive material ns-tast-gd-024.pdf	" Title of document 
   ONR GUIDE 
   MANAGEMENT OF RADIOACTIVE MATERIAL AND RADIOACTIVE WASTE ON 
  NUCLEAR LICENSED SITES 
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
   NS-TAST-GD-24 Revision 6 
   Date Issued: 
   September 2019 
   Review Date: 
   September 2022 
   Approved by: 
   Nicholas Blackburn 
   Professional Lead 
   Record Reference: 
   2019/254780 
   Revision commentary: 
   Revision 6 
   TABLE OF CONTENTS 
   1. 
   INTRODUCTION ............................................................................................................... 2 
   2. 
   PURPOSE AND SCOPE ................................................................................................... 2 
   3. 
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION ......................... 3 
   4. 
   RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ..................................................................................................................... 5 
   5. 
   GOVERNMENT POLICY ................................................................................................... 6 
   6. 
   ADVICE TO INSPECTORS ............................................................................................... 8 
   7. 
   REFERENCES ................................................................................................................ 21 
   8. 
   ACRONYMS .................................................................................................................... 24 
   9. 
   APPENDICES .................................................................................................................. 25 
   © Office for Nuclear Regulation, 2019 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 09/19 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 27 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation 
   1. 
   INTRODUCTION 
   1.1 
   The Office for Nuclear Regulation (ONR) has established its Safety Assessment 
  Principles for Nuclear Facilities (SAPs) [1] which apply to the assessment by ONR 
  specialist inspectors of safety cases for nuclear facilities that may be operated by 
  potential licensees, existing licensees, or other dutyholders.  The principles presented 
  in the SAPs are supported by a suite of Technical Assessment Guide (TAG) [2] to 
  guide regulatory decision making.  The outcome of an assessment by ONR is to reach 
  an independent and informed judgement on the adequacy of a nuclear safety case [3].  
  This TAG contains guidance to advise and inform ONR inspectors and assessors in 
  the exercise of their regulatory judgment. 
   2. 
   PURPOSE AND SCOPE 
   2.1 
   2.2 
   2.3 
   This TAG contains general guidance, to advise and inform ONR inspectors in 
  exercising their professional regulatory judgements on the management of nuclear 
  matter on nuclear licensed sites.  This TAG has also been written with due cognisance 
  of relevant International Atomic Energy Agency (IAEA) safety standards for the 
  management of radioactive waste [4].  This TAG is also intended to demonstrate how 
  ONR meets the Western European Nuclear Regulators’ Association (WENRA) Safety 
  Reference Levels (SRL) for waste and spent nuclear fuel storage [5] and for treatment 
  and conditioning of radioactive waste [6]. 
   The TAG is written as guidance for ONR inspectors to carry out their regulatory duties, 
  it is not written for duty holders and although it may be used by duty holders as a 
  source of guidance or good practice, it should not be interpreted by duty holders as a 
  set of prescriptive legal requirements. 
   This guidance relates to the management of radioactive material and radioactive 
  waste, which is currently being, or may be accumulated or stored on nuclear licensed 
  sites, which have met ONR’s criteria relating to bulk quantities for licensing [7].  In this 
  guidance, the meaning of these terms is as defined in ONR’s Licence Condition 
  Handbook [8].  Some radioactive material and radioactive waste is also nuclear matter, 
  as defined in section 26(1) of the Nuclear Installations Act (NIA65) [9]: 
   “nuclear matter” means, subject to any exceptions which may be prescribed- 
   a) 
   b) 
   any fissile material in the form of uranium metal, alloy or chemical compound 
  (including natural uranium), or of plutonium metal, alloy or chemical compound, 
  and any other fissile material which may be prescribed; and 
   any radioactive material produced in, or made radioactive by exposure to the 
  radiation incidental to, the process of producing or utilising any such fissile 
  material as aforesaid. 
   2.4 
   Radioactive material and radioactive waste may be generated as a result of activities 
  associated with the nuclear fuel cycle, nuclear medicine, licensed defence sites, 
  research or as a result of decommissioning.  Radioactive material includes materials in 
  store prior to use (e.g. new reactor fuel and radioisostopes), and also certain fissile 
  and other radioactive materials that may be declared as radioactive waste in the future.  
  These materials will require safe long-term management in a similar manner as for 
  radioactive waste. 
   2.5 
   This guidance is intended to be applicable to the predisposal management of 
  radioactive material and radioactive waste, at all nuclear facilities on nuclear licensed 
  sites, including nuclear power plant, nuclear chemical plant, storage facilities and 
  disposal facilities.  The management of radioactive material and radioactive waste is 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 2 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   closely linked with the management of the decommissioning of nuclear facilities, and 
  these activities require an integrated approach. 
   2.6 
   It covers through-life management of all radioactive material and radioactive waste 
  from creation through generation, processing, storage and up to but not including 
  disposal or discharge.  It includes all forms of radioactive material and radioactive 
  waste: solid, liquid and gaseous. 
   2.7 
   Key terms pertinent to the management of radioactive material and radioactive waste 
  are defined as follows: 
    
    
    
    
    
   Accumulation – The gathering or amassing of radioactive material or 
  radioactive waste in any form; 
   Processing – Any operation that changes the characteristics of the waste, 
  including pre-treatment, treatment and conditioning; 
   Keeping – Possession of radioactive material with the intention of use for the 
  purpose for which it was obtained; 
   Storage – Emplacement of radioactive material and radioactive waste in an 
  appropriate engineered facility with the intention of retrieval; 
   Disposal – Emplacement of solid radioactive waste in an appropriate 
  engineered facility without the intention of retrieval and release of liquid or 
  gaseous radioactive waste to the environment, referred to as discharge. 
   3. 
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION 
   Nuclear Site Licence Conditions 
   3.1 
   All of the licence conditions (LCs) apply and are relevant to activities involving the 
  management of radioactive material and radioactive waste [8].  However, there are a 
  number of LCs that are of particular relevance: 
    
    
    
    
    
    
    
    
    
    
    
    
   LC4 
   Restrictions on nuclear matter on the site 
   LC5 
   Consignment of nuclear matter 
   LC6 
   Documents, records, authorities and certificates 
   LC15 
   Periodic review 
   LC17 
   Management systems 
   LC23 
   Operating rules 
   LC25 
   Operational records 
   LC28 
   Examination, inspection, maintenance and testing 
   LC32 
   Accumulation of radioactive waste 
   LC33 
   Disposal of radioactive waste 
   LC34 
   Leakage and escape of radioactive material and radioactive waste 
   LC35 
   Decommissioning. 
   Ionising Radiation Regulations 2017 
   3.2 
   The Ionising Radiations Regulations 2017 (IRR17) control the use of ionising radiation 
  in the workplace with the intent of restricting exposure and limiting dose to the 
  workforce and the public [10].  Some of the regulations are particularly relevant to the 
  management of radioactive material and radioactive waste, examples include: 
    
   Regulation 8 
   (radiation risk assessments) 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 3 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
    
    
    
    
   Regulation 9  
   (restriction of exposure) 
   Regulation 12  (dose limitation) 
   Regulation 29  (accounting for radioactive substances) 
   Regulation 30  (keeping and moving of radioactive substances). 
   The Carriage of Dangerous Goods and Use of Transportable Pressure 
  Equipment Regulations 2009 
   3.3 
   3.4 
   3.5 
   3.6 
   3.7 
   3.8 
   Legislation governing intra-national and international transport of radioactive materials 
  is based on IAEA Regulations for the Safe Transport of Radioactive Materials, 
  currently Specific Safety Requirements No. SSR-6 (SSR-6).  These regulations are 
  translated into European modal regulations (e.g. the Agreement concerning the 
  International Carriage of Dangerous Goods by Road (ADR) and Rail (RID) transport, 
  respectively), within which radioactive materials are referred to as Class 7 (out of 9 
  classes) Dangerous Goods.  The modal regulations are given legal effect in Great 
  Britain via the Carriage of Dangerous Goods and Use of Transportable Pressure 
  Equipment Regulations (CDG) [11].  Specific paragraphs within the regulations 
  prescribe the different safety requirements for radioactive material, packagings and 
  packages (see NS-TAST-GD-99 for further details [2]). 
   Environmental Permitting Regulations 2016 
   The Environment Agency (EA) and Natural Resources Wales (NRW) regulate the 
  disposal of radioactive waste from nuclear licensed sites under the Environmental 
  Permitting Regulations 2016 (EPR16) in England and Wales, respectively [12]. 
   Nuclear licensees in England and Wales are exempt from the EPR16 requirement to 
  obtain a permit from the relevant environmental regulator to accumulate radioactive 
  waste and/or keep and use radioactive material (EPR16 Schedule 23). 
   For further guidance on how ONR works with the environmental regulators on matters 
  of mutual interest, see the Memoranda of Understanding for EA [13] and NRW [14] 
  and supporting guidance [15] and [16], respectively. 
   Environmental Authorisations (Scotland) Regulations 2018 
   The Scottish Environment Protection Agency (SEPA) regulates the management and 
  disposal of radioactive waste on nuclear licensed sites under the Environmental 
  Authorisations (Scotland) Regulations 2018 (EASR18) in Scotland [17].  SEPA has 
  also published guidance on its standard conditions for authorisations for radioactive 
  substances activities [18]. 
   Nuclear licensees in Scotland now require a permit from SEPA for the management of 
  radioactive waste on site, and for the long term storage of radioactive waste prior to 
  disposal (EASR18 Schedule 8).  Inspectors should be aware that SEPA’s duties and 
  powers now explicitly apply to any activities involved in the management of radioactive 
  waste on nuclear licensed sites, in so far as such activities have the potential to give 
  rise to exposures to the environment or the public, now or in the future.  Nuclear 
  licensees in Scotland remain exempt from the requirement for a permit from SEPA to 
  keep and use radioactive material on nuclear licensed sites. 
   3.9 
   ONR and SEPA have agreed to work together to ensure that ONR’s principal function 
  and SEPA’s general purpose can be achieved.  This agreement is reflected in the 
  updated MoU between ONR and SEPA [19] and the associated MoU Guidance [20]. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 4 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   4. 
   RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS 
   Safety Assessment Principles 
   4.1 
   The SAPs provide nuclear inspectors with a framework for making consistent 
  regulatory judgements on the safety of activities on nuclear installations, and also 
  recognises the legal duty on licensees to reduce risk so far as is reasonably 
  practicable (SFAIRP).  The SAPs are split into sections relating to different aspects of 
  nuclear safety.  One section of the SAPs is dedicated to radioactive waste and those 
  principles are summarised here: 
    
   RW.1 – Strategies for radioactive waste 
   A strategy should be produced and implemented for the management of 
  radioactive waste on site 
    
   RW.2 – Generation of radioactive waste 
   The generation of radioactive waste should be prevented or, where it is not 
  reasonably practicable, minimised in terms of quantity and activity 
    
   RW.3 – Accumulation of radioactive waste 
   The total quantity of waste accumulated on site at any time should be 
  minimised so far as is reasonably practicable 
    
   RW.4 – Characterisation and segregation 
   Radioactive waste should be characterised and segregated to facilitate its 
  subsequent safe and effective management 
    
   RW.5 – Storage of radioactive waste and passive safety 
   Radioactive waste should be stored in accordance with good engineering 
  practice and in a passively safe condition 
    
   RW.6 – Passive safety timescales 
   Radiological hazards should be reduced systematically and progressively.  The 
  waste should be processed into a passive state as soon as is reasonably 
  practicable 
    
   RW.7 – Making and keeping records 
   Information that might be needed for the current and future safe management 
  of radioactive waste should be recorded and preserved. 
   4.2 
   In addition to the RW SAPs, the following SAPs may also be of particular relevance to 
  both radioactive material and radioactive waste: 
    
    
    
    
    
   FP.8 – one of the fundamental principles that underpin the SAPs and which 
  outlines ONR’s expectations regarding protection of present and future 
  generations. 
   SC.1, SC.3 to SC.8 – these principles relate to the process for producing safety 
  cases, including their characteristics, content, maintenance and ownership. 
   RP.1 to RP.7 – these principles relate to radiation protection and control of 
  areas to limit spread of radioactive contamination. 
   ENM.1 to ENM.6 – these principles relate to the control of nuclear matter on 
  the nuclear licensed site. 
   DC.1 to DC.9 – these principles relate to arrangements for decommissioning of 
  a facility, which apply at all stages of the lifecycle of a facility. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 5 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
    
    
    
    
   RL.1 to RL.8 – these principles relate to land quality management. 
   ECS.1 to ECS.5 – these principles relate to classification and standards of 
  structures, systems and components (SSC) employed to deliver safety 
  functions. 
   EMT.2 – this principle relates to the regular and systematic examination, 
  inspection, maintenance and testing of SSC. 
   EAD.1 to EAD.5 – these principles relate to the management of ageing and 
  degradation of SSCs that may be required for the full lifetime of the facility.
   Technical Assessment Guides 
   4.3 
   There are a number of other TAGs that may be of relevance to the management of 
  radioactive material and radioactive waste [2]: 
    
    
    
    
    
    
    
   NS-TAST-GD-005 
   ONR guidance on the demonstration of ALARP; 
   NS-TAST-GD-023 
   Control of processes involving nuclear matter; 
   NS-TAST-GD-026 
   Decommissioning on nuclear licensed sites; 
   NS-TAST-GD-033 
   Duty holder management of records; 
   NS-TAST-GD-081 
   Safety aspects specific to storage of spent nuclear fuel; 
   NS-TAST-GD-083 
   Land quality management; 
   NS-TAST-GD-101 
   Geological disposal. 
   IAEA Requirements and WENRA Safety Reference Levels 
   4.4 
   In addition to the SAPs, the International Atomic Energy Agency (IAEA) Safety 
  Standards and the Safety Reference Levels (SRLs) developed by the Western 
  European Nuclear Regulators Association (WENRA) are considered to be UK relevant 
  good practice (RGP). 
   4.5 
   The most relevant IAEA documents are: 
    
    
    
   General Safety Requirements: Predisposal Management of Radioactive Waste 
  (GSR Part 5) [4]; 
   Safety Specific Guide: Predisposal Management of Radioactive Waste from 
  Nuclear Power Plants and Research Reactors (SSG-40) [21]; 
   Safety Specific Guide: Predisposal Management of Radioactive Waste from 
  Nuclear Fuel Cycle Facilities (SSG-41) [22]. 
   4.6 
   The most relevant WENRA SRLs for the management of radioactive waste are: 
    
    
   Waste and spent fuel storage [5]; 
   Treatment and conditioning of radioactive waste [6]; 
   4.7 
   The IAEA requirements and WENRA SRLs have been explicitly considered during 
  development of this TAG. 
   5. 
   GOVERNMENT POLICY 
   5.1 
   The last full review of Government policy on radioactive waste was in 1994/95; the 
  conclusions were set out in Cm2919 [23]. 
   5.2 
   The following key principles arose from this policy: 
    
   Radioactive wastes should not be unnecessarily created; 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 6 of 27 
    
    
    
    
    
    
   Office for Nuclear Regulation 
    
    
   Such wastes as are created should be safely and appropriately managed and 
  treated; and 
   Wastes should be safely disposed of at appropriate times and in appropriate 
  ways. 
   5.3 
   These are underpinned by general requirements that: 
   5.4 
   5.5 
   5.6 
    
    
   Radioactive waste will be manages and disposed of in ways which protect the 
  public, workforce and environment; and 
   Radioactive waste management should safeguard the interest of existing and 
  future generations and the wider environment, and in a manner that commands 
  public confidence and takes due account of costs. 
   Radioactive waste disposal is a devolved matter in the UK, and the relevant 
  Governmental bodies have since elaborated on various aspects of policy as described 
  in the following sections. 
   The following sections on radioactive waste management policies in the UK refer to 
  specific classifications of waste: higher activity radioactive waste (HAW) and low level 
  waste (LLW).  Further information on these and other waste classifications is provided 
  in Reference [23] and Appendix A. 
   Policy for HAW (England and Wales) 
   In 2006 the Committee for Radioactive Waste Management (CoRWM) published its 
  recommendations for the long term management of higher activity wastes (HAW) [24].  
  In response, the UK Government established that deep geological disposal is the 
  preferred route for HAW in England and Wales.  Since then, the Government has set 
  out (in 2008) and updated (in 2014 and 2018) the framework for managing HAW in the 
  long term through geological disposal, coupled with safe and secure interim storage 
  and on-going research and development to support its optimised implementation: 
    
    
    
   Managing Radioactive Waste Safely (MRWS), 2008 [25] 
   Implementing Geological Disposal, 2014 [26] 
   Implementing Geological Disposal – Working With Communities, 2018 [27]. 
   5.7 
   The Welsh Government has adopted the policy of geological disposal for the long term 
  management of HAW; their current policy is set out in the following documents: 
    
    
    
   Welsh Government Policy on the Management and Disposal of Higher Activity 
  Radioactive Waste, 2015 [28] 
   Geological Disposal of Higher Activity Waste: Community Engagement and 
  Siting Process, 2015 [29] 
   Geological Disposal of Higher Activity Waste: Working with Communities, 
  2019 [30]. 
   Policy for HAW (Scotland) 
   5.8 
   Scotland's policy for HAW is that long-term management of HAW should be in near-
  surface facilities which should be located as near to the site where the waste is 
  produced as possible so that the need to transport the waste over long distances is 
  minimal.  The policy also states the need to demonstrate how facilities will be 
  monitored and how waste packages, or waste could be retrieved.  The current policy is 
  set out in the following documents: 
    
   Scotland’s Higher Activity Radioactive Waste Policy, 2011 [31] 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 7 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
    
   Implementation Strategy for Scotland’s Policy on Higher Activity Radioactive 
  Waste, 2016 [32]. 
   Policy for LLW (UK) 
   5.9 
   The UK policy for the management of solid low level waste (LLW) is set out in the 
  following document: 
    
   Policy for the Long Term Management of Solid Low Level Radioactive Waste in 
  the United Kingdom, 2007 [33]. 
   5.10 
   A complementary UK Strategy on solid LLW was published in 2016 [34].  The key aim 
  of the LLW policy is to provide a high-level framework within which individual LLW 
  management decisions can be taken flexibly, to ensure safe, environmentally-
  acceptable and cost-effective management solutions that appropriately reflect the 
  nature of the LLW concerned. 
   5.11 
   A key component of the policy is definitions for Low Level Waste as in Appendix A. 
   5.12 
   In its policy, Government looks to the various regulators to maximise the consistency 
  of their approaches in regulating radioactive waste management, including disposal of 
  LLW, and on matters relating to delicensing and clean-up of nuclear sites and other 
  land contaminated by radioactivity.  Government also looks to the regulatory bodies to 
  make clear, through published material, the steps that have been taken to address this 
  requirement. 
   5.13 
   In its policy, Government states that plans for the management of all radioactive waste, 
  including LLW, must be developed by waste managers.  These plans must be 
  prepared in a form, and to a level of detail, suitable for consideration by the relevant 
  regulatory bodies. 
   5.14 
   All nuclear licensed sites should have a plan for the management of their LLW 
  holdings and predicted future arisings that is part of a wider integrated waste 
  management strategy, and is compatible with proposed end states. 
   5.15 
   The environment agencies’ guidance on the decommissioning and clean-up of nuclear 
  licensed sites sets out their expectations for waste management plans [35]. 
   6. 
   ADVICE TO INSPECTORS 
   Fundamental expectations 
   6.1 
   ONR has four fundamental expectations, which it expects licensees to meet so far as 
  is reasonably practicable.  These expectations are as follows: 
    
    
    
    
   Generation of radioactive waste should be avoided, where radioactive waste is 
  unavoidable, generation should be minimised according to the waste hierarchy 
   Radioactive material and radioactive waste should be managed safely 
  throughout its lifecycle in a manner that is consistent with modern standards 
   Predisposal management of radioactive waste should take account of the 
  anticipated disposal route, and full use should be made of existing routes 
   Where the disposal route is not yet available, radioactive material and 
  radioactive waste should be put into a passively safe state as soon as 
  reasonably practicable for interim storage pending future disposal, or other 
  long-term solution. 
   6.2 
   These fundamental expectations should form a common thread through any 
  assessment relating to the management of radioactive waste or radioactive material. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 8 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   6.3 
   6.4 
   6.5 
   6.6 
   6.7 
   6.8 
   6.9 
   6.10 
   Joint Guidance on the Management of Higher Activity Radioactive Waste on 
  Nuclear Licensed Sites 
   Whilst ONR regulates the management of radioactive waste on nuclear licensed sites 
  and the environment agencies regulate disposals, the regulators work together on 
  decisions concerning permissioning of activities relating to HAW [36].  This is 
  necessary to ensure both safety and environmental protection can be achieved over 
  the long timescales associated with the management of HAW. 
   To this end, the environment agencies and ONR have published joint guidance on the 
  management of HAW on nuclear licensed sites [37] (the Joint Guidance).  The Joint 
  Guidance covers all aspects relating to the safe and secure management of HAW 
  produced on nuclear licensed sites. 
   In assessments relating to HAW, inspectors should look to the Joint Guidance for 
  further details on joint regulatory expectations.  However, the principles therein may 
  also be relevant to the management of other radioactive waste, and also to radioactive 
  material, for example spent fuel. 
   In addition to providing guidance on regulatory expectations for the management of 
  HAW, the Joint Guidance also describes the regulatory process by which licensees 
  may obtain regulatory acceptance of their proposals. 
   Strategies for the management of radioactive waste 
   In line with Government Policy [23], ONR expects licensees to produce and maintain a 
  strategy that describes their approach to the current and future management of 
  radioactive material and radioactive waste.  If a licensee is responsible for a number of 
  sites, then it may be appropriate for the licensee to produce a corporate strategy 
  supported by a series of site-specific strategies. 
   In selecting a preferred strategy, licensees should demonstrate that a full range of 
  management options have been examined, taking account of all technical factors, 
  social factors, Government Policies and international agreements.  The reasons for 
  reaching the preferred strategy should be recorded and major assumptions and 
  uncertainties should be identified, together with the approach for their resolution. 
   The scope of the strategy should include all materials and wastes arising on a site, 
  including secondary wastes and those expected to arise from final decommissioning.  
  The strategy should take account of interdependencies between waste streams and 
  processes among all steps to demonstrate that an optimum management process is 
  delivered. 
   The licensee’s strategy should identify the inventory of its nuclear liabilities and 
  describe the means of managing each waste stream from generation to disposal by 
  practical and cost-effective methods.  The strategy should cover the complete lifecycle 
  of the material and associated facilities, and should include routine discharges of liquid 
  and gaseous radioactive wastes.  The strategy should not be restricted to the 
  consideration of nuclear matter that licensees currently regard as radioactive waste: it 
  should also cover all radioactive material, including materials held up in store prior to 
  operational use, spent nuclear fuel, other stocks of fissile and recyclable material and 
  radioactively contaminated land (referred to as an ‘accumulation of nuclear matter’; 
  see NS-TAST-GD-83 [2]). 
   6.11 
   The strategy should describe how the licensee will provide and maintain the 
  arrangements to ensure that the radioactive material and radioactive waste is 
  managed safely until its ultimate disposal, including the provision of an appropriate 
  organisation and supporting infrastructure. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 9 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   6.12 
   6.13 
   The strategy should be linked to, or integrated with the strategy for decommissioning of 
  nuclear facilities including the management of radioactively contaminated land and the 
  ability to dispose of the resulting wastes. 
   The strategy should demonstrate how the objectives of the OSPAR Convention have 
  been taken into account, in particular, the impact on the volume and total activity of on-
  site waste arisings of solid and liquid wastes, options for storage and ultimate disposal, 
  and implications for compliance with the ALARP principle.  The UK strategy for 
  radioactive discharges, which was reviewed in 2018 [38], aims to prevent pollution of 
  the OSPAR maritime area (the North East Atlantic) from radiation through progressive 
  and substantial reductions of discharges, emissions and losses of radioactive 
  substances. 
   6.14 
   The manner and form in which they choose to prepare, maintain and document the 
  information relating to their strategies is a matter for the licensees.  It is not the aim of 
  this guidance to be prescriptive; however, strategies are expected to contain the 
  following elements: 
    
   Descriptions of: 
    
   
    
    
    
   the licensee’s radioactive waste management objectives and policy; 
  the current and future waste inventory, including decommissioning 
  wastes and radioactive materials that may be declared as waste in the 
  future; 
  the preferred option for managing each waste stream throughout its 
  lifecycle to disposal, including programmes showing timescales, 
  methods and proposed disposal route.  For wastes where disposition is 
  not defined fully or optimised, a description of the management 
  arrangements for these, including strategies to minimise generation of 
  these in future; 
  the justification of the preferred option based on ALARP and Best 
  Available Techniques (BAT), including the alternative options examined, 
  the selection factors taken into account, major assumptions and the 
  availability of disposal routes; 
  how the balance between foreclosure of disposal options and passive 
  safety has been addressed, and resolved in cases where there may be 
  conflict. 
    
    
    
    
    
   Demonstration of consistency with Government Policy and ONR’s fundamental 
  expectations for radioactive waste management; 
   Significant uncertainties should be identified, the impact assessed and the 
  approach for resolution described; 
   Results of analyses to assess the sensitivity of the selection of the preferred 
  option to assumptions, uncertainties and factors; 
   Approach to ensuring safety including, where appropriate, demonstration that 
  hazards posed by legacy wastes are being adequately controlled and 
  progressively reduced; 
   Corporate arrangements and infrastructure for continuing capability to meet 
  licensee responsibilities. 
   6.15 
   The strategy should contain sufficient detail to be standalone, but may be supported by 
  a number of other documents, including individual documents describing waste stream 
  lifecycle management, site lifetime plan, site decommissioning strategy and site 
  strategy for end states.  In some cases, the strategy may be encompassed by existing 
  documents, such as Waste Management Plans for LLW. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 10 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   6.16 
   Further guidance on the production of radioactive waste strategies can be found in the 
  Joint Guidance [37].  Licensees may choose to present their strategy in the form of an 
  Integrated Waste Strategy (IWS) document, for which NDA has produced guidance on 
  the form and content of such documents [39]. 
   6.17 
   6.18 
   6.19 
   6.20 
   6.21 
   Application of ALARP across the lifecycle 
   ONR expects licensees to manage radioactive waste in a manner that is compatible 
  with ultimate disposal, or other long-term solution, and, unless justified on safety 
  grounds, does not unnecessarily foreclose any foreseeable management options.  The 
  risks should be assessed in a holistic manner and not restricted to part of the overall 
  time period. 
   However, the nature of radioactive waste management means that multiple facilities 
  are likely to be involved in the different aspects relating to generation, processing, 
  storage, transport and disposal, and for HAW, these activities are expected to take 
  place over a significant period of time.  Safety cases specific to individual facilities in 
  radioactive waste management are unlikely to provide sufficient information on the 
  case for the management that covers the whole waste lifecycle. 
   Additionally, there may be situations, particularly during post operation clean-out and 
  decommissioning, where the risks may increase temporarily so that the long-term risks 
  can then be reduced or eliminated.  Such increased risks need to be balanced against 
  the continuing risks from doing nothing and with due consideration of the alternatives 
  available to address the hazard. 
   Therefore, the case for safe management of some waste streams across their whole 
  lifecycle needs to be considered on a case-by-case basis, taking account of all factors, 
  to ensure that an appropriate balance is achieved.  These factors include requirements 
  imposed by the environmental permit (including optimisation, BAT and disposability) 
  and any waste acceptance criteria for the final disposal facility.  The licensee also 
  needs to address the risk that future disposal options may require the wastes to be 
  reworked into an alternative form and also that reworking may be necessary as a result 
  of deterioration of the waste packages or accidental damage.  For HAW, Radioactive 
  Waste Management Ltd. (RWM) has an advisory role, and it is for the licensee to seek 
  appropriate advice from RWM.  The advice may be used by the licensee as part of the 
  case for safe management of the waste across the lifecycle. 
   In addition to the requirement to produce adequate facility safety cases, licensees 
  should also demonstrate how the key elements of long-term safety and environmental 
  performance will be delivered for the management of radioactive waste across the 
  lifecycle, which may not be addressed in the individual plant safety cases and 
  environmental documentation.  Where waste is transferred between multiple plants or 
  sites, good practice would suggest production of the case for its overall management 
  early in the waste stream lifecycle, enabling its maintenance and update upon 
  subsequent transfer(s).  The case for a particular waste stream should cover the 
  period from generation, through processing, storage, transport and up to the removal 
  of the waste stream from site for eventual disposal, or other long-term solution. 
   6.22 
   The manner and form in which they choose to prepare, maintain and document the 
  information relating to the case for management of radioactive waste is a matter for the 
  licensees, and should be proportionate to the hazard presented by the waste.  
  Licensees may choose to present their case in the form of a Radioactive Waste 
  Management Case (RWMC).  Further guidance on the form and content of RWMCs for 
  HAW can be found in the Joint Guidance [37]. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 11 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   Predisposal management of radioactive waste 
   6.23 
   Radioactive waste should be managed in a manner that minimises the need for 
  processing, and that it is compatible with anticipated facilities for ultimate disposal or 
  long-term solution. 
   6.24 
   The following steps, as identified in GSR Part 5 and discussed in more detail below, 
  are key to the safe management of radioactive waste: 
    
    
    
    
   Generation 
   Processing 
   Storage 
   Waste acceptance criteria. 
   6.25 
   Whilst the next sections are focussed on the predisposal management of radioactive 
  wastes, many of the principles may be applicable to the management of radioactive 
  materials.  Further guidance on the predisposal management of HAW can be found in 
  the Joint Guidance [37]. 
   Generation 
   6.26 
   Licensees should demonstrate that radioactive waste is not unnecessarily created, and 
  that the generation and accumulation of radioactive waste is minimised. 
   6.27 
   6.28 
   6.29 
   6.30 
   Licence Condition 32 requires licensees to make and implement adequate 
  arrangements for minimising, so far as is reasonably practicable, the rate of production 
  and total quantity of radioactive waste accumulated on site.  Licence Condition 4(1) 
  requires licensees to ensure that no nuclear matter is brought onto site, except in 
  accordance with adequate arrangements for this purpose. 
   The licensee should demonstrate that adequate steps have been taken first to avoid 
  the creation of radioactive waste, and then to minimise the amount generated, both in 
  terms of volume and activity, initially in the design phase and then throughout the 
  lifetime of facilities that generate or manage radioactive waste.  Generation also 
  includes the transfer of radioactive material or radioactive waste from other national 
  and international sites; where this occurs, ownership shall be clear and unequivocal. 
   The licensee should demonstrate suitable and sufficient design features and 
  operational procedures to support the management of radioactive waste, which should 
  be subject to systematic review and review as necessary. 
   The licensee’s approach to the minimisation of radioactive waste shall include 
  application of the waste management hierarchy, the key principles of which should be 
  reflected within the operational procedures.  Inspectors should be cognisant that 
  licensees are also required by the environment agencies to demonstrate that waste 
  management options have been optimised using BAT; this should be balanced with 
  ONR’s requirement for risks to be ALARP (see NS-TAST-GD-005 on the 
  demonstration of ALARP [2]).  ONR’s expectations for the application of waste 
  minimisation, which encompass the waste hierarchy, include the following: 
    
    
    
    
    
   Minimisation of the production of secondary wastes; 
   Segregation of waste streams; 
   Preventing spread of contamination; 
   Recycling and reusing material; 
   Clearance and exemption; 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 12 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
    
    
    
   Activity reduction; 
   Volume reduction; 
   Disposal. 
   6.31 
   The generation of wastes that may be difficult to convert into a passive form for 
  storage, or for which there is no obvious disposal route should be avoided; these 
  wastes may be classed by licensees as ‘problematic’ or ‘orphan’ wastes.  Where these 
  wastes exist, licensees should demonstrate adequate arrangements for their 
  management, and further arisings of problematic wastes are minimised. 
   6.32 
   The licensee should, so far as is reasonably practicable, characterise and segregate 
  radioactive waste in order to facilitate safe and effective management and disposal. 
   6.33 
   6.34 
   6.35 
   6.36 
   6.37 
   The radioactive waste should be characterised in terms of its physical, mechanical, 
  chemical, radiological and biological properties, along with its source or origin.  
  Licensees should develop a systematic approach to characterisation that takes 
  account of regulatory expectations for control and management over the entire lifetime 
  of the radioactive waste, including disposal, or other long-term solution.  
  Characterisation should be done as soon as practicable to inform onward 
  management, but further characterisation may be required at any of the subsequent 
  steps in predisposal management.  Licensees should also take into account the 
  requirements for Nuclear Material Accountancy and Control (NMAC) for Safeguards 
  purposes. 
   Segregation involves accumulating those materials with similar characteristics, and 
  separating or avoiding mixing those with different characteristics.  Where practicable, 
  radioactive waste should be segregated as close to the point of generation as possible.  
  Segregation is most effective if it is taken into account at the process design stage and 
  can contribute significantly to the effective and safe management of radioactive waste.  
  Some legacy wastes have arisen because incompatible wastes have been mixed 
  inappropriately, without due consideration of ALARP across the lifecycle. 
   Pre-treatment operations may also be employed to minimise the amount of radioactive 
  waste to be further processed, stored and disposed of.  These operations, for example 
  decontamination and incineration, may be employed in order to allow reclassification of 
  the waste at a lower level or to allow the waste to be cleared from regulatory control 
  (see Appendix A).  Additionally, licensees may opt for decay storage in cases where 
  wastes are borderline in terms of classification; ONR expects this alternative approach 
  to be justified in terms of ALARP and underpinned as part of the overall waste 
  strategy. 
   Processing 
   Licensees should process radioactive waste into a passively safe state as soon as is 
  reasonably practicable.  Appendix B provides general principles for radioactive waste 
  management. 
   Radioactive waste should be processed as close to the point of generation as 
  practicable and in a form suitable for subsequent waste management steps.  Passive 
  safety is most appropriately achieved by providing multiple physical barriers to the 
  release of radioactivity to the environment, which should be designed to provide 
  effective containment and prevent leakage.  These barriers include the form of the raw 
  or processed waste, and the packaging, where appropriate. 
   6.38 
   To achieve passive safety, the radioactivity should be immobilised, and packaged in a 
  form that is physically and chemically stable.  For some wastes, the radioactivity may 
  be immobilised by virtue of the nature of the material, for example, activated 
  uncontaminated metals.  The term ‘passive safety’ is more usually associated with 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 13 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   6.39 
   6.40 
   wastes that have already been processed for long-term storage, pending disposal.  
  However, passive safe storage should be provided at all stages in predisposal 
  management of all radioactive waste, to ensure isolation and for environmental 
  protection. 
   Passive safety is most relevant in cases where radioactive wastes need to be 
  managed in the long-term, for example HAW, where the disposal route is not yet 
  available.  However, ONR expects licensees to consider proportionate application of 
  the principles of passive safety in the management of all radioactive wastes (see 
  Appendix B). 
   ONR expects licensees to demonstrate that their processing of radioactive waste will 
  not unnecessarily foreclose future management options, unless there are worthwhile 
  safety benefits.  There may be potential for a conflict between the expectations not to 
  foreclose options with expectations for achieving passive safety.  In such cases, all 
  relevant factors will need to be taken into account and a judgement made that an 
  appropriate balance has been achieved, and which considers radioactive waste 
  management across the lifecycle. 
   6.41 
   There are a number of factors that could influence the timing of the implementation of 
  passive safety, such as: 
    
    
    
    
    
    
    
    
    
    
   The magnitude of the radioactive hazard; 
   The current form of the radioactive waste; 
   The safety of the current facilities in which accumulation of raw waste is taking, 
  or has taken place; 
   The rate of deterioration of the facilities; 
   The rate of deterioration in the condition of the radioactive waste; 
   Uncertainty in the knowledge of the waste; 
   Integration with decommissioning plans; 
   Radioactive decay or ingrowth; 
   The availability of a disposal route; 
   The need for active safety systems. 
   6.42 
   Radioactive waste processing may comprise treatment and/or conditioning, with the 
  ultimate goal of producing a waste product that is suitable for disposal.  Examples of 
  treatment options include filtration, ion exchange, incineration and size reduction; 
  these should be employed with the aim of rendering the waste into a state that 
  facilitates conditioning of solid and some liquid wastes, or discharge of liquid and 
  gaseous wastes.  Conditioning consists of operations that produce a waste product 
  suitable for safe handling, storage and disposal, taking account of the timescales 
  expected for these onward activities.  Examples of conditioning operations include 
  encapsulation of the wastes in a suitable matrix, for example cementitious grout, 
  vitrification or drying of the wastes. 
   6.43 
   The processing techniques should be selected on the basis of the characteristics 
  (including non-radiological) of the waste concerned, as these may affect safety during 
  processing and the suitability of the product for onward management to disposal.  The 
  licensee should describe the expected properties of the intended waste product and 
  ensure that adequate controls are applied to processes and activities to achieve 
  consistent, safe outcomes. 
   6.44 
   For conditioned wastes, the waste packaging should be selected such that it 
  contributes to passive safety over the expected timescales.  Dependent on the nature 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 14 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   6.45 
   6.46 
   6.47 
   6.48 
   6.49 
   6.50 
   6.51 
   of the waste and the hazard it presents, the packaging may need to provide shielding 
  in addition to containment, and may also need to take account of criticality safety and 
  heat-bearing wastes. 
   Waste products should be uniquely identifiable via appropriate labelling, which should 
  be designed to ensure identification over the expected period and conditions of 
  passive safe storage.  Licensees should ensure that labelling of waste packages for 
  disposal is compliant with the requirements set out by the disposal facility. 
   Licence Condition 17 requires licensees to make and implement adequate quality 
  management arrangements in respect of all matters which may affect safety.  With 
  respect to the predisposal management of radioactive waste, licensees are expected 
  to make and implement adequate arrangements for quality control and quality 
  assurance procedures for the processing and packaging of radioactive waste.  These 
  arrangements should ensure that the waste products comply with the relevant 
  specifications, including those of the final disposal facility, or discharge routes for liquid 
  and gaseous wastes.  These arrangements should cover the procurement of the 
  packaging and any raw materials used in processing, the quality of the final product 
  and all necessary records. 
   Storage 
   Licensees should, so far as is reasonably practicable, store radioactive waste in a 
  passively safe state, such that it can be inspected, monitored, retrieved and preserved 
  in a condition suitable for its subsequent management. 
   Licence Condition 4(2) requires licensees to ensure that nuclear matter is stored in 
  accordance with adequate arrangements made for this purpose.  Licence Condition 34 
  requires the licensee to ensure, so far as is reasonably practicable, that radioactive 
  material and radioactive waste is adequately controlled or contained so that it cannot 
  leak or otherwise escape. 
   Storage of radioactive waste is by definition an interim measure and can occur at, or 
  between, any steps in predisposal management from generation to disposal, including 
  decay storage as a step on the way to disposal.  The storage vessel, for example 
  tanks containing raw liquid wastes or conditioned waste packages, and the storage 
  building or structure form part of the multi-barrier system and should be designed to 
  provide effective containment and prevent leakage.  In some cases, the role of the 
  storage building or structure may be limited to providing environmental protection, 
  radiation shielding and presenting a secure boundary against unauthorised intrusion or 
  interference and entry of wildlife. 
   The licensee should demonstrate that the design of the storage building or structure is 
  fit for purpose, taking account of the hazards posed by the stored radioactive waste 
  and the expected timescales for passive safe storage, which could extend beyond 100 
  years in some cases.  There should be sufficient storage capacity for waste generated 
  during normal operations, and consideration given to reserve capacity in case of 
  incidents or abnormal events.  For storage of liquid wastes, this should include an 
  adequate provision of secondary containment. 
   Licensees may wish to use temporary facilities for radioactive waste storage 
  in the 
  short-term to support other processes, for example decommissioning, retrieval of 
  radioactive waste for disposal or passive safe storage, or pending construction of other 
  facilities.  In these cases, licensees should demonstrate that the temporary facilities 
  are fit for purpose and that any risks from their use are reduced ALARP through 
  provision of an adequate safety case.  ONR expects that such arrangements to be 
  truly temporary and required for relatively short periods of time.  If such arrangements 
  are required for longer time periods, then they cannot be regarded as temporary. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 15 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   6.52 
   6.53 
   6.54 
   6.55 
   Licence Condition 23 requires the licensee to identify the conditions and limits 
  necessary in the interests of safety (referred to as operating rules).  Licence Condition 
  28 requires the licensee to make and implement adequate arrangements for the 
  regular and systematic examination, inspection, maintenance and testing of all plant 
  which may affect safety. 
   The fundamental objective of inspection of stored radioactive waste, including 
  unconditioned waste and waste packages is to confirm that they, and the facilities that 
  contain them, are in an acceptable condition for continuing safe storage, retrieval, 
  processing and final disposal, and will remain so for the relevant timescales. 
   Licensees should develop a strategy, including criteria (operating rules) against which 
  the condition of the stored radioactive waste and stored waste packages are to be 
  assessed.  The strategy should also provide justification as to the method and 
  frequency of inspections.  Where strategies are based on predicted rates of 
  degradation, inspections should also be undertaken at appropriate time intervals to 
  confirm that the waste is not evolving to an unexpected degree.  The licensee should 
  also include consideration of the environmental conditions within the storage facility. 
   Given that an increasing number of waste treatment and storage facilities are being 
  constructed and operated, there is a need to ensure that the operating rules for such 
  facilities are appropriately defined within the safety case and are set in suitably 
  measurable terms.  It should be noted that in such cases, surveillance inspections will 
  be infrequent, with long gaps, potentially years, between inspections.  Thus, any such 
  operating rules should have robust margins of safety associated with them and be 
  demonstrable within the safety case. 
   6.56 
   The inspection strategy should be reviewed for adequacy at appropriate intervals, 
  taking account of results derived from previous inspections. 
   6.57 
   Further guidance on ONR’s expectations for dedicated storage facilities that is also 
  applicable to waste packages is given in the TAG for Spent Fuel Management (NS-
  TAST-GD-081).  In addition, NDA has produced industry guidance on the interim 
  storage of HAW [40]. 
   Waste Acceptance Criteria 
   6.58 
   Licensees should establish acceptance criteria (operating rules) for radioactive waste 
  and waste packages that are accepted for processing, storage, transport and disposal, 
  and make arrangements for assessment against them.  The criteria should specify the 
  radiological, physical, chemical and biological characteristics of the waste or waste 
  packages that are to be processed or stored, taking account of the operating limits and 
  conditions to ensure consistency with the safety case. 
   6.59 
   Licensees should also make adequate provisions for the safe management of 
  radioactive waste or waste packages that do not meet the criteria. 
   6.60 
   6.61 
   Data and information recording 
   Licensees should make adequate provision for recording and preserving all the data 
  and information that may be required in the future to ensure the safe management of 
  radioactive material and radioactive waste, for as long as such information may be 
  required. 
   Licence Condition 6 requires licensees to make adequate records to demonstrate 
  compliance with each condition of the site licence, and to ensure that such records are 
  preserved for 30 years.  Licence Condition 25 requires licensees to ensure that 
  adequate records are made a kept of the operation, inspection and maintenance of 
  nuclear facilities; these shall include records relating to the amount and location of all 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 16 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   nuclear matter.  Licence Condition 32 requires licensees to make adequate 
  arrangements for the recording the amount of radioactive waste accumulated on site. 
   6.62 
   The record preservation period of 30 years reflects the requirements of NIA65 with 
  respect to third party liability.  This period starts from the time when decommissioning 
  or decontamination of the plant is complete and all radioactive waste has been 
  transferred to another location or disposed of.  However, records required to support 
  the safe management of radioactive waste during long-term storage and final disposal 
  will need to be managed by the licensee over a significant period of time prior to 
  disposal, and subsequently by the operator of the disposal facility.  As a result, the 
  records may be required for periods in excess of 100 years and consideration needs to 
  be given to the content of such records, and the form in which they are kept.  Records 
  should be held by the licensee until the responsibility for the waste has been passed to 
  another body such as the operator of a disposal facility; however, some information will 
  need to be retained to comply with NIA65 requirements.  For on-site disposals, records 
  would need to be maintained until the site is released from regulation. 
   6.63 
   ONR expects licensees to develop and maintain a records system that takes into 
  account the purpose, content and storage of records, where the records should 
    
    
    
   Contain all the information that may be required in the future, 
   Be accessible and legible to those who will consult them, and 
   Be assembled and maintained in a secure form. 
   6.64 
   The information contained in records is required for two principal reasons: firstly in 
  connection with nuclear liabilities under NIA65, and secondly, to support the safe 
  management of the waste of the whole lifecycle.  This guidance is relevant to the latter, 
  in particular the roles that operational records play in supporting future radioactive 
  waste management and decommissioning, including: 
    
    
    
    
    
    
    
    
    
   Review of waste management (and decommissioning) strategies; 
   Review of facility safety cases (periodic review of safety); 
   Ensuring continued safe storage; 
   Retrieval of waste and waste packages; 
   Packaging or repackaging of waste; 
   Disposal of waste; 
   Dismantling of structures and plant; 
   Management following incidents; 
   Making modifications. 
   6.65 
   In addition to the regulators and the licensee, records will be of value to other 
  organisations or persons in the future, for example: 
    
    
    
    
    
   Any successor licensee; 
   The operator of a disposal facility; 
   Local planning authority; 
   Members of the public; 
   International organisations (e.g. IAEA). 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 17 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   6.66 
   It is beyond the scope of this guidance to define the extent of the records that 
  licensees are expected to assemble with respect to their nuclear facilities, but the 
  following provides some guidance specifically for radioactive waste: 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Relevant characteristics, including radionuclide inventory, the amount, 
  radiological classification, its physical, chemical and biological form, any 
  associated uncertainties in the estimates of the characteristics and any 
  criticality-relevant information; 
   Details of the ownership; 
   Origin of the waste and its location on site or within a storage facility; 
   Development and specification of waste packages, including treatment and 
  conditioning; 
   Details of packaging; 
   Design and construction materials; 
   Inspection, maintenance and testing; 
   Records of all waste disposals; 
   Quality records; 
   Safety case records; 
   Records of incidents; 
   Research and development; 
   Regulatory interactions; 
   Interactions with operators of disposal facilities. 
   6.67 
   6.68 
   6.69 
   6.70 
   The fundamental requirement for records storage is that they should be in a secure 
  and accessible form for as long as the information could be of value.  Due to the long 
  timescales associated with the interim storage of HAW and some licensee’s decision 
  to defer decommissioning, the projected storage period for many records will be 
  significant, in excess of 100 years in some cases, and should be taken into account in 
  developing the records system.  Further guidance on the management of records is 
  provided in Reference [2] (NS-TAST-GD-033). 
   Safety management 
   ONR expects licensees to provide safety cases demonstrating the safe operation of all 
  their facilities, including those for the management of radioactive material and 
  radioactive waste. 
   Licence Condition (LC) 23(1) requires licensees to provide safety cases that 
  demonstrate the safe operation of all facilities on site, including those specifically for 
  the management of radioactive waste.  General guidance on the purpose, scope and 
  content of safety cases for all types of nuclear facilities is available in Reference [2] 
  (NS-TAST-GD-051).  However, there are a number of important issues that are 
  particularly relevant to radioactive waste management facilities, which need to be 
  addressed in the safety cases. 
   The lack of a disposal facility for HAW means that radioactive waste management 
  facilities will be required to operate safely for very long periods of time.  In some cases, 
  these facilities may be new, but in many other cases the plants were built a long time 
  ago and to different standards.  Some historical plants remain in good condition, but 
  others may be physically deteriorating.  Additionally, some historical plants may be 
  repurposed for the management of radioactive waste.  All these issues need to be 
  considered in developing an acceptable safety case. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 18 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   6.71 
   The safety case should demonstrate that the design and operation of the facility and its 
  associated arrangements meet modern standards and also justify safe operation 
  throughout the projected life of the facility.  For older facilities built to earlier standards, 
  the age of the facility, as well as the anticipated remaining lifetime, must be taken into 
  account and the issue of whether suitable and sufficient measures are available to 
  satisfy ALARP will need to be judged on a case by case basis.  A safety case 
  comprises a suite of safety documentation which, when taken together, provide this 
  justification.  The specification and format of a safety case is the responsibility of the 
  licensee; however, the following elements that are particularly relevant to radioactive 
  waste management facilities should be considered: 
    
   Descriptions of facilities, environment and processes, including 
    
   
   
   
   buildings and plant; 
  site conditions; 
  waste streams (characterisation and quantities); 
  waste management processes; 
    
    
    
    
   Consistency with waste management and decommissioning strategies; 
   Identification of modern standards and good practice; 
   Demonstration that radioactive material and radioactive waste are adequately 
  controlled and contained; 
   Operations procedures, including 
    
   
   
   Operating instructions; 
  Relevant limits, rules and conditions for operations; 
  Inspection, maintenance and monitoring schedules. 
    
   Demonstration that the plant: 
    
   
   
   
   is fit for purpose; 
  is consistent with good engineering and good practice; 
  provides adequate safety throughout its proposed life; 
  that risks are reduced ALARP. 
    
   That the ageing of structures, systems and components, plant and waste 
  packages is adequately managed. 
   6.72 
   Licence Condition 15 requires licensees to make and implement adequate 
  arrangements for the periodic and systematic review and assessment of safety cases.  
  Further guidance on periodic safety reviews can be found in Reference [2] (NS-TAST-
  GD-050). 
   6.73 
   The review would normally be expected to be conducted at least every 10 years and 
  ONR expects licensees to give adequate consideration to the following, as they relate 
  to the management of radioactive materials and radioactive wastes: 
    
    
    
    
   the accumulation and monitoring of radioactive waste 
   operating experience since the last review 
   maintenance, inspection and testing experience since the last review 
   the history of incidents and abnormal events since the last review. 
   6.74 
   The review should ensure that in cases where the facility provides a safety function 
  that cannot be provided by an alternative means, the forward look includes 
  consideration of the time which may be needed to design, construct and commission, 
  or to procure a replacement facility or equipment, should the original be found to be 
  unserviceable at some point in the future, i.e. there must be no interruption in safety 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 19 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   function.  This applies particularly to radioactive waste stores, and to other facilities in 
  which the hazard cannot be simply removed by shutting them down.  For stores 
  containing significant quantities of radioactive material and radioactive waste, the 
  review needs to consider the entire period until retrieval.  This is particularly important 
  if the material or waste is chemically reactive, degrading or could leak to the 
  environment. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 20 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   7. 
   1  
   2  
   3  
   4  
   5  
   6  
   7  
   8  
   9  
   10  
   11  
   12  
   13  
   14  
   15  
   REFERENCES
   Safety Assessment Principles for Nuclear Facilities, 2014 Edition Revision 0. 
  November 2014. 
  www.onr.org.uk/saps 
   ONR Nuclear Safety Technical Assessment Guides. 
  www.onr.org.uk/operational/tech_asst_guides 
   ONR Guide, Purpose and Scope of Permissioning, NS-PER-GD-014 Revision 6, 
  November 2016. 
  www.onr.org.uk/operational/assessment/ns-per-gd-014.pdf 
   IAEA, Predisposal Management of Radioactive Waste; IAEA General Safety 
  Requirements part 5: GSR Part 5, May 2009. 
  http://www-pub.iaea.org/MTCD/publications/PDF/Pub1368_web.pdf 
   Western European Nuclear Regulators’ Association, Waste and Spent Nuclear Fuel 
  Storage Safety Reference Levels, Working Group on Waste and Decommissioning 
  (WGWD), Version 2.2, April 2014. 
  http://www.wenra.org/media/filer_public/2014/05/08/wgwd_storage_report_final.pdf 
   Western European Nuclear Regulators’ Association, Radioactive Waste Treatment and 
  Conditioning Safety Reference Levels, Working Group on Waste and 
  Decommissioning (WGWD), April 2018. 
  http://www.wenra.org/media/filer_public/2018/04/17/report_radioactive_waste_treatme
  nt_and_conditioning_safety_reference_levels.pdf 
   ONR, Interim Position Statement: Interpretation of “bulk quantities” in relation to the 
  storage of radioactive matter, November 2012. 
  http://www.hse.gov.uk/consult/condocs/cd-onr-bulk-interim.pdf 
   ONR, Licence Condition Handbook, February 2017. 
  www.onr.org.uk/silicon.pdf 
   Nuclear Installations Act 1965 (c57), The Stationery Office, 1965, ISBN 
  9780108502163. 
  http://www.legislation.gov.uk/ukpga/1965/57/contents 
   Ionising Radiations Regulations Statutory Instrument 2017/1075; The Stationary 
  Office; ISBN 9780111162231. 
  http://www.legislation.gov.uk/id/uksi/2017/1075 
   The Carriage of Dangerous Goods and Use of Transportable Pressure Equipment 
  Regulations Statutory Instrument 2009/1348; The Stationary Office; ISBN 
  9780111480120. 
  http://www.legislation.gov.uk/uksi/2009/1348/pdfs/uksi_20091348_en.pdf 
   Environmental Permitting Regulations (England and Wales) 2016, The Stationery 
  Office SI 2016 No 1154. 
  http://www.legislation.gov.uk/uksi/2016/1154/pdfs/uksi_20161154_en.pdf 
   Memorandum of Understanding between the Office for Nuclear Regulation and the 
  Environment Agency on Matters of Mutual Interest in England, August 2015. 
  http://www.onr.org.uk/documents/2015/mou-onr-ea-180815.pdf 
   Memorandum of Understanding between the Office for Nuclear regulation and the 
  Natural Resources Body for Wales on Matters of Mutual Interest in Wales, February 
  2015. 
  http://www.onr.org.uk/documents/2015/nrw-mou.pdf 
   Guidance to support the Joint Regulatory Memorandum of Understanding between the 
  Office for Nuclear Regulation and the Environment Agency on Matters of Mutual 
  Interest in England, ONR-INSP-GD-061 Revision 1, March 2018. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 21 of 27 
    
    
    
    
    
    
    
   Office for Nuclear Regulation 
   16  
   17  
   18  
   19  
   20  
   21  
   22  
   23  
   24  
   25  
   26  
   27  
   28  
   29  
   Guidance to support the Joint Regulatory Memorandum of Understanding between the 
  Office for Nuclear Regulation and the Natural Resources Body for Wales on Matters of 
  Mutual Interest in Wales, ONR-INSP-GD-063 Revision 1, June 2019. 
   The Environmental Authorisations (Scotland) Regulations 2018, SI 2018 No 219. 
  https://www.legislation.gov.uk/ssi/2018/219/pdfs/ssi_20180219_en.pdf 
   The Environmental Authorisations (Scotland) Regulations 2018: Guide to standard 
  conditions for radioactive substances activities, RS-G-100 Version 1.1.0. 
  https://www.sepa.org.uk/media/372002/easr-guide-to-standard-conditions.pdf 
   Memorandum of Understanding between the Office for Nuclear regulation and the 
  Scottish Environment Protection Agency on Matters of Mutual Interest in Scotland, 
  January 2019. 
  http://www.onr.org.uk/documents/2019/mou-onr-sepa.pdf 
   Guidance to support the Joint Regulatory Memorandum of Understanding between the 
  Office for Nuclear Regulation and the Scottish Environment Protection Agency on 
  Matters of Mutual Interest in Scotland, ONR-INSP-GD-062 Revision 1, June 2019. 
   IAEA Safety Standards, Predisposal Management of Radioactive Waste from Nuclear 
  Power Plants and Research Reactors, SSG-40, June 2016. 
  https://www-pub.iaea.org/MTCD/Publications/PDF/Pub1719web-85295015.pdf 
   IAEA Safety Standards, Predisposal Management of Radioactive Waste from Nuclear 
  Fuel Cycle Facilities, SSG-41, August 2016. 
  https://www-pub.iaea.org/MTCD/Publications/PDF/Pub1720web-34641098.pdf 
   HM Government, Review of Radioactive Waste Management Policy, Command 2919, 
  July 1995. 
   Committee on Radioactive Waste Management (CoRWM), Managing our Radioactive 
  Waste Safely – CoRWM’s Recommendations to Government, CoRWM 700 July 2006. 
  https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
  nt_data/file/294118/700_-
  _CoRWM_July_2006_Recommendations_to_Government_pdf.pdf 
   Managing Radioactive Waste Safely: A Framework for Implementing Geological 
  Disposal, Command 7386; A White Paper by DEFRA, BERR and the Devolved 
  Administrations for Wales and Northern Ireland, June 2008. 
  https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/228903/
  7386.pdf 
   Implementing Geological Disposal: A Framework for the long-term Management of 
  Higher Activity Radioactive Waste, July 2014. 
  https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/332890/
  GDF_White_Paper_FINAL.pdf 
   Implementing Geological Disposal: Working With Communities, December 2018. 
  https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
  nt_data/file/766643/Implementing_Geological_Disposal_-
  _Working_with_Communities.pdf 
   Welsh Government Policy on the Management and Disposal of Higher Activity 
  Radioactive Waste, 2015. 
  http://gov.wales/docs/desh/policy/150519-policy-on-the-management-and-disposal-of-
  higher-activity-radioactive-waste-en.pdf 
   Welsh Government, Geological Disposal of Higher Activity Waste: Community 
  Engagement and Siting Process, December 2015. 
  https://gweddill.gov.wales/docs/desh/publications/151210-geological-disposal-of-
  higher-activity-radioactive-waste-community-engagement-and-siting-processes-
  en.PDF 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 22 of 27 
    
    
    
    
    
    
    
   Office for Nuclear Regulation 
   30  
   31  
   32  
   33  
   34  
   35  
   36  
   37  
   38  
   39  
   40  
   Welsh Government, Geological Disposal of Higher Activity Radioactive Waste: 
  Working with Communities, 2019. 
  https://gweddill.gov.wales/docs/desh/publications/190116-geological-disposal-of-
  higher-activity-radioactive-waste-working-with-communities-en.pdf 
   Scottish Government, Scotland's Higher Activity Radioactive Waste Policy, 2011, 
  ISBN: 978 0 7559 9892 0. 
  http://www.gov.scot/Resource/Doc/338695/0111419.pdf 
   Scottish Government, Implementation Strategy for Scotland’s Policy on Higher Activity 
  Radioactive Waste, December 2016. 
  https://www.gov.scot/binaries/content/documents/govscot/publications/strategy-
  plan/2016/12/higher-activity-waste-implementation-strategy/documents/00511782-
  pdf/00511782-pdf/govscot%3Adocument/00511782.pdf 
   Policy for the Long Term Management of Solid Low Level Radioactive Waste in the 
  United Kingdom, March 2007. 
  https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
  nt_data/file/254393/Low_level_waste_policy.pdf 
   UK Strategy for the Management of Solid Low Level Waste from the Nuclear Industry, 
  February 2016. 
  https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
  nt_data/file/497114/NI_LLW_Strategy_Final.pdf 
   Management of radioactive waste from Decommissioning of Nuclear Sites: Guidance 
  on Requirements for Release from Radioactive Substances Regulation, Version 1.0 
  July 2018. 
  https://www.sepa.org.uk/media/365893/2018-07-17-grr-publication-v1-0.pdf 
   Regulatory Arrangements for the Management of Higher Activity Radioactive Waste on 
  Nuclear Licensed Sites: Regulatory Position Statement – 2017 Update. 
  http://www.onr.org.uk/documents/2017/statement-on-haw-june-2017.pdf 
   The Management of Higher Activity Radioactive Waste on Nuclear Licensed Sites, 
  Joint Guidance from ONR, EA, SEPA and NRW to Nuclear Licensees, Revision 2, 
  February 2015. 
  http://www.onr.org.uk/wastemanage/waste-management-joint-guidance.pdf 
   UK Strategy for Radioactive Discharges – 2018 Review of the 2009 Strategy, 
  Department for Business, Energy and Industrial Strategy, June 2018. 
  https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
  nt_data/file/718723/2018Rev2009UKStratRadDischargeFin.pdf 
   NDA, ENG01 Specification and guidance on the Content and Format of an Integrated 
  Waste Strategy, Revision 3 October 2012. 
  https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/517827/
  ENG01-Specification-and-Guidance-on-the-Content-and-Format-of-an-Integrated-
  Waste-Strategy.pdf 
   NDA, Industry Guidance: Interim Storage of Higher Activity Waste Packages – 
  Integrated Approach, Issue 3 January 2017. 
  https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
  nt_data/file/600642/Industry_Guidance_-_Interim_Storage_-_Intetgrated_Approach.pdf 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 23 of 27 
    
    
    
    
    
    
    Title of document 
   8. 
   ACRONYMS 
   ALARP 
   As low as reasonably practicable 
   BAT 
   CDG 
   Best Available Techniques 
   Carriage of Dangerous Goods and Use of Transportable Pressure Equipment 
  Regulations 2009 
   CoRWM 
   Committee on Radioactive Waste Management 
   EA 
   GDF 
   GSR 
   HAW 
   HLW 
   IAEA 
   ILW 
   Environment Agency 
   Geological Disposal Facility 
   General Safety Requirement 
   Higher Activity Radioactive Waste 
   High Level Waste 
   International Atomic Energy Agency 
   Intermediate Level Waste 
   (NS)LC 
   (Nuclear Site) Licence Condition 
   LLW 
   NIA65 
   NMAC 
   NRW 
   Low Level Waste 
   Nuclear Installations Act 1965 
   Nuclear Material Accountancy and Control 
   Natural Resources Wales 
   PSR/PRS 
   Periodic Safety Review / Periodic Review of Safety 
   RGP 
   SAP 
   Relevant Good Practice 
   Safety Assessment Principle(s) (ONR) 
   SEPA 
   Scottish Environment Protection Agency 
   SFAIRP 
   So far as is reasonably practicable 
   SRL 
   SSC 
   SSG 
   TAG 
   TIG 
   Safety Reference Level (WENRA) 
   Structure, System and Component 
   Specific Safety Guide 
   Technical Assessment Guide(s) (ONR) 
   Technical Inspection Guide(s) (ONR) 
   WENRA 
   Western European Nuclear Regulators’ Association 
   © Office for Nuclear Regulation, 2019 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 09/19 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 24 of 27 
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation 
   9. 
   APPENDICES 
   APPENDIX A – RADIOACTIVE WASTE DEFINITIONS 
   Higher Activity Radioactive Waste (HAW) 
   9.1 
   9.2 
   9.3 
   9.4 
   Higher Activity Waste comprises High Level Waste (HLW) (or heat generating waste), 
  Intermediate Level Waste (ILW) and such Low Level Waste (LLW) as cannot be 
  disposed of at present. 
   High Level Waste (HLW) 
   HLW – radioactive waste that is sufficiently radioactive that the decay heat significantly 
  increases its temperature and the temperature of its surroundings [23]. 
   Typical characteristics of HLW are thermal power above ~2 kW/m3.  The heat 
  generated from such waste has to be taken into account when designing storage or 
  disposal facilities. 
   Intermediate Level Waste (ILW) 
   ILW - radioactive waste with radioactivity levels exceeding the upper boundaries for 
  LLW, but which does not require heating to be taken into account for the design of 
  storage or disposal facilities [23].  IAEA guidance is that ILW thermal power is below 
  ~2 kW/m3. 
   Low Level Waste (LLW) 
   9.5 
   LLW is defined [33] as: 
    
   “radioactive waste having a radioactive content not exceeding four giga-
  becquerels per tonne (GBq/te) of alpha or 12 GBq/te of beta/gamma activity.” 
   9.6 
   The lower activity limit for LLW, below which waste is not required to be subject to 
  specific regulatory control is defined as ‘out of scope’ in the environmental permitting 
  regulations: 
    
    
   For England and Wales: EPR16, Schedule 23, Part 2 and Part 3 [12] 
   For Scotland: EASR18, Schedule 8, Part 1 and Part 6 [17]. 
   Very Low Level Waste (VLLW; a sub-category of LLW) 
   9.7 
   VLLW is a sub-category of LLW; however amendments to legislation in 2011 means 
  that this sub-category is now obsolete.  Notwithstanding this, the term continues to be 
  used in nuclear policy and guidance documents, as well as some environmental 
  permits for England and Wales.  The following definitions are taken from the UK 
  Strategy for the Management of Solid LLW from the Nuclear Industry [34]. 
   VLLW (Low Volume) 
   9.8 
   Low volumes (‘dustbin loads’) of “radioactive waste which can be safely disposed of to 
  an unspecified destination with municipal, commercial or industrial waste (“dustbin” 
  disposal) if: 
    
    
   each 0.1 m3 of waste contains less than 400 kBq of total activity or single items 
  contain less than 40 kBq of total activity 
   For wastes containing carbon-14 or hydrogen-3 (tritium): 
    
    
   in each 0.1 m3, the activity limit is 4,000 kBq for carbon-14 and 
  hydrogen-3 (tritium) taken together; and 
  for any single item, the activity limit is 400 kBq for carbon-14 and 
  hydrogen-3 (tritium) taken together. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 25 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   9.9 
   Controls on disposal of this material, after removal from the premises where the 
  wastes arose, are not necessary.” 
   VLLW (High Volume) 
   9.10 
   For bulk disposals – High Volume VLLW – where: 
    
    
   “Radioactive waste with maximum concentrations of four megabecquerels per 
  tonne (MBq/te); or 
   for waste containing hydrogen-3 (tritium), with maximum concentrations of 
  40 MBq/te; 
   can be disposed of to specified landfill sites. 
   9.11 
   Controls on disposal of this material, after removal from the premises where the 
  wastes arose, will be necessary in a manner specified by the environment regulators.” 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 26 of 27 
    
    
    
    
    
   Office for Nuclear Regulation 
   APPENDIX B – GENERAL PRINCIPLES FOR PASSIVE SAFETY 
   9.12 
   The following is a list of general principles taken from the SAPs [1] that should be 
  considered in proposals developed by licensees. 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   The radioactivity should be immobilised; 
   The wasteform and its container should be physically and chemically stable; 
   Energy should be removed from the wasteform; 
   A multibarrier approach should be adopted in ensuring containment; 
   The wasteform and its container should be resistant to degradation; 
   The storage environment should avoid degradation that may render the waste 
  unsuitable for long-term management or disposal; 
   The need for active safety systems to ensure safety should be minimised; 
   The need for monitoring and maintenance to ensure safety should be 
  minimised; 
   The should be no need for prompt intervention to maintain the facility in a safe 
  condition; 
   The storage building should be resistant to foreseeable hazards; 
   Access should be provided for response to incidents; 
   The storage facility should be designed and operated so that individual 
  packages can be inspected and retrieved within an appropriate period of time.  
  This may include the need for reserve storage space; 
   The lifetime of the storage building should be appropriate for the storage period 
  prior to disposal; 
   Appropriate provisions should be made for dealing with any radioactive waste 
  or its packaging that shows signs of unacceptable behaviour; 
   The package should be compatible with the long-term management strategy for 
  the waste, which may include the need for a further period of storage, or 
  disposal. 
   Report : NS-TAST-GD-24 Revision 6 
  CM9 Ref.: 2019/254780 
   Page 27 of 27 
    
    
    
    
    
  "
  nuclear construction sites cns-tast-gd-6.6	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/nuclear construction sites cns-tast-gd-6.6.pdf	" Title of document 
   OFFICIAL 
   ONR GUIDE 
   NUCLEAR CONSTRUCTION SITES 
   Document Type: 
   Nuclear Security Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   CNS-TAST-GD-6.6 Revision 0 
   March 2017 
   Review Date: 
   March 2020 
   Approved by: 
   David Pascoe 
   Professional Lead 
   Record Reference: 
  Revision commentary: 
   TRIM Folder 4.4.2.19076. (2017/106085) 
  New document issued 
   TABLE OF CONTENTS 
   1. 
  INTRODUCTION ................................................................................................................. 2 
  2. 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  3. 
  RELATIONSHIP TO RELEVANT LEGISLATION ................................................................ 2 
  4. 
  RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE ...................................... 2 
  5. 
  RELATIONSHIP TO NATIONAL POLICY DOCUMENTS ................................................... 3 
  6. 
  DEFINITION OF A NUCLEAR CONSTRUCTION SITE ...................................................... 3 
  7. 
  ADVICE TO INSPECTORS ................................................................................................. 4 
  8. 
  NUCLEAR CONSTRUCTION SITES – GENERAL ............................................................. 5 
  9. 
  SECURITY ARRANGEMENTS FOR A NUCLEAR CONSTRUCTION SITE ...................... 6 
  10. LICENSED NUCLEAR SITE UNDER CONSTRUCTION .................................................... 8 
  11. MULTIPLE UNIT SITES .................................................................................................... 10 
  12. REFERENCES .................................................................................................................. 11 
  13. GLOSSARY AND ABBREVIATIONS ................................................................................ 12 
  APPENDIX 1 – SUMMARY OF INDICATIVE MEASURES FOR NUCLEAR 
  CONSTRUCTION SITES .................................................................................................. 13 
  APPENDIX 2 – SUMMARY OF INDICATIVE MEASURES FOR CIVIL LICENSED 
  NUCLEAR SITES UNDER CONSTRUCTION SITES ....................................................... 15 
   OFFICIAL 
   © Office for Nuclear Regulation, 2017 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 03/17 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 17 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   1. 
   1.1 
   1.2 
   2. 
   2.1 
   3. 
   3.1 
   3.2 
   4. 
   4.1 
   INTRODUCTION 
   The Office for Nuclear Regulation (ONR) has established a set of Security Assessment 
  Principles (SyAPs) (Reference 7). This document contains Fundamental Security 
  Principles (FSyPs) that dutyholders must demonstrate have been fully taken into 
  account in developing their security arrangements to meet relevant legal obligations. 
  The security regime for meeting these principles is described in security plans 
  prepared by the dutyholders, which are approved by ONR under the Nuclear Industries 
  Security Regulations (NISR) 2003 (Reference 1).  
   The term ‘security plan’ is used to cover all dutyholder submissions such as nuclear 
  site security plans, temporary security plans and transport security statements. NISR 
  Regulation 22 dutyholders may also use the SyAPs as the basis for Cyber Security 
  and Information Assurance documentation that helps them demonstrate ongoing legal 
  compliance for the protection of Sensitive Nuclear Information (SNI). The SyAPs are 
  supported by a suite of guides to assist ONR inspectors in their assessment and 
  inspection work, and in making regulatory judgements and decisions.  This Technical 
  Assessment Guidance (TAG) is such a guide. 
   PURPOSE AND SCOPE 
   This TAG contains guidance to advise and inform ONR inspectors in the exercise of 
  their regulatory judgement during intervention activities relating to assessment of 
  physical protection at nuclear construction sites.  It aims to provide general advice and 
  guidance to ONR inspectors on how this aspect of security should be assessed. It 
  does not set out how ONR regulates the dutyholder’s arrangements.  It does not 
  prescribe the detail or methodologies for dutyholders to follow to demonstrate they 
  have addressed the SyAPs. It is the dutyholders responsibility to determine and 
  describe this detail within their submission and for ONR to assess whether the 
  arrangements are adequate.  
   RELATIONSHIP TO RELEVANT LEGISLATION 
   The term ‘dutyholder’ mentioned throughout this guide is used to define ‘responsible 
  persons’ on civil nuclear licensed sites and other nuclear premises subject to security 
  regulation, a ‘developer’ carrying out work on a nuclear construction site and approved 
  carriers, as defined in NISR. It is also used to refer to those holding SNI.  
   NISR defines a ‘nuclear premises’ and requires ‘the responsible person’ as defined to 
  have an approved security plan in accordance with Regulation 4. It further defines 
  approved carriers and requires them to have an approved Transport Security 
  Statement in accordance with Regulation 16. Persons to whom Regulation 22 applies 
  are required to protect SNI. ONR considers Physical Protection Systems (PPS) to be 
  an important component of a dutyholder’s arrangements in demonstrating compliance 
  with relevant legislation.   
   RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE 
   The essential elements of a national nuclear security regime are set out in the 
  Convention on the Physical Protection of Nuclear Material (CPPNM) (Reference 4) and 
  the IAEA Nuclear Security Fundamentals (Reference 3). Further guidance is available 
  within IAEA Technical Guidance and Implementing Guides. 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 2 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   4.2 
   Fundamental Principle C of the CPPNM refers to the legislative and regulatory 
  framework should provide for the establishment of applicable physical protection 
  requirements and include a system of evaluation and licensing or other procedures to 
  grant authorisation. The importance of issues relating to authorisation reiterated in the 
  Nuclear Security Fundamentals, specifically: 
    
   Essential Element 3: Legislative and Regulatory Framework – 3.3 The 
  legislative and regulatory framework, and associated administrative 
  measures, to govern the nuclear security regime provides for the 
  establishment of nuclear security regulations and requirements, and 
  associated procedures for evaluating applications and granting 
  authorisations or licences.  
   A more detailed description of issues relating to legislative and regulatory frameworks 
  is provided in Recommendations level guidance, specifically paragraphs 3.8 to 3.17 of 
  Nuclear Security Series (NSS) 13, Recommendations on Physical Protection of 
  Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5) (Reference 2). This 
  document recommends that the State should licence activities or grant authorisation 
  only when such activities comply with its physical protection regulations.  
   The IAEA also publish Implementing Guide NSS No. 19 ‘Establishing the Nuclear 
  Security Infrastructure for a Nuclear Power Programme’ (Reference 8) where further 
  relevant information can be found on legislative and regulatory frameworks at 
  paragraphs 3.1 to 3.12.  
   RELATIONSHIP TO NATIONAL POLICY DOCUMENTS 
   The SyAPs provide ONR inspectors with a framework for making consistent regulatory 
  judgements on the effectiveness of a dutyholder’s security arrangements.  This TAG 
  provides guidance to ONR inspectors when assessing a dutyholder’s submission 
  demonstrating they have effective processes in place to achieve SyDP 6.6 – Nuclear 
  Construction Sites, in support of FSyP 6 – Physical Protection Systems.  The TAG is 
  consistent with other TAGs and associated guidance and policy documentation. 
   The HMG Security Policy Framework (SPF) (Reference 5) describes the Cabinet 
  Secretary’s expectations of how HMG organisations and third parties handling HMG 
  information and other assets will apply protective security to ensure HMG can function 
  effectively, efficiently and securely. The security outcomes and requirements detailed 
  in the SPF have been incorporated within the SyAPs. This ensures that dutyholders 
  are presented with a coherent set of expectations for the protection of nuclear 
  premises, SNI and the employment of appropriate personnel security controls both on 
  and off nuclear premises. 
   The Classification Policy (Reference 6) indicates those categories of SNI, which 
  require protection and the level of security classification to be applied. 
   DEFINITION OF A NUCLEAR CONSTRUCTION SITE 
   Section 77 of the Anti-Terrorism, Crime and Security Act 2001 (Reference 9), defines 
  the term ‘Nuclear Construction Site’ as a site on which works are being carried out with 
  a view to it becoming a nuclear site wholly or mainly for purposes other than defence 
  purposes, which is situated within 5 kilometres of an existing nuclear site.  NISR 2003 
   4.3 
   4.4 
   5. 
   5.1 
   5.2 
   5.3 
   6. 
   6.1 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 3 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   further defines a ‘Nuclear Construction Site’ as one which works are being carried out 
  by a developer pursuant to the grant or issue of a planning or development consent 
  order.  
   ADVICE TO INSPECTORS 
   Nuclear construction sites present unique challenges to security, not least the scale of 
  some projects, extent of activity and numbers of personnel involved. All SyAPs and 
  their associated TAGs will be relevant to nuclear construction site security at some 
  stage and this TAG does not intend to reproduce the content of those TAGs.  The aim 
  of this TAG is to highlight to inspectors the differences a construction site has to an 
  operational site to allow for proportionate assessment.  It is a key principle that security 
  measures are effective and proportionate to the threat, and inspectors should 
  recognise that dutyholders need flexibility to manage changes to the construction 
  process.  Inspectors should be open to innovative proposals whilst ensuring risks are 
  appropriately mitigated.     
    
   
   
   
   
   
   
   
   
   The following list of TAGs whilst not exhaustive, are particularly relevant to this TAG: 
  Governance and Leadership 
  Maintenance of a Robust Security Culture 
  Commissioning of Security Systems 
  Oversight of Suppliers of Items of Services of nuclear Security 
  Categorisation for Theft 
  Categorisation for Sabotage 
  Physical Protection Design 
  Adjacent and Enclave Sites 
  Guidance on the Purpose, Scope and Quality of a Nuclear Site Security Plan 
  The purpose of the assessment is to determine whether the security arrangements on 
  a Nuclear Construction Site are adequate to address three specific risks: 
  The threat a Construction Site may pose to a neighbouring nuclear site 
  The threat a Construction Site may pose to an existing operating nuclear site 
  where a facility is being constructed 
  The risk of sabotage through introducing defects into the new nuclear facility 
  while it is under construction that could compromise the safety or security of 
  the nuclear facility once it starts operations 
  The assessment should also provide a level of confidence that the facility is being 
  constructed to meet the arrangements that will be detailed in the security plan once the 
  facility becomes operational using ‘secure by design’ principles.   
    
   
    
   This document is not intended to provide guidance on the detailed design of security 
  arrangements for the operating facility. It is produced to highlight areas for assessment 
  consideration throughout the construction phase. 
   7. 
   7.1 
   7.2 
   7.3 
   7.4 
   7.5 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 4 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   Regulatory Expectation 
   7.6 
   The regulatory expectation is that dutyholders demonstrate within their security plan 
  how their physical protection system is phased according to sensitivity of the site as 
  construction develops in order to provide ongoing assurance that its activities cannot 
  be exploited by an adversary.  
   FSyP 6 – Physical 
  Protection System 
   Nuclear Construction Sites 
   SyDP 6.6 
   Dutyholders should ensure that they implement a physical protection system designed 
  to ensure its activities cannot be exploited by an adversary to incorporate a latent 
  defect or to pose a threat to an adjacent site.  
   8. 
   NUCLEAR CONSTRUCTION SITES – GENERAL 
   Phased Approach 
   8.1 
   8.2 
   8.3 
   In order to provide for effective and proportionate security arrangements throughout 
  the lifetime of the construction project, it is important that a phased approach is 
  adopted.  The phases should identify key points during the construction process when 
  it is necessary to make incremental security enhancements to reflect the rise in the 
  level of risk as the project progresses. Each phase should be documented in the 
  Construction Site Security Plan (CSSP) together with the associated security 
  arrangements clearly articulated.  Security ‘hold points’ should be identified before 
  progressing from one phase to the next to provide time to assess and/or approve 
  amended or new versions of the security plan, and allow time for those revised 
  arrangements to become embedded and operational with proven reliability prior to an 
  increase in site sensitivity or categorisation. Examples of phases will be dependent on 
  the function of the new facility, but may include:  
  Ground Investigations. 
  Preparatory Groundworks.   
  First Nuclear Concrete. 
  Introduction of Nuclear or Other Radioactive Material. 
  First Criticality. 
  Consideration should also be given to the proportionate arrangements for Temporary 
  Security Plans (TSPs) during the transitional period without them placing an 
  unnecessary burden on both dutyholder and regulator. This may be achieved by 
  defining in the security plan the type of activity and bounding cases where TSPs are 
  required. 
    
   
   
   
   
   Coordination with Licence Application and Licence Grant 
   The ONR publication ‘Licensing Nuclear Installations’ requires appropriate measures 
  to be in place to manage all aspects of security before a site licence is granted.  
  Inspectors will be required to assess the security measures in place and confirm they 
  are appropriate. The dutyholder should submit a draft security plan at licence 
  application and engage with ONR inspectors during its development to ensure it can 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 5 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   be approved.  The approval in principle of the security plan prior to Site Licence Grant 
  can be regarded as acceptance that ONR is satisfied with the security arrangements in 
  place and a Site Licence can be granted. 
   8.4 
   The submission must include detail of the security architecture for end state 
  operations. This provides assurance to ONR that there is a defined end state for the 
  security regime and allows ONR to check that progress during the transitional period 
  aligns with regulatory expectations and in accordance with agreed timescale. Changes 
  to the end state security architecture will require submission of an amended or new 
  issue of the plan for approval. 
   Inspectors should consider: 
    
    
    
    
   Is the security phased in its approach to reflect the level of risk as the project 
  progresses? 
   Are there appropriate hold points identified between the phases? 
   Are there appropriate provisions in place for engagement with the regulator 
  to support achieving approval in principle of the security plan? 
   Does the security plan include detail of the security architecture for site end 
  state operations? 
   9. 
   9.1 
   SECURITY ARRANGEMENTS FOR A NUCLEAR CONSTRUCTION SITE 
   An approved security plan must be in place before a developer undertakes activities on 
  a nuclear construction site to construct a new nuclear facility and for which Planning or 
  Development Consent has been granted.  The security plan for the construction phase 
  should reflect the arrangements listed below. 
   Security Appointments 
   9.2 
   9.3 
   9.4 
   A Company Security Manager should be appointed at the early stages of the project to 
  develop security arrangements and author the security plan.  A member of the 
  dutyholder’s senior management team should be appointed to oversee the overall 
  delivery of security.   
   A Site Security Manager or a Suitably Qualified and Experienced (SQEP) senior site 
  manager should be appointed to act as a security focal point for liaison with the 
  adjacent site and to oversee security force activity.  
   Once appointed, the Construction Site Director should have clear sight of security 
  measures being adopted, a clear understanding of the risks and have clear 
  responsibilities for security governance. 
   Liaison with Adjacent Site 
   9.5 
   Arrangements must be in place between the Security Manager and the adjacent 
  nuclear site’s security manager to ensure there is a flow of information including 
  activity on site, any potential hazards and reporting of security incidents for more 
  information.  
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 6 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   Identification of Vulnerabilities and Hazards 
   9.6 
   Using the NIMCA as a basis, an evaluation of the vulnerabilities and hazards should 
  be undertaken to ensure appropriate security arrangements are in place to mitigate the 
  associated risks of construction projects. Examples of vulnerabilities may include 
  heavy plant/vehicles, explosives and charges (used in geotechnical surveys), 
  scaffolding, ladders, heavy tools, fuel and chemicals, and large mounds of spoil and 
  earth. Example mitigation measures are at Appendix A. 
   Access Control/Authorised Entry 
   9.7 
   9.8 
   9.9 
   The term Access Control is commonly used in relation to site or building access.  It is 
  likely that the initial stages of any development will be undertaken on open land where 
  Public Rights of Way (PROW) are still in place and there may be no defined perimeter.  
  In such cases, access to controllable areas and buildings should be strictly managed 
  to mitigate any vulnerabilities that the dutyholder has identified.   
   Once PROW have been closed, a perimeter fence or barrier should be erected to 
  delineate the boundary of the Nuclear Construction Site. 
   Only authorised personnel and essential vehicles should be permitted access.  Non-
  essential vehicles should be parked off the construction site and away from any 
  adjacent Nuclear Site or Facility. 
   Security Control Point 
   9.10 
   A Security Control Point should be established on the site at the designated 
  vehicle/pedestrian access point.  It should be staffed by security personnel and used to 
  control and account for pedestrians/vehicles accessing and exiting from the 
  construction site. This can act as a base from which security patrols are carried out 
  and security documentation/records held. 
   Searches 
   9.11 
   A facility should be provided to carry out searches of personnel and vehicles to 
  minimise the risk of the introduction of prohibited items. 
   Contractors Security Arrangements 
   9.12 
   Contracts with third parties should clearly stipulate the security arrangements that are 
  required.  Contractors are required to adhere to the same security arrangements as 
  the dutyholder’s staff.  Arrangements involving the submission of security plans by 
  contactors to the dutyholder should be approved by the dutyholder’s Security Manager 
  and supported by comprehensive audit and assurance arrangements.  The use of such 
  plans does not absolve the dutyholders from being responsible or accountable for 
  security, and statements to that effect should be clearly articulated in the security plan. 
   Personnel Security 
   9.13 
   Large scale construction projects present unique challenges for dutyholders due to the 
  large workforce on site, the majority of whom will probably be contractors and sub-
  contractors, both long term and transient, employing a mixture of backgrounds and 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 7 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   nationalities.  The level of vetting checks required for staff, contractors and visitors on 
  a Nuclear Construction Site will depend on access requirements (e.g. to SNI, site plans 
  and construction plant) and their roles, such as security and senior management 
  positions.  FSyP 8 requires dutyholders to deliver the appropriate combination of 
  recruitment checks and vetting to satisfy themselves of the honesty and integrity of 
  potential employees. 
   9.14 
   The dutyholder must have a clear personnel security strategy which reflects the 
  phased approach where security arrangements are commensurate with the level of 
  risk as the project progresses.  Use of zones or compounds should be considered 
  where access should be limited to those personnel with higher levels of vetting/security 
  clearance.   
   Security Culture 
   9.15 
   There may be particular challenges to fostering a good security culture amongst 
  workers on a construction site due to the large numbers of people involved, the often 
  transient nature of contractors and the limited exposure many will have had to nuclear 
  security. The dutyholder should consider implementing a robust nuclear security 
  culture from project start or implement a phased approach as the site develops. 
   Inspectors should consider: 
    
    
    
    
    
    
    
    
    
   Is there a company security manager and a member of the senior 
  management team appointed to oversee the delivery of security? 
   Is there a Site Security Manager or SQEP senior manager appointed to act 
  as the security focal point for liaison with the adjacent site and to oversee 
  security force activity? 
   Does the Construction Site Manager have a clear understanding of the risks 
  and have clear responsibilities for security governance? 
   Are there effective liaison arrangements in place with any adjacent nuclear 
  premises? 
   Has NIMCA been used as a basis for an evaluation of the vulnerabilities and 
  hazards to ensure appropriate security arrangements are in place to mitigate 
  the associated risks of construction projects? 
   Are access control arrangements effective, incorporating a security control 
  point and searching? 
   Is there adequate control of the supply chain?  
   Is there a clear and effective personnel security strategy? 
   Is there an effective strategy in place to foster a strong security culture? 
   10. 
   LICENSED NUCLEAR SITE UNDER CONSTRUCTION 
   10.1 
   The term ‘Licensed Nuclear Site Under Construction’ is used to describe a new site on 
  which construction activity is being carried out, from the point at which a Nuclear Site 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 8 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   Licence is granted up to the time that the site is to become operational. A Licensed 
  Nuclear Site Under Construction must have an approved NSSP in place.  The NSSP is 
  to build on the measures already detailed in the CSSP to address the threat to and 
  from a neighbouring operating nuclear site.  It is also required to address the risk of 
  sabotage through maliciously introducing defects into the nuclear facility while it is 
  being constructed that could compromise safety or security once operations start. 
   10.2 
   The dutyholder should submit a draft NSSP at licence application and engage with 
  ONR inspectors during its development.  The NSSP should reflect the phased 
  approach to security arrangements throughout the project as described in para 8.1 
  above.  The approval in principle of the NSSP prior to Site Licence Grant can be 
  regarded as acceptance that ONR is satisfied with the security arrangements in place. 
  The NSSP should also outline end state security requirements. These are the security 
  standards, procedures and arrangements, including the location of buildings and 
  barriers that must be in place before the site is formally categorised to the highest 
  category for the prevention of theft or sabotage (refer to the PPS outcomes).   
   Introduction of defects 
   10.3 
   The dutyholder should clearly identify the point at which the site is sufficiently 
  developed to be vulnerable to the introduction of defects which may compromise the 
  safety or security of the facility once it starts operating.  Vulnerabilities should be 
  clearly identified and appropriate security arrangements put in place to mitigate the 
  risks.  
   Introduction of Nuclear or Other Radioactive Material 
   10.4 
   As the project progresses there may be a requirement to introduce Nuclear Material 
  (NM) and Other Radioactive Material (ORM) such as radioactive sources and new 
  nuclear fuel before the facility becomes operational.  The security arrangements to 
  protect this material must achieve the required PPS outcome as detailed in the PPS 
  Outcome Definition Table.  
   Site Boundary 
   10.5 
   A permanent fence should be in place which delineates the site boundary and 
  excludes any public rights of way. 
   Serious Organised Crime and Police Act (SOCPA)  
   10.6 
   Once a Licence has been granted the site becomes a ‘designated site’ subject to the 
  Serious Organised Crime and Police Act (SOCPA) 2005 s128 (Reference 10). 
  Dutyholders are to demonstrate that enforcement of SOCPA can be implemented 
  whenever necessary (e.g. the provision of a defined boundary, access control and 
  clear signage). 
   Inspectors should consider: 
    
    
   Does the security plan adopt the phased approach? 
   Does the security plan outline the end-state security arrangements? 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 9 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
    
    
    
   Does the security plan identify the point at which the site is sufficiently 
  developed to be vulnerable to the introduction of defects which may 
  compromise the safety or security of the facility once it starts operating? 
   Does the security plan demonstrate the required security outcome is 
  achieved at all stages of project development, particularly as NM and ORM 
  is brought on and the categorisation for theft and sabotage increases? 
   Is there an appropriate site boundary in place that allows in enforcement of 
  SOCPA once the licence is granted? 
   11. 
   MULTIPLE UNIT SITES 
   11.1 
   New Nuclear Power Stations may consist of two or more operating reactors in close 
  proximity to one another.  The timeframe for operations may mean one or more units 
  operating whilst others are still under construction.  Security arrangements during this 
  period must still achieve the appropriate PPS outcome for the operating reactor(s).  
  Inspectors should be flexible and engage with dutyholders to ensure that security 
  arrangements, some of which may be temporary, continue to achieve the appropriate 
  PPS outcome. 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 10 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   12. 
   1. 
   2. 
   3. 
   4. 
   5. 
   6. 
   7. 
   8. 
   9. 
   REFERENCES 
   Nuclear Industries Security Regulations 2003.  Statutory Instrument 2003 
   No. 403 
   IAEA Nuclear Security Series No. 13.  Nuclear Security Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities 
  (INFCIRC/225/Revision 5).  January 2011.  www-
  pub.iaea.org/MTCD/Publications/PDF/Pub1481_web.pdf. 
   IAEA Nuclear Security Series No. 20.  Objective and Essential Elements of a 
  State’s Nuclear Security Regime. http://www-
  pub.iaea.org/MTCD/Publications/PDF/Pub1590_web.pdf 
   Convention on the Physical Protection of Nuclear Material (CPPNM) 
   https://ola.iaea.org/ola/treaties/documents/FullText.pdf 
   HMG Security Policy Framework. Cabinet Office.  
   https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/3
  16182/Security_Policy_Framework_-_web_-_April_2014.pdf 
   NISR 2003 Classification Policy – Trim Ref. 2012/243357. 
   Security Assessment Principles – Trim Ref. 2017/121036   
   IAEA Nuclear Security Series No. 14. Nuclear Security Recommendations on 
  Radioactive Material and Associated Facilities. http://www-
  pub.iaea.org/MTCD/Publications/PDF/Pub1488_web.pdf 
   The Anti-Terrorism, Crime and Security Act 2001. 
   http://www.legislation.gov.uk/ukpga/2001/24/pdfs/ukpga_20010024_en.pdf 
   10. 
   The Serious Organised Crime and Policing Act 2005. 
   http://www.legislation.gov.uk/ukpga/2005/15/pdfs/ukpga_20050015_en.pdf 
   Note: ONR staff should access the above internal ONR references via the How2 
  Business Management System. 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 11 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   13. 
   GLOSSARY AND ABBREVIATIONS 
   CPPNM 
  CSSP 
  FSyP 
  IAEA 
  NIMCA 
  NISR 
  NM 
  NSS 
  NSSP 
  ONR 
  ORM 
  PPS 
  PROW 
  SIA 
  SNI 
  SOCPA 
  SPF 
  SQEP 
  SyDP 
  TAG 
   Convention on the Physical Protection of Nuclear Material 
  Construction Site Security Plan 
  Fundamental Security Principle 
  International Atomic Energy Agency 
  Nuclear Industries Malicious Capabilities Planning Assumptions 
  Nuclear Industries Security Regulations 
  Nuclear Material 
  Nuclear Security Series 
  Nuclear Site Security Plan 
  Office for Nuclear Regulation 
  Other Radioactive Material 
  Physical Protection System 
  Public Right of Way 
  Security Industry Association 
  Sensitive Nuclear Information 
  Serious Organised Crime and Policing Act 
  Security Policy Framework 
  Suitably Qualified and Experienced 
  Security Delivery Principle 
  Technical Assessment Guide 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 12 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   APPENDIX 1 – SUMMARY OF INDICATIVE MEASURES FOR NUCLEAR CONSTRUCTION 
  SITES 
   1. 
   2. 
   The table below provides details on the most commonly deployed measures and 
  processes to achieve the required security for a nuclear construction site. It is not an 
  exhaustive list and dutyholders may consider other measures that achieve the required 
  outcome. 
   Each measure or process should be applied in a graduated manner according to the 
  threat or risk being mitigated as the site develops. 
   MEASURES AND PROCESS TABLE –
  Measure or Process 
   NUCLEAR CONSTRUCTION SITES 
  Description
   Initial stages - Site will not have a perimeter.   
   Prevent 
  Unauthorised 
  Access to 
  equipment 
   Plant and Vehicles 
    
   
    
   
    
    
    
    
    
   
   Account for all personnel on site. 
  Remove or secure
   all equipment and plant which pose a 
  threat 
  to 
  the 
  adjoining 
  site(s) 
  when not
  in 
  use 
  such 
  as 
  ladders, 
  scaffolding, 
  hazardous materi
  al 
  in 
  compounds, 
  stores 
  or I
  SO 
  Containers. 
  Ensure keys are adequately secured an controlled 
  Clearly 
  define any trespas
  s 
  policy 
  and how the compan
  deal with trespass and protest action 
  An 
  inventory 
  of equ
  ipment 
  should 
  be 
  carried out 
  When 
  Public 
  Rights 
  of 
  Way 
  are 
  closed/re-routed, 
  install 
  a
  suitable 
  fence 
  to define 
  the perimeter and provide 
  for a 
  defined 
  site access/exit point(s) 
   frequent 
   kept and
   y 
   will 
   checks 
   Construction 
  sites 
  should 
  not 
  be 
  used 
  as 
  storage 
  areas 
  when 
  plant 
  is 
  not 
  in 
  use 
  and the 
  amount 
  of pl
  ant 
  on si
  te 
  should 
  be 
  minimised. 
  Designated 
  compounds 
  or 
  parking 
  areas, 
  away 
  from 
  adjacent site, should be used when plant is not in use. 
  Plant and vehicles should be immobilized when not in use. 
  Keys 
  should 
  be 
  controlled 
  and drawn on
  ly 
  by 
  authorised 
  persons  
   the 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 13 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
     
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   MEASURES AND PROCESS TABLE –
  Measure or Process 
   NUCLEAR CONSTRUCTION SITES 
  Description
    
    
    
    
    
    
    
   
    
    
   Spoil 
   Liaison with other 
  adjacent Site 
   Maintain Clear 
  Zones 
   Guarding/Security 
  Force 
   Prevent prohibited 
  items being 
  introduced to site 
   Contingency 
  Plans 
   Extensive excavation work will result 
  in 
  large quantities of spoil. 
  A 
  plan 
  should 
  be i
  n 
  place 
  to address the
  impact 
  of spoil 
  mounds 
  on 
  security 
  measures 
  facilitating 
  an 
  attack 
  or the
  conduct 
  of 
  hostile 
  reconnaissance 
  on an ad
  jacent 
  operating 
  facility, or circumvent security measures 
   Ensure 
  formal liais
  on 
  takes 
  place 
  with 
  security 
  staff 
  from 
  adjacent sites and stakeholders such as CNC and Home Office 
  Police force CTSAs. 
  Appropriate 
  arrangements 
  should 
  be 
  in pla
  ce 
  to 
  report 
  security 
  incidents 
  to the 
  company 
  security 
  manager and adjac
  ent 
  nuclear site’s security staff on a 24/7 basis 
   clear 
   zones 
   are 
   maintained 
   Ensure 
  sites 
  Ensure non-essential vehicles are parked off-site and well away 
  from any adjoining nuclear facility. 
   site and adjacent
   around 
   A 
  SQEP 
  security 
  force shoul
  d 
  be 
  in 
  place. 
   Duties 
  should 
  be 
  clearly 
  documented. 
  Where 
  CGF 
  are 
  employed, 
  contracts
  should include a set of key performance indicators. 
  Contract guards must be SIA Licence holders. 
  A Security Control Point should be located by the access point. 
   Random searches of personnel/vehicles entering site should be 
  carried out to achieve the specified security outcome. 
   Contingency 
  plans 
  should 
  document 
  actions 
  to 
  be 
  taken 
  if 
  a 
  security 
  event, 
  including 
  protest, 
  action 
  takes 
  place. 
  This 
  should 
  include 
  communication 
  with 
  CNC, 
  local 
  police 
  and 
  adjacent sites 
   Personnel 
  Security 
    
   Clear policy 
  checks 
   should document 
   the 
   requirements 
   for 
   background 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 14 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   APPENDIX 2 – SUMMARY OF INDICATIVE MEASURES FOR CIVIL LICENSED NUCLEAR 
  SITES UNDER CONSTRUCTION SITES 
   1. 
   A Civil Licensed Nuclear Site Under Construction must have an approved Nuclear Site 
  Security Plan.  The plan may be a simple transition from the Construction Site Security 
  Plan, but a phased approach should be adopted.  The NSSP relating to the operational 
  site should reflect the appropriate PPS outcome and the relevant TAGs should be 
  referred to.  Similarly, the relevant PPS outcomes must be achieved from the point at 
  which NM and/or ORM is introduced to the licensed site. 
   MEASURES AND PROCESS TABLE –
  Measure or Process 
   CIVIL LICENSED NUCLEAR CONSTRUCTION SITES 
  Description
   Prevent 
  Unauthorised 
  access to Site 
   Contingency 
  Plans 
   Prevent 
  unauthorised 
  access/use of 
  equipment 
    
    
    
    
    
    
    
   
    
   
    
    
    
   are c
   losed 
   Ensure 
  a 
  site 
  perimeter 
  is 
  in 
  place, 
  all 
  PROW 
  clear zones are in place around perimeter. 
  All 
  personnel 
  entering 
  site 
  are aut
  horised 
  guard force or use of AACS 
  Vehicle access limited to essential vehicles and minimised with 
  the use of off-site delivery points. 
  Vehicles are searched on entry 
   through 
   checks 
   and 
   by 
   The 
  dutyholder 
  is 
  to 
  ensure appropriate 
  contingency 
  plans 
  are 
  in 
  place 
  to assist i
  n 
  countering 
  relevant 
  malicious 
  capabilities. 
  These should be consistent with emergency arrangements. 
  In 
  particular, 
  dutyholders 
  should 
  recognise 
  the pot
  ential 
  increase 
  in threat from protestor action.  
   be 
   and 
   cabs 
   should 
   mmobilised 
   Plant/vehicles 
  should be i
  secured when unoccupied. 
  Use of PIN protected control systems should be considered. 
  Vehicles 
  should 
  be p
  arked 
  in 
  designated 
  positions 
  away 
  from 
  adjacent or sensitive areas. 
  Consider use of Vehicle alarms/tracking systems 
  Secure 
  Compounds/ISO 
  Containers 
  used 
  scaffolds, hazardous materials etc. 
  Ensure 
  there 
  is 
  an i
  nventory 
  of 
  plant, 
  equipment, 
  volatile 
  materials and that random checks are carried out on them. 
  Keys should be held securely and accounted for at all times. 
  Access 
  controls 
  should 
  prevent 
  unauthorised 
  persons
  accessing equipment or plant. 
   ladders, 
   for 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 15 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   SOCPA 
  Provisions 
    
   SOCPA is very specific on what parts of a licensed site are covered as 
  detailed below:  
   
  all ground inside the outer perimeter of the protection required 
  for any premises, defined as the line of the outermost fences, 
  walls or other obstacles provided or relied upon for protecting 
  those premises from intruders; and  
  that line shall be determined on the assumption that every 
  gate, door or other barrier across a way through a fence, wall 
  or other obstacle is closed.  
  How this is managed is a matter for dutyholders, however as a 
  minimum the following is to be achieved: 
   
  warning 
  signs 
  are displayed aroun
  d 
  the 
  outer 
  perimeter 
  to 
  ensure 
  all 
  possible 
  approach route
  s 
  are 
  adequately 
  covered, 
  especially those that adjoin public property and rights of way;  
  wherever 
  possible, 
  signs are 
  located 
  so 
  they 
  can also 
  be rea
  d 
  during the hours of darkness;  
  signs 
  are 
  made 
  and, where pract
  icable, 
  positioned 
  in 
  such 
  a 
  way that reduces the possibility of them being used as climbing 
  aids, but ensures that they are securely attached to a fence;  
  signs 
  are 
  positioned 
  so 
  that, 
  wherever 
  possible, 
  lines 
  sight/vision through a fence are kept clear;  
  sufficient spare signs are held to 
  replace any 
  and,  
  procedures are in place to liaise with civil police. 
   lost or damaged; 
   of 
    
    
    
    
    
   Tower Cranes 
   Void Management 
    
    
    
    
    
   in 
   to 
   place 
   secure 
   the bas
   Arrangements 
  should 
  be 
  Tower Crane effectively. 
  The 
  span 
  of 
  the 
  crane 
  should 
  not compro
  mise 
  adjacent site or operating reactor’s perimeter. 
  On 
  a 
  multi-unit 
  NPS, 
  construction 
  requiring 
  tower c
  ranes 
  should 
  be comp
  leted 
  before 
  any adj
  acent 
  unit 
  operations 
  commence. 
   security 
   of an
   of 
   e 
   a 
   As 
  the 
  build progresses
  , 
  the 
  complexity 
  of 
  structures 
  will 
  increase. 
  To 
  minimise 
  the 
  risk 
  of 
  unauthorised i
  tems 
  being 
  introduced, 
  dutyholders 
  should 
  have a plan that c
  overs 
  the 
  security of voids 
  in structures. 
   This should 
  include a means of 
  searching then securing voids. 
  Zoning of sites to protect critical infrastructure. 
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 16 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   Technical Security 
  Measures 
   Construction 
  sites may 
  cover a wide area several 
  times 
  the 
  size of 
  the 
  eventual 
  operating 
  site.  
  Electronic 
  security 
  arrangements 
  such 
  as 
  PIDS, 
  CCTV, AACS a
  nd 
  lighting 
  should 
  be 
  considered 
  and 
  deployed 
  as 
  is p
  racticable. 
  When 
  identifying 
  vulnerabilities, 
  dutyholders 
  should 
  have 
  prioritised where the 
  deployment 
  of 
  such 
  systems 
  will 
  be 
  most 
  effective.  The following should be taken into account: 
   
  Sites 
  may 
  not ha
  ve 
  an electric
  ity 
  supply, 
  therefore 
  equipment 
  with 
  self-contained 
  power 
  sources 
  – 
  diesel 
  generators, 
  battery 
  supplies, solar and wind powered should be considered. 
  The 
  continuous 
  development 
  of 
  the 
  site 
  should 
  be 
  taken 
  into 
  account 
  and 
  portable 
  security 
  systems 
  may 
  need 
  to be
  considered. 
  Site activities should be taken into account with regard to cable 
  laying, 
  particularly 
  when 
  heavy pl
  ant 
  is 
  moving 
  and 
  excavations 
  are 
  underway. 
   Con
  sideration 
  may 
  be 
  given 
  to 
  alternative transmission systems such as wireless technology. 
  Where 
  PIDS/IDS 
  are 
  used, 
  there s
  hould 
  be 
  a 
  suitable 
  means 
  of verification/assessment in place. 
  An 
  OR1 
  and 
  OR2 
  should 
  be completed to determine what 
  security measures are needed and to what effect. 
    
    
    
    
   Report CNS-TAST-GD-6.6 
  TRIM Ref: 2017/106085 
   Page 17 of 17 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
  "
  Organisational Change ns-tast-gd-048	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Organisational Change ns-tast-gd-048.pdf	" Title of document 
   ONR GUIDE 
   Organisational Change   
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   NS-TAST-GD-048 Revision 5 
   September 2018 
   Review Date: 
   September 2021 
   Approved by: 
   Stuart Allen 
   Professional Lead – Human and 
  Organisational Capability 
   Record Reference: 
   Revision commentary: 
   TRIM Folder 1.1.3.776. (2018/283567) 
  Fit for purpose update 
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
   5. 
  6. 
   INTRODUCTION ................................................................................................................. 2 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION ......................... 2 
  RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ADDRESSED ............................................................................................... 3 
  ADVICE TO INSPECTORS ................................................................................................. 5 
  APPENDICES .................................................................................................................... 17 
   © Office for Nuclear Regulation, 2018 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 09/18 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 25 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   2. 
   2.1 
   2.2 
   2.3 
   2.4 
   INTRODUCTION 
   ONR has established its Safety Assessment Principles (SAPs) MS.1 to MS.4 which 
  apply to the assessment by ONR specialist inspectors of the organisational capability 
  of potential and existing licensees.  The principles presented in these SAPs are 
  supported by a suite of guides to further assist ONR’s inspectors in their technical 
  assessment work in support of making regulatory judgments and decisions.  This 
  technical assessment guide is one of those guides. 
   PURPOSE AND SCOPE 
   The purpose of this Technical Assessment Guide (TAG) is to assist in making informed 
  judgements and decisions on the adequacy of the licensee’s arrangements and their 
  implementation, to ensure that changes to organisational structure or resources which 
  may affect safety are adequately controlled in accordance with the requirement of 
  nuclear site licence condition (LC) 36 ‘Organisational Capability’ as set out in Appendix  
   Appendix 4 of this TAG also provides guidance on how Inspectors should approach 
  the revised clause in LC 36(1), added in 2011, which requires licensees to provide and 
  maintain adequate financial and human resources to fulfil their obligations in respect of 
  nuclear safety.  The revised LC 36(1) was introduced, together with amendments to LC 
  17 ‘Management Systems’, to ensure that the Nuclear Safety Directive 
  2009/71/Euratom (NSD) is fully implemented in Great Britain.  
   It incorporates guidance for inspectors in judging the adequacy with which licensees’ 
  arrangements have been implemented, originally presented in T/INS/036 ‘LC36 
  Control of Organisational Change’, thus consolidating related guidance within this 
  single reference document.  Factors that the inspector may wish to consider 
  concerning the way in which a licensee’s arrangements are implemented are set out in 
  Appendix 5.   
   ONR guidance on assessing arrangements to provide and maintain adequate human 
  resources is presented in NS-TAST-GD-065 ‘Function and Content of the Nuclear 
  Baseline’. Together, these guides provide comprehensive advice to inspectors on the 
  requirements of LC36, as such they should be considered in combination when judging 
  the adequacy of a licensee’s arrangements for LC36.  The nuclear industry Safety 
  Directors’ Forum (nuclearinst.com/Safety-Directors-Forum) has also published a Good 
  Practice Guide (GPG) ‘Nuclear Baseline and the Management of Organisational 
  Change – A Good Practice Guide’, with the cooperation of ONR.  This guidance should 
  be considered as relevant good practice and inspectors should encourage licensees to 
  be familiar with it, and use it, where appropriate.  Where licensees are able to 
  demonstrate that their arrangements are consistent with the guidance in the GPG, 
  inspectors should regard this as meeting the expectations of this TAG and sufficient for 
  compliance with LC 36(2) and LC 36(5). 
   3. 
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION 
   The following UK legal and other requirements are applicable to this TAG: 
   3.1 
   The Management of Health and Safety at Work Regulations 
    
   These 
  regulations 
  describe 
  employers’ 
  responsibilities, 
  addressing 
  the 
  requirements 
  for 
  control 
  and 
  co-operation 
  with 
  outside 
  undertakings, 
  together 
  with 
  appropriate 
  arrangements 
  for 
  effective 
  planning, 
  organisation, 
  control, 
  monitoring 
  and 
  review. 
  In 
  particular, Regulation 
  13 
  requires 
  employers 
  to 
  take 
  into 
  account 
  employees’ 
  capabilities 
  as 
  regards 
  health 
  and 
  safety 
  when 
  entrusting tasks to employees.  
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 2 of 25 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   3.2 
   Nuclear Site Licence Conditions  
    
   The following site licence conditions are of particular relevance to this TAG: 
  LC 
  6 
  – 
  Documents, 
  Records, 
  Authorities 
  and 
  Certificates. 
   The 
  licensee 
  shall 
  make 
  adequate 
  records 
  to 
  demonstrate 
  compliance 
  with 
  any 
  of 
  the 
  conditions 
  attached 
  to 
  the 
  nuclear 
  site 
  licence. 
  The 
  licensee’s management 
  of 
  change 
  arrangements 
  should 
  include 
  provision 
  for 
  the 
  identification 
  and 
  management of records arising from implementation of the arrangements. 
    
    
    
    
   LC12 
  – 
  Duly 
  Persons. 
   Authorised 
   and 
   Other 
   Suitably 
   Qualified 
   and 
   Experienced 
   The 
  licensee 
  shall 
  make 
  and 
  implement 
  adequate 
  arrangements 
  to 
  ensure 
  that only suitably qualified and experienced persons perform any duties 
  which 
  may 
  affect 
  the 
  safety 
  of 
  operations 
  on 
  the 
  site. 
  Persons 
  fulfilling 
  management 
  of 
  organisational 
  change 
  roles, 
  as 
  roles 
  which 
  may 
  affect 
  the 
  safety 
  of 
  operations, 
  must 
  be 
  suitably 
  qualified 
  and 
  experienced 
  to 
  fulfil 
  those 
  roles. 
   – 
   17 
   LC 
   Management 
   The 
  licensee 
  shall 
  establish 
  and 
  implement 
  adequate 
  quality 
  management 
  arrangements 
  in 
  respect 
  of 
  all 
  matters 
  which 
  may 
  affect 
  safety. Management 
  of 
  change 
  arrangements 
  should 
  be 
  an 
  integral 
  part of the licensee’s management system. 
   Systems. 
   – 
   26 
   LC 
   and 
   Control 
   Supervision 
   The 
  licensee 
  shall 
  ensure 
  that 
  no 
  operations 
  are 
  carried 
  out 
  which 
  may 
  affect 
  safety 
  except 
  under 
  the 
  control and supervision of suitably qualified and experienced persons appointed 
  for 
  that 
  purpose 
  by 
  the 
  licensee. 
  Persons 
  fulfilling 
  management 
  of 
  change 
  roles, as roles which may affect the safety of operations, should be SQEP. 
   Operations. 
   of 
   – 
   36 
   LC 
   Organisational 
   The 
  licensee 
  shall 
  provide 
  and 
  maintain 
  adequate 
  financial 
  and 
  human 
  resources 
  to 
  ensure 
  the 
  safe 
  operation 
  of 
  the 
  licensed 
  site, and make 
  and 
  implement 
  arrangements 
  to 
  control any 
  change 
  to 
  its organisational structure or resources which may affect safety. 
   Capability. 
   4. 
   RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY 
  STANDARDS ADDRESSED 
   Safety Assessment Principles 
   4.1 
   The Safety Assessment Principles for Nuclear Facilities (2014 Edition, Revision 0) 
  provide a framework to guide regulatory decision making in the nuclear permissioning 
  process.  They are supported by Technical Assessment Guides (TAGs) which further 
  aid the decision-making process.  The following principles are of particular relevance to 
  this TAG: 
    
    
    
    
   of 
   for 
   safety 
   nuclear 
   oversight 
   MS.1 
  – 
  Leadership. 
  Identifies 
  the 
  need 
  performance and a Management System. 
  MS.2 
  – 
  Capable 
  Organisation. 
  Identifies 
  the 
  need 
  for 
  changes 
  to 
  the 
  organisation to be systematically evaluated to ensure that they do not adversely 
  affect nuclear safety management capabilities. 
  MS.3 – Decision Making. Identifies the need for decision making to be based on 
  processes 
  that 
  ensure 
  the 
  conflict 
  between 
  nuclear 
  safety 
  and 
  other 
  business 
  goals, 
  including 
  commercial 
  and 
  schedule 
  pressures 
  and 
  external 
  influences, 
  are recognised and resolved. 
  MS.4 
  – 
  Learning. 
  Identifies 
  the 
  need 
  for 
  lessons 
  to 
  be 
  learned 
  from 
  internal 
  and 
  external 
  sources 
  to 
  continually 
  improve 
  leadership, 
  organisational 
  capability, safety decision making and safety performance, 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 3 of 25 
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Technical Assessment Guides (TAGs) 
   4.2 
   The following Technical Assessment Guides are applicable to this TAG: 
    
   NS-TAST-GD-027 – Training and Assuring Personnel Competence 
   This TAG addresses 
  the means by which 
  the 
  licensee demonstrates 
  that 
  it has 
  a 
  systematic 
  approach 
  to 
  identification 
  and 
  delivery 
  of 
  personnel 
  competence 
  and 
  its 
  training 
  processes 
  and 
  arrangements 
  for 
  assuring 
  personnel 
  competence. 
    
   NS-TAST-GD-049 – Licensee Core and Intelligent Customer Capabilities 
   This TAG addresses 
  the means by which 
  the 
  licensee demonstrates 
  that 
  it has 
  sufficient 
  in-house expertise 
  to maintain 
  control and oversight 
  of nuclear 
  safety 
  at 
  all 
  times, 
  and 
  the 
  use 
  and 
  oversight 
  of 
  contractors 
  whose 
  work 
  has 
  the 
  potential to impact on nuclear safety 
    
   NS-TAST-GD-050 – Periodic Safety Reviews 
   This 
  TAG 
  expects 
  a 
  Periodic 
  Safety 
  Review 
  (PSR) 
  to 
  review 
  changes 
  to 
  the 
  licensee’s 
  organisational 
  structure 
  and 
  resources 
  to 
  consider 
  their 
  cumulative 
  impact 
  and 
  to 
  determine 
  if 
  the 
  current 
  position 
  is 
  adequate 
  for 
  continued 
  safe 
  operation of the plant or site 
    
   NS-TAST-GD-065 – Function and Content of the Nuclear Baseline 
   This 
  TAG 
  addresses 
  the 
  means 
  by 
  which 
  the 
  licensee 
  demonstrates 
  that 
  its 
  organisational 
  structure, 
  staffing 
  and 
  competencies 
  are, 
  and 
  remain, 
  suitable 
  and 
  sufficient 
  to 
  manage 
  nuclear 
  safety 
  throughout 
  the 
  full 
  range 
  of 
  the 
  Licensee’s 
  business. 
  It 
  provides 
  the 
  foundation 
  from 
  which 
  organisational 
  changes can be assessed. 
    
   NS-TAST-GD-061 – Staffing Levels and Task Organisation 
   This TAG provides detailed guidance to support the assessment of the 
  approaches and methods used by applicants and licensees to derive, validate 
  and monitor staffing arrangements; and to specify task organisation, in 
  particular, the design of shift work systems and team design.  
   – 
   Function 
   and 
   Content 
   of 
   a 
   Safety 
   Management 
    
   NS-TAST-GD-072 
  Prospectus 
   Element 
  4 
  of 
  this 
  TAG 
  requires 
  a 
  licensee 
  to 
  have 
  adequate 
  structures and resources to meet the nuclear safety needs of the business. 
    WENRA Reactor Safety Reference Levels  
   4.3 
   The objective of The Western European Nuclear Regulators Association (WENRA) is 
  to develop a common approach to nuclear safety in Europe by comparing national 
  approaches to the application of International Atomic Energy Authority (IAEA) safety 
  standards.  The reference levels in the following harmonisation issues represent good 
  practices in the WENRA member states, are relevant, and should be taken into 
  account by the Inspector: 
    
    
   Issue B: Operating Organisation 
  - Organisational Structure. 
  Identifies 
  the need 
  for 
  the 
  adequacy 
  of 
  the 
  organisational 
  structure 
  to 
  be 
  assessed 
  when 
  organisational 
  changes 
  are 
  made, 
  and 
  for 
  changes 
  to 
  be 
  justified 
  in 
  advance, 
  carefully planned, and evaluated after implementation. 
  Issue 
  C: 
  Management 
  System 
  - 
  Objectives. 
  Identifies 
  the 
  need 
  for 
  the 
  management 
  system 
  to 
  achieve 
  and 
  enhance 
  nuclear 
  safety 
  by 
  ensuring 
  that 
  other 
  demands 
  on 
  the 
  licensee 
  are 
  not 
  considered 
  separately 
  from 
  nuclear 
  safety requirements. 
   IAEA Safety Standards 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 4 of 25 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   4.4 
   The IAEA Safety Standards (Requirements and Guides) were the benchmark for 
  revision of the SAPs in 2014 and are recognised by ONR as relevant good practice.  
  They should therefore be consulted, where relevant, by the inspector, although it 
  should be appreciated that they are design standards rather than regulatory standards.  
  The Safety Requirements publication GSR Part 2 ‘Leadership and Management for 
  Safety’ (IAEA 2016) is relevant.  It defines the requirements for establishing, 
  assessing, sustaining and continuously improving leadership and management for 
  safety in organisations.  Requirement 9 focuses on provision of resources and 
  requirement 12 focuses on fostering a culture for safety. 
   4.5 
   GSR Part 2 requires that: 
    
   Provision is made in the management system to identify any changes (including 
  organisational 
  changes) 
  that 
  could 
  have 
  significant 
  implications 
  for 
  safety 
  and 
  to ensure that they are appropriately analysed; and 
  Planned 
  reviews 
  of 
  the 
  management 
  system 
  take 
  organisation. 
  The following reports produced by IAEA are also directly relevant: 
   changes 
   account 
   in 
   the 
   of 
    
   4.6 
   18 
   – 
   Managing 
   Change 
   in 
   the 
   Nuclear 
   Industry: 
   The 
   Effects 
   This 
  report 
  discusses 
  how 
  and 
  why 
  maintenance 
  of 
  high 
  levels 
  of 
  safety, 
  and 
  what 
  challenge and reap all the benefits of change. 
   change 
  can 
  can 
  be 
  done 
   challenge 
  to 
  control 
   on 
   the 
  that 
   INSAG 
  Safety. 
    
    
   IAEA Safety Guide GS-G-3.1 and GS-G-3.5 – Application of the 
  Management System for Facilities and Activities and The Management 
  System for Nuclear Installations  
   These documents provide generic guidance to aid in establishing, 
  implementing, assessing and continually improving a management system. 
   5. 
   ADVICE TO INSPECTORS 
   Background  
   5.1 
   5.2 
   5.3 
   5.4 
   LC 36(1), which was introduced by a variation to all extant nuclear site licences in July 
  2011, requires the licensee to provide and maintain adequate financial and human 
  resources. 
   Appendix 4 provides guidance to inspectors on the approach that should be taken to 
  assessing the financial resources aspects of this requirement.  However, when this 
  variation was introduced, ONR advised that it considered that existing licensees would 
  already comply with the requirement to provide and maintain adequate human 
  resources, by virtue of their Nuclear Baseline. 
   NS-TAST-GD-065 ‘Function and Content of a Nuclear Baseline’ sets out ONR’s 
  expectations that a licensee should have a nuclear baseline to provide a 
  demonstration that it has suitable and sufficient organisational structures, staffing and 
   competences in place to effectively and reliably carry out those activities which 
  could impact on nuclear safety. 
   NS-TAST-GD-065, supplemented by other guidance such as NS-TAST-GD-027 
  ‘Training and Assuring Personnel Competence’, is therefore instrumental in setting out 
  ONR’s expectations of the way in which a licensee shows that it has, and maintains, 
  adequate human resources.  The nuclear baseline also provides a clear description of 
  the currently intended staffing levels as a reference point or ‘baseline’ against which 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 5 of 25 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   5.5 
   5.6 
   5.7 
   5.8 
   5.9 
   5.10 
   5.11 
   5.12 
   the licensee can assess the potential impact on nuclear safety of proposed 
  organisational changes, noting that it will also be affected by changes in business 
  objectives such as lifetime extensions. 
   LC 36(2) requires the licensee to make and implement adequate arrangements to 
  control any change to its organisational structure or resources which may affect safety.  
  Appendix 1 states the licence condition in full.  ONR interprets this condition to relate 
  specifically to nuclear safety although licensees may wish to apply similar 
  arrangements to manage changes affecting industrial safety, security, environmental 
  matters or other parts of their business. 
   The licensee’s management of change arrangements should ensure that the nuclear 
  safety implications of a proposed change are fully considered and that risks arising 
  from inadequate assessment and implementation of the change are recognised and 
  suitably controlled.  These arrangements should be part of a licensee’s management 
  system. 
   There are many drivers for organisational change and, without formal change 
  management, a licensee may not immediately recognise the implications of a 
  proposed course of action.  Examples of drivers for organisational change and their 
  potential implications are given in Appendix 2. 
   It is important that the full implications of a proposed change or a series of changes are 
  assessed prior to implementation of the change(s).  This is to guard against a failure to 
  consider all relevant factors and potential dependencies between related changes, and 
  the potential for 'salami slicing' in which a major change is decomposed into a series of 
  lesser changes which are treated independently.  This applies to changes at all levels 
  in the organisation including the very top of the organisation i.e. the Board or Executive 
  team, where changes in the composition and knowledge of either of these teams can 
  have a potentially significant influence over nuclear safety. 
   Changes should be classified according to nuclear safety significance. Broad guidance 
  for inspectors on the classification of organisational changes is given in Appendix 3.  
  The level of assessment required should be proportionate to the potential nuclear 
  safety significance of the change. 
   It should be noted that replacing one post holder with another post holder on a like-for-
  like basis need not constitute a trigger for the application of management of change 
  arrangements as this should ordinarily be addressed through the licensee’s 
  arrangements made under LC 12.  However, where a number of changes are to be 
  undertaken in the same area or there is a consequential effect on roles and 
  responsibilities, the arrangements should be applied.  
   In addition to this TAG and NS-TAST-GD-065, inspectors should be familiar with the 
  nuclear industry GPG on ‘Nuclear Baseline and the Management of Organisational 
  Change.  This guidance was produced, and is maintained, by an industry working 
  group that includes ONR.  Where licensees are able to demonstrate that their 
  arrangements are consistent with the guidance in the GPG, inspectors should regard 
  this as meeting the expectations of this TAG and sufficient for compliance with the 
  Licence Condition.  The GPG is available on the website of the Safety Director’s 
  Forum (nuclearinst.com/Safety-Directors-Forum). 
   For new build organisations, it is important that management of change arrangements 
  are fully developed and implemented in sufficient time to allow an adequate period of 
  demonstrated working, usually in the region of 12 months prior to the Nuclear Site 
  Licensing (NSL) decision. It is recognised that new build organisations develop rapidly 
  during the pre-application and early NSL assessment phase of the project. However, 
  implementation of these arrangements should enable an organisation to establish and 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 6 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   5.13 
   5.14 
   5.15 
   demonstrate the appropriate level of control, while supporting the development of the 
  company’s resourcing strategy. This should enabling ONR to gain confidence in the 
  company’s approach to building a nuclear competent organisation.   
   ONR recognises that, unlike mature licensee organisations, a new build organisation 
  may not be ‘right first time’ and will continue to evolve, particularly during the early 
  stages of a new build project.  The organisation should ensure that its management of 
  change arrangements are proportionate to the phase of the project and sufficiently 
  flexible to enable rather than constrain organisational development. 
   ONR acknowledges that for low hazard sites, typically those below the REPPIR 
  threshold, it may be proportionate for a simplified management of change process to 
  be applied.  It is however still important that an adequate risk assessment is 
  undertaken for organisational changes on these lower hazard sites to ensure the 
  organisational capability is suitable to manage nuclear safety.  It is particularly 
  important that a proportionate process allowing flexibility is developed to manage staff 
  reduction prior to entry of a site into care and maintenance.  
   ONR Permissioning of Organisational Change  
   To introduce flexibility into the permissioning process, licensees may prescribe, with 
  ONR agreement ‘derived’ powers for use by ONR usually but not exclusively when 
  permissioning the highest category of change proposal. The ‘derived’ powers defined 
  in a licensee’s LC 36 arrangements may include agreement, notification, 
  acknowledgement and specification but not approval, consent or direction. However, 
  derived powers have no formal legal basis and constitute administrative arrangements 
  agreed between ONR and the licensee. Inspectors should note that inclusion of 
  derived powers are not a prerequisite for the licensee’s LC 36 arrangements to be 
  considered as adequate, nor does their use preclude the use of primary powers to 
  exercise regulatory control over modifications. This guidance provides advice to 
  inspectors on ONR’s expectations for adequate licensee arrangements required under 
  LC36 (2).  
   5.16 
   The licensee’s arrangements may also include provision for enhanced implementation 
  monitoring and control of a proposed organisational change by ONR, where ONR 
  considers that the use of primary or derived power Licence Instruments may not be 
  appropriate or proportionate to exercise regulatory control and oversight of a licensee’s 
  modification proposal. Where this is the case, the inspector should check that such 
  arrangements are consistent with the expectations set out in NS-PER-GD-001 
  Revision 2. 
   5.17 
   This guidance provides advice to inspectors on ONR’s expectations for adequate 
  licensee arrangements required under LC36 (2). 
   Management of Change Principles 
   5.18 
   There are some broad principles which underpin ONR’s expectations of a licensee’s 
  management of change arrangements.  These are set out below and then each 
  principle is discussed in more detail in the following sections.  
   1. 
   2. 
   be 
  robust, 
  incorporated 
  as 
  applied 
  to 
  all 
  activities 
  that 
   The 
  arrangements 
  should 
  management 
  system 
  and 
  impact on nuclear safety; 
  The Board 
  of 
  the 
  licensee/Executive 
  should 
  own 
  and 
  support 
  the management 
  of 
  change 
  arrangements 
  and 
  ensure 
  that 
  they 
  are 
  embedded 
  throughout 
  the 
  organisation; 
   part 
  of 
  the 
  licensee’s 
  have 
  the 
  potential 
  to 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 7 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   3. 
   4. 
   5. 
   6. 
   The arrangements should reference the nuclear baseline and include a process 
  for updating it on a regular basis; 
  The arrangements should include an initial screening assessment to identify the 
  potential 
  safety 
  significance 
  of 
  a 
  change 
  proposal 
  and 
  establish 
  a 
  suitable 
  categorisation for determining the level of analysis, justification and challenge; 
  The 
  licensee 
  should 
  assess 
  and 
  justify 
  the 
  safety 
  of 
  a 
  proposed 
  change, 
  commensurate 
  with 
  its 
  unmitigated 
  potential 
  impact 
  on 
  safety 
  should 
  the 
  change be inadequately conceived or executed, identify and implement suitable 
  controls 
  to 
  ensure 
  nuclear 
  safety 
  is 
  not 
  adversely 
  affected 
  and 
  monitor 
  the 
  implementation of the change.  
  The 
  licensee 
  should 
  periodically 
  review 
  the 
  effectiveness 
  arrangements and the changes that have been implemented. 
   overall 
   of 
   the 
   Principle 1  
  A 
  licensee’s 
  management 
  of 
  change 
  arrangements 
  should 
  be 
  robust, 
  incorporated as part of 
  the management system and applied 
  to all activities 
  that 
  have the potential to impact on nuclear safety. 
   The licensee should have formal, systematic arrangements in place to assess, monitor 
  and review organisational changes to ensure that they are managed in a co-ordinated, 
  consistent and effective manner.  These arrangements should be owned and 
  supported by the licensee Board/Executive. 
   These arrangements, which may under primary powers be approved by ONR, should 
  be part of the licensee’s management system, and ideally be integrated with the 
  organisation’s HR processes rather than being separate and additional.  This also 
  means that the resource implications of change can be considered as part of the 
  overall management of the organisation and its capabilities. They should set out the 
  roles and responsibilities for managing changes with clearly assigned responsibilities 
  for originating, peer review, approval, monitoring, close-out of individual changes and 
  post change reviews.  
   The scope of the licensee’s arrangements should include all organisational changes 
  that could potentially affect nuclear safety, not just roles and posts included in the 
  nuclear baseline.  The licensee needs to be able to demonstrate through a 
  proportionate application of its arrangements that it can influence or mitigate the 
  impact of such changes so that nuclear safety is not compromised. This may, for 
  example, include the impact on the licensee of proposed actions or decisions made by 
  parent companies or Parent Body Organisations where these could impact on the 
  licensee’s capability or its management of nuclear safety.  The licensee should also 
  consider the potential effects on culture and morale arising from the change. 
   The scope of the arrangements should also include important enabling and support 
  functions such as human resources, finance and procurement where these have the 
  potential either directly, or through consequential change, to impact on the licensee’s 
  management of nuclear safety. 
   The arrangements should allow for use of the management of change process as a 
  flexible risk assessment tool where appropriate.  Examples of when this might be 
  necessary include long-term absences and long-standing vacancies.  The default 
  assumption should be that all posts and changes have the potential to affect safety 
  management unless it can be demonstrated otherwise.  
   Proposed changes should be assessed using a consistent methodology. The 
  methodology should be applied to all proposed changes in order to make and record 
  an early judgement of the potential impact on nuclear safety.  ONR’s expectations of a 
  methodology are set out in Principles 4 and 5. 
   5.19 
   5.20 
   5.21 
   5.22 
   5.23 
   5.24 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 8 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   5.25 
   5.26 
   5.27 
   5.28 
   5.29 
   Staff involved in ensuring or assuring the quality of management of change proposals 
  should be suitably qualified and experienced persons (SQEP) to do so and SQEP 
  requirements for staff fulfilling key roles within the arrangements should be clearly 
  defined.  The importance of SQEP input to a management of change assessment 
  cannot be over emphasised as staff experienced in the management of change 
  process can apply that experience and judgement to avoid the potential pitfalls that 
  less experienced staff may not be aware of. 
   Staff implementing LC36 arrangements should be given specific training in MOC 
  theory and principles as well as the licensee’s arrangements.  They should not be 
  deemed to be competent on the basis of seniority. 
   The arrangements should ensure that individual change proposals are clearly identified 
  and that details of the change i.e. change category and other important attributes are 
  recorded in a change register.  Documentation used to assess, decide upon, monitor, 
  review and close-out the change should be retained for current and future reference in 
  accordance with the licensee’s arrangements under LC 6. ‘Documents, Records, 
  Authorities and Certificates’. 
   The arrangements should consider and, where possible, allow for the reversibility of 
  changes or the application of contingency plans should subsequent performance 
  monitoring indicate that the change has been inappropriately conceived or 
  inadequately implemented.  The extent of the reversibility may be related to the 
  significance of the change and the availability of effective countermeasures. For larger, 
  more significant changes, consideration should also be given to the options for how the 
  objectives of the change can be achieved, including a justification of the chosen option.  
  The development of a communications plan should also be considered. 
   All change proposals should be subject to a proportionate level of scrutiny and 
  challenge, analogous to expectations for modifications to existing plant made under LC 
  22 ‘Modification or Experimentation on Existing Plant’. The level of scrutiny is likely to 
  increase with potential significance.  Where the safety significance of a proposed 
  change is judged to be high, the arrangements should provide for seeking advice from 
  the NSC (or identified equivalent status body where appropriate), and senior 
  management oversight of the effectiveness of the process and implementation of 
  individual changes.  
   5.30 
   The licensee’s arrangements should require approval to be formally granted by a 
  SQEP prior to implementation of a change subject to satisfactory confirmation that any 
  enabling actions have been completed, and for the change to be formally signed off on 
  completion. 
   5.31 
   The effectiveness of implementation of the arrangements should be routinely 
  monitored and reviewed as part of the licensee’s normal assurance processes. 
   5.32 
   The inspector should consider whether or not:  
    
    
    
    
   of 
   change 
   arrangements 
   The 
  licensee 
  has 
  formal, 
  documented 
  management 
  which are an integral part of its management system; 
  It 
  is clear 
  that 
  the arrangements apply 
  to all aspects of 
  the 
  licensee’s activities, 
  including 
  changes 
  at 
  Board 
  or 
  Executive 
  team 
  level, 
  that 
  have 
  the 
  potential 
  to 
  affect 
  nuclear 
  safety, 
  and 
  have 
  they 
  been 
  promulgated 
  to 
  all 
  parts 
  of 
  the 
  licensee’s organisation; 
  The 
  documented 
  arrangements 
  date; 
  The arrangements use a methodology which is easy to understand and follow; 
   available 
   and 
   up 
   are 
   clear, 
   to 
   to 
   end 
   users 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 9 of 25 
    
    
    
    
   Office for Nuclear Regulation  
    
    
    
    
    
    
   interpreted 
   and 
   applied 
   are 
   being 
   across 
   the 
   consistently 
   of 
  change 
  system and 
   The 
  methodology 
  is 
  licensee organisation; 
  Roles 
  and 
  responsibilities 
  for 
  implementing 
  the 
  management 
  arrangements are clearly defined, 
  integrated with 
  the management 
  understood by staff with management of change process roles; 
  SQEP 
  requirements 
  for 
  staff 
  fulfilling 
  key 
  roles 
  within 
  the 
  arrangements 
  clearly defined; 
  Staff 
  fulfilling 
  key 
  management 
  SQEP 
  for 
  those 
  roles 
  and 
  they 
  licensee’s organisation; 
  All change proposals are 
  logged 
  in a change 
  register and 
  records are available 
  to 
  substantiate 
  the 
  key 
  decisions 
  made 
  in 
  support 
  of 
  significant 
  changes 
  in 
  accordance with the licensee’s arrangements for LC 6; 
  The 
  arrangements 
  are 
  subject 
  to 
  the 
  processes 
  of 
  independent 
  audit operated by the licensee. 
   of 
  change 
  arrangements 
  are 
  demonstrably 
  have 
  a 
  suitable 
  level 
  of 
  authority 
  within 
  the 
   review 
   and 
   Principle 2  
  The 
  Board 
  of 
  the 
  management 
  of 
  change 
  arrangements 
  throughout the organisation.  
   licensee/Executive 
   should 
  and 
  ensure 
   own 
  that 
   and 
  support 
  the 
  they 
  are 
  embedded 
   5.33 
   5.34 
   5.35 
   5.36 
   5.37 
   5.38 
   A licensee’s management of change arrangements should be peer reviewed and 
  implemented consistently and effectively, and a visible commitment to these 
  arrangements should be made by the licensee Board/Executive.  The Board/Executive 
  should be able to show that it actively uses the MOC arrangements and supports the 
  management of change process by regularly reinforcing to the workforce the 
  importance of having and following a robust change process.  
   The Board/Executive should ensure that SQEP resources are put in place to develop 
  the management of change arrangements, to implement them and to maintain 
  oversight of the way in which the arrangements are used.  This should include 
  provision for suitable levels of challenge and independent peer review of change 
  proposals as part of the licensee’s corporate governance arrangements, and for 
  seeking advice from the Nuclear Safety Committee or identified equivalent status body 
  where appropriate.  
   The management of change arrangements should apply throughout the company, up 
  to and including the Executive team and Board, noting that strategic and complex 
  changes to the structure or staff composition of a business may often originate at this 
  level.  
   Progress with, and the effectiveness of, the implementation of significant, complex 
  changes should be regularly monitored by the Board/Executive. The Board/Executive 
  should establish an oversight process for this purpose as appropriate.  
   It is expected that the licensee Board/Executive will proactively discuss significant, 
  complex changes with ONR at an early stage.  This will allow the licensee to share its 
  intentions with ONR and for ONR to provide advice and guidance as appropriate.  It 
  will also help ONR to understand the licensee’s business drivers and to schedule and 
  prioritise its own resources as appropriate.  
   The Board/Executive should satisfy itself that management of change arrangements 
  are embedded throughout the organisation and that suitable provision is made to 
  periodically review the effectiveness of the arrangements, and to monitor the 
  cumulative effects of changes on the overall health of the licensee organisation.  It 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 10 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   should ensure that the reasons for, and progress with, significant, complex changes 
  are communicated to the workforce.  
   5.39 
   The inspector should consider whether or not:  
    
    
    
    
    
    
    
    
   of, 
   and 
   that 
  are 
   ensures 
   oversight 
   itself 
  they 
   appropriate 
   the 
  management 
  of 
  being 
  implemented 
   The Board and Executive are able to demonstrate their commitment to effective 
  management of organisational change;  
  The 
  Board 
  and 
  Executive 
  has 
  regularly 
  satisfied 
  change 
  arrangements 
  are 
  adequate 
  and 
  that 
  effectively;  
  There 
  is 
  a 
  governance 
  process 
  that 
  challenge to, all proposed changes;  
  The Board/Executive is involved in assessing the implications of changes which 
  may 
  have 
  a greater potential 
  impact 
  on nuclear 
  safety as part of 
  the 
  licensee’s 
  governance arrangements;  
  The Board/Executive 
  is aware of 
  the need 
  changes with ONR at an early stage;  
  The 
  licensee’s 
  governance 
  arrangements 
  provide 
  for 
  an 
  oversight 
  process 
  to 
  monitor 
  implementation 
  and 
  provide 
  strategic 
  guidance 
  and 
  support 
  for 
  more 
  significant changes; 
  The 
  Board/Executive 
  regularly 
  seeks 
  assurance 
  that 
  implementation 
  significant and complex changes is proceeding satisfactorily;  
  The 
  licensee’s 
  communication 
  arrangements 
  adequately 
  convey 
  the 
  reasons 
  for, and progress with, implementation of significant changes to the workforce.  
   to discuss more significant, complex 
   more 
   of 
   Principle 3  
  A 
  licensee’s 
  management 
  of 
  change 
  arrangements 
  should 
  reference 
  nuclear baseline and include a process for updating it on a regular basis.  
   the 
   5.40 
   5.41 
   A licensee should have a nuclear baseline which provides a demonstration that it has 
  suitable and sufficient organisation structures, staffing and competences in place to 
  effectively and reliably carry out those activities which could impact on nuclear safety.   
   The nuclear baseline should act as a reference point or ‘baseline’ against which the 
  licensee can assess the potential impact on nuclear safety of proposed organisational 
  changes.  Individual change assessments should reference the baseline where the 
  proposed change is likely to have an impact on it.  
   5.42 
   The baseline should be dynamic and updated as changes are made to the 
  organisational structure and resources, and periodically reviewed to consolidate 
  changes.  
   5.43 
   The nuclear baseline should be used as an integral part of the licensees resourcing 
  processes.  
   5.44 
   The inspector should consider whether or not:  
    
   
    
   The baseline is up to date and reflective of the licensee’s current organisation;  
  Management 
  of 
  change 
  assessments 
  include 
  a 
  reference 
  to 
  the 
  nuclear 
  baseline 
  and 
  identify 
  whether 
  or 
  not 
  the 
  proposed 
  changes 
  affect 
  baseline 
  roles;  
  The 
  nuclear 
  baseline 
  is 
  regularly 
  reviewed 
  to 
  incorporates changes affecting baseline roles;  
   ensure 
   date 
   that 
   and 
   up 
   to 
   is 
   it 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 11 of 25 
    
    
    
    
   Office for Nuclear Regulation  
    
    
    
    
    
   of 
   the 
   cumulative 
   The 
  management 
  of 
  change 
  arrangements 
  take 
  account 
  effects of low category changes on the nuclear baseline;  
  The 
  management 
  of 
  change 
  arrangements 
  take 
  account 
  of 
  vulnerabilities when completing the risk assessment of the change; 
  The management of change arrangements are 
  integrated with human 
  processes;  
  There 
  is 
  evidence 
  that 
  the 
  resource 
  implications 
  of 
  proposed 
  changes 
  shared with human resources as part of the change assessment process;  
  Resource 
  actions 
  arising 
  from 
  individual 
  management 
  of 
  change 
  assessments 
  have been closed and, if not, that unresolved actions are being managed.  
   resource 
   baseline 
   are 
   5.45 
   5.46 
   5.47 
   5.48 
   5.49 
   Principle 4  
  A 
  licensee’s 
  management 
  of 
  change 
  arrangements 
  should 
  include 
  an 
  initial 
  screening 
  assessment 
  to 
  identify 
  the 
  potential 
  safety 
  significance 
  of 
  a 
  change 
  proposal 
  and 
  establish 
  a 
  suitable 
  categorisation 
  for 
  determining 
  the 
  level of analysis, justification and challenge.  
   It is important that a proposed change is assessed prior to implementation to ensure 
  that the implications of the change are fully understood.  The assessment can be 
  considered as an organisational risk assessment which identifies the potential risks 
  associated with the proposed change, including risks arising both from the outcome of 
  a proposed change and the process of transition.  
   The licensee’s management of change arrangements should include provision for an 
  initial screening assessment to identify the potential nuclear safety significance of a 
  proposed change in the event that the change is inadequately conceived or executed.  
  The output of this assessment should be used to inform the classification of the 
  change (as required by LC 36 (5)) which in turn is related to the level of analysis, 
  justification and scrutiny that the licensee gives to the change proposal.  The screening 
  assessment should be formally recorded in a management of change register once 
  internal licensee approval to further develop the proposal has been gained. 
   Change classification or categorisation methodology should consider the risks 
  associated with the change being inadequately conceived or executed, and should not 
  take planned mitigation into account.  ONR expects the change classification or 
  category of all changes to be independently challenged prior to implementation 
  proportionally.  
   ONR normally expects the number of change proposals which fall into the top category 
  to be relatively few.  These ordinarily include proposals which constitute wholesale 
  organisational change or which potentially challenge the basis upon which the licence 
  was granted.  Licensees usually have three further categories of change proposal for 
   less significant changes.  Broad guidance on classification of organisational changes 
  is given in Appendix 3 for illustrative purposes, and there is guidance in the GPG.  
   The licensee’s arrangements should make appropriate provision for engaging ONR 
  and, in the case of significant or complex changes, early engagement.  This will allow 
  ONR to provide advice and guidance to the licensee as appropriate and should 
  simplify ONR permissioning of such changes since it will have prior knowledge of the 
  rationale for the change and gained confidence in the licensee’s approach to 
  assessing the implications of the change.  This early engagement is particularly 
  important in a number of cases, for example where a licensee is planning to reduce 
  staff numbers through a redundancy programme where a statutory consultation period 
  may apply.  ONR will expect engagement to have commenced before the statutory 
  consultation period is invoked.  Further examples include where significant change is 
  planned to the management of the organisation. 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 12 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   5.50 
   ONR expects:  
    
    
    
   The 
  licensee’s 
  arrangements 
  to 
  affirm 
  that 
  Category 
  1 
  changes 
  shall 
  not 
  proceed 
  without 
  the 
  formal 
  agreement 
  of 
  ONR 
  and 
  for 
  such 
  changes 
  to 
  be 
  submitted 
  in 
  writing 
  to 
  ONR 
  in 
  accordance 
  with 
  LC 
  36 
  (5). 
  In 
  such 
  circumstances 
  it 
  is prudent 
  for 
  the 
  licensee 
  to ensure 
  that sufficient 
  time 
  is built 
  into 
  the 
  change 
  programme 
  to 
  provide 
  for 
  ONR 
  assessment 
  of 
  the 
  proposed 
  change.  The licensee should facilitate this through early engagement with ONR 
  so 
  that 
  the level of regulatory 
  interest can be established and resources can be 
  put in place to assess the change.   
  The 
  licensee’s 
  arrangements 
  for 
  Category 
  2 
  change 
  proposals 
  should 
  require 
  the 
  change 
  to 
  be 
  submitted 
  in 
  writing 
  to 
  ONR 
  a 
  suitable 
  period 
  before 
  the 
  proposed 
  implementation date. 
   This 
  is at 
  least 20 working days. 
  If, during 
  this 
  period, 
  ONR 
  informs 
  the 
  licensee 
  in 
  writing 
  that 
  ONR 
  wishes 
  to 
  review 
  the 
  proposal 
  before 
  it 
  proceeds, 
  the 
  licensee’s 
  arrangements 
  should 
  confirm 
  that 
  the 
  change 
  will 
  not 
  proceed 
  until 
  ONR 
  agreement 
  is 
  obtained. 
  It 
  is, 
  again, 
  clearly 
  in 
  the 
  licensee’s 
  interests 
  to 
  give 
  ONR 
  early 
  notice 
  of 
  Category 
  2 
  changes 
  where 
  possible 
  so 
  that 
  any 
  potential 
  issues 
  can 
  be 
  discussed 
  and 
  resolved 
  without 
  undue 
  impact 
  on 
  the 
  licensee’s 
  programme 
  or 
  a 
  need 
  to 
  invoke 
  the 
  derived 
  power 
  in 
  the 
  licensee’s 
  arrangements. 
  Where 
  ONR 
  does 
  not 
  intend 
  to 
  exercise 
  the 
  derived 
  power 
  and 
  permission 
  the 
  change, 
  ONR 
  should 
  formally 
  communicate 
  this 
  to 
  the 
  licensee 
  in 
  writing 
  so 
  that 
  it 
  may 
  proceed 
  with 
  the 
  proposed 
  change 
  earlier 
  if 
  it 
  chooses. 
  The 
  basis 
  for 
  ONR’s 
  decision not to exercise the derived power should be documented.  
  Category 
  3 
  and 
  4 
  changes 
  should 
  be 
  entered 
  into 
  the 
  licensee’s 
  management 
  of 
  change 
  register 
  which 
  should 
  be 
  available 
  for 
  periodic 
  sampling 
  by 
  the 
  inspector. 
  If ONR 
  informs 
  the 
  licensee 
  in writing 
  that ONR wishes 
  to 
  review 
  the 
  proposal 
  before 
  it 
  proceeds, 
  the 
  licensee’s 
  arrangements 
  should 
  confirm 
  that 
  the change will not proceed until ONR agreement is obtained.   
  Where an agreement, in accordance with the licensee’s own arrangements, is needed 
  from ONR to allow a proposed change to proceed, the inspector should arrange for the 
  change to be formally assessed, and a Project Assessment Report (PAR) produced, in 
  accordance with ONR’s permissioning procedure.  Once ONR is satisfied that the 
  change may proceed, a Licence Instrument will be issued to the licensee to permission 
  the change.  
   Application of the classification methodology and implementation of management of 
  change arrangements should not allow changes, which if assessed in totality could 
  constitute a Category 1 or 2 change, to be reduced to a number of smaller, lower 
  significance changes i.e. the arrangements should not allow ‘salami slicing’.  
   Over time, and with experience, a licensee may develop an appreciation of the likely 
  category for individual changes and will form a view based on an initial, informal 
  assessment.  This initial assessment should not be used in place of a comprehensive 
  assessment for significant changes, nor should the change originator pre-judge the 
  categorisation of a change without an appropriate assessment of the implications of 
  the change.  
   Some changes may be borderline between two classifications or categories.  In these 
  situations ONR expects the licensee to take a conservative position and consider the 
  change at the higher level.  Some changes may attract key stakeholder interest.  In 
  these situations ONR expects the change to be categorised in accordance with the 
  licensee’s arrangements.  Occasionally a higher level of scrutiny can be applied; this 
  will be viewed positively but is not expected to be normally adopted.   
   5.51 
   5.52 
   5.53 
   5.54 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 13 of 25 
    
    
    
    
     
    
    
    
    
   Office for Nuclear Regulation  
   5.55 
   The inspector should consider whether or not:  
    
    
    
    
    
    
    
   An 
  initial 
  screening 
  assessment 
  has 
  been 
  prepared 
  to 
  identify 
  the 
  potential 
  impact of the change proposal on nuclear safety significance and categorise the 
  proposal;  
  The 
  risk 
  assessment 
  uses 
  a 
  clear, 
  consistent 
  and 
  well-informed 
  approach 
  which identifies potential risks arising both from the final outcome of the change 
  and the process of transition;  
  The 
  classification 
  methodology 
  is 
  easy 
  to 
  understand 
  and 
  is 
  being 
  objectively and consistently, throughout the licensee’s organisation;  
  There 
  is 
  a 
  checking 
  process 
  to 
  confirm 
  that 
  changes 
  have 
  been 
  categorised and challenged by a SQEP;  
  Safeguards 
  are 
  in 
  place 
  to 
  avoid 
  under-categorisation 
  slicing’;  
  The 
  licensee’s 
  arrangements 
  identify, 
  and 
  meet 
  ONR’s 
  expectations 
  for, 
  the 
  need 
  to 
  communicate Category 1 and 2 change proposals 
  to ONR and 
  include 
  a 
  derived 
  power 
  which 
  will 
  allow 
  ONR 
  to 
  provide 
  formal 
  agreement 
  to 
  change 
  proposals as set out in the bullet points in paragraph 5.16; 
  The 
  licensee’s 
  arrangements 
  encourage 
  authors 
  of 
  change 
  provision for timely engagement with ONR. 
   proposals 
   correctly 
   to make 
   of 
   changes 
   applied 
   or 
   ‘salami 
   Principle 5  
  The 
  licensee 
  should 
  assess 
  and 
  justify 
  the 
  commensurate 
  with 
  its 
  potential 
  impact 
  on 
  suitable 
  controls 
  to 
  ensure 
  nuclear 
  safety 
  monitor the implementation of the change 
   safety 
  safety, 
  is 
  not 
   of 
  a 
  proposed 
  change, 
  identify 
  and 
  implement 
  adversely 
  affected 
  and 
   5.56 
   Changes which are identified via the initial screening assessment as falling into 
  categories 1, 2 and 3, as illustrated in Appendix 3, should be subject to a more detailed 
  assessment which is documented as part of the justification for the change.  The 
  justification should ordinarily include:  
   5.57 
    
    
   
   A statement of the reason for and objectives of the change. This is typically 
  identified in the ‘initial screening assessment’;  
  A risk assessment;  
  An implementation plan.  
  Changes assessed as having a significant potential impact on nuclear safety i.e. 
  Categories 1, 2 should be subject to a more detailed risk assessment which is 
  documented as part of the justification for the change.  The risk assessment should be 
  proportionate to the nuclear safety significance and complexity of the change being 
  proposed.  The assessment should identify the ‘enablers’, or arrangements that need 
  to be put in place to facilitate the change proposal and ensure that risks are controlled.  
  These should include actions required to mitigate the risks arising from both the final 
  outcome of the change and during transition as appropriate.  The licensee may identify 
  a need to undertake a formal workload assessment for changes that have the potential 
  to impact on the workload of an individual(s).  
   5.58 
   In many cases achieving an adequate assessment is unlikely without active 
  consultation with the staff affected by the proposed change at an appropriate stage.  
  Although this can be sensitive, many post holders will have a unique knowledge of how 
  they carry out their work and what its demands are.  
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 14 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   5.59 
   5.60 
   5.61 
   5.62 
   5.63 
   5.64 
   5.65 
   5.66 
   The risk assessment for a large, complex change proposal may indicate that it is 
  preferable to divide the overall change into smaller, more manageable elements.  This 
  may have advantages in that elements can be assigned to different leads that have 
  better-defined responsibilities and knowledge for taking a change forward.  However, 
  there are risks in this approach because potential dependencies between these 
  elements may be missed.  For example, an individual responsible for one element may 
  make assumptions about the continued provision of resources or arrangements that 
  might be affected by changes to other elements.  
   In such instances, the licensee should produce an umbrella or ‘overarching’ 
  management of change proposal to define the scope of the overall proposal and set a 
  single, coherent framework for managing the different elements which are 
  encompassed within it.  The risk assessment for the overarching management of 
  change should reference the risks related to specific elements, but should also take a 
  broader cross-cutting perspective. It should also consider risks arising at the interfaces 
  between the various elements. 
   ONR expects the licensee to put in place suitable processes for endorsing change 
  proposals.  Usually, Category 3 and 4 changes may be endorsed by the originator or 
  local process owner following an independent review of the classification or category.  
  However, Category 1 and 2 changes should be endorsed by an individual who has a 
  full understanding of the implications of the proposed change.  Such individuals are 
  more likely to be at a more senior level in the licensee organisation.  
   As noted in Principle 3, justification documents for Category 1 and 2 arrangements 
  may need advice by a Nuclear Safety Committee or an equivalent body in accordance 
  with the licensee’s arrangements.  
   The mitigating actions and enablers identified in the risk assessment should, following 
  endorsement, be addressed in an implementation plan.  The implementation plan 
  should show how the mitigating actions and enablers will be delivered and managed.  
  It should include a clear definition of responsibilities for taking forward the change and 
  maintaining a suitable level of managerial oversight.  For example, the inspector 
  should be able to find evidence that documentation has been endorsed to confirm that 
  enabling actions have been completed and to confirm that the change may proceed.  
   The output of a risk assessment may indicate that it is preferable to introduce the 
  change on a phased or staged basis as a means of best managing the risks 
  associated with the change.  This should be reflected in the implementation plan, and 
  the licensee should consider introducing stage gates, or hold points, as necessary to 
  manage the process.  ONR interaction may be considered appropriate by the licensee 
  or ONR for some of these stages, depending on the nuclear safety significance.  
   The implementation plan should also include indicators that can be used to monitor 
  progress in implementing the change and provide confidence that no adverse effects 
  are being realised.  These indicators may be qualitative or quantitative as appropriate.  
  They should primarily be ‘leading’ indicators that consider the potential consequences 
  of the change being inadequately conceived or executed such as training completed; 
  overtime worked; maintenance backlogs etc., rather than ‘lagging’ indicators which 
  typically monitor reduction in accident rates.  
   Significant changes i.e. those identified as Category 1 or 2 in Appendix 3, should have 
  Board/Executive oversight, using indicators and any other appropriate measures, to 
  confirm that changes are being correctly managed.  In the event that a change is not 
  proceeding satisfactorily the Board/Executive should identify and sponsor remedial 
  action.  This monitoring should be proportionate to the significance of the change and 
  continue for the life of the change. It should also include a post-completion review to 
  confirm that the objectives of the change have been satisfactorily achieved.  
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 15 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   5.67 
   5.68 
   5.69 
   Where possible, the implementation plan should reflect potential contingency actions 
  that may be required in the event that the change is not proceeding as planned.  
  Where potential consequences are high it may be appropriate for the licensee to 
  maintain for a suitable period the capability to reverse the change.  
   Justification documents should be formally signed off when the change is complete 
  and should be retained as a record in accordance with the licensee’s LC 6 
  arrangements.  It can be helpful to ‘close out’ the change at an appropriate date, after 
  the outcome has been monitored and sufficient confidence has been gained that the 
  change need not be reversed or altered significantly.  
   Under LC36 (6), ONR may direct a licensee to halt a change to its organisation 
  structure or resources if it is concerned the change may have been inadequately 
  conceived or executed.  In practice, it is envisaged that this power will be used rarely.  
  In such circumstances, ONR and the licensee should discuss the proposed change 
  and seek to resolve any issues such that an agreed way forward is established. If ONR 
  is content that the proposed change, amended if necessary, may proceed then it will 
  provide a formal consent to permit it to progress.  
   5.70 
   The inspector should consider whether or not:  
    
    
    
    
    
    
    
    
    
    
    
    
   to 
   the 
   significance 
   and 
   changes 
   are 
   proportionate 
   need 
  to 
  develop 
  a 
  means 
  of 
  defining 
   an 
  and 
   ‘overarching 
  coordinating 
   to 
  implementing 
  intervention 
  as 
   persons 
  and 
  adequately 
  should 
  the 
  change 
  be 
   formally 
  endorsed 
  to 
  confirm 
  that 
  proposed 
  off 
  upon 
  completion 
  of 
  necessary 
  enabling 
   Assessments 
  of 
  proposed 
  category of the change;  
  Assessments 
  have 
  been 
  carried 
  out 
  by 
  competent 
  consider 
  the 
  range 
  of 
  potential 
  consequences 
  inadequately conceived or executed;  
  The 
  licensee 
  has 
  acknowledged 
  the 
  ‘management 
  of 
  change 
  assessment 
  as 
  larger, more complex changes;  
  The 
  licensee’s 
  arrangements 
  provide 
  for 
  a 
  staged 
  approach 
  larger, 
  complex 
  changes 
  and 
  make 
  provision 
  for 
  ONR 
  appropriate;  
  Justification 
  documents 
  have 
  been 
  changes 
  may 
  proceed 
  and 
  signed 
  actions by a SQEP; 
  Changes 
  have 
  been 
  adequately 
  documented 
  to 
  enable 
  the 
  objective 
  change, and the change categorisation to be clearly understood; 
  Enabling and mitigating actions 
  for Category 1 and 2 changes are 
  satisfactorily address the identified risks;  
  The 
  licensee’s 
  senior 
  management 
  and 
  the 
  Nuclear 
  Safety 
  Committee 
  have 
  been 
  involved 
  in 
  considering 
  the 
  implications 
  a 
  Category 
  1 
  change 
  prior 
  to  
  implementation;  
  Arrangements 
  are 
  in 
  place 
  in 
  the 
  licensee 
  organisation 
  to 
  monitor 
  Category 
  1 
  and 
  2 
  changes 
  and, 
  in 
  the 
  event 
  that 
  a 
  change 
  is 
  not 
  proceeding 
  satisfactorily, 
  to initiate remedial action;  
  Suitable 
  qualitative 
  or 
  quantitative 
  indicators 
  have 
  been 
  developed 
  significant changes and if they are linked to enabling and remedial actions;  
  The 
  indicators are being used 
  to monitor the effectiveness of 
  implementation of 
  significant changes;  
  There 
  is 
  a 
  process 
  documents;  
   relevant and 
   consistency 
   justification 
   of 
   the 
   for 
   to 
   check 
   the 
   quality 
   and 
   of 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 16 of 25 
    
    
    
    
   Office for Nuclear Regulation  
    
    
   a 
   are 
   filed 
   within 
   documents 
   Justification 
  scrutiny;  
  There 
  is 
  a 
  post-change 
  review 
  process 
  to 
  successful 
  and 
  unsuccessful 
  changes 
  to 
  be 
  changes 
  and, 
  if 
  appropriate, 
  incorporated 
  into 
  change arrangements.  
   site-wide 
   system 
   and 
   available 
   for 
   enable 
  learning 
  points 
  from 
  taken 
  into 
  account 
  for 
  future 
  the 
  licensee’s 
  management 
  of 
   5.71 
   5.72 
   Principle 6  
  The 
  licensee 
  should 
  periodically 
  review 
  the 
  effectiveness 
  arrangements and the changes that have been implemented.  
   of 
   the 
   overall 
   The licensee should be encouraged to capture the learning gained from applying its 
  management of change process, especially to larger and more complex changes.  This 
  should be reflected, where appropriate, in changed arrangements e.g. training.  The 
  arrangements themselves should be subject to periodic review to confirm that they are 
  working satisfactorily and to identify process improvements.  Reviews may take the 
  form of formal audit by a licensee’s assurance function or management reviews as part 
  of a structured approach to business improvement.  
   It is important that the senior management are engaged in the review process to 
  demonstrate leadership and commitment to the management of change arrangements.  
  The effectiveness of the arrangements, and the totality of changes and their impact on 
  the organisation, should be regularly reviewed by them to ensure that the 
  arrangements are working satisfactorily and that the organisation is not being 
  degraded as a result of a succession of changes.  
   5.73 
   The inspector should consider whether or not:  
    
    
    
    
    
   
    
   the 
   of 
   change 
   to monitor 
   management 
   the effectiveness 
   The arrangements provide 
  for 
  the Board/Executive 
  of implementation of more significant changes;  
  There 
  is 
  a 
  formal 
  review 
  process 
  to 
  confirm 
  that 
  arrangements are operating satisfactorily;  
  Senior 
  management 
  are 
  engaged 
  in 
  the 
  review 
  process 
  leadership and commitment is demonstrated to the workforce;  
  The 
  review 
  process 
  involves 
  persons 
  other 
  than 
  those 
  with 
  a 
  management 
  of 
  change 
  process 
  role 
  to 
  ensure 
  that 
  the 
  views 
  of 
  originators 
  and 
  implementers 
  are captured; 
  The outcome of reviews is shared with the workforce;  
  There 
  is 
  a mechanism 
  for 
  sharing 
  learning 
  and 
  building 
  the arrangements as part of continuous improvement;  
  The 
  cumulative 
  effects 
  of 
  multiple 
  changes 
  on 
  the 
  organisation 
  have 
  considered 
  by 
  senior management 
  and 
  if 
  there 
  is 
  any 
  evidence 
  of 
  action 
  taken to avoid the potential degradation of the licensee organisation.  
   been 
  being 
   learning 
   their 
   back 
   into 
   that 
   and 
   how 
   6. 
   APPENDICES    
   APPENDIX 1: LICENCE CONDITION 36 ‘ORGANISATIONAL CAPABILITY’ 
   6.1 
   Licence Condition 36 requires that:  
    
   The 
  licensee 
  shall 
  provide 
  and 
  maintain 
  adequate 
  financial 
  resources to ensure the safe operation of the licensed site.  
   and 
   human 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 17 of 25 
    
    
    
    
    
   Office for Nuclear Regulation  
    
    
    
    
    
   of 
   the 
   or 
   parts 
   Without 
  prejudice 
  to 
  the 
  requirements 
  of 
  paragraph 
  1, 
  the 
  licensee 
  shall 
  make 
  and 
  implement 
  adequate 
  arrangements 
  to 
  control 
  any 
  change 
  to 
  its 
  organisational structure or resources which may affect safety.  
  The 
  licensee 
  shall 
  submit 
  to 
  ONR 
  for 
  approval 
  such 
  part 
  aforesaid arrangements as the Executive may specify.  
  The 
  licensee 
  shall 
  ensure 
  that 
  once 
  approved 
  no 
  alteration 
  or 
  amendment 
  is 
  made 
  to 
  the 
  approved 
  arrangements 
  unless 
  the 
  ONR 
  has 
  approved 
  such 
  alteration or amendment.  
  The 
  aforesaid 
  arrangements 
  shall 
  provide 
  for 
  the 
  classification 
  of 
  changes 
  to 
  the 
  organisational 
  structure 
  or 
  resources 
  according 
  to 
  their 
  safety 
  significance.  
  The 
  arrangements 
  shall 
  include 
  a 
  requirement 
  for 
  the 
  provision 
  of 
  adequate 
  documentation 
  to 
  justify 
  the 
  safety 
  of 
  any 
  proposed 
  change 
  and 
  shall 
  where 
  appropriate provide for the submission of such documentation to the ONR.  
  The 
  licensee 
  shall 
  if 
  so 
  directed 
  by 
  the 
  ONR 
  halt 
  the 
  change 
  to 
  its 
  organisational 
  structure 
  or 
  resources 
  and 
  the 
  licensee 
  shall 
  not 
  recommence 
  such change without the consent of the ONR.  
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 18 of 25 
    
    
    
    
    
   Office for Nuclear Regulation  
   APPENDIX 2: EXAMPLES OF DRIVERS FOR ORGANISATIONAL CHANGE 
   6.2 
   This appendix provides some examples of drivers for organisational change and the 
  potential implications for nuclear safety if a change is inadequately conceived or 
  executed.  
    
    
    
    
    
    
    
    
    
    
   Cost 
   reduction. 
   This 
  may 
  result 
  fulfil baseline organisational roles.  
   in 
   inadequate 
   resources 
   being 
   available 
   to 
   of 
   or 
   Sales, 
   creation 
   mergers 
   acquisitions, 
   This 
  may 
  lead 
  to 
  a 
  loss 
  of 
  nuclear 
  related 
  expertise 
  at 
  Board 
  and 
  Executive 
  level, 
  resulting 
  in 
  a 
  lack 
  of understanding 
  of what 
  is 
  required 
  to maintain 
  the 
  defence 
  in 
  depth 
  which 
  is 
  essential 
  to 
  the 
  achievement 
  of 
  very 
  high 
  levels 
  of 
  safety.  
  Corporate 
  mergers 
  may 
  result 
  in 
  a 
  lack 
  of 
  harmonisation 
  of 
  standards 
  and 
  procedures, 
  and 
  a 
  lack 
  of 
  clarity 
  of 
  managerial 
  responsibilities 
  and 
  accountabilities.  
   companies. 
   subsidiary 
   and 
   Downsizing, 
   re-engineering 
   This 
  may 
  result 
  in 
  understaffing 
  and 
  lack 
  of 
  competent 
  staff 
  or 
  'intelligent 
  customer' 
  capability 
  to 
  make 
  an 
  informed 
  judgement. 
  It 
  may 
  lead 
  to 
  instances 
  where 
  there 
  is 
  insufficient 
  competent 
  staff 
  available 
  to 
  assess 
  the 
  safety 
  significance 
  of 
  activities with 
  the potential 
  to 
  impact on nuclear safety, or 
  the 
  loss of 
  ‘corporate 
  memory’ in a particular field.  
   outsourcing. 
   Reduction 
   of 
   the 
   numbers 
   of 
   layers 
   of 
   management. 
   This 
  may 
  unacceptable 
   result 
  in 
  increase 
   Organisational 
   inadequate 
  supervision 
  or 
  oversight 
  of 
  staff work, 
  or 
  an 
  in individual workload or management spans of control. 
  This 
  is 
  particularly 
  appropriate 
  in 
  the 
  case 
  of 
  new 
  build 
  organisations 
  where 
  the 
  organisation 
  structure 
  may 
  change 
  several 
  times 
  as 
  the 
  project 
  progress 
  both 
  within 
  a 
  particular 
  project 
  phase 
  and 
  as 
  the 
  project progresses from one phase to the next. 
   development. 
   and 
   change 
   restructuring 
   Organisational 
   Downgrading 
   This 
  competent staff being diverted to restructuring/change projects.  
  so 
  that 
  he 
  or 
  she 
  is 
  no 
  longer 
  a 
  member of the licensee’s Executive or Board, resulting in a loss of independent, 
  authoritative advice for nuclear safety at Board level.  
   This may 
  result 
  in 
  the 
  loss of key staff and expertise 
   Relocation of offices. 
   initiatives. 
   Safety 
   Head 
   result 
   post 
   may 
   the 
   of 
   in 
   in 
   critical areas.  
   in 
   of 
   for 
   and 
   staff. 
   training 
   policies 
   Changes 
   recruitment 
   This 
  may 
  result 
  from national skills shortages, demographics etc leading to vacancies not being 
  filled, 
  recruitment 
  of 
  poor 
  quality 
  staff, 
  and 
  degradation 
  of 
  the 
  competence 
  of 
  individuals and the organisation as a whole. 
  Although 
  not 
  necessarily 
  an 
  organisational 
  change 
  this 
  change 
  could 
  still 
  result 
  in 
  significant 
  safety 
  risks. 
  Organisational 
  change 
  control 
  can 
  be 
  used 
  as 
  a 
  flexible 
  risk 
  assessment 
  tool 
  in 
  these 
  cases, 
  which 
  is 
  seen 
  as 
  good 
  practice, 
  allowing 
  the 
  organisation 
  to 
  manage 
  potential 
  risks.  
   Executive. 
   Change 
   Board 
   in 
   / 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 19 of 25 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   APPENDIX 3 : BROAD GUIDANCE ON CLASSIFICATION OF ORGANISATIONAL 
  CHANGES 
   6.3 
   The approach to classifying changes may vary according to licensee. The following 
  example classifications are provided for illustrative purposes to guide the inspector:  
    
    
    
    
   o 
   o 
  o 
  o 
  o 
   o 
  o 
  o 
  o 
  o 
   o 
   o 
   o 
  o 
  o 
  o 
   o 
   o 
   o 
  o 
   affect 
   the 
   Category 1 
  changes, which 
  if 
  inadequately 
  conceived or 
  executed, 
  could 
  result 
  in a major 
  reduction 
  in 
  the standards of nuclear safety with 
  the potential 
  for on-
  site and off-site impact such as:  
  Wide 
  ranging 
  company 
  or 
  site 
  changes 
  that 
  have 
  the 
  potential 
  to 
  validity of, or basis on which, the nuclear site licence was granted.  
  Changes resulting in the granting of a new site licence.  
  Sale, acquisition or merger of a licensee organisation or a nuclear licensed site.  
  Changes involving more than one business unit, division or site.  
  Large-scale downsizing or outsourcing of a nuclear safety significant function.  
  Category 2 
  changes, which 
  if 
  inadequately 
  conceived or 
  executed, 
  could 
  result 
  in a 
  significant 
  reduction 
  in 
  the 
  standards of nuclear 
  safety with 
  the potential 
  to 
  affect a large proportion of or the whole of a site such as:  
  Changes that affect people within a whole facility.  
  Changes that affect a whole department or large groups of staff.  
  Changes that affect several layers of management.  
  Significant reduction in the size of a team that has an EH&S role.  
  Changes 
  with 
  significant 
  potential 
  to 
  adversely 
  impact 
  on 
  a 
  site’s 
  response.  
  Changes 
  resulting 
  in 
  a 
  significant 
  transfer 
  of 
  key 
  EH&S 
  responsibilities such as those associated with DAP duties. 
  Changes in staff shift patterns   
  Category 3 
  changes, which 
  if 
  inadequately 
  conceived or 
  executed, 
  in 
  a 
  minor 
  reduction 
  in 
  the 
  standards 
  of 
  nuclear 
  safety 
  with 
  the 
  affect a single plant, department or business unit such as:  
  Changes that affect staff within one process area or a significant part of a plant.  
  Changes that affect a small group of staff, such as part of a department.  
  Small reduction in the size of a team.  
  Changes 
  in 
  management 
  accountabilities/responsibilities 
  impact on EH&S.  
  Transfer of responsibilities between departments/units. 
   Category 4 changes with negligible or no effect on nuclear safety such as:  
  Changes 
  to 
  organisational 
  responsibilities 
  that 
  do 
  not 
  lead 
  to 
  a 
  significant 
  increase in the workload of any line manager or group of staff.  
  A reduction in the size of a team that has little or no EH&S role.  
  Staff 
  being 
  moved 
  or 
  leaving 
  following 
  completion 
  of 
  a 
  project 
  work. 
   could 
  result 
  potential 
  to 
   accountabilities 
   emergency 
   or 
   package 
   of 
   a 
   small 
   and 
   that 
   have 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 20 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   6.4 
   6.5 
   6.6 
   APPENDIX 
  4: 
  GUIDANCE 
  TO 
  INSPECTORS 
  ON 
  THE 
  APPROACH 
  TO 
  UNDERTAKEN 
  FOR 
  ASSURING 
  COMPLIANCE 
  WITH 
  THE 
  ‘ADEQUACY 
  FINANCIAL RESOURCES’ ASPECT OF LC 36(1) 
   BE 
  OF 
   Purpose and scope  
   The purpose of this appendix is to support a proportionate and consistent regulatory 
  approach to ONR inspection and assessment against the financial resources aspect of 
  LC 36 (1) ‘Organisational Capability’.  
   Background  
   Article 6(5) of the Nuclear Safety Directive 2009/71/Euratom requires member states to 
  ensure that licensees are required to provide and maintain adequate financial and 
  human resources to fulfil their obligations in respect of nuclear safety.  In order to 
  ensure that this requirement was fully transposed in Great Britain, LC 36 was changed 
  in July 2011 to introduce a revised LC 36(1) which requires licensees to provide and 
  maintain adequate financial and human resources to ensure the safe operation of the 
  licensed site.  
   ONR consulted with all nuclear site licence holders on this amendment (and a 
  proposed modification to LC 17) and conducted an impact assessment.  ONR also 
  published a supporting note advising that ONR considered licensees would already 
  comply with the requirement to provide and maintain adequate human resources, by 
  virtue of their Nuclear Baseline.  The note also stated that: “On a day-to-day basis, 
  compliance with legal duties to ensure an appropriate level of nuclear safety is likely to 
  be sufficient evidence of compliance with the licence condition regarding the licensee’s 
  existing financial resources”.  With regard to the requirement to maintain adequate 
  financial resources, ONR’s view is that the licensee should be able to clearly 
  demonstrate that it:  
   in 
    
    
    
    
    
    
   Understands 
  the 
  hazards 
  and 
  risks 
  of 
  its 
  undertakings 
  and 
  is 
  operating 
  accordance with its safety case and complying with the licence conditions;  
  Is 
  reducing 
  risk 
  so 
  far 
  as 
  is 
  reasonably 
  practicable, 
  and 
  implementing 
  improvements in a timely manner where these are identified as ALARP;  
  Is 
  maintaining 
  an 
  adequate 
  Nuclear 
  Baseline 
  resource 
  and 
  implementing 
  arrangements for managing organisational change set out under LC 36(2);  
  Has 
  assessed 
  what 
  financial 
  resources 
  are 
  necessary 
  to 
  continue 
  to 
  meet 
  those needs;  
  Has, and 
  is maintaining, or has 
  financial resources; and  
  Has relevant records and they are being retained in accordance with LC 6.  
   in place arrangements 
   its 
   to obtain, 
   the necessary 
   Guidance on inspection of arrangements 
   6.7 
   Regulatory Approach 
  The financial resources of a licensee are not ordinarily the focus of routine inspection 
  activities.  Rather, inspectors should be alert to indirect evidence that may indicate a 
  reduction in the ability or willingness of the licensee to provide or maintain adequate 
  financial resources to ensure safety.  Evidence may include failure to resource plant 
  improvements; staff shortages that are not being filled; delays in delivering activities 
  such as maintenance etc.  Should indications be found that investment in safety-
  related plant or people may not be adequate to provide and maintain safety, the 
  inspector should seek to establish whether it is attributable to other factors (for 
  example difficulties in identifying SQEP resource; technical difficulties or 
  disagreements etc.) and, if so, to progress the matter in the normal manner.  
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 21 of 25 
    
    
    
    
   Office for Nuclear Regulation  
   6.8 
   6.9 
   6.10 
   If the safety issue cannot be resolved to the satisfaction of the inspector, and financial 
  resource issues are identified as a possible factor, this matter should be elevated to 
  the relevant Superintending Inspector and Professional lead for consideration.  It is 
  anticipated that discussions will take place with the licensee to determine the cause of 
  the issue and attempt to resolve it.  This may entail an ONR review of safety cases; 
  annual financial accounts, plans for construction and key financial decision points; 
  investment plans; lifetime plans, the nuclear baseline and other documents.  If the 
  issue cannot be resolved, and failure to comply with LC 36(1) is suspected, 
  consideration may be given to engaging external expert financial advice to inform the 
  process of establishing ONR’s enforcement options.  The need to take this course of 
  action is expected to be rare.  
   Where the licensee's budget is controlled by another body (for example, the Nuclear 
  Decommissioning Authority (NDA) or a parent organisation), financial (and other 
  resourcing) arrangements are likely to be set out in contractual arrangements such as 
  a Shareholders Agreement between the licensee and the controlling body.  ONR may 
  seek to examine these documents.  ONR anticipates that the controlling body will co-
  operate with the licensee in ensuring the adequacy of the resources needed for safety, 
  and to meet its obligations under HSWA Section 3(1).  The licensee, however, retains 
  an absolute responsibility for nuclear safety.  
   Government assurances regarding a licensee’s financial standing  
   ONR will approach the relevant government department at the time of processing a 
  licence application, or responding to a request for relicensing, to seek its assurances 
  regarding the applicant’s financial status.  ONR may, on rare occasions when it deems 
  it relevant, also seek such assurances from government to inform ONR’s approach 
   set out in paragraphs 6.7 to 6.9 above.  Government assurances will be used by 
  ONR to provide confidence that, at the point of licensing, an organisation’s financial 
  arrangements are adequate to enable it to fulfil its obligations as a nuclear site 
  licence holder.  Subsequent to the granting of a licence, the approach set out in 
  paragraphs 6.7 to 6.9 above will be followed. 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 22 of 25 
    
    
    
    
   Office for Nuclear Regulation  
    APPENDIX 
  5: 
  GUIDANCE 
  FOR 
  INSPECTORS 
  ON 
  THE 
  FACTORS 
  THAT 
  MAY 
  BE 
  CONSIDERED 
  WHEN 
  INSPECTING 
  THE 
  LICENSEE’S 
  IMPLEMENTATION 
  OF 
  ITS 
  MANAGEMENT OF CHANGE ARRANGEMENTS 
   6.11 
   The following ‘short-form’ guidance is provided to assist inspectors to judge the 
  adequacy of licensees’ arrangements to comply with LC 36 clauses (2) to (5).  In order 
  to promote a consistent regulatory approach, this appendix incorporates guidance 
  previously included within the inspection guidance T/INS/036.  This Appendix 
  complements the more detailed guidance in the main body of this TAG and reference 
  to that material should be made where appropriate.  
   Management of change arrangements  
   6.12 
   Interview a sample of Board, Executive and Lead Team members to examine their 
  knowledge of:  
    
    
    
    
    
   The 
  importance of management 
  of 
  change 
  arrangements as an 
  integral part of 
  business strategy implementation, nuclear safety and resource management;  
  The 
  need 
  for 
  the 
  Board/Executive 
  to 
  visibly 
  commit 
  to 
  management 
  of 
  organisational change as a key business process;  
  The 
  need 
  for 
  the 
  implications 
  of 
  all 
  proposed 
  organisational 
  changes 
  to 
  be 
  formally 
  assessed 
  using 
  a 
  consistent 
  methodology 
  which 
  is 
  an 
  integral 
  part 
  of 
  the licensee’s management system;  
  The 
  Board/Executive’s 
  role 
  in 
  ensuring 
  that 
  the 
  implications 
  complex changes are fully assessed prior to implementation; 
  The 
  Board/Executive’s 
  role 
  in 
  providing 
  oversight 
  of 
  significant 
  changes and ensuring that the objectives of the changes are met; 
  The 
  importance 
  of 
  regularly 
  monitoring 
  the 
  state 
  of 
  the 
  organisation 
  to 
  ensure 
  that 
  nuclear 
  safety 
  is 
  not 
  progressively 
  degraded 
  over 
  time 
  as 
  a 
  result 
  of 
  a 
  succession of changes; 
  The 
  need 
  to 
  regularly 
  review 
  that 
  the 
  licensee’s 
  management 
  arrangements 
  are 
  up 
  to 
  date 
  and 
  are 
  being 
  consistently 
  applied 
  entirety of the licensee organisation; 
  The importance of having SQEPs in key management of change roles. 
  Check that the baseline contains a substantiation of the ‘right size and structure’ for the 
  licensee organisation.  Check that there is not a presumption that the existing structure 
  is adequate.  
   of 
  change 
  across 
  the 
   significant 
   complex 
   and 
   and 
   of 
    
    
    
   Check that the arrangements are linked to human resource processes and that Human 
  Resources is involved in assessing implications of changes for workforce planning and 
  training, and taking action as appropriate.  
   6.13 
   6.14 
   6.15 
   Interview some of the managers proposing changes and key role holders such as 
  reviewers to examine their knowledge of:  
    
   
    
    
   Roles and responsibilities;  
  Staging of changes where appropriate;  
   The 
  value 
  of 
  enabling 
  actions 
  which 
  managed i.e. verifiably closed out;  
  Use 
  of 
  performance 
  indicators 
  and 
  contingency measures 
  and that they have been properly identified and managed;  
   been 
   have 
   properly 
   identified 
   and 
   or 
   remedial 
   actions, 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 23 of 25 
    
    
    
    
    
   Office for Nuclear Regulation  
    
   
   The importance of reviews at appropriate times during implementation.  
  Records requirements. 
  Confirm that the arrangements are being adhered to by discussion with staff at various 
  levels throughout the licensee’s organisation.  
   6.16 
   6.17 
   Check the change register and observe if:  
   6.18 
   6.19 
    
   There 
  are 
  similar, 
  linked 
  changes 
  which 
  should 
  have 
  been 
  managed 
  in 
  coordinated 
  manner 
  i.e. 
  under 
  an 
  umbrella 
  or 
  overarching 
  management 
  change, and given a higher change category; 
  There 
  is 
  evidence 
  of 
  ‘salami 
  slicing’ 
  of 
  a 
  larger 
  changes.  
  Check the licensee's implementation of its review and audit processes and examine:  
   change 
   series 
   into 
   of 
    
   a 
  of 
   a 
   smaller 
    
   
   
   
   
   
   Periodic review and update of the nuclear baseline;  
  Reviews of performance indicators during and after implementation;  
  Categorisation reviews;  
  Independent safety reviews;  
  Reviews of implementation of the arrangements and plans for improvement.  
  Reviews of cumulative effects of change on the organisation.  
  Check the licensee’s communication arrangements to confirm whether or not the 
  workforce understands the implications of significant changes and is kept informed of 
  implementation progress.  
    
   Check that arrangements exist to periodically update the nuclear baseline and 
  that the baseline is up to date and reflective of the licensee organisation.  
   Implementation of change proposals  
   6.20 
   Select a sample of change proposals for checking.  The sample should include top 
  category changes if there have been any, and lower category changes throughout the 
  range of significance.  The sample should ideally include any corporate changes which 
  may affect safety on site.  Consider ‘calling in’ changes (at any or all category levels) 
  for specialist assessment.  
   6.21 
   For each change proposal in the sample:  
    
    
    
   o 
  o 
  o 
   o 
   Check 
  the 
  register 
  of 
  change 
  proposals 
  to 
  confirm 
  that 
  change 
  proposals 
  for 
  significant 
  changes 
  were 
  reviewed 
  and 
  authorised 
  through 
  the 
  appropriate 
  route 
  and 
  available 
  in 
  time 
  to 
  provide 
  20 
  working 
  days’ 
  notice 
  for 
  ONR 
  assessment prior to implementation if required.  
  Make a judgement about the accuracy of the classification of the change.  
   Check that the substantiation document for significant changes includes where 
  appropriate: 
  A clear description of the objectives of the change; 
  A reference to the nuclear baseline; 
  A 
  risk 
  assessment 
  which 
  has 
  been 
  change; 
  A detailed implementation plan with timescales, including staging of the change 
  where appropriate; 
   classification 
   inform 
   used 
   the 
   the 
   to 
   of 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 24 of 25 
    
    
    
    
     
   Office for Nuclear Regulation  
   o 
  o 
  o 
  o 
   o 
  o 
    
    
    
    
   
   
    
   Enabling actions as precursors to implementation of the change; 
  Performance indicators to monitor the effectiveness of implementation; 
  Contingency plans and remedial actions; 
  Shadow working to confirm planned arrangements where appropriate.  
  Check 
  that 
  authorisation 
  to 
  proceed with 
  the 
  proposed 
  change was 
  granted 
  a SQEP.  
  Check that all enabling actions for significant changes were satisfactorily closed 
  out 
  before 
  the 
  appropriate 
  parts 
  of 
  the 
  change 
  were 
  implemented. 
  Verify 
  a 
  sample of the actions if appropriate.  
  Check 
  that 
  the 
  performance 
  indicators 
  were 
  used 
  to 
  monitor 
  implementation 
  progress 
  and 
  that 
  contingency 
  plans 
  or 
  remedial 
  actions 
  were 
  invoked 
  at 
  an 
  appropriate time.  
  Check that the change proposal was signed off as complete by a SQEP.  
  Check that the objectives of the change were met.  
  Check 
  that 
  any 
  staff 
  implications 
  have 
  been 
  satisfactorily 
  example:  
  Vacancy filling and recruitment;  
  Training and development.  
  Check that the baseline has been updated to reflect the impact on baseline 
  roles where appropriate.  
   addressed, 
   by 
   for 
   Report : NS-TAST-GD-048 Revision 5 
  TRIM Ref: 2018/283567 
   Page 25 of 25 
    
    
    
    
    
  "
  oversight of items or services cns-tast-gd-4.3	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/oversight of items or services cns-tast-gd-4.3.pdf	" Title of document 
   OFFICIAL 
   ONR GUIDE 
   OVERSIGHT OF SUPPLIERS OF ITEMS OR SERVICES OF NUCLEAR SECURITY 
  SIGNIFICANCE 
   Document Type: 
   Nuclear Security Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   CNS-TAST-GD-4.3 Revision 0 
   March 2017 
   Review Date: 
   March 2020 
   Approved by: 
  Record Reference: 
  Revision commentary: 
   David Pascoe 
   Professional Lead 
   TRIM Folder 4.4.2.19074. (2017/106068) 
  New document issued 
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
  5. 
  6. 
  7. 
  8. 
  9. 
   INTRODUCTION ................................................................................................................. 2 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  RELATIONSHIP TO RELEVANT LEGISLATION ................................................................ 2 
  RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE ...................................... 2 
  RELATIONSHIP TO NATIONAL POLICY DOCUMENTS ................................................... 3 
  ADVICE TO INSPECTORS ................................................................................................. 3 
  SUPPLY CHAIN OVERSIGHT AND ASSURANCE ............................................................ 4 
  REFERENCES .................................................................................................................... 8 
  GLOSSARY AND ABBREVIATIONS .................................................................................. 9 
   © Office for Nuclear Regulation, 2017 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 03/17 
   OFFICIAL 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 9 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   1. 
   1.1 
   1.2 
   2. 
   2.1 
   3. 
   3.1 
   3.2 
   4. 
   4.1 
   INTRODUCTION 
   The Office for Nuclear Regulation (ONR) has established a set of Security Assessment 
  Principles (SyAPs) (Reference 1). This document contains Fundamental Security 
  Principles (FSyPs) that dutyholders must demonstrate have been fully taken into 
  account in developing their security arrangements to meet relevant legal obligations. 
  The security regime for meeting these principles is described in security plans 
  prepared by the dutyholders, which are approved by ONR under the Nuclear Industries 
  Security Regulations (NISR) 2003 (Reference 2). 
   The term ‘security plan’ is used to cover all dutyholder submissions such as nuclear 
  site security plans, temporary security plans and transport security statements. NISR 
  Regulation 22 dutyholders may also use the SyAPs as the basis for Cyber Security 
  and Information Assurance (CS&IA) documentation that helps them demonstrate 
  ongoing legal compliance for the protection of Sensitive Nuclear Information (SNI). The 
  SyAPs are supported by a suite of guides to assist ONR inspectors in their 
  assessment and inspection work, and in making regulatory judgements and decisions.  
  This Technical Assessment Guidance (TAG) is such a guide. 
   PURPOSE AND SCOPE 
   This TAG contains guidance to advise and inform ONR inspectors in exercising their 
  regulatory judgment during assessment activities relating to a dutyholder’s supply 
  chain management arrangements.  It aims to provide general advice and guidance to 
  ONR inspectors on how this aspect of security should be assessed. It does not set out 
  how ONR regulates the dutyholder’s arrangements.  It does not prescribe the detail, 
  targets or methodologies for dutyholders to follow in demonstrating they have 
  addressed the SyAPs. It is the dutyholder’s responsibility to determine and describe 
  this detail and for ONR to assess whether the arrangements are adequate. 
   RELATIONSHIP TO RELEVANT LEGISLATION 
   The term ‘dutyholder’ mentioned throughout this guide is used to define ‘responsible 
  persons’ on civil nuclear licensed sites and other nuclear premises subject to security 
  regulation, a ‘developer’ carrying out work on a nuclear construction site and approved 
  carriers, as defined in NISR. It is also used to refer to those holding SNI. 
   NISR defines a ‘nuclear premises’ and requires ‘the responsible person’ as defined to 
  have an approved security plan in accordance with Regulation 4. It further defines 
  approved carriers and requires them to have an approved Transport Security 
  Statement in accordance with Regulation 16. Persons to whom Regulation 22 applies 
  are required to protect SNI. ONR considers supply chain management to be an 
  important component of a dutyholder’s arrangements in demonstrating compliance 
  with relevant legislation. 
   RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE 
   The essential elements of a national nuclear security regime are set out in the 
  Convention on the Physical Protection of Nuclear Material (CPPNM) (Reference 3) and 
  the IAEA Nuclear Security Fundamentals (Reference 4). Further guidance is available 
  within IAEA Technical Guidance and Implementing Guides. 
   Report CNS-TAST-GD-4.3 
  TRIM Ref: 2017/106068 
   Page 2 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   4.2 
   Fundamental Principle J of the CPPNM refers to quality assurance and states that ‘a 
  quality assurance policy and quality assurance programmes should be established and 
  implemented with a view to providing confidence that specified requirements for all 
  activities important to physical protection are satisfied’. The importance of issues 
  relating to assurance activities are also recognised in the Nuclear Security 
  Fundamentals, specifically: 
    
   Essential Element 12: Sustaining a Nuclear Security Regime – 3.12  
   h) Routinely performing assurance activities to identify and address issues 
  and factors that may affect the capacity to provide adequate nuclear 
  security including cyber security at all times. 
   A more detailed description of the elements is provided in Recommendations level 
  guidance, specifically Nuclear Security Series (NSS) 13, Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5) (Reference 5). 
   RELATIONSHIP TO NATIONAL POLICY DOCUMENTS 
   The SyAPs provide ONR inspectors with a framework for making consistent regulatory 
  judgements on the effectiveness of a dutyholder’s security arrangements.  This TAG 
  provides guidance to ONR inspectors when assessing a dutyholder’s submission 
  demonstrating they have effective processes in place to achieve SyDP 4.3 – Oversight 
  of Suppliers, in support of FSyP 4 – Nuclear Supply Chain Management.  The TAG is 
  consistent with other TAGs and associated guidance and policy documentation. 
   The HMG Security Policy Framework (SPF) (Reference 6) describes the Cabinet 
  Secretary’s expectations of how HMG organisations and third parties handling HMG 
  information and other assets will apply protective security to ensure HMG can function 
  effectively, efficiently and securely. The security outcomes and requirements detailed 
  in the SPF have been incorporated within the SyAPs. This ensures that dutyholders 
  are presented with a coherent set of expectations for the protection of nuclear 
  premises, SNI and the employment of appropriate personnel security controls both on 
  and off nuclear premises. 
   The Classification Policy (Reference 7) indicates those categories of SNI, which 
  require protection and the level of security classification to be applied. 
   ADVICE TO INSPECTORS 
   This TAG is to be used by inspectors in their assessment of the adequacy of the 
  dutyholder’s arrangements for the supply chain management of items or services of 
  nuclear security significance. 
   The effective procurement of items and services is a fundamental element in the 
  provision of an adequate security infrastructure to deliver an appropriate and enduring 
  security effect. 
   4.3 
   5. 
   5.1 
   5.2 
   5.3 
   6. 
   6.1 
   6.2 
   Report CNS-TAST-GD-4.3 
  TRIM Ref: 2017/106068 
   Page 3 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   Regulatory Expectations 
   6.3 
   The regulatory expectation is that dutyholders will describe in the security plan how 
  they apply oversight of suppliers of items or services of nuclear security significance to 
  support effective nuclear supply chain management arrangements. 
   FSyP 4 - Nuclear Supply Chain 
  Management 
   Oversight of Suppliers of Items or 
  Services of Nuclear Security 
  Significance 
   SyDP 4.3 
   Dutyholders should conduct effective oversight and assurance of their supply chain.  
   6.4 
   6.5 
   6.6 
   6.7 
   7. 
   7.1 
   7.2 
   The purchaser should establish an effective commercial and/or Supply Chain strategy 
  to enable effective delivery of items and/or services. The purchaser’s commercial 
  and/or Supply Chain strategy will influence all arrangements associated with the 
  procurement security items or services. An effective strategy with appropriate oversight 
  and assurance, deployed through the organisation’s business planning process should 
  ensure delivery of an effective security solution. 
   Oversight arrangements should include measures to review contracts, how 
  relationships are managed and performance analysis of vendors. 
   There are parties who might wish to substitute counterfeit, fraudulent or suspect items 
  for genuine items or services for commercial gain and assurance activities should 
  include a focus on the application of processes to prevent such items from entering the 
  Supply Chain. Of equal concern is that parties may wish to incorporate a ‘back door’ to 
  Operational Technology or Information Technology (OT/IT) to allow subsequent ease 
  of access following installation. Dutyholders should be aware that such ‘back doors’ 
  can create significant vulnerabilities and give specific consideration to mitigate their 
  introduction. There is also the possibility that a party acting maliciously may wish to 
  introduce latent defects (for example by installing malware on OT/IT) for subsequent 
  exploitation.  Dutyholders and their supply chain should recognise these issues and 
  have in place appropriate arrangements to mitigate them. 
   Assurance activities should ensure appropriate arrangements are in place for all 
  contracts involving security classified information or equipment including that 
  considered SNI in accordance with FSyP7 and its associated delivery principles. 
   SUPPLY CHAIN OVERSIGHT AND ASSURANCE 
   The dutyholder should conduct effective oversight and assurance of the Supply Chain, 
  including the acceptance of items or services for work with security significance. 
   The dutyholder should establish effective arrangements for the oversight of supplier 
  performance throughout the contract period and their quality assurance to ensure that 
  items or services will meet the specified intent. The dutyholder should ensure that it 
  has sufficient capability to oversee and assure performance throughout the tiers of the 
  Supply Chain. Assurance activities should include the inspection, test, release, 
  acceptance and storage of security significant items and services. 
   Report CNS-TAST-GD-4.3 
  TRIM Ref: 2017/106068 
   Page 4 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   7.3 
   7.4 
   7.5 
   Dutyholders should develop and retain sufficient Intelligent Customer capability to 
  specify, conduct oversight and assurance, monitor manufacturing, fabrication and 
  testing, and acceptance for technical adequacy of the items or services being 
  purchased. 
   The dutyholder’s oversight and assurance arrangements should review the supplier’s 
  security culture and procedures, during and post contract award to ensure the Supply 
  Chain organisations and their leaders continue to understand and promote the 
  importance of nuclear security and the contribution of any security significant 
  equipment or service they supply, to achieving the requirements of the dutyholder. 
   The level of oversight and assurance deployed by the dutyholder should be guided by 
  the performance of the supplier or Supply Chain. If performance is below expectation 
  then the dutyholder should increase the level of engagement, oversight and assurance 
  controls until supplier performance meets expectations or until completion or 
  termination of the contract. Conversely, if a supplier demonstrates routine delivery to 
  the specified requirements, right first time, every time, the dutyholder may consider a 
  change to the method and extent of oversight and assurance as appropriate (i.e. from 
  release inspection at the manufacturer’s works to receipt inspection at the purchaser’s 
  facility).  
   Oversight 
   7.6 
   The level of oversight deployed by the dutyholder should be commensurate with the 
  impact of the item or service if it fails to meet the specified intent. The dutyholder’s 
  approach should be influenced by the type of contract, the performance of the supplier, 
  their suppliers and the implications to security of poor performance. Dutyholders are 
  likely to deploy some or all of the following approaches: 
    
    
    
    
   Contract Review – Meetings between the supplier and dutyholder should 
  review performance and delivery issues including security requirements.  
   Supplier Relationship Management – Used to maintain effective relationships 
  between the supplier and dutyholder throughout the contract period to achieve 
  common objectives. Effective relationship management should support a 
  collaborative approach between the dutyholder and supplier. 
   Vendor Analysis – Performance analysis throughout the contract period with 
  data collated on contract success criteria, delivery to correct quality, schedule 
  and cost. Vendor analysis may be utilised to target and demonstrate 
  improvements, rank and rate suppliers and maintain a dutyholder’s preferred 
  suppliers listing. 
   Review of the supplier’s quality assurance arrangements to ensure appropriate 
  standards are also applied to their suppliers alongside appropriate testing of 
  these items on receipt.  
   7.7 
   The dutyholder’s Supply Chain oversight arrangements should generate quantitative 
  and qualitative performance data to demonstrate that suppliers of security significant 
  items or services will meet specified target levels. Dutyholders should instigate 
  remedial measures as appropriate, which may include withdrawal of contract, to 
  address sub-standard performance that may impact nuclear security. 
   Report CNS-TAST-GD-4.3 
  TRIM Ref: 2017/106068 
   Page 5 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Assurance 
   OFFICIAL  
   7.8 
   7.9 
   7.10 
   The dutyholder should have suitable assurance and acceptance processes for items or 
  services being supplied or undertaken by others on its behalf. The level of assurance, 
  inspection and test deployed upon item or service completion should be 
  commensurate with the security significance of the item or service being supplied. 
   Acceptance of items or services may include verification or independent assessment 
  using second or independent third party organisations. This should be planned and 
  executed, in part, by the application of quality plans. This approach provides essential 
  levels of assurance which are in addition to that provided through the supplier’s own 
  quality arrangements. 
   In deciding the levels of assurance, in addition to the security significance of the item 
  or service, the dutyholder should consider: the level of assurance normally applied to 
  the item or service for its intended use, the code/standard requirements, and the 
  difficulty of inspection and testing post-manufacture or installation. It is important that 
  ONR has access to all parties that are carrying out quality related activities if 
  requested. Access is normally arranged through the dutyholder. This should include 
  lower-tier suppliers. 
   7.11 
   The dutyholder’s assurance activities should examine the effectiveness of 
  arrangements for the transport, receipt and storage of items or assembly sub-
  components within the dutyholder’s facilities prior to delivery from the supplier. The 
  storage arrangements should be sufficient to maintain item traceability and prevent 
  damage, loss, deterioration, tampering or inadvertent use. 
   Inspectors should consider: 
    
    
    
    
   Do the dutyholder’s oversight and assurance processes allow them control of 
  their supply chain management and procurement process arrangements for 
  security significant items, from specification of requirement and sourcing a 
  supplier including contract award, through to manufacture of item, construction 
  of facility or provision of item or service? 
   Does the dutyholder confirm through its oversight and assurance processes 
  that its expectations are understood, communicated throughout the Supply 
  Chain and routinely reviewed to ensure that suppliers have appropriate 
  understanding of the security application and importance of their high 
  consequence items or services? 
   Does the dutyholder have sufficient capability to oversee and assess 
  performance throughout the Supply Chain, and confirm that the level of 
  oversight and assurance deployed by the supplier post contract award is 
  commensurate with the risk of the item or service failing to meet the specified 
  intent? These QA arrangements for the supply chain may be delivered by the 
  principal contractor employed by the dutyholder. 
   Does the dutyholder utilise qualitative and quantitative data to demonstrate 
  supplier performance during contract execution and instigate remedial 
  measures where appropriate? 
   Report CNS-TAST-GD-4.3 
  TRIM Ref: 2017/106068 
   Page 6 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
    
    
    
    
    
   Is the dutyholder carrying out adequate and appropriate assurance and 
  acceptance of items or services being supplied or undertaken by others on its 
  behalf? 
   Are any Inspection Agencies used competent to provide third party assurance 
  and verification of items or services significant to security? 
   Do the dutyholder’s assurance processes undertake regular reviews of the 
  supplier’s quality activities including the release of hold points, with the level of 
  evidence to support hold point release defined and tested?  
   Do the dutyholder’s assurance processes undertake regular reviews of 
  supplier’s quality activities for Technical Queries (TQs), with a specific focus on 
  the aggregation of multiple TQs? 
   Does the dutyholder seek assurance from suppliers that the measures 
  introduced to prevent CSFI from entering supply chain are in place and 
  effective? 
   Report CNS-TAST-GD-4.3 
  TRIM Ref: 2017/106068 
   Page 7 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   8. 
   1. 
   2. 
   3. 
   4. 
   5.  
   6. 
   REFERENCES 
   Security Assessment Principles – Trim Ref. 2017/121036   
   Nuclear Industries Security Regulations 2003.  Statutory Instrument 2003 No. 403 
   Convention on the Physical Protection of Nuclear Material (CPPNM) 
   https://ola.iaea.org/ola/treaties/documents/FullText.pdf 
   IAEA Nuclear Security Series No. 20.  Objective and Essential Elements of a State’s 
  Nuclear Security Regime. http://www-
  pub.iaea.org/MTCD/Publications/PDF/Pub1590_web.pdf 
   IAEA Nuclear Security Series No. 13.  Nuclear Security Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5).  January 2011.  www-pub.iaea.org/MTCD/Publications/PDF/Pub1481_web.pdf 
   HMG Security Policy Framework. Cabinet Office.  
   https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/316182/
  Security_Policy_Framework_-_web_-_April_2014.pdf 
   7. 
   NISR 2003 Classification Policy – Trim Ref. 2012/243357 
   Note: ONR staff should access the above internal ONR references via the How2 Business Management 
  System. 
   Report CNS-TAST-GD-4.3 
  TRIM Ref: 2017/106068 
   Page 8 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   9. 
   GLOSSARY AND ABBREVIATIONS 
   CFSI 
  CPPNM 
  CS&IA 
  FSyP 
  IAEA 
  NISR 
  NSS 
  ONR 
  SCM 
  SNI 
  SPF 
  SQEP 
  SyAPs 
  SyDP 
  TAG 
  TQ 
   Counterfeit, Fraudulent or Suspect Item 
  Convention on the Physical Protection of Nuclear Material 
  Cyber Security and Information Assurance 
  Fundamental Security Principle 
  International Atomic Energy Agency 
  Nuclear Industries Security Regulations 
  Nuclear Security Series 
  Office for Nuclear Regulation 
  Supply Chain Management 
  Sensitive Nuclear Information 
  Security Policy Framework 
  Suitably Qualified and Experienced 
  Security Assessment Principles 
  Security Delivery Principle 
  Technical Assessment Guide 
  Technical Query 
   Report CNS-TAST-GD-4.3 
  TRIM Ref: 2017/106068 
   Page 9 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
  "
  Probabilistic Safety Analysis	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Probabilistic Safety Analysis.pdf	" Title of document 
   ONR GUIDE 
   Probabilistic Safety Analysis     
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   Approved by: 
   NS-TAST-GD-030 Revision 6 
   June 2019 
   R Moscrop 
   Review Date: 
   June 2022 
   Professional Lead Fault Analysis 
   Record Reference: 
  Revision commentary: 
   CM9 2018/408246 
  Fit for purpose review with minor and insignificant changes 
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
   INTRODUCTION ................................................................................................................. 2 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION ......................... 3 
  SAPS ADDRESSED AND RELATIONSHIP WITH WENRA REFERENCE LEVELS AND 
  IAEA STANDARDS ............................................................................................................. 3 
  ADVICE TO INSPECTORS ............................................................................................... 14 
  REFERENCES (GENERAL) .............................................................................................. 23 
  REFERENCES (TECHNICAL ASSESSMENT GUIDES, TAGS) ...................................... 23 
  BIBLIOGRAPHY ................................................................................................................ 24 
  APPENDIX 1 - NS-TAST-GD-030 – ASSESSMENT EXPECTATIONS FOR REVIEW OF 
  PSAS FOR NUCLEAR POWER PLANTS ......................................................................... 24 
  10. APPENDIX 2 – NS-TAST-GD-030 – MAPPING BETWEEN ISSUE O (PROBABILISTIC 
  SAFETY ANALYSIS) OF THE WENRA REFERENCE LEVELS AND THE 
  REQUIREMENTS OF THIS TAG ...................................................................................... 79 
   5. 
  6. 
  7. 
  8. 
  9. 
   © Office for Nuclear Regulation, 2019 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 06/19 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   2. 
   2.1 
   2.2 
   2.3 
   2.4 
   2.5 
   2.6 
   2.7 
   2.8 
   INTRODUCTION 
   ONR has established its Safety Assessment Principles (SAPs) which apply to the 
  assessment by ONR specialist inspectors of safety cases for nuclear facilities that may 
  be operated by potential licensees, existing licensees, or other dutyholders.  The 
  principles presented in the SAPs are supported by a suite of guides to further assist 
  ONR’s inspectors in their technical assessment work in support of making regulatory 
  judgements and decisions.  This technical assessment guide is one of these guides. 
   PURPOSE AND SCOPE 
   The purpose of this technical assessment guide is to provide an interpretation of those 
  Safety Assessment Principles (Ref 6.1) related to PSA and to provide specific 
  guidance to inspectors engaged in the assessment of PSAs and PSA related 
  submissions (from Licensees, Licence Applicants or Generic Design Assessment 
  (GDA) Requesting Parties. All these are referred to as dutyholders in this TAG).  
   The “SAPs addressed” section of this TAG concentrates on interpretation of the SAPs; 
  general guidance on the assessment of PSA is given in the “Advice to inspectors” 
  section. Detailed guidance on the assessment of PSA specific to Nuclear Power Plants 
  (NPPs) is provided in Appendix 1.  
   As with all guidance, inspectors should use their judgement and discretion in the depth 
  and scope to which they apply the guidance provided in this TAG and its Appendix 1.  
   This TAG does not provide detailed information on how to judge the technical 
  adequacy of the various PSA aspects assessed. The reviewers should use their own 
  knowledge and experience for this. However, aid can be sought in the publications 
  listed in Sections 5, 6, 7 and in Appendix 1.  
   It is not the intention of this guide to prescribe specific methods and approaches for 
  conducting PSA. Dutyholders may choose to use alternative methods to those covered 
  by this TAG (and in particular its Appendix 1) as long as they lead to equally valid 
  outcomes. In cases where the PSA or specific areas of it have been undertaken using 
  alternative approaches inspectors should review them on a case-by-case basis and 
  judge them on their own merits. External expert support may be sought if necessary. 
   In addition, it should be noted that PSA covers a whole range of disciplines and, 
  therefore, PSA assessment requires involvement of inspectors with in-depth expertise 
  in a range of areas such as fault studies and thermal-hydraulic analysis, mechanical, 
  electrical and C&I systems, civil engineering, human factors, software reliability, 
  structural integrity, internal and external hazards, severe accident and radiation safety. 
  On the other hand, individual assessments of said areas of the safety case can benefit 
  from, and should take advantage of, the insights the PSA provides on the relative 
  importance of issues addressed in those technical areas. 
   Inspectors must be able to form an opinion on whether risks are ALARP and it is not 
  unreasonable to expect numerical input to the demonstration that the risk is ALARP. 
  NS-TAST-GD-051 (Ref 7.10) provides further guidance on the role of PSA within 
  safety cases and NS-TAST-GD-005 (Ref 7.1) provides further guidance on the role of 
  PSA in the demonstration of ALARP. 
   Although this TAG does not specifically cover PSA for the risk to persons on-site from 
  nuclear accidents, it provides sufficient information to help inspectors assessing the 
  PSA inputs for this particular aspect of the safety case provided by the dutyholders.  
  PSA’s primary focus is usually to assess off-site risks; however PSA may be used to 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 2 of 81 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   3. 
   3.1 
   3.2 
   3.3 
   3.4 
   3.5 
   3.6 
   3.7 
   provide an input to assessment of on-site risk and comparison against Numerical 
  Targets 5 and 6.  
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION  
   The site licence conditions give a legal framework which can be drawn on in 
  assessment and are, in general, set out in the form of requiring the licensee to make 
  adequate arrangements, in the interests of safety, to secure certain objectives. The 
  principal licence conditions (LCs) relevant to PSA are LC14, LC15, LC23, LC24, LC27 
  and LC28. 
   LC14 requires the licensee to make and implement adequate arrangements for the 
  production and assessment of safety cases. Normally, the licensee’s safety case will 
  need to contain PSA as well as deterministic analysis. 
   LC15 sets out the requirements for periodic review and reassessment of safety cases. 
  The periodic reviews carried out under these arrangements include those for updating / 
  extending the PSA (or producing one, if none previously existing, and comparison with 
  relevant good practice) and using it to support the arguments for continuing operation 
  during the period until the next review. 
   LC23 requires that the safety case identifies the conditions and limits necessary in the 
  interest of safety and it is ONR’s expectation that both the probabilistic (PSA) and the 
  deterministic aspects of the safety case will contribute to this process. Similarly, ONR 
  expects that PSA will contribute to the identification of suitable and sufficient safety 
  mechanisms, devices and circuits, as required by LC27 and provide a significant input 
  for LC28 in identifying plant that may affect safety for which regular, systematic 
  examination, inspection, maintenance and testing will be required.  
   LC24 requires the licensee to ensure that all operating instructions which may affect 
  safety are written down and include all operating instructions that are necessary in the 
  interests of safety.  Thus, ONR expects the PSA to be well documented, wide in scope 
  and of high fidelity. 
   In addition to these principal licence conditions, LC6 requires that adequate records be 
  made and maintained. In this regard, it is ONR’s expectation that licensees will 
  establish Living PSA programmes and that, in the framework of these programmes, all 
  relevant files and records will be maintained for the life of the facility.  Also, LC 17 sets 
  out the requirement for quality assurance (QA) arrangements for all matters that affect 
  safety. In this respect Licensees are expected to establish an adequate QA process 
  that is effectively applied during all phases of the PSA and its application.   
   Safety cases, including PSA, may be produced to support activities such as 
  construction of new facilities, commissioning, modifications and decommissioning. 
  These activities, covered by licence conditions 19, 20, 21, 22 and 35, require safety 
  documentation. 
   4. 
   SAPS ADDRESSED AND RELATIONSHIP WITH WENRA REFERENCE LEVELS 
  AND IAEA STANDARDS 
   4.1 
   Introduction 
   This 
  guide 
  interprets 
  ONR’s 
  use 
  of 
  the 
  PSA 
  related 
  safety 
  assessment 
  principles 
  as 
  set out 
  in ONR’s SAPs 
  (Ref 6.1) FA.1, and FA.10 
  to FA.14. This guide also addresses 
  those 
  aspects 
  of 
  the 
  principles 
  on 
  ‘assurance 
  of 
  validity', 
  AV.1 
  to 
  AV.8, 
  that 
  are 
  specifically 
  applicable 
  to 
  PSA. 
  Numerical 
  targets 
  related 
  to 
  PSA 
  are 
  explained 
  more 
  fully in annex 2 of the SAPs, and predominantly relate to Targets 7, 8 and 9. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 3 of 81 
    
    
    
    
    
   Office for Nuclear Regulation  
   4.2 
   Fault analysis: general – Design basis analysis, PSA and severe accident analysis – 
  FA.1 
   “Fault 
  analysis 
  basis 
  analysis, 
  ALARP”  
   should 
  be 
  carried 
  out 
  comprising 
  suitable 
  and 
  sufficient 
  design 
  PSA 
  and 
  severe 
  accident 
  analysis 
  to 
  demonstrate 
  that 
  risks 
  are 
   This 
  principle 
  outlines 
  the 
  inter-relationship 
  between 
  the 
  three 
  types 
  of 
  fault 
  analysis, 
  DBA, 
  PSA 
  and 
  SAA 
  and 
  how 
  in 
  combination 
  they 
  address 
  the 
  range 
  of 
  potential 
  initiating 
  events 
  (IEs) 
  with 
  nuclear 
  safety 
  significance 
  off 
  the 
  site. 
  As 
  with 
  DBA 
  and 
  SAA, the scope of PSA should be suitable and sufficient and used along with the other 
  two 
  fault 
  analysis 
  approaches 
  to 
  help 
  demonstrate 
  that 
  risks 
  are 
  ALARP 
  and 
  to 
  address SAPs Numerical Targets 7, 8 and 9. 
   4.3 
   Fault analysis: PSA – Need for a PSA – FA.10 
   “Suitable 
  and 
  sufficient 
  PSA 
  should 
  be 
  and design development and analysis” 
   performed 
   as 
   part 
   of 
   the 
   fault 
   analysis 
   above 
   of 
   the 
   the 
   overall 
   risk 
   facility 
   against 
   This 
  principle 
  sets 
  the 
  framework 
  and 
  requirements 
  for 
  a 
  PSA 
  study. 
  The 
  overriding 
  aim 
  of 
  the 
  PSA 
  assessment 
  is 
  to 
  assist 
  ONR 
  judgements 
  on 
  the 
  safety 
  of 
  the 
  facility 
  and 
  whether 
  the 
  risks 
  of 
  its 
  operation 
  are 
  being 
  made 
  as 
  low 
  as 
  reasonably 
  practicable.  
  This 
  TAG 
  provides 
  guidance 
  which 
  will 
  enable 
  inspectors 
  to 
  judge 
  that 
  the 
  expectation for a suitable and sufficient PSA has been met by the dutyholders.  
  A PSA should be suitable and sufficient to inform: 
  1) 
  A 
  judgement 
  as 
  to 
  the 
  acceptability 
  of 
  the numerical targets of the SAPs. 
  2) 
  A 
  judgement 
  that 
  a 
  balanced 
  design 
  has 
  been 
  achieved, 
  such 
  that 
  no 
  particular 
  class 
  of 
  accident 
  or 
  feature 
  of 
  the 
  facility 
  makes 
  a 
  disproportionate 
  (e.g., 
  of 
  the 
  order 
  of 
  one 
  tenth 
  or 
  greater) 
  contribution 
  to 
  the 
  risk 
  target 
  of 
  concern. However, where 
  risk 
  is 
  low (for example below 
  the BSO), 
  it 
  is unlikely 
  that 
  further 
  engineering measures 
  would 
  be 
  reasonably 
  practicable 
  to 
  address 
  any disproportion. 
  3) 
  That 
  the 
  risks 
  associated 
  with 
  the 
  design 
  and 
  operation 
  of 
  the 
  well 
  as 
  changes 
  in 
  risk 
  associated 
  with 
  any 
  modification 
  to 
  plant 
  or 
  are and will remain ALARP. 
  The depth 
  of 
  the PSA 
  for 
  a given 
  facility may 
  vary 
  depending on 
  the magnitude 
  of 
  the 
  radiological 
  hazard 
  and 
  risks 
  and 
  the 
  complexity 
  of 
  the 
  facility. 
  For 
  complex 
  facilities 
  such 
  as 
  nuclear 
  reactors 
  or 
  reprocessing 
  facilities, 
  comprehensive 
  PSAs 
  that 
  meet 
  modern standards should be developed for all types of IEs and all operational modes. 
  It is relevant to stress that ONR expects ALARP to be integral to all considerations of a 
  facility 
  and 
  site 
  whether 
  new 
  or 
  existing, 
  i.e. 
  it 
  is 
  not 
  a 
  process 
  to 
  be 
  carried 
  out 
  only 
  after a design is completed.  
  Fault analysis: PSA – Validity – FA.11 
   facility, 
  as 
  operation, 
   4.4 
   “PSA should reflect the current design and operation of the facility or site” 
   This principle establishes 
  the need 
  for each aspect of 
  the PSA 
  to be directly 
  related 
  to 
  existing 
  facility 
  information, 
  facility 
  documentation 
  or 
  the 
  analysts’ 
  assumptions 
  in 
  the 
  absence 
  of 
  such 
  information. 
  The 
  PSA 
  should 
  be 
  documented 
  in 
  such 
  a 
  way 
  as 
  to 
  allow this principle to be met. 
  In 
  addition, 
  in 
  order 
  to meet 
  this 
  principle, 
  the 
  PSA 
  should 
  be 
  updated 
  as 
  necessary 
  to 
  reflect 
  the 
  current 
  design 
  and 
   be 
  kept 
  living, 
  i.e. 
  it 
  should 
  operational 
  features 
  and 
  to 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 4 of 81 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   4.5 
   4.6 
   incorporate 
  feedback 
  from 
  understanding 
  of 
  physical 
  modelling techniques. 
  Fault analysis: PSA – Scope and extent – FA.12 
   internal 
  and 
  external 
  operational 
  experience, 
  improved 
  processes 
  or 
  accident 
  progression 
  and 
  advances 
  in 
   “PSA 
  should 
  cover 
  all 
  significant 
  sources 
  of 
  operating states and all relevant initiating faults” 
   radioactivity, 
   all 
   permitted 
   In order to meet this principle the scope of the PSA should cover all significant sources 
  of 
  radioactivity 
  at 
  the 
  facility 
  (e.g., 
  fuel 
  ponds, 
  fuel 
  handling 
  facilities, 
  waste 
  storage 
  tanks, 
  radioactive 
  sources, 
  reactor 
  cores, 
  etc), 
  all 
  types 
  of 
  IEs 
  (e.g., 
  internal 
  faults, 
  internal 
  hazards, 
  external 
  hazards) 
  and 
  all 
  operational 
  modes 
  (e.g., 
  nominal 
  full 
  power/throughput, 
  low 
  power/throughput, 
  shutdown, 
  start-up, 
  refuelling, 
  maintenance 
  outages). 
  Where 
  the 
  offsite 
  consequences 
  are 
  potentially 
  significant, 
  such 
  as 
  for 
  an 
  operating power 
  reactor, 
  the PSA 
  should 
  be at 
  least 
  to 
  level 2 
  and 
  include all external 
  events 
  (including 
  beyond 
  design 
  basis 
  events 
  that 
  could 
  realistically 
  lead 
  to 
  a 
  significant offsite release (see also SAPs para 618).  
  Fault analysis: PSA – Adequate representation – FA.13 
   “The PSA model should provide an adequate representation of the facility and/or 
  site” 
   PSA. 
  Inspectors 
  thus 
  provides 
  a 
   1)  General 
  The 
  aim 
  of 
  this 
  principle 
  is 
  to 
  ensure 
  the 
  technical 
  adequacy 
  of 
  the 
  should 
  be 
  satisfied 
  that 
  the 
  PSA 
  has 
  a 
  robust 
  technical 
  basis 
  and 
  credible picture of the contributors to the risk from the facility.  
  Starting 
  from 
  the 
  list 
  of 
  IEs 
  from 
  SAP 
  FA.2 
  (Identification 
  of 
  Initiating 
  Faults), 
  the 
  PSA 
  should 
  identify 
  systematically 
  and 
  comprehensively 
  the 
  complete 
  range 
  of 
  sequences 
  leading 
  to 
  the 
  “undesired” 
  consequences 
  that may 
  occur. 
  This makes 
  no 
  distinction 
  in 
  regard to the frequency at which each sequence is estimated to arise, rather it seeks to 
  ensure that all conceivable routes to a release are systematically identified.  
  In order to address the relevant numerical targets of the SAPs, the PSA needs to have 
  regard 
  to 
  accidents 
  with 
  severe 
  consequences 
  and 
  to 
  those 
  that 
  have 
  a 
  higher 
  frequency but lower radiological consequence.   
  Where 
  there 
  are 
  multiple 
  units 
  or 
  facilities 
  on 
  a 
  site, 
  the 
  PSA 
  should 
  consider 
  significant 
  sources 
  of 
  radioactivity, 
  including 
  any 
  dependencies 
  or 
  potential 
  propagation of IEs or other effects between different units or facilities.  
  2)  PSA Models 
  PSA 
  should 
  account 
  for 
  all 
  contributions 
  to 
  the 
  risk, 
  including, 
  but 
  not 
  necessarily 
  restricted 
  to: 
  random 
  component 
  individual 
  failures, 
  components 
  which 
  are 
  failed 
  by 
  the 
  IE, 
  common 
  cause 
  failures 
  (CCFs) 
  (and, 
  as 
  necessary, 
  other 
  dependent 
  and 
  consequential 
  failures), 
  unavailabilities 
  due 
  to 
  testing 
  and 
  maintenance, 
  pre-initiating 
  event  human errors (e.g., misalignments and mis-calibrations), human errors that lead 
  to 
  IEs 
  and 
  human 
  errors 
  during 
  the 
  course 
  of 
  the 
  accident 
  sequences 
  (including 
  misdiagnosis, 
  decision 
  errors, 
  omission 
  errors 
  and 
  commission 
  errors). 
  The 
  potential 
  dependencies 
  between 
  separate 
  human 
  activities 
  (either 
  by 
  the 
  same 
  or 
  by 
  different 
  operators) should be analysed and reflected in the models and probabilities used.   
  The level of detail of PSA should be sufficient to ensure that it 
  is realistic, that the logic 
  is 
  correct, 
  that 
  the dependencies are 
  captured, 
  and 
  that 
  the 
  data used 
  is applicable 
  to 
  the 
  boundary 
  selected 
  for 
  each 
  (basic) 
  event 
  in 
  the 
  PSA. 
  Model 
  simplifications 
  (e.g., 
  modelling 
  of 
  bounding 
  sequences, 
  use 
  of 
  super-components) 
  and 
  their 
  justification 
  should 
  be 
  clearly 
  described; 
  particular 
  attention 
  should 
  be 
  paid 
  to 
  ensuring 
  that 
  dependencies are not missed due 
  to 
  such simplifications. As noted 
  in SAPs para 652, 
   all 
  for 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 5 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   and 
   until 
   a 
   safe 
   stable 
   state 
   is 
   justify 
   the 
   reached 
   the 
  PSA 
  should 
  model 
  events 
  mission time accordingly. 
  The 
  frequency 
  of 
  occurrence 
  and 
  consequences 
  of 
  each 
  of 
  the 
  fault 
  sequences 
  identified 
  should 
  be 
  estimated. 
  Sequences 
  should 
  not 
  be 
  discounted 
  solely 
  on 
  the 
  basis 
  that 
  their 
  individual 
  frequency 
  is 
  low, 
  since 
  the 
  total 
  contribution 
  from 
  all 
  low 
  frequency 
  sequences 
  may 
  be 
  significant 
  in 
  respect 
  to 
  the 
  numerical 
  targets 
  of 
  the 
  SAPs. 
  Where 
  groups 
  are 
  used 
  to 
  represent 
  several 
  IEs 
  or 
  accident 
  sequences, 
  the 
  group 
  should be assigned a 
  frequency equal 
  to 
  the summed 
  frequency of all 
  the contributors 
  in 
  the 
  group 
  and 
  should 
  be 
  represented 
  by 
  the most 
  onerous 
  one 
  (i.e. 
  the 
  IE which 
  is 
  bounding 
  in 
  terms 
  of 
  impacts 
  or 
  the 
  sequence 
  which 
  is 
  bounding 
  in 
  terms 
  of 
  consequences). 
  Thus, 
  such 
  simplifications 
  are 
  always 
  conservative. Care 
  needs 
  to 
  be 
  taken to avoid gross conservatism, since it could affect the conclusions drawn from the 
  analysis, 
  and 
  could 
  severely 
  limit 
  the 
  usefulness 
  of 
  the 
  PSA 
  to 
  support 
  decision-
  making.  
  Best-estimate 
  methods 
  and 
  data 
  should 
  be 
  used 
  for 
  the 
  transient 
  analyses, 
  accident 
  progression 
  analyses, 
  source 
  term 
  analyses, 
  radiological 
  analysis 
  and 
  any 
  other 
  deterministic 
  analyses 
  that 
  support 
  the 
  PSA. 
  Where 
  no 
  credible 
  best 
  estimate 
  is 
  possible, 
  reasonably 
  conservative 
  assumptions 
  should 
  be 
  made 
  and 
  the 
  sensitivity 
  of 
  the 
  risk 
  to 
  these 
  assumptions 
  should 
  be 
  established. 
  The 
  term 
  “best-estimate” 
  is 
  defined in the SAPs Glossary (Ref 6.1). 
  SAP 
  EDF.14 
  addresses 
  deterministic 
  consideration 
  of 
  CCFs 
  and 
  discusses 
  the 
  deterministic 
  expectation 
  for 
  modelling 
  of 
  CCFs. 
  Probabilistic 
  modelling 
  of 
  CCFs 
  is 
  expected 
  to 
  be 
  on 
  a 
  best-estimate 
  basis 
  and 
  any 
  claims 
  on 
  CCF 
  in 
  a 
  PSA 
  model 
  should 
  be 
  credible 
  and 
  adequately 
  justified, 
  however 
  additional 
  regulatory 
  scrutiny 
  should 
  be 
  applied 
  for 
  CCFs 
  below 
  1E-5. 
  PSA 
  studies 
  should 
  identify 
  the 
  relative 
  contribution 
  to 
  risk 
  from 
  the 
  features 
  of 
  the 
  facility 
  and 
  allow 
  a 
  judgement 
  on 
  the 
  balance 
  of 
  the 
  design. 
  This 
  is 
  ideally 
  achieved 
  if 
  each 
  component 
  of 
  the 
  study 
  is 
  treated 
  in 
  a 
  best 
  estimate 
  manner. 
  If 
  one 
  element 
  of 
  the 
  study 
  contains 
  a 
  large 
  measure 
  of 
  conservatism 
  and 
  dominates 
  the 
  resulting 
  risk 
  calculation, 
  evaluating 
  the 
  benefit 
  from 
  improving 
  the 
  reliability of 
  that element, or 
  indeed other elements, 
  is more 
  difficult. 
  Therefore, 
  while 
  the 
  use 
  of 
  conservative 
  design 
  basis 
  analysis 
  within 
  the 
  PSA 
  can 
  be 
  justified 
  to 
  show 
  either 
  that 
  the 
  risks 
  are 
  low, 
  or 
  to 
  act 
  as 
  a 
  screening 
  mechanism 
  for 
  future 
  best 
  estimate 
  analysis, 
  risk-informed 
  decision 
  making 
  could 
  be 
  severely 
  compromised by the use of this type of analysis.  
  3)  PSA Data 
  Facility 
  specific 
  data 
  should 
  be 
  used, 
  to 
  the 
  frequencies and probabilities used in PSA.  
  Where 
  facility 
  specific 
  data 
  is 
  not 
  available, 
  use 
  of 
  generic 
  data 
  may 
  be 
  acceptable 
  providing 
  it 
  is 
  shown 
  to 
  be 
  appropriate 
  to 
  the 
  design 
  and 
  operating 
  conditions 
  of 
  the 
  facility 
  and 
  it 
  relates 
  to 
  a 
  relevant 
  and 
  sufficiently 
  large 
  population. 
  The 
  source 
  of 
  the 
  data, the sample size and the uncertainty in the data should be specified. If changes to 
  the 
  source 
  data 
  are 
  made 
  to 
  take 
  account 
  of 
  differences 
  between 
  the 
  available 
  data 
  and the plant conditions, these should be justified. 
  Where 
  facility 
  specific 
  data 
  is 
  not 
  sufficient 
  it 
  should 
  be 
  combined 
  with 
  applicable 
  generic 
  data 
  using 
  a 
  justified 
  mathematical 
  technique, 
  such 
  as 
  Bayesian 
  update 
  of 
  generic data with facility-specific data (as described, for example, in Refs 6.2 and 6.3). 
  Where no 
  relevant statistical data are available, 
  judgements should be made and 
  their 
  bases 
  stated. 
  Particular 
  attention 
  should 
  be 
  paid 
  to 
  determining 
  the 
  sensitivity 
  of 
  the 
  results of 
  the PSA 
  to 
  such 
  judgements. Ad-hoc 
  judgements 
  not 
  following a 
  robust and 
  systematic process should generally attract inspector’s scrutiny.     
   calculation 
   possible, 
   for 
   extent 
   the 
   of 
   the 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 6 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   in 
  the 
   the 
  key 
   PSA, 
  the 
  influencing 
   used 
  for 
  should 
  be 
   the 
  calculations 
  of 
  probabilities 
  justified 
  and 
  should 
  account 
  for 
  all 
   When 
  models 
  are 
  methodologies 
  used 
  factors. In particular: 
  i. 
   Probability data 
  for personnel errors should 
  take account of 
  the specific 
  task 
  demands, psychological 
  influences 
  (e.g. stress), degree of supervision, 
  level of 
  training, 
  working 
  practices, 
  time 
  available, 
  physical 
  environment, 
  etc, 
  and 
  the 
  potential 
  dependencies 
  between 
  separate 
  activities 
  (either 
  by 
  the 
  same 
  or 
  by 
  different 
  operators). 
  Any 
  equipment 
  or 
  procedural 
  requirements 
  to 
  promote 
  reliable 
  human 
  performance 
  should 
  be 
  identified. 
  The 
  best 
  estimate 
  approach 
  to 
  risk 
  analysis 
  requires 
  that 
  the 
  beneficial 
  and 
  potentially 
  detrimental 
  performance of 
  personnel be 
  represented within 
  the PSA. 
  The 
  factors 
  that 
  can 
  influence 
  the 
  ability 
  of 
  personnel 
  to 
  carry 
  out 
  activities 
  need 
  to 
  be 
  carefully 
  considered 
  before 
  any 
  quantification 
  can 
  take 
  place. 
  NS-TAST-GD-063 
  (Ref 
  7.3) 
  discusses 
  the 
  subject 
  of 
  Task 
  Analysis 
  which 
  is 
  judged 
  a 
  necessary 
  precursor to any quantification. 
  ii. The approach 
  selected 
  for 
  the Common Cause Failure 
  (CCF) modelling and 
  for 
  CCF 
  parameter 
  estimation 
  should 
  be 
  justified 
  and 
  should 
  be 
  adequate 
  to 
  represent 
  any 
  level 
  of 
  redundancy 
  present 
  in 
  the 
  specific 
  design 
  of 
  the 
  facility. 
  The 
  consideration 
  of 
  coupling 
  mechanisms 
  and 
  facility 
  specific 
  defences 
  against 
  CCF 
  should 
  be 
  traceable. 
  The 
  applicability 
  of 
  the 
  CCF 
  data 
  sources 
  used should be demonstrated. 
  iii. 
  The 
  methodology 
  used 
  for 
  the 
  calculation 
  of 
  probabilities 
  of 
  structural 
  failures should be justified and the details of the analysis should be transparent. 
  If 
  use 
  is 
  made 
  of 
  data 
  from 
  available 
  structural 
  (e.g. 
  pipework) 
  failure 
  databases, 
  the 
  sources 
  of 
  data 
  and 
  the 
  way 
  in 
  which 
  the 
  data 
  has 
  been 
  used 
  should 
  be 
  clear 
  and 
  the 
  applicability 
  of 
  the 
  data 
  should 
  be 
  justified. 
  If 
  use 
  is 
  made 
  of 
  probabilistic 
  fracture 
  mechanics 
  codes, 
  the 
  codes 
  should 
  be 
  state 
  of 
  the 
  art 
  and 
  should 
  have 
  been 
  validated 
  against 
  operational 
  experience 
  and/or 
  experiments. 
  The 
  range 
  of 
  loads 
  and 
  combinations 
  of 
  loads 
  that 
  could 
  lead 
  to 
  the 
  structural 
  failures 
  of 
  concern 
  should 
  be 
  adequate 
  to 
  represent 
  the 
  conditions which are possible for the facility under evaluation.   
  iv. 
  Any 
  methodologies 
  used 
  by 
  licensees 
  to 
  estimate 
  computer 
  or 
  software-
  based 
  system 
  reliability 
  for 
  use 
  in 
  PSA 
  are 
  expected 
  to 
  use 
  best-estimate 
  methods 
  and 
  to 
  consider 
  uncertainty 
  and 
  sensitivity. 
  These 
  methodologies 
  should meet 
  industry accepted practices and consider 
  the contributions of both 
  hardware 
  and 
  software 
  failures. 
  Estimation 
  of 
  software 
  reliability 
  should 
  take 
  into 
  account 
  influencing 
  factors 
  (primarily 
  systematic) 
  that 
  affect 
  the 
  quality 
  of 
  the 
  software 
  and 
  are 
  informed 
  by 
  the 
  specification 
  and 
  design 
  of 
  the 
  system 
  (e.g. 
  considering 
  the 
  reliability 
  targets 
  for 
  system 
  design 
  based 
  on 
  safety 
  integrity 
  levels 
  in 
  IEC 
  61508 
  or 
  equivalent). 
  Any 
  dependencies 
  introduced 
  by 
  the systematic nature of software failure(s) should be accounted for accordingly 
  in 
  the 
  PSA. 
  If 
  software 
  elements 
  of 
  a 
  computer 
  based 
  system 
  (e.g. 
  operating 
  systems, 
  application 
  software 
  supporting 
  different 
  functions) 
  have 
  been 
  individually modelled 
  in 
  the 
  PSA, 
  the 
  dependencies 
  between 
  the 
  various 
  parts 
  should be addressed explicitly. Any self-checking or diagnostic functions built in 
  the 
  computer 
  based 
  system 
  should 
  be 
  taken 
  into 
  account 
  in 
  an 
  adequate 
  manner 
  (e.g. 
  considering 
  the 
  dependencies 
  between 
  these 
  functions 
  and 
  the 
  primary 
  safety 
  functions 
  delivered 
  by 
  the 
  system). 
  The 
  dependencies 
  between 
  two 
  (or 
  more) 
  computer 
  based 
  systems 
  should 
  be 
  dealt 
  with 
  explicitly. 
  NS-
  TAST-GD-046 (Ref 7.8) and IAEA report NP-T-3.27 (Ref 8.4) provide additional 
  guidance on the assessment of reliability for a computer based system. 
  v. 
  Assumptions 
  on 
  reliability 
  of 
  passive 
  features 
  or 
  passive 
  systems 
  should 
  be 
  substantiated by suitable analysis covering 
  the full range of accident conditions 
  for which they are required and by extensive tests.  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 7 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   vi. 
  Analyses 
  to 
  estimate 
  the 
  probability 
  of 
  occurrence 
  of 
  phenomena 
  (for 
  example 
  in 
  the 
  severe 
  accident 
  portion 
  of 
  the 
  PSA) 
  should 
  be 
  performed 
  in 
  a 
  systematic 
  and 
  transparent 
  manner 
  taking 
  account 
  of 
  up-to-date 
  information 
  from an appropriate range of sources about the phenomena.  
  4)  PSA Results 
  The 
  results 
  of 
  the 
  PSA 
  should 
  be 
  comprehensively 
  documented 
  and 
  properly 
  interpreted. 
  The 
  numerical 
  results 
  of 
  the 
  PSA 
  should 
  always 
  be 
  presented 
  together 
  with 
  list/s 
  of 
  minimal 
  cutsets 
  and 
  the 
  list 
  of 
  basic 
  events 
  and 
  associated 
  importance 
  measures 
  (as 
  a 
  minimum 
  Fractional 
  Contributions 
  or 
  Fussell 
  Vesely 
  Importance 
  and 
  Risk 
  Increase 
  factors 
  or 
  Risk 
  Achievement 
  Worth). 
  It 
  should 
  be 
  noted 
  that 
  the 
  importance 
  measures, 
  in 
  themselves, 
  represent 
  sensitivities 
  of 
  the 
  results 
  of 
  the 
  PSA 
  to the 
  inputs and, therefore, 
  the dutyholders should provide 
  justification of whether any 
  high 
  values 
  shown 
  are 
  acceptable 
  and 
  nothing 
  reasonable 
  can 
  be 
  done 
  to 
  reduce 
  unduly high risk contributions.  
  In 
  all 
  aspects 
  of 
  the 
  analysis 
  where 
  assumptions 
  have 
  been made 
  including 
  those 
  on 
  how 
  the 
  plant 
  and 
  the 
  operating 
  staff 
  behave, 
  these 
  and 
  their 
  justification 
  should 
  be 
  clearly 
  described. 
  The 
  sensitivity 
  of 
  the 
  results 
  of 
  the 
  PSA 
  to 
  changes 
  in 
  assumptions 
  should be evaluated and clearly documented.  
  Uncertainty 
  on 
  input 
  probability 
  and 
  frequency 
  values 
  should 
  be 
  estimated 
  and 
  propagated 
  through 
  the 
  models 
  to 
  generate 
  uncertainty 
  distributions 
  on 
  the 
  resulting 
  frequencies 
  or 
  probabilities 
  of 
  undesired 
  events. 
  The 
  means 
  of 
  these 
  distributions 
  should be compared against the numerical targets in the SAPs.  
  Based 
  on 
  the 
  importance, 
  sensitivity 
  and 
  uncertainty 
  evaluations, 
  the 
  dutyholder 
  should 
  gain 
  an 
  understanding 
  of 
  which 
  parametric 
  and 
  modelling 
  uncertainties 
  contribute 
  most 
  to 
  the 
  overall 
  uncertainty 
  in 
  the 
  probabilities 
  or 
  frequencies 
  of 
  undesired events and should, subject 
  to reasonable practicability, 
  take steps to reduce 
  such uncertainties.  
  Ultimately, 
  the 
  results 
  of 
  the 
  uncertainty 
  and 
  sensitivity 
  evaluations 
  should 
  confidence that the overall conclusions obtained from the PSA are still valid. 
  Fault analysis: PSA – Use of PSA – FA.14 
   provide 
   “PSA 
  should 
  be 
  used 
  to 
  inform 
  the 
  design 
  operation of the site and its facilities” 
   process 
   and 
   help 
   ensure 
   the 
   safe 
   4.7 
   the dutyholders 
  the 
  supporting 
   the expectations on what uses 
  decision-making 
  and 
  on 
  how 
   The aim of 
  this principle 
  is 
  to establish 
  should 
  make 
  of 
  the 
  PSA 
  to 
  support 
  analyses should be undertaken. 
  1)  Uses of PSA  
  The 
  PSA 
  should 
  provide 
  information 
  for, 
  and 
  receive 
  information 
  from, 
  the 
  facility 
  designers 
  and 
  operators 
  so 
  that 
  consistency 
  is 
  achieved 
  between 
  the 
  PSA 
  and 
  the 
  design 
  and 
  operation 
  of 
  the 
  facility. 
  Following 
  such 
  an 
  approach 
  allows 
  the PSA 
  to 
  be 
  a powerful tool to aid decision making. Inspectors should expect the PSA to provide an 
  input to the following: 
  i. 
  Initial 
  design, 
  design 
  development 
  and 
  design 
  modifications 
  and 
  back-fits 
  during 
  the 
  life 
  of 
  the 
  facility. 
  ONR 
  expects 
  the 
  PSA 
  to 
  be 
  integrated 
  into 
  the 
  design 
  process 
  in 
  an 
  iterative 
  manner, 
  i.e. 
  the 
  PSA 
  should 
  be 
  used 
  in 
  all 
  the 
  stages of the design. 
  ii. 
  Support 
  to 
  the 
  safety 
  classification 
  of 
  structures, 
  systems 
  and 
  components 
  (SSCs). ONR 
  expects 
  PSA 
  to 
  inform 
  the 
  safety 
  classification 
  of 
  SSCs 
  through 
  consideration 
  of 
  for 
  example 
  system 
  reliabilities 
  and 
  PSA 
  importance 
  measures.  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 8 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   daily 
   (systems, 
   of 
   of 
   all 
   provide 
   valuable 
   information 
   to 
   a 
   demonstration 
   of 
   the 
   management 
   for management 
   the 
  facility 
  significant 
   iii. Development of, and changes to, operating limits and conditions and testing, 
  inspection and maintenance schedules of the facility. 
  iv. 
  Testing, 
  inspection 
  and 
  maintenance 
  planning 
  and 
  plant configuration.  
  v. Periodic system reviews and overall periodic safety review of the facility.  
  vi. Justification for any change to the way in which the facility is operated.  
  vii. 
  Development 
  of, 
  and 
  changes 
  to, 
  operating 
  procedures 
  for 
  managing 
  stages of incidents and accidents, including severe accidents. 
  viii. Design 
  of, and 
  changes 
  to, operator-training programmes 
  of incidents and accidents, including severe accidents. 
  ix. Off-site 
  emergency 
  planning 
  and 
  response 
  including 
  effectiveness of countermeasures. 
  x. Evaluation of 
  the 
  risk significance of 
  the abnormal occurrences at 
  and 
  identification 
  of 
  measures 
  to 
  avoid 
  future 
  recurrences 
  of 
  safety 
  events. 
  In 
  addition 
  to 
  the 
  above, 
  PSA 
  can 
  and 
  should 
  ONR inspectors in the following (see Ref 6.6): 
  a. 
  Understanding 
  the 
  safety 
  significance 
  of 
  the 
  issues 
  under 
  consideration 
  by 
  the Office 
  for Nuclear Regulation, 
  e.g. modifications 
  being 
  assessed 
  or 
  events 
  under investigation.  
  b. 
  Focusing 
  inspection 
  activities 
  on 
  those 
  areas 
  features, etc.) with the highest safety significance. 
  c. Understanding the safety significance of inspection findings.  
  d. 
  Assisting 
  in 
  forming 
  a 
  judgement 
  towards 
  the 
  adequacy 
  demonstration of meeting SAP Numerical Targets 5 and 6. 
  2)  Technical adequacy of PSA applications  
  For 
  the 
  PSA 
  to 
  be 
  an 
  effective 
  tool 
  to 
  support 
  decision 
  making, 
  not 
  only 
  should 
  the 
  quality of 
  the PSA be adequate 
  (in 
  line with SAP FA.13) but also 
  the way 
  in which 
  the 
  PSA 
  is 
  used 
  should 
  be 
  appropriate, 
  i.e. 
  PSA 
  studies 
  performed 
  to 
  support 
  any 
  safety 
  submission, 
  including 
  the 
  justification 
  of 
  any modification 
  to 
  plant 
  or 
  operation, 
  should 
  be comprehensive, technically sound and properly documented. In this regard: 
  i. 
  Any 
  issue 
  that 
  is 
  going 
  to 
  be 
  evaluated 
  using 
  PSA 
  (e.g. 
  a 
  facility 
  design 
  or 
  operational feature, a proposed change to the design, or an event at the facility) 
  should be explicitly defined together with the type of results required as input to 
  the decision-making, including any numerical criteria that need to be met.  
  ii. All aspects of the PSA model and data potentially affected by the issue under 
  study should be identified, evaluated for impact and modified if necessary. 
  iii. 
  All 
  the 
  assumptions 
  should 
  be 
  checked 
  for 
  validity 
  against 
  the 
  issue 
  under 
  study and modified if appropriate. 
  iv. 
  Sensitivity 
  analyses 
  should 
  be 
  carried 
  out 
  to 
  estimate 
  the 
  sensitivity 
  of 
  the 
  risk 
  to 
  changes 
  in 
  relevant 
  assumptions 
  and 
  areas 
  of modelling 
  uncertainty, 
  to 
  check 
  the 
  risk 
  impact 
  of 
  different 
  options 
  under 
  consideration 
  and 
  to 
  carry 
  out 
  ‘what 
  if’ 
  analyses 
  if 
  appropriate. 
  The 
  results 
  of 
  the 
  sensitivity 
  analyses 
  should 
  be used to inform the decision-making process.   
  v. Uncertainty analyses should be carried out  
  vi. 
  Based 
  on 
  the 
  results 
  of 
  the 
  sensitivity 
  and 
  dutyholder 
  should 
  show 
  that 
  the 
  most 
  important 
   uncertainty 
  analyses, 
  the 
  modelling 
  and 
  parametric 
   components, 
   licensees’ 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 9 of 81 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   uncertainties have been minimised, or that the results of the application are not 
  affected by 
  these uncertainties, or 
  that 
  the decision based on 
  the 
  results of 
  the 
  application 
  takes 
  account 
  of 
  the 
  uncertainties 
  by 
  adopting 
  the 
  precautionary 
  principle 
  (as 
  described 
  in 
  paragraphs 
  89 
  and 
  the 
  following 
  ones 
  of 
  R2P2, 
  Ref 
  6.5). 
  vii. 
  The 
  issue 
  under 
  study 
  could 
  potentially 
  affect 
  aspects 
  of 
  the 
  risk 
  not 
  covered 
  within 
  the 
  scope 
  of 
  the 
  existing 
  PSA. 
  These 
  limitations 
  in 
  the 
  PSA 
  in 
  relation 
  to 
  the 
  issue 
  under 
  evaluation 
  should 
  be 
  recognised 
  and 
  identified 
  explicitly. 
  In 
  order 
  to 
  perform 
  a 
  comprehensive 
  risk 
  analysis 
  the 
  PSA 
  models 
  should be extended and/or enhanced to cover the missing aspects. If this is not 
  practicable 
  (e.g. 
  due 
  to 
  time 
  constraints), 
  the 
  risk 
  impact 
  of 
  the 
  issue 
  associated 
  with 
  areas 
  outside 
  the 
  scope 
  of 
  the 
  existing 
  PSA 
  should 
  be 
  analysed qualitatively.   
  viii. 
  The 
  outcome 
  of 
  the 
  PSA 
  studies 
  clear, 
  comprehensive 
  and 
  traceable 
  based 
  on 
  a 
  systematic 
  application 
  of 
  results of the PSA evaluations.  
  Fault analysis: assurance of validity of data and models – Theoretical models – AV.1 
   performed 
  to 
  evaluate 
  issues 
  should 
  be 
  and 
  should 
  provide 
  recommendations 
  decision-making 
  criteria 
  applied 
  to 
  the 
   “Theoretical models should adequately represent the facility and site” 
   Theoretical 
  models 
  are 
  used 
  throughout 
  the 
  PSA, 
  e.g., 
  reliability 
  models 
  (including 
  CCF 
  and 
  human 
  reliability models), models 
  for 
  the 
  evaluation 
  of 
  the 
  thermal-hydraulic 
  or 
  chemical 
  behaviour, 
  the 
  progression 
  of 
  the 
  accident 
  and 
  the 
  transport 
  of 
  fission 
  products, 
  models 
  for 
  the 
  analysis 
  of 
  structural 
  integrity 
  of 
  containment 
  and 
  any 
  other 
  structures, 
  models 
  for 
  the 
  evaluation 
  of 
  the 
  impact 
  of 
  the 
  various 
  isotopes 
  on 
  human 
  health, etc.  
  SAP 
  AV.1 
  is 
  strongly 
  linked 
  to 
  AV.2 
  discussed 
  below 
  and 
  together 
  aim 
  to 
  ensure 
  that 
  all 
  the 
  calculations 
  that underlay 
  the PSA are adequate 
  to 
  represent 
  the 
  facility. 
  In 
  this 
  respect, these SAPs reinforce specific PSA SAPs FA.11 and FA.13 above.  
  Fault analysis: assurance of validity of data and models – Calculation methods – AV.2 
   “Calculation 
  methods 
  used 
  for 
  the 
  analyses 
  should 
  physical and chemical processes taking place” 
   adequately 
   represent 
   the 
   Calculation 
  methods 
  are 
  used 
  in 
  support 
  of 
  various 
  tasks 
  in 
  PSA, 
  e.g. 
  thermal-
  hydraulic 
  analyses, 
  analyses 
  of 
  chemical 
  behaviour, 
  accident 
  progression 
  analyses, 
  analysis 
  of 
  structural 
  integrity 
  of 
  containment 
  and 
  any 
  other 
  structures, 
  fission 
  product 
  release 
  and 
  transport, 
  analysis 
  of 
  health 
  effects, 
  etc. 
  PSA 
  software, 
  in 
  itself, 
  uses 
  a 
  calculation 
  algorithm 
  to 
  quantify 
  the 
  PSA models 
  and 
  to 
  obtain 
  the 
  list 
  of 
  cutsets. 
  The 
  aim 
  of 
  this 
  principle 
  is 
  to 
  ensure 
  that 
  all 
  the 
  calculation 
  methods 
  used 
  in 
  the 
  PSA 
  adequately 
  represent 
  the 
  real 
  processes 
  taking 
  place 
  in 
  the 
  facility 
  and 
  that 
  the 
  calculations are done as intended by the analysts.  
  For 
  this, 
  inspectors 
  should 
  satisfy 
  themselves 
  that 
  the 
  calculation 
  algorithms 
  have 
  been validated with actual experience, experiments, tests or other calculation methods. 
  Inspectors 
  should 
  also 
  seek 
  evidence 
  that 
  uncertainties 
  in 
  the 
  calculation 
  methods 
  used 
  have 
  been 
  recognised 
  by 
  the 
  dutyholder 
  and 
  that 
  methods 
  have 
  only 
  been 
  applied within their limit of applicability. As deemed appropriate, inspectors may wish to 
  consider undertaking (or commissioning) independent calculations for some aspects of 
  the 
  PSA 
  (e.g., 
  addressing 
  areas 
  of 
  particular 
  concern) 
  using 
  different 
  calculation 
  methods. 
  This 
  is 
  particularly 
  important 
  if 
  the 
  PSA 
  is 
  being 
  used 
  to 
  support 
  a 
  new 
  design. TAG NS-TAST-GD-042 (Ref 7.7) should be referred to for further guidance. 
  Fault analysis: assurance of validity of data and models – Use of data – AV.3 
   4.8 
   4.9 
   4.10 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 10 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   4.11 
   4.12 
   “The 
  data 
  used 
  in 
  the 
  analysis 
  of 
  aspects 
  of 
  plant 
  performance 
  with 
  safety 
  significance 
  should 
  be 
  shown 
  to 
  be 
  valid 
  for 
  the 
  circumstances 
  by 
  reference 
  to 
  established physical data, experiment or other appropriate means” 
   Failure rate and probability data is the basis of the PSA; therefore, for the PSA to be an 
  adequate 
  representation 
  of 
  the 
  facility, 
  it 
  should 
  make 
  use 
  of 
  data 
  that 
  can 
  be 
  demonstrated to be valid for the facility. The use of data in PSA has been discussed in 
  Section 
  4.6 
  (3) 
  above. 
  Section 
  4.6 
  (4) 
  has 
  also 
  discussed 
  the 
  need 
  to 
  evaluate 
  the 
  uncertainty 
  in 
  the 
  input 
  data 
  and 
  its 
  impact 
  on 
  the 
  overall PSA 
  results. Section 
  4.7 
  (2) 
  has 
  addressed 
  how 
  to 
  interpret 
  this 
  uncertainty 
  in 
  decision-making. 
  Therefore, 
  this 
  SAP is viewed as a reinforcement of specific PSA SAPs FA.13 and FA.14.  
  Data 
  about 
  physical 
  processes 
  is 
  also 
  an 
  input 
  to 
  PSA 
  supporting 
  calculations. 
  Such 
  data 
  should 
  be 
  justified 
  by 
  reference 
  to physical data, 
  experiment 
  or other 
  appropriate 
  means. See also 4.11. 
  Fault analysis: assurance of validity of data and models – Computer models – AV.4 
   “Computer 
  models 
  and 
  datasets 
  used 
  be 
  developed, 
  maintained 
  and 
  applied 
  procedures” 
   in 
  in 
   support 
  of 
  the 
  safety 
  analysis 
  should 
  accordance 
  with 
  quality 
  management 
   Computer models are developed 
  to support various 
  tasks 
  in PSA, e.g. 
  for derivation of 
  success 
  criteria, 
  accident 
  progression 
  analyses, 
  fission 
  product 
  release 
  and 
  transport, 
  analysis 
  of 
  structural 
  integrity 
  of 
  containment 
  and 
  any 
  other 
  structures, 
  etc. 
  The 
  PSA 
  itself 
  comprises 
  a 
  computer 
  model 
  and 
  an 
  associated 
  database. 
  Therefore, 
  the 
  relevance of this SAP cannot be stressed enough. The aim of this principle is to ensure 
  that 
  all 
  the 
  calculations 
  that 
  underlay 
  the 
  PSA 
  are 
  undertaken 
  without 
  error. 
  For 
  this, 
  inspectors 
  may 
  wish 
  to 
  satisfy 
  themselves 
  that 
  the 
  dutyholders 
  have 
  put 
  in 
  place 
  adequate procedures to develop, maintain and apply computer models and databases.  
  These 
  procedures 
  should 
  cover 
  verification, 
  validation 
  or 
  qualification 
  of 
  computer 
  codes, 
  as 
  appropriate, 
  for 
  the 
  specific 
  design 
  of 
  the 
  facility. 
  The 
  procedures 
  should 
  also 
  require 
  the 
  dutyholder 
  to 
  identify 
  the 
  degree 
  of 
  accuracy 
  and 
  uncertainties 
  associated 
  with 
  the 
  selected 
  computer 
  codes 
  and 
  to 
  ensure 
  that 
  the 
  codes 
  are 
  only 
  used 
  within 
  their 
  limit 
  of 
  applicability 
  and 
  by 
  adequately 
  trained 
  users. 
  In 
  addition, 
  the 
  procedures 
  should 
  require 
  the 
  dutyholder 
  to 
  ensure 
  that 
  the 
  modelling 
  of 
  the 
  plant 
  inputted 
  as 
  underlying 
  basis 
  for 
  the 
  calculations 
  and 
  the 
  input 
  data 
  files 
  are 
  auditable 
  and 
  are 
  verified. 
  Inspectors 
  may 
  choose 
  to 
  review 
  or 
  audit 
  these 
  procedures 
  and/or 
  seek evidence of their correct application by the dutyholder. 
  Generally 
  inspectors 
  should 
  expect 
  that 
  the 
  Quality 
  Assurance 
  process 
  applied 
  to 
  the 
  PSA covers all 
  items 
  identified 
  in SAP AV.4. 
   Further guidance on 
  the use of computer 
  models in safety cases is provided in NS-TAST-GD-042 (Ref 7.7). 
  Fault analysis: assurance of validity of data and models – Documentation – AV.5 
   “Documentation 
  should 
  be 
  provided 
  analytical models and data” 
   to 
   facilitate 
   review 
   of 
   the 
   adequacy 
   of 
   the 
   PSAs 
  are 
  generally 
  large 
  and 
  complex 
  safety 
  analyses. 
  Therefore, 
  for 
  them 
  to 
  be 
  traceable, 
  reproducible, verifiable and updatable, 
  they need 
  to be documented 
  in 
  such 
  a 
  way 
  as 
  to 
  ensure 
  that 
  each 
  aspect 
  of 
  the 
  PSA 
  can 
  be 
  directly 
  related 
  to 
  existing 
  facility 
  information, 
  facility 
  documentation 
  or 
  the 
  analysts’ 
  assumptions 
  in 
  the 
  absence 
  of 
  such 
  information. 
  In 
  this 
  respect 
  this 
  SAP 
  reinforces 
  PSA-specific 
  SAP 
  FA.11 
  (Validity) addressed above. 
  Good 
  practice 
  on 
  PSA 
  documentation 
  can 
  be 
  found 
  in 
  IAEA 
  TECDOC 
  on 
  Living 
  PSA 
  (Ref 
  6.4). 
  This 
  report 
  recommends 
  that, 
  as 
  part 
  of 
  the 
  PSA 
  documentation, 
  individual 
  Task 
  Procedures 
  should 
  be 
  developed 
  to 
  ensure 
  that 
  all 
  analysts 
  working 
  on 
  a 
  task 
  develop 
  a 
  consistent 
  set 
  of 
  models 
  which 
  interface 
  without 
  overlap 
  or 
  omission. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 11 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   to 
   gain 
   Inspectors 
  may 
  choose 
  to 
  review 
  or 
  audit 
  these 
  procedures, 
  if 
  available, 
  confidence on the consistent application of methods throughout the PSA.  
  Ref 
  6.4 
  also 
  recommends 
  that 
  for 
  each 
  PSA 
  task, 
  analysis 
  files 
  should 
  be 
  compiled 
  including 
  relevant 
  reports, 
  input 
  data, 
  relevant 
  calculations, 
  and 
  model 
  or 
  database 
  files 
  containing 
  task 
  results. 
  The 
  PSA 
  task 
  reports: 
  should 
  describe 
  the 
  analyses 
  performed 
  and 
  all 
  the 
  modelling 
  assumptions; 
  should 
  identify 
  interfaces 
  with 
  other 
  tasks; and should 
  list all 
  the references used. These analysis 
  files should be controlled 
  documents 
  which 
  are 
  maintained 
  for 
  the 
  life 
  of 
  the 
  facility. 
  They 
  enable 
  any 
  PSA 
  analyst 
  familiar with 
  the 
  particular 
  task 
  to 
  recreate, modify or 
  review 
  the particular part 
  of the PSA. Experience with large PSA models suggest that unless there is a complete 
  set 
  of 
  such 
  files, 
  it 
  is 
  very 
  difficult 
  to 
  define 
  and 
  understand 
  each 
  element 
  of 
  the 
  computer model and the results of its quantification. 
  Fault analysis: assurance of validity of data and models – Sensitivity analyses – AV.6 
   “Studies 
  should 
  be 
  carried 
  out 
  to 
  determine 
  the 
  sensitivity 
  of 
  the 
  analysis 
  (and 
  the 
  conclusions drawn 
  from 
  it) 
  to 
  the 
  assumptions made, 
  the data used 
  and 
  the 
  methods of calculation”  
   Sensitivity 
  analyses 
  are 
  a 
  key 
  aspect 
  of 
  the PSA 
  because 
  they 
  are 
  needed 
  to 
  provide 
  confidence 
  that 
  the 
  conclusions 
  obtained 
  from 
  the 
  PSA 
  are 
  valid 
  despite 
  the 
  uncertainties 
  associated 
  with 
  the 
  supporting 
  analysis 
  and 
  assumptions 
  used 
  in 
  the 
  development of 
  the PSA. 
  If 
  the sensitivity analyses performed do not provide sufficient 
  confidence 
  in 
  the 
  validity 
  of 
  the 
  conclusions 
  of 
  the 
  PSA, 
  reasonably 
  practicable 
  steps 
  need to be 
  taken 
  to reduce 
  the uncertainties associated with 
  the model and data – 
  this 
  may 
  include 
  use 
  of 
  independent methods 
  and 
  computer 
  codes, where 
  appropriate, 
  as 
  indicated in the text accompanying SAP AV.6.  
  Sensitivity 
  analyses 
  have 
  been 
  addressed 
  in 
  Section 
  4.6 
  (4). 
  In 
  addition, 
  Section 
  4.7 
  (2) 
  discusses 
  the 
  role 
  of 
  sensitivity 
  analyses 
  when 
  using 
  PSA 
  to 
  support 
  decision-
  making. Therefore, this SAP reinforces specific PSA SAPs FA.13 and FA.14.  
  Fault analysis: assurance of validity of data and models – Data collection – AV.7 
   “Data should be collected throughout the operating life of the facility to check or 
  update the safety analysis” 
   The 
  validity 
  and 
  applicability 
  of 
  the 
  IE 
  frequencies, 
  unavailabilities, 
  etc, 
  used 
  in 
  the 
  PSA 
  can 
  only 
  be 
  periodically using facility specific information.  
  Therefore, 
  it 
  is 
  reasonable 
  to 
  expect 
  dutyholders 
  to 
  put 
  systems 
  in 
  place 
  for 
  collecting 
  relevant data 
  throughout 
  the 
  life of 
  the 
  facility and 
  to use 
  this data every 
  time 
  the PSA 
  is updated as required e.g. by PSA SAP FA.11 (above) and Assurance of Validity SAP 
  AV.8 (below). 
  Fault analysis: assurance of validity of data and models – Update and review – AV.8 
   failure 
  probabilities, 
  these 
  are 
  reviewed 
   component 
  assured 
  if 
   4.13 
   4.14 
   4.15 
   “The 
  safety 
  periodically” 
   analysis 
   should 
   be 
   updated 
   where 
   necessary 
   and 
   reviewed 
   Licence 
  Condition 
  15 
  requires 
  the 
  licensees 
  to 
  conduct 
  periodic 
  reviews 
  of 
  the 
  safety 
  cases 
  for 
  their 
  facilities. These periodic safety 
  reviews (PSRs) are normally carried out 
  every 
  ten 
  years. 
  However 
  a 
  licensee's 
  arrangements 
  under 
  LC15 
  should 
  also 
  require 
  interim 
  reviews 
  on 
  a 
  shorter 
  term 
  basis 
  taking 
  into 
  account 
  the 
  number 
  and 
  safety 
  significance 
  of modifications 
  to 
  the 
  facility and/or 
  changes 
  to 
  the 
  safety case 
  since 
  the 
  previous review (See NS-TAST-GD-050, Ref 7.9).  
  AV.8 should also be interpreted as highlighting the principle of Living PSA, in that ONR 
  expects 
  PSAs 
  to 
  be 
  living 
  analyses 
  that 
  constantly 
  reflect 
  the 
  best 
  estimate 
  of 
  the 
  dutyholder on 
  the 
  reliability of components, plant availability etc, current knowledge on 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 12 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   this 
   regard, 
   this 
   principle 
   reinforces 
   plant 
  behaviour, and modern analysis methods. 
  In 
  the specific PSA principle FA.11 discussed above.  
  It 
  is 
  expected 
  that 
  review 
  by 
  the 
  facility 
  operators 
  will 
  identify 
  if 
  operating 
  experience 
  has 
  proved 
  to 
  be 
  significantly 
  different 
  from 
  the 
  assumptions 
  in 
  the 
  analyses 
  and 
  then 
  take action to ensure that risks remain ALARP. 
  The 
  frequency 
  at 
  which 
  an 
  updating 
  or 
  reconsideration 
  of 
  the 
  PSA 
  should 
  be 
  carried 
  out will depend upon a number of 
  factors, e.g. 
  related 
  to 
  the systems 
  that are 
  in place 
  to 
  collect 
  and 
  analyse 
  data 
  and 
  to 
  the 
  understanding 
  of 
  ageing 
  effect 
  and 
  trends 
  in 
  system 
  reliability. 
  Dutyholders 
  are 
  expected 
  to 
  evaluate 
  the 
  impact 
  of 
  modifications 
  (design, 
  procedures, 
  operating 
  practices, 
  etc.) 
  on 
  the 
  PSA 
  results 
  on 
  a 
  case-by-case 
  basis. 
  Some modifications may 
  therefore 
  require 
  the 
  PSA 
  to 
  be 
  immediately 
  updated. 
  IAEA TECDOC on Living PSA (Ref 6.4) 
  indicates 
  that it 
  is a good practice at operating 
  NPPs not to accumulate a backlog of such evaluations for a period 
  longer 
  than a year. 
  It 
  also 
  suggests 
  that, 
  even 
  if 
  risk-significant 
  modifications 
  do 
  not 
  arise 
  for 
  a 
  longer 
  period, 
  the 
  dutyholder 
  should 
  still 
  revise, 
  update 
  and 
  formally 
  amend 
  the 
  PSA 
  every 
  three years.  
  Target 7: Individual risk to people off the site from accidents 
   4.16 
   “The targets for the individual risk of death to a person off the site, from 
  accidents at the site resulting in exposure to ionising radiation, are: 
   BSL: 
   1 x 10-4 pa 
   BSO: 
   1 x 10-6 pa” 
   Target 7 address accident risks to the public, summed for all facilities on a site. 
   4.17 
   Target 8: Frequency dose targets for accidents on an individual facility – any person off 
  the site 
   “The targets for the total predicted frequencies of accidents on an individual 
  facility, which could give doses to a person off the site are: 
   Effective dose, mSv 
   Total predicted frequency per annum 
   0.1-1 
   1-10 
   10-100  
   100-1000 
   >1000 
   BSL 
   1 
   1 x 10-1 
   1 x 10-2  
   1 x 10-3 
   1 x 10-4 
   BSO 
   1 x 10-2 
   1 x 10-3 
   1 x 10-4 
   1 x 10-5 
   1 x 10-6” 
   Target 8 sets limits on the frequencies of classes of accidents at individual facilities 
  that could give rise to doses off the site within the specified bands. 
   4.18 
   Target 9: Total risk of 100 or more fatalities 
   “The targets for the total risk of 100 or more fatalities, either immediate or 
  eventual, from accidents at the site in exposure to ionising radiation, are: 
   BSL: 
   BSO: 
   1 x 10-5 pa 
   1 x 10-7 pa” 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 13 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Target 9 is intended to be used as a guide to assist in judging whether more detailed 
  analysis is warranted. As with other numerical targets, Target 9 is a pragmatic 
  approach to enable targeted and proportionate use of resources.  ALARP 
  considerations by dutyholders below the BSO should, however, not be ruled out.  
   4.19 
   Relationship with the WENRA Reference Levels 
   The 
  Reactor 
  Harmonization 
  Working 
  Group 
  of 
  the 
  Western 
  European 
  Nuclear 
  Regulators 
  Association 
  (WENRA) 
  published 
  Reactor 
  Safety 
  Reference 
  Levels 
  in 
  January 
  2007 
  and 
  revised 
  versions 
  in 
  January 
  2008 
  and 
  most 
  recently 
  September 
  2014. Issue O of this document refers to Probabilistic Safety Analysis (PSA). This TAG 
  is 
  consistent 
  with 
  Issue 
  O 
  of 
  the 
  WENRA 
  reference 
  levels. 
  Appendix 
  2 
  presents 
  the 
  mapping between Issue O of the WENRA reference levels and this TAG. 
  Relationship with the IAEA Standards 
   4.20 
   Key relevant 
  IAEA publications on PSA are 
  listed 
  in Sections 6, 8, A1-4 and A1-5. The 
  contents of 
  this TAG, 
  including 
  its Appendix 1, 
  are broadly 
  consistent with 
  those 
  IAEA 
  publications. 
  In particular, Refs [6.4, A1-5.6 and A1-5.10] and the 
  IAEA Specific Safety 
  Guides 
  on 
  Level 
  1 
  and 
  Level 
  2 
  PSA, 
  Refs 
  [A1-5.7 
  and 
  A1-5.8] 
  have 
  been 
  specifically 
  used for the preparation of Appendix 1 of the TAG. 
   5. 
   ADVICE TO INSPECTORS 
   5.1 
   Introduction 
   This 
  section 
  of 
  the 
  TAG 
  aims 
  to 
  provide 
  guidance 
  on 
  the 
  assessment 
  of 
  a PSA which 
  generally 
  is 
  associated 
  with 
  SAPs 
  FA.10 
  to 
  FA.14. 
  The 
  guidance 
  in 
  this 
  section 
  is 
  presented 
  in 
  the order of a 
  typical PSA as 
  this 
  is 
  likely 
  to be of more practical value 
  to 
  the inspectors.  
  This 
  section 
  is 
  split 
  up 
  into 
  a 
  number 
  of 
  parts 
  dealing 
  with 
  the 
  different 
  elements 
  of 
  a 
  PSA. 
  Each 
  part 
  is 
  made 
  up 
  of 
  a 
  number 
  of 
  specific 
  points 
  of 
  guidance 
  to 
  ONR 
  inspectors. 
  It should be noted 
  that all of 
  these points need not be met 
  fully 
  in each and 
  every 
  instance. 
  It 
  is 
  left 
  to 
  the 
  judgement of 
  the 
  individual 
  inspector 
  to 
  identify both 
  the 
  scope of assessment and which, if any, of the shortfalls are significant. 
  The 
  guidance 
  provided 
  in 
  this 
  section 
  is 
  generally 
  applicable 
  to 
  the 
  assessment 
  of 
  PSAs 
  for 
  all 
  types 
  of 
  nuclear 
  facilities. 
  However, 
  more 
  specific 
  and 
  detailed 
  assessment 
  expectations 
  for 
  review 
  of PSAs 
  for NPPs 
  are 
  given 
  in Appendix 
  1 
  to 
  this 
  TAG. Since much of 
  the guidance provided 
  in Appendix 1 can also be applied 
  to other 
  types 
  of 
  facilities, 
  inspectors 
  may 
  wish 
  to 
  use 
  Appendix 
  1 
  at 
  their 
  discretion 
  for 
  the 
  assessment of PSAs for facilities other than NPPs. 
  PSA Scope 
   5.2 
   1)  PSA should be a systematic analysis to identify all important fault sequences which 
  can 
  lead 
  to 
  radiological consequences and 
  to evaluate 
  their contribution 
  to 
  the 
  level of 
  risk 
  represented 
  by 
  the 
  facility. 
  The 
  PSA 
  should 
  set 
  out 
  to 
  identify 
  all 
  the 
  significant 
  contributions 
  to 
  the 
  estimate 
  of 
  the 
  level 
  of 
  risk 
  otherwise 
  the 
  analysis 
  is 
  not 
  complete 
  and conclusions drawn from the analysis may thus be incorrect. 
  2) 
   The same expectation of scope 
  for PSAs 
  is, 
  in principle, applicable 
  to both old and 
  new 
  facilities. 
  However, 
  the 
  methods 
  and 
  details 
  of 
  analysis 
  that 
  licensees 
  choose 
  to 
  use to demonstrate that the level of risk from their facility is ALARP may be different. 
  3)  The inspector may consider: 
  i. 
  in 
  cases 
  where 
  there 
  is 
  worthwhile; 
   producing 
   currently 
   would 
   no 
   PSA, 
   whether 
   one 
   be 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 14 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   of 
   of 
   the 
   on 
   the 
   analysis 
   be made 
   comparison 
   radioactivity 
   a meaningful 
   ii. 
  in 
  cases 
  where 
  there 
  is 
  a 
  PSA, 
  whether 
  the 
  objectives 
  appropriate and its scope adequate to meet them; 
  iii. 
  whether 
  the 
  scope 
  of 
  the 
  PSA 
  covers 
  all 
  the 
  sources 
  facility; 
  iv. whether 
  the 
  scope 
  of 
  the 
  PSA 
  allows 
  with the numerical targets of the SAPs; 
  v. whether the scope of the PSA covers all classes of IEs and hazards; 
  vi. whether the scope of the PSA covers all foreseeable operating modes of the 
  facility; 
  vii. 
  whether 
  identified; 
  viii. 
  whether, 
  where 
  the 
  scope 
  of 
  the 
  PSA 
  has 
  been 
  reduced, 
  a 
  justification 
  provided to confirm that this would not change the conclusions of the PSA; 
  ix.   in the case of a site with multiple reactors or facilities, whether the scope of 
  the PSA is well defined (e.g. for a single representative unit, or multiple units or 
  facilities), 
  and 
  whether 
  the 
  justification 
  for 
  scope 
  is 
  provided 
  and 
  adequate 
  (additional discussion on multi-unit considerations is contained in Section 5.13). 
  4) 
   Specific assessment expectations 
  for 
  review of 
  the scope of 
  the PSA 
  for NPPs can 
  be found in Table A1-1.2 (PSA Scope) of Appendix 1. 
  PSA Methodology 
   reductions 
   pointers 
   above 
   scope 
   of 
   the 
   any 
   PSA 
   from 
   the 
   in 
   to 
   are 
   are 
   is 
   1) 
   The 
  starting point 
  for 
  the PSA 
  is 
  a detailed description of 
  the design 
  and operation 
  of 
  the 
  facility 
  and 
  its 
  associated 
  protection 
  system, 
  and 
  their 
  behaviour 
  in 
  fault 
  conditions. 
  This 
  would 
  typically 
  include 
  facility 
  descriptions, 
  fault 
  schedules, 
  drawings, 
  operating 
  instructions, 
  safety 
  reports 
  and 
  transient, 
  radiological 
  and 
  any 
  other 
  deterministic analyses that support the PSA. 
  2)  The inspector may consider whether: 
  i. the detailed design of the facility and its equipment to which the PSA refers is 
  identified; 
  ii. 
  sufficient 
  information 
  is 
  provided 
  on 
  the 
  design 
  and 
  operation 
  of 
  the 
  facility 
  and 
  on 
  its 
  behaviour 
  in 
  fault 
  conditions 
  to 
  support 
  the 
  PSA. 
  (The 
  inspector 
  should 
  consider 
  carrying 
  out 
  a 
  site 
  visit(s) 
  to 
  confirm 
  a 
  selection 
  of 
  design 
  and 
  operating assumptions used in the PSA); 
  iii. 
  the 
  methods 
  of 
  analysis 
  used 
  in 
  the 
  meet the objectives of the analysis; 
  iv. the PSA has been fully documented; 
  v. the PSA has been carried out in accordance with written QA procedures; 
  vi. 
  the 
  PSA 
  has 
  undergone 
  an 
  independent 
  assessment/peer 
  review 
  and 
  findings are acceptable. 
  3) 
   Specific assessment expectations 
  for 
  review of 
  the adequacy of 
  the documentation 
  provided 
  in 
  support 
  of 
  each 
  technical 
  task 
  of 
  the 
  PSAs 
  for 
  NPPs 
  can 
  be 
  found 
  in 
  the 
  various Tables of Appendix 1. 
  Derivation of Initiating Events Including Hazards 
   suitable 
   defined 
   PSA 
   and 
   are 
   are 
   the 
   to 
   5.3 
   5.4 
   1) 
   A 
  list 
  should 
  be 
  included 
  providing 
  identification 
  of 
  all 
  of 
  the 
  identifiable 
  IEs within 
  the scope of the PSA which could lead directly or in combination with other failures to a 
  release of radioactive material. 
  2)  The inspector may consider whether: 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 15 of 81 
    
    
    
    
    
   Office for Nuclear Regulation  
   is 
   is 
   all 
   so 
   that 
   given 
   PSA, 
  to 
  the 
   of 
  radioactive 
  that 
  this 
  would 
   material 
  are 
  not 
  included 
  in 
  the 
  not 
  lead 
  to 
  a 
  significant 
  contribution 
   i. the list of IEs covers all the sources of radioactive material in the facility; 
  ii. 
  the 
  quantity, 
  form 
  and 
  location 
  of 
  all 
  radioactive 
  material 
  in 
  the 
  facility 
  identified; 
  iii. 
  if 
  any 
  sources 
  justification 
  is 
  given 
  risk; 
  iv. the list of IEs covers all the operating modes of the facility; 
  v. 
  if 
  any 
  operating 
  mode 
  is 
  not 
  covered 
  in 
  the 
  list 
  of 
  IEs, 
  justification 
  that the contribution to the risk is small during this operating mode; 
  vi. 
  the 
  IE 
  identification 
  process 
  is 
  shown 
  to 
  be 
  comprehensive 
  possible IEs are identified; 
  vii. the list of IEs includes partial failures as well as total failure; 
  viii. all relevant internal hazards are listed; 
  ix. all relevant external hazards are listed; 
  x. each IE  is defined; 
  xi. the causes of each IE are identified; 
  xii. 
  features 
  such 
  as 
  administrative 
  systems, 
  control 
  which limit the frequency of an IE are identified; 
  xiii. failures of protection system equipment which can occur as a consequence 
  of an IE are identified; 
  xiv. a 
  list 
  is 
  prepared of 
  IEs which 
  are 
  screened 
  from 
  the 
  list of 
  IEs 
  because of 
  very low frequency or ""incredibility"", with reference to the justification; 
  xv. 
  full 
  records of 
  the 
  IE 
  identification process 
  are available 
  and are 
  of 
  quality; 
  xvi. any IE screening criteria adopted are clearly described and justified. 
  3) 
   Specific assessment expectations 
  for 
  review of 
  the adequacy and completeness of 
  the 
  list 
  of 
  IEs 
  considered 
  in 
  the 
  PSAs 
  for 
  NPPs 
  can 
  be 
  found 
  in 
  Tables 
  A1-2.1 
  (identification 
  and 
  grouping 
  of 
  initiating 
  events), 
  A1-2.7 
  (analysis 
  of 
  hazards) 
  and 
  A1-
  2.8 (low power and shutdown modes) of Appendix 1. 
  Protection and Mitigation Systems 
   interlocks 
   systems, 
   suitable 
   etc. 
   5.5 
   for each 
   1) 
   The PSA should 
  identify 
  the 
  safety systems which are 
  required 
  to operate 
  of the IEs and identify the success criteria for each of the safety functions. 
  2)  The inspector may consider whether for each IE:  
  i. the safety functions have been identified; 
  ii. 
  the 
  minimum 
  safety 
  systems 
  requirements 
  have been identified; 
  iii. 
  the 
  minimum 
  protection 
  system 
  requirements 
  deterministic / transient analysis presented; 
  iv. for automatic protection actions, the parameters and systems used to initiate 
  the action have been identified; 
  v. 
  for 
  manually 
  initiated 
  protection 
  actions, 
  the 
  alarms 
  and 
  indications 
  would alert the operator to the need for the action are identified. 
  3) 
  Specific 
  assessment 
  expectations 
  for 
  review 
  of 
  the 
  adequacy 
  of 
  the 
  credited 
  safeguards 
  in 
  PSAs 
  for 
  NPPs 
  can 
  be 
  found 
  in 
  Table 
  A1-2.2 
  (Accident 
  sequence 
  development: determination of success criteria) of Appendix 1. 
   consistent 
   functions 
   achieve 
   safety 
   which 
   with 
   any 
   are 
   the 
   to 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 16 of 81 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   5.6 
   Accident Sequence Analysis 
   functions 
  required 
  and 
  which 
  can 
  operate 
  to 
   1) 
  The 
  next 
  stage 
  of 
  the 
  PSA 
  is 
  the 
  accident 
  sequence 
  analysis 
  which 
  models 
  the 
  behaviour 
  of 
  the 
  facility 
  for 
  the 
  IEs. 
  The 
  analysis 
  should 
  cover 
  all 
  possible 
  combinations 
  of 
  success 
  or 
  failure 
  of 
  the 
  protection 
  systems 
  to 
  perform 
  the 
  safety 
  functions 
  and 
  should 
  identify 
  the 
  accident 
  sequences which 
  involve 
  failure 
  to maintain 
  the facility within safe limits. 
  2) 
  The 
  end 
  points 
  of 
  the 
  accident 
  sequence 
  analysis 
  should 
  be 
  categorised 
  in 
  terms 
  compatible 
  with 
  the 
  numerical 
  targets 
  of 
  the 
  SAPs 
  addressed. 
  This 
  does 
  not 
  necessarily mean that the categories defined by the dutyholders have to be identical to 
  those 
  corresponding 
  to 
  the 
  numerical 
  targets 
  of 
  the 
  SAPs. 
  However, 
  safety 
  cases 
  should be presented 
  in a manner which allows 
  inspectors 
  to make 
  judgements against 
  the SAPs’ targets. The inspector may check that, for each IE: 
  i. 
  the 
  accident 
  sequence 
  analysis 
  covers 
  all 
  the 
  safety 
  all 
  the 
  combinations 
  of 
  protection 
  system 
  equipment 
  perform the safety functions; 
  ii. 
  the 
  accident 
  sequence 
  analysis 
  takes 
  account 
  of 
  all 
  dependencies between safety functions and protection systems; 
  iii. 
  the accident sequence analysis covers all 
  the mechanisms which could 
  lead 
  to 
  failure 
  of 
  the 
  physical 
  barriers 
  such 
  as 
  a 
  reactor 
  pressure 
  vessel 
  or 
  the 
  containment; 
  iv. 
  the 
  accident 
  sequence 
  analysis 
  covers 
  the 
  factors 
  which 
  affect 
  the 
  release 
  and 
  transport 
  of 
  radioactive 
  materials 
  to 
  the 
  environment 
  and 
  their 
  effects 
  on 
  humans; 
  v. 
  sufficient 
  radiological 
  analysis 
  is 
  available 
  to 
  justify 
  end-points 
  of 
  the 
  accident 
  sequence 
  analysis 
  assumptions have been made; 
  vi. 
  the 
  transient, 
  radiological 
  and 
  other 
  deterministic 
  analyses 
  used 
  to 
  support 
  the PSA models do not contain undue pessimisms 
  (these should preferably be 
  best estimate); 
  vii. 
  where 
  IEs 
  are 
  grouped, 
  the 
  frequency 
  is 
  the 
  sum 
  of 
  the 
  grouped and the group is represented by the most onerous one. 
  3)  Specific assessment expectations for review of the adequacy of the grouping of IEs 
  in 
  PSAs 
  for 
  NPPs 
  can 
  be 
  found 
  in 
  Table 
  A1-2.1 
  of 
  Appendix 
  1. 
  Specific 
  assessment 
  expectations 
  for 
  review 
  of 
  the 
  accident 
  sequence 
  analysis 
  in 
  PSAs 
  for 
  NPPs 
  can 
  be 
  found in Table A1-2.3 of Appendix 1. 
  Protection and Mitigation Systems Failure Analysis 
   categorisation 
  of 
  the 
  that 
  best-estimate 
   functional 
   individual 
   the 
  or 
   IEs 
   the 
   5.7 
   1)  The accident sequence analysis identifies combinations of IEs and failures of safety 
  systems 
  and 
  then 
  considers 
  the 
  failures 
  of 
  these 
  systems 
  down 
  to 
  a 
  lower 
  level 
  to 
  identify 
  the 
  combinations 
  of 
  basic 
  events 
  within 
  the 
  various 
  safety 
  systems 
  or 
  support 
  systems 
  which 
  could 
  lead 
  to 
  the 
  failure. 
  The 
  basic 
  events 
  would 
  typically 
  include; 
  component 
  failure, 
  CCF, 
  component 
  unavailability 
  during 
  maintenance 
  or 
  test 
  and 
  operator error. 
  2) 
  The 
  most 
  usual 
  method 
  of 
  safety 
  system 
  analysis 
  is 
  techniques are acceptable but may need additional scrutiny. 
  3)  The inspector may consider whether: 
  i. 
  the 
  systems 
  failure 
  analysis 
  covers 
  accident sequence analysis; 
   identified 
   analysis; 
   failure 
   states 
   other 
   fault 
   tree 
   all 
   the 
   by 
   the 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 17 of 81 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   of 
   have 
   been 
   modes 
   system 
   protection 
   equipment 
   ii. 
  the 
  analysis 
  has 
  been 
  carried 
  out 
  to 
  a 
  low 
  enough 
  level 
  of 
  detail 
  (e.g. 
  individual 
  component 
  level) 
  so 
  that 
  the 
  design 
  and 
  operation 
  of 
  the 
  system 
  is 
  adequately modelled; 
  iii. 
  all 
  the 
  relevant 
  failure 
  included; 
  iv. 
  where 
  components 
  have 
  been 
  grouped 
  together 
  in 
  the 
  analysis 
  (e.g. 
  in 
  “super-components”), 
  failure 
  of 
  each 
  of 
  the 
  components 
  in 
  the 
  mode 
  specified 
  has the same effect on the system and justification is clearly documented; 
  v. the systems failure analysis models all the support systems required and that 
  all interdependencies due to common services have been represented; 
  vi. 
  the 
  systems 
  failure 
  analysis 
  takes 
  account 
  of 
  consequential 
  failures 
  could occur due to the IE or hazard; 
  vii. 
  CCFs 
  are 
  included 
  in 
  the 
  models 
  at 
  an 
  appropriate 
  level 
  and 
  that 
  probability given to each CCF has been derived on a best-estimate basis;   
  viii. all operator errors which can contribute to the failure of a system credited in 
  the 
  PSA 
  have 
  been 
  identified 
  and 
  modelled 
  in 
  the 
  analysis, 
  with 
  due 
  consideration of dependencies; 
  ix. the unavailability of components, trains of systems or the entirety of systems 
  during periods of maintenance or testing has been addressed in the analysis. 
  4) 
  Specific 
  assessment 
  expectations 
  for 
  review 
  of 
  the 
  System 
  Analysis 
  in 
  PSAs 
  for 
  NPPs can be found in Table A1-2.4 of Appendix 1. 
  PSA Input Data 
   which 
   the 
   5.8 
   for 
   the 
   use 
   and 
   and 
   IE 
   in 
   the 
   best 
   events 
   included 
   estimate 
   preferably 
   appropriate 
   frequencies 
   1)  Data is required to estimate the frequencies and probabilities in the PSA. 
  2)  The inspector may consider whether: 
  i. 
  data 
  is 
  provided 
  for 
  all 
  the 
  basic 
  PSA; 
  ii. 
  the 
  data 
  provided 
  is 
  made of it in the PSA; 
  iii. 
  where 
  use 
  is 
  made 
  of 
  operating 
  experience 
  data 
  in 
  calculating 
  IE 
  frequencies 
  and 
  component 
  failure 
  rates, 
  and 
  the 
  event 
  is 
  a 
  potentially 
  important 
  contributor 
  to 
  the 
  risk, 
  there 
  is 
  an 
  adequate 
  discussion 
  of 
  the 
  relevance of the data and the statistical uncertainty; 
  iv. 
  where 
  insufficient 
  directly 
  relevant 
  data 
  are 
  available, 
  the 
  source 
  quoted generic data and the basis of any judgements are stated; 
  v. for IE frequencies: 
  a. the data covers all the causes of the IEs which have been identified; 
  b. where 
  the 
  IE 
  frequency 
  has 
  been 
  calculated 
  from 
  failure 
  data 
  for 
  the 
  causes 
  of 
  the 
  fault, 
  the 
  data 
  is 
  applicable 
  for 
  this 
  use 
  and 
  has 
  been 
  combined correctly to derive the frequency; 
  c. 
  where 
  no 
  relevant 
  operating 
  data 
  is 
  available 
  and 
  judgement 
  been 
  used 
  to 
  assign 
  the 
  IE 
  frequency, 
  the 
  basis 
  for 
  this 
  judgement 
  been stated and shown to be valid, as far as possible; 
  vi.  for component failure rates (or probabilities): 
  a. 
  the 
  boundaries 
  of 
  the 
  component 
  for 
  which 
  defined; 
  b. the data covers all relevant failure modes of the component; 
   specified 
   has 
  has 
   data 
   of 
   any 
   the 
   is 
   are 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 18 of 81 
    
    
    
    
    
   Office for Nuclear Regulation  
   tests 
  and 
   after 
  a 
  fault, 
  reference 
  to 
   c. 
  the 
  data 
  used 
  corresponds 
  to 
  the 
  component 
  in 
  terms 
  of 
  type, 
  manufacture, operating environment, usage and maintenance regime; 
  d. 
  the 
  form of 
  the data 
  is 
  suitable 
  - 
  that 
  is, a 
  failure 
  rate per unit 
  time or 
  a 
  failure 
  probability 
  per 
  demand 
  is 
  given 
  as 
  appropriate 
  for 
  running 
  or 
  standby components; 
  e. where a test interval is used to change a failure rate per unit time to a 
  failure 
  probability 
  per 
  demand, 
  there 
  should 
  be 
  a 
  reference 
  to 
  the 
  relevant testing schedule and procedures; 
  f. 
  where 
  a 
  component 
  is 
  required 
  to 
  operate 
  continuously 
  the 
  required 
  period 
  of 
  operation 
  is 
  defined 
  and 
  justified 
  by 
  the supporting deterministic analysis; 
  vii. for component unavailabilities: 
  a. 
  the data covers all causes of component unavailability 
  including 
  (scheduled 
  and 
  unscheduled), 
  maintenance 
  (scheduled 
  unscheduled) and repair; 
  b. justification is given that the frequency and duration of the component 
  unavailabilities adequately represents typical facility operation; 
  viii.  for CCFs: 
  a. 
  the 
  probability 
  of 
  failure 
  best-estimate methods; 
  b. 
   where numerical values are derived 
  through engineering 
  judgement, 
  adequate 
  justification 
  is given that 
  this reflects the potential 
  for common 
  cause failures to occur. The engineering judgement should take account 
  of 
  layout, 
  segregation 
  and 
  any 
  other 
  measures 
  adopted 
  to 
  reduce 
  the 
  likelihood of a common cause failure (see NS-TAST-GD-036, Ref 7.6) 
  ix. operator error probabilities:  
  a. 
  should 
  reflect 
  the 
  complexity 
  of 
  the 
  task 
  required 
  and 
  the 
  factors 
  which may 
  be 
  present 
  which 
  influence 
  the 
  performance 
  of 
  the 
  operator 
  (stress, 
  the 
  time 
  available, 
  training, 
  procedures 
  and 
  environmental 
  conditions); 
  b. 
  where 
  judgements 
  have 
  been 
  made, 
  the 
  basis 
  stated and shown to be valid as far as possible; 
  x. 
  the 
  measures 
  proposed 
  to 
  ensure 
  that 
  the 
  reliabilities 
  claimed 
  components 
  and 
  systems 
  will 
  be 
  achieved 
  and/or 
  maintained, 
  are 
  stated 
  evidence is available to demonstrate the adequacy of any such measures; 
  xi. 
  the 
  possibility 
  of 
  component 
  failure 
  rates 
  or 
  unavailabilities 
  increasing 
  time, e.g. through ageing, is considered. 
  3)  Specific assessment expectations for review of the Data Analysis in PSAs for NPPs 
  can be found in Tables A1-2.5 (Human Reliability Analysis) and A1-2.6 (Data Analysis) 
  of Appendix 1. 
  Analysis of Internal and External Hazards 
   associated 
   judgement 
   with 
   each 
   CCF 
   is 
   derived 
   using 
   for 
   the 
   is 
   for 
  and 
   with 
   5.9 
   1) 
  Development 
  of 
  internal 
  and 
  external 
  hazard 
  PSA 
  generally 
  follows 
  a 
  similar 
  method 
  to 
  the 
  Level 
  1 
  internal 
  events PSA method, 
  i.e.: 
  selection 
  of 
  IE 
  (in 
  this 
  case 
  a 
  particular 
  internal 
  or 
  external 
  hazard); 
  screening 
  and 
  bounding 
  of 
  the 
  IE; 
  accident 
  sequence 
  analysis 
  and 
  systems 
  analysis. As 
  such, 
  the 
  recommendations 
  listed 
  above 
  are generally applicable for both hazard PSA and internal-events PSA. 
  2)  Specific assessment expectations for review of the Analysis of Internal and External 
  Hazards in PSAs for NPPs can be found in Table A1-2.7 of Appendix 1.  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 19 of 81 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   5.10 
   Analysis of Other Operating Modes 
   1) 
  As 
  stated 
  above, 
  the 
  scope 
  of 
  a 
  PSA 
  is 
  expected 
  to 
  address 
  all 
  operating 
  modes 
  wherein 
  the nuclear 
  facility 
  is expected 
  to operate. The 
  recommendations 
  listed above 
  are generally also applicable for PSA models of operating modes other than ‘at-power’. 
  2) 
  Specific 
  assessment 
  expectations 
  for 
  review 
  of 
  the 
  Analysis 
  of 
  Low 
  Power 
  and 
  Shutdown Modes in PSAs for NPPs can be found in Table A1-2.8 of Appendix 1. 
  Evaluation of Release Frequencies 
   5.11 
   Specific 
  assessment 
  expectations 
  found in Table A1-3 of Appendix 1. 
   for 
   review 
   of 
   the 
   Level 
   2 
   PSA* 
   for 
   NPPs 
   can 
   be 
   * 
  For 
  NPPs, 
  Level 
  1 
  PSA 
  is 
  the 
  part 
  of 
  the 
  overall 
  PSA 
  that 
  focuses 
  on 
  the 
  potential 
  for 
  core 
  damage; 
  Level 
  2 
  PSA 
  widens 
  this 
  analysis 
  to 
  consider 
  release 
  magnitudes 
  and 
  frequencies 
  from losses of containment or otherwise; while Level 3 PSA 
  is wider still, and considers risks to 
  the public from off-site releases. 
   5.12 
   Evaluation of Off-site Risks and Consequences 
   Specific assessment expectations for review of the Level 3 PSA for NPPs can be found 
  in Table A1-4 of Appendix 1. 
  Multi-unit considerations 
   5.13 
   The majority of existing and proposed nuclear sites in the UK contain multiple reactor 
  units or other facilities.  Whilst the topic of multi-unit PSA is a topic of ongoing 
  international research, dutyholders are expected to consider the impact of multiple 
  reactor units and other facilities within the PSA.  For existing sites with limited 
  dependencies between individual facilities this may be limited to a single unit PSA for a 
  representative reactor unit or facility, supported by a justification for this approach 
  providing a suitable and sufficient PSA to support the expected PSA applications.  For 
  a new build site, or a site with significant or complex interactions between facilities, 
  more detailed analysis may be required. 
   ONR has an open research item on multi-unit PSA and provides a representative on 
  OECD/NEA WGRISK and IAEA working groups for multi-unit PSA research topics.  
  Further advice may be sought from inspectors involved in the ONR and international 
  multi-unit PSA research topics as required. 
   The following provides some general advice to inspectors on the different aspects of 
  PSA relevant to multi-unit considerations: 
   1) 
   2) 
   PSA scope.  As stated in Section 4.5, the scope of the PSA is expected to cover 
  all significant sources of radioactivity on site.   The presence of multiple reactor 
  units and other facilities on a site should be taken into account when developing 
  and justifying the scope of the PSA. 
   PSA methodologies.  There are a number of options available to dutyholders 
  when considering multiple reactor units or facilities within the PSA.  This may 
  extend from justification that a single unit model adequately represents the site, 
  all the way to a fully integrated multi-unit PSA covering all sources of radioactivity 
  on site, and various steps in-between.  There are advantages and disadvantages 
  to the different approaches, depending upon the complexity of the site, the 
  dependencies between the facilities, and the level of risk for the site.  The 
  approach taken should be suitable to understand the risk and develop a suitable 
  and sufficient PSA to support the expected PSA applications. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 20 of 81 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   3) 
   4) 
   5) 
   6) 
   7) 
   8) 
   9) 
   Initiating events.  Initiating events which affect multiple units or facilities should 
  be considered and analysed.  Initiating events which propagate between units or 
  facilities should also be considered and analysed. 
   Accident sequence analysis.  Dependencies and the potential for propagation 
  between units and facilities should be identified and suitably considered in the 
  PSA.  This may include safety systems, support systems, control systems, 
  operator actions, CCFs, phenomenology, and radiological consequences.  The 
  potential for a radiological release at one facility to impact the operator response 
  on an adjacent facility should be considered. 
   Input data.  Data used in the PSA model or any multi-unit sensitivity studies may 
  be impacted by the scope of the PSA, including CCFs, operator actions and 
  initiating event frequencies.  Data used in any multi-unit PSA models or studies 
  should be documented and justified.   
   Internal hazards.  The potential for propagation of internal hazards between units 
  and facilities should be considered.  This may include tasks such as extending 
  the fire PSA multi compartment analysis to consider adjacent facilities. 
   External hazards.  Many external hazards have the potential to impact multiple 
  facilities on the same site.  External hazard prioritisation and external hazards 
  PSA models or sensitivity analysis should include consideration of all facilities 
  which may be affected by the external hazard.  Additional analysis for seismic 
  PSA may be required to consider the potential for correlation between SSCs in 
  different facilities. 
   Evaluation of off-site consequences.  Additional consequence analysis may be 
  required to evaluate the consequences of a multi-unit accident.  For example, a 
  seismic event may be considered to lead to a release on multiple similar 
  facilities, with a similar or higher frequency than a single unit release, and 
  therefore additional consequence analysis should be performed. 
   Quantification and presentation of results.  PSA results should be quantified, 
  aggregated and presented in a suitable way to allow for comparison against 
  SAPs numerical targets, understanding of sensitivity and uncertainty, 
  demonstration of risks being reduced to ALARP and use of PSA results to 
  support the expected PSA applications. 
   10) 
   Interpretation of numerical targets.  SAPs Numerical Targets 7 and 9 relate to 
  site-wide risk, and therefore assessment against Numerical Targets 7 and 9 
  should include consideration of all facilities on the site.  The SAPs contain a 
  definition for societal risk (Target 9) which refers to “an activity from which risk is 
  assessed as a whole and is under the control of one company in one location, or 
  within a site boundary”.  
   SAPs Numerical Target 8 relates to risk from a facility. The SAPs define a facility 
  as “A part of a nuclear site identified as being a separate unit for the purposes of 
  nuclear or radiological risk”. From a PSA point of view, dutyholders are expected 
  to define the boundaries of each facility for the purposes of assessment against 
  Target 8.  This definition should include consideration of dependencies.  For 
  example, where facilities are coupled or connected, or multiple reactors are 
  contained in close proximity within the same building or the same body of water 
  they may be considered the same facility for the purposes of assessment against 
  Target 8.  
   5.14 
   Quantification of the Analysis 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 21 of 81 
    
    
    
    
   Office for Nuclear Regulation  
   verified, 
  by 
  the 
   1) 
  The 
  PSA 
  should 
  determine 
  the 
  combinations 
  of 
  basic 
  events 
  such 
  as 
  component 
  failure, 
  CCF, 
  operator 
  error 
  and 
  plant 
  unavailability 
  which 
  lead 
  to 
  the 
  fault 
  sequence 
  and 
  determine 
  its 
  frequency 
  of 
  occurrence. 
  The 
  methods 
  used 
  to 
  do 
  this 
  should 
  be 
  identified 
  and 
  shown 
  to 
  be 
  adequate. 
  Due 
  to 
  the 
  complexity 
  of 
  the 
  analysis, 
  the 
  quantification 
  of 
  the 
  PSA 
  normally 
  requires 
  a 
  computer 
  program. 
  This 
  code 
  should 
  be 
  quality 
  assured 
  (see 
  AV.4) 
  and 
  the 
  evidence 
  of 
  this 
  should 
  be 
  provided 
  by 
  the 
  dutyholder (AV.5). 
  2)  The inspector may consider whether: 
  i. 
  where 
  computer 
  programs 
  are 
  used, 
  they 
  and 
  their 
  results 
  are 
  manual 
  calculations 
  should 
  have 
  been 
  independently 
  checked 
  dutyholder; 
  ii. 
  the 
  combinations 
  of 
  basic 
  events 
  (minimal 
  cutsets) 
  which 
  lead 
  to 
  failure 
  of 
  the 
  protection 
  or 
  support 
  systems 
  are 
  identified 
  and 
  listed 
  for 
  each 
  of 
  the 
  IEs 
  analysed; 
  iii. that single order minimal cutsets are identified and brought to the attention of 
  the assessors dealing with compliance with the single failure criteria; 
  iv. the combinations of basic events do lead to the protection system failure (for 
  this, 
  inspectors 
  should 
  review 
  a 
  sample 
  of 
  the 
  cutsets 
  including 
  those 
  which 
  make the highest contributions to the frequency/probability calculated); 
  v.  if the quantification of the analysis has required a restriction to be applied on 
  the 
  probability 
  of 
  the 
  combinations 
  of 
  basic 
  events 
  included, 
  this 
  has 
  not 
  affected the accuracy of the analysis significantly; 
  vi. 
  in the calculation, all dependencies are taken into account. This includes the 
  dependency 
  between 
  redundant 
  components, 
  between 
  nominally 
  diverse 
  systems and between individual operator errors. Dependencies due to common 
  support systems should be modelled explicitly in the analysis; 
  vii. 
  the 
  importance 
  of 
  IEs, 
  components, 
  systems, 
  operator 
  dependencies in the calculation of the risk have been identified. 
  3)  Specific assessment expectations for review of the Quantification of PSAs for NPPs 
  can be found in Table A1-2.9.2 of Appendix 1. 
  Sensitivity and Uncertainty Studies 
   errors 
   and 
   5.15 
   1) 
   The 
  results of 
  the probabilistic analysis may be 
  sensitive 
  to 
  the assumptions made 
  and 
  the 
  data 
  used. 
  Since 
  these 
  contain 
  some 
  uncertainty, 
  studies 
  should 
  be 
  carried 
  out to determine the degree of sensitivity to ensure that the conclusions drawn from the 
  analysis are still valid in the light of these uncertainties (AV.6). These sensitivity studies 
  should cover a 
  sufficiently wide 
  range of 
  conditions 
  to give 
  confidence 
  in 
  the accuracy 
  of 
  the 
  results 
  of 
  the 
  analysis 
  and 
  the 
  conclusions 
  drawn 
  from 
  it. 
  Standard 
  importance 
  functions 
  may 
  be 
  used 
  to 
  identify 
  the 
  critical 
  basic 
  events 
  to 
  be 
  covered 
  by 
  the 
  sensitivity 
  studies, 
  as well 
  as 
  providing 
  the means 
  by which 
  the 
  impact 
  to 
  the 
  risk 
  can 
  be gauged. 
  2)  The inspector may check that: 
  i. 
  appropriate 
  studies 
  have 
  been 
  carried 
  out 
  to 
  determine 
  the 
  sensitivity 
  of 
  the 
  results 
  of 
  the 
  PSA 
  to 
  any 
  significant 
  uncertainties 
  in 
  the 
  models, 
  assumptions 
  and data; 
  ii. 
  as 
  far 
  as 
  the 
  basic 
  justified, 
  systematically 
  uncertainty. 
  3) 
  Specific 
  assessment 
  expectations 
  for 
  review 
  of 
  the 
  Sensitivity 
  and 
  Analyses in PSAs for NPPs can be found in Table A1-2.9.1 of Appendix 1. 
   concerned, 
  the 
  error 
  factors 
  used 
  are 
  a 
  reasonable 
  representation 
  of 
   event 
  data 
  is 
  assigned 
  and 
   Uncertainty 
   are 
  the 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 22 of 81 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   5.16 
   Presentation of the Results of the PSA 
   which 
   the 
   meet 
   the 
   the 
   PSA 
   results 
   of 
   numerical 
   1)  The results of the PSA should be presented in a form which allows comparison with 
  the numerical targets of the SAPs and the dutyholder's own criteria. 
  2)  The inspector may consider: 
  i. whether sufficient information is provided to allow ONR to make a comparison 
  with the SAPs; 
  ii. 
  the 
  extent 
  to 
  SAPs; 
  iii. 
  whether 
  suitable 
  judgements 
  have 
  magnitude 
  of 
  ‘excluded’ 
  contributions 
  to 
  in the PSA; 
  iv. 
  whether 
  the 
  results 
  of 
  the 
  PSA 
  have 
  been 
  reviewed 
  systematically 
  to 
  determine 
  if changes could be made 
  to 
  the design or operation of 
  the 
  facility 
  to 
  make 
  the 
  risks 
  as 
  low 
  as 
  reasonably 
  practicable 
  – 
  see 
  ONR’s 
  ALARP 
  guidance, NS-TAST-GD-005 (Ref 7.1). 
  v. whether, in cases where changes to the design or operation of the facility are 
  proposed, the corresponding reduction in the risk has been calculated.  
  3) 
  Specific 
  assessment 
  expectations 
  for 
  review 
  of 
  the 
  Results 
  of 
  the 
  PSAs 
  for 
  NPPs 
  can 
  be 
  found 
  in 
  Tables 
  A1-2.9 
  (Level 
  1 
  PSA), 
  A1-3.6 
  (Level 
  2 
  PSA), 
  A1-4.2 
  (Level 
  3 
  PSA) and A1-5 (Overall conclusions from the PSA) of Appendix 1. 
   been 
  made, 
  where 
  the 
  risk 
  in 
  relation 
  to 
   possible, 
  of 
  the 
  those 
  calculated 
   target 
   in 
   the 
   6. 
   6.1 
   6.2 
   6.3 
   6.4 
   6.5 
   6.6 
   7. 
   7.1 
   7.2 
   7.3 
   7.4 
   7.5 
   7.6 
   7.7 
   7.8 
   REFERENCES (GENERAL) 
   ONR, Safety Assessment Principles for Nuclear Facilities, 2014 Edition.  
   US NUCLEAR REGULATORY COMMISSION, Handbook of Parameter Estimation for 
  Probabilistic Risk Assessment, NUREG/CR-6823 (2002) 
   BEDFORD, T, COOKE, R, Probabilistic Risk Analysis – Foundations and Methods, 
  Cambridge University Press (2001) 
   INTERNATIONAL ATOMIC ENERGY AGENCY, Living Probabilistic Safety 
  Assessment (PSA), IAEA-TECDOC-1106, IAEA, Vienna (1999) 
   HSE, Reducing Risks and Protecting People – HSE’s Decision Making Process, 2001 
   ONR, Risk informed regulatory decision making, 2017 
   REFERENCES (TECHNICAL ASSESSMENT GUIDES, TAGS) 
   NS-TAST-GD-005, Guidance on the demonstration of ALARP. 
   NS-TAST-GD-011, The single failure criterion. 
   NS-TAST-GD-063, Human reliability analysis.  
   NS-TAST-GD-016, Integrity of metal components and structures. 
   NS-TAST-GD-017, Civil engineering. 
   NS-TAST-GD-036, Diversity, redundancy, segregation and layout of mechanical plant. 
   NS-TAST-GD-042, Validation of computer codes and calculation methods. 
   NS-TAST-GD-046, Computer based safety systems. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 23 of 81 
    
    
    
    
    
   Office for Nuclear Regulation  
   7.9 
   NS-TAST-GD-050, Periodic Safety Reviews (PSRs). 
   7.10 
   NS-TAST-GD-051, The purpose, scope and content of safety cases. 
   8. 
   BIBLIOGRAPHY  
   8.1 
   8.2 
   8.3 
   8.4 
   9. 
   (See also list of References and Bibliography of Appendix 1) 
  INTERNATIONAL ATOMIC ENERGY AGENCY, Procedures for Conducting 
  Probabilistic Safety Assessment for Non-Reactor Nuclear Facilities, IAEA TECDOC-
  1267, IAEA, Vienna (2002) 
   INTERNATIONAL ATOMIC ENERGY AGENCY, A Framework for a Quality Assurance 
  Programme for PSA, IAEA-TECDOC-1101, IAEA, Vienna (1999).  
   INTERNATIONAL ATOMIC ENERGY AGENCY, IPERS Guidelines for the 
  International Peer Review Service. Second Edition. Procedures for Conducting 
  Independent Peer Reviews of Probabilistic Safety Assessments, IAEA-TECDOC-832, 
  IAEA, Vienna (1995). 
   INTERNATIONAL ATOMIC ENERGY AGENCY, Dependability Assessment of 
  Software for Safety Instrumentation and Control Systems at NPPs, IAEA Nuclear 
  Energy Series NP-T-3.27, IAEA, Vienna (2018) 
   APPENDIX 1 - NS-TAST-GD-030 – ASSESSMENT EXPECTATIONS FOR REVIEW 
  OF PSAS FOR NUCLEAR POWER PLANTS 
   A1-1  Introductory note 
   A1-1.1 
  This 
  Appendix 
  provides 
  detailed 
  guidance 
  on 
  the 
  assessment 
  of 
  PSA 
  specific 
  for 
  Nuclear 
  Power 
  Plants 
  (NPPs). 
  This 
  is 
  presented 
  in 
  the 
  form 
  of 
  a 
  Table 
  of 
  Assessment 
  Expectations 
  for different stages 
  in 
  the 
  lifecycle of a nuclear power plant, 
  i.e. PSAs submitted 
  for 
  generic 
  design 
  assessment 
  (GDA), 
  site 
  licensing, 
  reactor 
  commissioning 
  and 
  to 
  support 
  NPP 
  operation. 
  Inspectors 
  should 
  bear 
  in 
  mind 
  that 
  much 
  of 
  the 
  guidance 
  provided 
  in 
  Appendix 1 can also be applied to other types of installations. 
  A1-1.2 
  There 
  is 
  an 
  expectation 
  that 
  dutyholders 
  will 
  present 
  the 
  PSA 
  analysis 
  within 
  a 
  framework compatible with good industry practices. For NPPs this suggests a traditional Level 
  1, 2, 3 PSA 
  framework as presented 
  in 
  IAEA Guidance (Refs A1-4.1 – A1-4.4). Inspectors will 
  gain 
  confidence 
  in 
  the 
  acceptability 
  of 
  risk 
  from 
  the 
  facility 
  and 
  ALARP 
  compliance 
  by 
  reviewing 
  the 
  facility 
  risk 
  level 
  against 
  the numerical 
  targets 
  of 
  the SAPs 
  and 
  the probabilistic 
  criteria 
  proposed 
  by 
  INSAG 
  (Ref 
  A1-4.5), 
  which 
  implies 
  a 
  need 
  to 
  calculate 
  the 
  appropriate 
  risk figures of merit including core damage frequency and large release frequency. 
  A1-1.3 
   However, 
  in order 
  to address 
  the 
  relevant numerical 
  targets of 
  the SAPs, dutyholders 
  will 
  also 
  need 
  to 
  identify 
  and 
  study 
  those 
  sequences 
  that 
  have 
  a 
  higher 
  frequency 
  but 
  lower 
  radiological 
  consequence. 
  As 
  an 
  example, 
  in 
  PWRs, 
  Steam 
  Generator 
  Tube 
  Rupture 
  sequences without core damage could 
  lead 
  to 
  releases 
  in 
  the 
  lower dose bands of Numerical 
  Target 
  8 
  of 
  the SAPs. 
  The 
  guidance 
  in 
  this Appendix 
  does 
  not 
  specifically 
  cover 
  assessment 
  expectations 
  for PSA studies addressing 
  release categories 
  for non-core damage sequences. 
  ONR 
  prefers 
  that 
  dutyholders 
  present 
  the PSAs 
  for NPPs 
  in 
  the 
  traditional 
  Level 
  1, 
  2, 
  3 
  PSA 
  framework 
  as 
  discussed 
  above, 
  addressing 
  release 
  categories 
  for 
  non-core 
  damage 
  sequences separately.  
  A1-1.4  Other aspects not specifically covered by the guidance in this Appendix include worker 
  risk and risk from facilities at the NPP other than the nuclear reactor. Nevertheless, these risks 
  need 
  to be 
  evaluated by 
  the dutyholders 
  in order 
  to address 
  the 
  relevant numerical 
  targets of 
  the SAPs.  
  A1-2 
  Not used 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 24 of 81 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   A1-3 
   Use of this Appendix 
   A1-3.1 
  The 
  Tables 
  in 
  this 
  Appendix 
  present 
  check 
  lists 
  of 
  items 
  that 
  inspectors 
  should 
  generally 
  expect 
  to 
  see 
  when 
  assessing 
  the 
  different 
  areas 
  of 
  the 
  PSAs 
  for 
  nuclear 
  reactors. 
  The aim is to address all key aspects of modern PSA for nuclear reactors to help inspectors to 
  assess, 
  raise 
  comments, 
  questions 
  and 
  issues 
  in 
  a 
  focused 
  and 
  systematic 
  fashion, 
  and, 
  finally, judge the adequacy of each feature of the PSAs submitted by the dutyholders.  
  A1-3.2 
   Although 
  an 
  attempt 
  has 
  been made 
  to make 
  this 
  appendix 
  comprehensive, 
  it 
  is 
  only 
  meant 
  for 
  guidance 
  and 
  by 
  no 
  means 
  should 
  be 
  taken 
  to 
  imply 
  that 
  inspectors 
  have 
  no 
  discretion when choosing the scope and depth of the assessment to be undertaken.  
  A1-3.3 
  In 
  addition, 
  it 
  should 
  be 
  stressed 
  that 
  is 
  not 
  the 
  intention 
  of 
  Appendix 
  1 
  to 
  prescribe 
  specific 
  methods 
  and 
  approaches 
  for 
  conducting 
  PSA 
  for 
  NPPs. 
  Dutyholders 
  may 
  choose 
  to 
  use 
  alternative methods 
  to 
  those 
  covered 
  in 
  this 
  appendix 
  as 
  long 
  as 
  they 
  are 
  shown 
  to 
  lead 
  to 
  equally 
  valid 
  outcomes. 
  In 
  cases 
  where 
  the 
  PSA 
  or 
  specific 
  areas 
  of 
  it 
  have 
  been 
  undertaken 
  using 
  alternative 
  approaches, 
  inspectors, 
  should 
  review 
  on 
  a 
  case-by-case 
  basis 
  and judge each on its own merits.  
  A1-3.4 
   This Appendix 
  can 
  be 
  used 
  in 
  a more 
  prescriptive manner when 
  commissioning PSA 
  assessment 
  work 
  (to 
  be 
  done 
  on 
  behalf 
  of 
  ONR) 
  from 
  external 
  contractors. 
  In 
  such 
  cases, 
  inspectors may wish to restrict the use of discretion by the contractor and/or specify the scope 
  and depth of assessment. 
   A1-4 
   References 
   A1-4.1 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Safety 
  Assessment 
  and 
  Verification 
  for 
  Nuclear 
  Power 
  Plants, 
  Safety 
  Standards 
  Series, 
  Safety 
  Guide 
  NS-G-1.2, 
  IAEA, 
  Vienna 
  (2001) 
  A1-4.2 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Procedures 
  for 
  Conducting 
  Probabilistic Safety Assessment 
  of Nuclear Power Plants 
  (Level 
  1), Safety Series No 
  50-P-4, 
  IAEA, Vienna (1992) 
  A1-4.3 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Procedures 
  for 
  Conducting 
  Probabilistic 
  Safety 
  Assessments 
  of 
  Nuclear 
  Power 
  Plants 
  (Level 
  2): 
  Accident 
  Progression, 
  Containment 
  Analysis 
  and 
  Estimation 
  of 
  Accident 
  Source 
  Terms, 
  Safety 
  Series 
  No. 
  50-P-8, 
  IAEA, Vienna, 1995 
  A1-4.4 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Procedures 
  for 
  Conducting 
  Probabilistic Safety Assessments of Nuclear Power Plants (Level 3), IAEA-Safety Series 50-P-
  12, IAEA, Vienna (1996). 
  A1-4.5 
  INTERNATIONAL 
  NUCLEAR 
  SAFETY 
  ADVISORY 
  GROUP, 
  Basic 
  Safety 
  for Nuclear Power Plants, 75-INSAG-3 Rev. 1, INSAG-12, IAEA, Vienna (1999) 
   Principles 
   A1-5 
   Bibliography 
   A1-5.1 
  AMERICAN 
  SOCIETY 
  OF 
  MECHANICAL 
  ENGINEERS, 
  Standard 
  for 
  Probabilistic 
  Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-1.4-2013 (2013) 
  A1-5.2 
  AMERICAN 
  NUCLEAR 
  SOCIETY, 
  External 
  Events 
  PRA 
  Methodology, 
  American 
  National Standard, ANSI/ANS-58.21-2007 (2007) 
  A1-5.3 
  EPRI/NRC-RES, 
  Fire 
  PRA 
  Methodology 
  6850 (2005) 
  A1-5.4 
  AMERICAN 
  NUCLEAR 
  SOCIETY, 
  Standard, ANSI/ANS-58.23-2007 (2007) 
  A1-5.5 
  EUROPEAN 
  UTILITY 
  REQUIREMENTS 
  FOR 
  LWR 
  NUCLEAR 
  POWER 
  PLANTS, 
  Volume 2: Generic Nuclear Island Requirements – Chapter 17: PSA Methodology, Revision C 
  (2001) 
   Methodology, 
   NUREG/CR-
   American 
   National 
   for 
   Nuclear 
   Power 
   Facilities, 
   Fire 
   PRA 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 25 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ATOMIC 
  ENERGY 
  AGENCY, 
  Development 
  and 
  Application 
  of 
  Assessment 
  for 
  Nuclear 
  Power 
  Plants, 
  Specific 
  Safety 
  guide 
  No. 
   A1-5.6 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Determining 
  the 
  quality 
  of 
  probabilistic 
  safety 
  assessment 
  (PSA) 
  for 
  applications 
  in 
  nuclear 
  power 
  plants, 
  IAEA-
  TECDOC-1511, IAEA, Vienna (2006) 
  A1-5.7 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Development 
  and 
  Application 
  of 
  Level 
  1 Probabilistic Safety Assessment 
  for Nuclear Power Plants, Specific Safety Guide No. 
  SSG-3. IAEA, Vienna 2010. 
  A1-5.8 
  INTERNATIONAL 
  Level 
  2 
  Probabilistic 
  Safety 
  SSG-4. IAEA, Vienna 2010. 
   A1-5.9 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Probabilistic 
  safety 
  assessments 
  of 
  Nuclear Power Plants for low power and shutdown modes, IAEA-TECDOC-1144, IAEA (2000) 
  A1-5.10 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Review 
  of 
  Probabilistic 
  Safety 
  Assessments by Regulatory Bodies, IAEA-Safety Report Series No 25, IAEA, Vienna (2002) 
  A1-5.11 
  INTERNATIONAL 
  ATOMIC 
  ENERGY 
  AGENCY, 
  Treatment 
  of 
  Internal 
  Fires 
  in 
  Probabilistic Safety Assessment 
  for Nuclear Power Plants, IAEA Safety Report Series No. 10, 
  IAEA, Vienna (1998) 
  A1-5.12  NUCLEAR ENERGY INSTITUTE, Probabilistic Risk Assessment (PRA) Peer Review 
  Process Guidance, NEI 00 02 (2000) 
  A1-5.13 
  NUCLEAR 
  ENERGY 
  INSTITUTE, 
  Process 
  for 
  Performing 
  Reviews using the ASME PRA standard, NEI 05-04 (January 2005) 
   Peer 
   Follow 
   on 
   PRA 
   A1-6 
   Table of Assessment Expectations 
   ASSESSMENT EXPECTATION 
   1. 
   Table A1-1.  General Expectations 
   Table A1-1.1  Approaches and methodologies 
   MET? 
   This table lists PSA Assessment Expectations for all the technical 
  areas of Level 1, 2 and 3 PSA. It is not the intention of this guide to 
  prescribe specific methods and approaches for all those technical 
  areas.  
  The dutyholder may choose to use alternative methods to those 
  covered by this table of expectations as long as they lead to equally 
  valid outcomes.  
  In cases where the PSA or specific areas of it have been undertaken 
  using alternative approaches, ONR will review them on a case-by-
  case basis and judge them on their own merits. External expert 
  support should be sought where necessary.  
   Task procedures have been developed for the individual PSA tasks 
  and these have been provided by the dutyholder. 
  ONR inspectors may wish to assess or audit the PSA task procedures 
  to gain confidence on the general adequacy of the methods and 
  approaches and their implementation, before specific detailed 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 26 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
     
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   assessments are undertaken of the various aspects of the PSA 
  models and data. 
   Inspectors may wish to request information on any independent or 
  peer review of the PSA commissioned by the dutyholders (e.g., 
  scope, findings, dutyholder’s action plan to address findings and their 
  status) in order to plan and inform their own assessment. 
   Inspectors may consider requesting the dutyholders to conduct self-
  assessments against this TAG and provide the results to ONR. 
   Table A1-1.2  PSA Scope 
   The overall risk analysis of the NPP covers all sources of radioactivity 
  at the facility (reactor core, fuel ponds, fuel handling facilities, waste 
  storage tanks, etc).  
  Adequate justification is provided when sources of radioactivity are 
  not included in the scope of the detailed PSA. 
   The PSA covers all types of initiating events (internal events, internal 
  hazards, external hazards). 
   The PSA covers all operational modes. 
   Table A1-1.3  Freeze Date 
   The freeze date for the design and operational features reflected in a 
  particular submission should be explicitly stated. 
   All the PSA models, data, documents and references that support the 
  submission are up-to-date and consistent with the “freeze date”. 
   Table A1-1.4  Computer Codes and Inputs 
   The codes used (e.g. for derivation of success criteria, accident 
  progression analyses, analysis of structural integrity of containment 
  and any other structures, fission product release and transport, 
  consequences on human health, etc) have been verified, validated or 
  qualified, as appropriate.  
  All codes and inputs meet ONR quality expectations as described in 
  SAPs paragraphs 678 ff and NS-TAST-GD-042. 
   The analyses, including the development and operation of the 
  computer codes, have been performed by suitable qualified and 
  experienced analysts. 
   The degree of accuracy, uncertainties and limitations associated with 
  the selected computer codes are identified. 
  The codes have been used within their limit of applicability. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 27 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The modelling (nodalization) of the plant inputted as underlying basis 
  for the code calculations (e.g., thermal-hydraulic, accident 
  progression, structural integrity, etc), is adequate and auditable. 
   The PSA quantification software is capable of quantifying the entire 
  model. 
   The input data files for the code calculations are auditable.  
  The sources of information (e.g. design documents) are identified. 
   Facility-specific and site-specific information are used.  
  If walk downs are used to obtain input data, these are documented in 
  an auditable fashion. 
   ONR holds a license for the PSA quantification software used, or 
  alternative suitable arrangements for PSA quantification by ONR 
  inspectors (or their contractors) are feasible. 
   All computer files for the PSA model/s and reliability database/s have 
  been provided to ONR. 
   Table A1-1.5  Assumptions in the PSA 
   All assumptions made throughout the study are clearly identified, 
  described and properly justified. 
  The specific aspects of the PSA models or data related to these 
  assumptions are clear.  
  A table of assumptions is provided. 
   The PSA may have to make use of assumptions for aspects of the 
  facility not yet available / under development and also when factual 
  information is missing or incomplete – it should be noted, however, 
  that ONR would not consider acceptable the use of assumptions in 
  the PSA in lieu of making use of factual information which is available 
  or can be obtained.   
   A process is in place to capture, track and review assumptions made 
  in the PSA, which could be affected by siting, design and 
  construction, or operational matters (such as procedures, 
  maintenance and testing strategies, training programmes, control 
  room staffing and organisation, etc), which need to be reviewed when 
  detailed information becomes available.  
   The system to capture, track and review PSA assumptions enables 
  the latest available design an operational information to be transferred 
  to the PSA so that assumptions (and models) can be reviewed 
  accordingly. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 28 of 81 
    
    
    
    
    
    
    
    
    
    
    
     
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   2. 
   Table A1-2.  Level 1 PSA 
   MET? 
   All the criteria used in the Level 1 PSA are defined and are adequate, 
  for example criteria for CORE DAMAGE for the Reactor PSA, criteria 
  for FUEL DAMAGE for the Fuel Route PSA, etc. 
   If design targets for CORE DAMAGE FREQUENCY, FUEL DAMAGE 
  FREQUENCY, etc, have been identified, these are explicitly stated. 
   Table A1-2.1  Identification and Grouping of Initiating Events 
    
   that 
  lead 
   The task scope is explicitly stated:  
   
  For 
  the 
  Reactor 
  PSA, 
  this 
  task 
  addresses 
  require 
  mitigation 
  to 
  prevent 
  core 
  damage 
  directly to core damage.  
  For 
  the 
  Fuel Route PSA, 
  this 
  task 
  addresses 
  all 
  disturbances 
  that 
  require 
  mitigation 
  to 
  prevent 
  fuel 
  damage 
  and 
  those 
  that 
  lead 
  directly to fuel damage.  
   all 
  disturbances 
  and 
  those 
  that 
   The process used in the identification and definition of initiating 
  events is clear and leads to a systematic and comprehensive 
  identification of initiating events. 
   Detailed records exists of all deductive analyses (e.g. master logic 
  diagrams) and / or inductive analyses (e.g. failure modes and effects 
  analyses) done to identify initiating events. All assumptions are 
  captured. 
   Previous experience at similar NPPs has been searched for and fed 
  back into the initiating event identification process. 
   The source documents used are identified. The applicability of the 
  information extracted and used from these source documents is clear. 
   A database exists of abnormal events and incidents which have led 
  (or could lead) to disruption of normal operation. This includes those 
  equipment failures that led to an initiating event and any 
  consequential failures to perform one or more of the safety functions 
  required. It also includes information on any test or maintenance 
  activity taking place at the time which could be related to the event. 
   A database exists for future recording of abnormal events and 
  incidents which lead (or could lead) to disruption of normal operation. 
   The analysis of the applicability of the initiating events to each 
  operating mode is transparent. 
   Consequential initiating events have been addressed and the way in 
  which they are developed is clear.  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 29 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   Each initiating event is clearly defined and characterised (i.e. its 
  causes and impact on plant are identified). 
   The process for grouping initiating events is clear, i.e. the grouping 
  criteria and the mapping to derive the final initiating event groups are 
  transparent. 
   Each initiating event group is represented by the most onerous event. 
   The initiating event groups have been defined in a way that 
  vulnerabilities are not masked.  
   Each initiating event group is clearly defined and characterised. The 
  information provided is sufficient for the quantification of initiating 
  event frequencies (i.e. its causes are identified) and for the 
  development of accident sequence models (i.e. its impact on plant is 
  stated).  
   Table A1-2.2  Accident sequence Development: Determination of Success Criteria 
   For each initiating event group, the safety functions, the systems 
  which can perform each of the functions, and any need for operator 
  intervention, are identified.  
   The sources and methods used for the derivation of success criteria 
  are transparent. 
   The limiting conditions defined for success / failure (for example, 
  cladding temperature, coolant system pressure, coolant system level, 
  enthalpy in fuel pellets, containment temperature and pressure, etc.) 
  are stated, justified, and are realistic. 
   The thermal-hydraulic, neutronics (and any other) analyses used for 
  derivation of success criteria have been performed on a best-estimate 
  basis and are specific to the facility. 
   Sufficient and representative thermal-hydraulic analyses have been 
  performed to demonstrate that each of the success paths depicted in 
  the event trees do indeed lead to successful outcomes (e.g., non core 
  damage).  These analyses are available and traceable. 
   Sufficient and representative thermal-hydraulic analyses have been 
  performed to demonstrate that a given system response will prevent 
  the safety limit being exceeded.   
   Timing for operator actions is justified (e.g. by sufficient and 
  representative thermal-hydraulic analyses). 
   The supporting analyses used to define the success criteria for each 
  success sequence in the event trees have adequately addressed the 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 30 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
    
    
    
   arise 
  during 
  the 
  and 
  operability 
  of 
  into 
  consideration 
   break 
  location) 
  have 
  been 
  to 
  be 
  bounding 
  for 
  the 
   following: 
   
  If initiating events have been grouped, the most onerous initiator is 
  considered. 
  Sequence 
  assumptions 
  (e.g., 
  LOCA 
  appropriately 
  chosen 
  and 
  justified 
  sequences depicted in the event trees. 
  The 
  influence 
  of 
  the 
  physical 
  conditions 
  that 
  evolution 
  of 
  the 
  sequences 
  on 
  the 
  functionality 
  the 
  systems 
  and 
  the 
  functions 
  has 
  been 
  taken 
  in the evaluation of the success criteria 
  The 
  analyses 
  have 
  considered 
  the 
  mission 
  time 
  for 
  each 
  sequence 
  (time 
  required 
  to 
  reach 
  a 
  stable 
  state 
  that 
  can 
  be 
  maintained without the actuation of additional systems)  
  Event 
  timings 
  and 
  time 
  window 
  definitions 
  have 
  been 
  adequately 
  treated.   
  Timings 
  for 
  a 
  manual 
  action 
  at 
  a 
  given 
  header 
  are 
  based 
  on 
  accident sequence modelling which appropriately 
  treats preceding 
  manual actions. 
  Any 
  conservatisms 
  conservatisms. 
  The use of the codes for each specific application is justified. 
   excessive 
   identified, 
   and 
   are 
   there 
   are 
   no 
    
    
    
    
   If use is made of success criteria for the various initiating event 
  groups from sources other than facility-specific analyses, the rationale 
  for this and the analysis of applicability are transparent and the 
  justification is adequate. 
   The thermal-hydraulic, neutronics (and any other) analyses used for 
  derivation of success criteria are thoroughly documented and fully 
  traceable. 
   For each success criterion, all applicable items are identified and 
  defined: 
   
  Clear definition of exact meaning of ‘success’.  
   
  Minimum 
  equipment 
  requirements 
  and 
  performance 
  (including mission times) 
  Details of 
  the 
  specific operator 
  actuations 
  for 
  manual 
  actuation 
  which 
  can 
  lead 
  considering any prior manual actions). 
   for 
    
   required and 
  latest 
  time 
  to 
  success 
  (especially 
   success 
   The regulator may choose to review in depth a representative subset 
  of thermal-hydraulic, neutronics and any other supporting analyses. In 
  these cases no significant errors have been found. 
   The regulator may choose to independently perform a representative 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 31 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   subset of thermal-hydraulic, neutronics and any other supporting 
  analyses. In these cases, the results obtained are consistent with 
  those presented by the dutyholder.   
   Table A1-2.3  Accident Sequence Development: Event Sequence Modelling 
   Table A1-2.3.1  General 
   The general assumptions relating to all event tree development are 
  defined up-front and properly justified. 
   General information is provided on the type of event tree models 
  produced and on the level at which the event tree headings are 
  defined (safety function, system, train). 
   The descriptive text for all event tree headings is clear and consistent 
  (and preferably expressed as functional success, e.g., “Injection of 
  2oo3 HHSI pumps” or “Operator starts depressurisation”, etc). 
   Sequence end states are identified and defined. 
   Any sequence end-state other than “Success” or “Core Damage” is 
  identified and defined, the rationale for its use explained (including the 
  overall contribution to the conclusions of the PSA). 
   As many event trees as necessary have been constructed so that the 
  PSA model does not have asymmetries artificially built in.  This is of 
  upmost importance to ensure the suitability of the PSA to support a 
  number of applications such as Risk Monitoring and those 
  applications based on evaluation of the results of the Importance 
  Analysis 
   Table A1-2.3.2  Specific for each Initiating Event Group Event Tree 
   All the sequences have been developed to a point in which a safe 
  stable state that can be maintained in the “long-term” without the 
  actuation of additional systems has been achieved.   
  The sequence timings are stated and justified. 
  Sequences in which a safe stable state has not been achieved (within 
  the established timing) have been assigned to Core Damage.  
   The evolution of the sequence of events following the representative 
  initiator from each initiating event group is described. This includes 
  the parameters that cause reactor trip, the signals / channels that 
  initiate various safety functions, and the operators’ intervention in the 
  course of the sequence. 
  The timing of events in the sequence following the success or failure 
  of signals / safety functions are identified and defined. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 32 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   All dependencies (human actions, equipment, environmental, spatial, 
  common mode failure, fluid medium) are identified and the way in 
  which such dependencies have been treated and included in the 
  accident sequences (either explicitly or implicitly) is correct.  
  Analysis to identify subtle dependencies has been carried out and 
  these have been incorporated in the PSA models. Some examples of 
  subtle dependencies are those which may arise between initiating 
  event and the safety functions / systems due to software based 
  control and protection systems, vapour locking of pipes due to high 
  temperature, and other dependencies which may otherwise have 
  been missed. 
   Each heading in the event tree is described, and its relationship to a 
  functional fault tree, system fault tree, human failure event, or other 
  event is identified. 
   When the same event tree heading is used with different boundary 
  conditions for different sequences (e.g., to capture dependencies on 
  the success or failure of preceding event headings), the various 
  boundary conditions for each heading are described. Its relationship, 
  depending on each boundary condition, to one or more functional 
  fault trees, system fault trees, human failure events, or other events is 
  identified. The way in which this is implemented in the modelling is 
  clearly described. 
   The mission time for each heading of each branch of the tree, when 
  applicable, is stated and justified (see SAPs para 652). 
  (Note: The IAEA standard on Level 1 PSA No SSG-3 indicates in 
  paragraph 5.49 says: ""The success criteria should specify the mission 
  times for the safety systems, that is, the time that the safety systems 
  will need to operate so that the reactor reaches a safe, stable 
  shutdown state and that will allow for long term measures to be put in 
  place to maintain this state. In many cases this has been taken to be 
  24 or 48 hrs for most initiating event. For new designs that provide the 
  features to delay core damage, consideration of longer mission time 
  may be necessary"" 
  There are more references to mission time in this standard (e.g., 
  paragraph 5.135, 9.28, 9.31, 9.53,).  
  The ASME PRA standard is also clear about this indicating that the 
  end states of the Level 1 PSA have to be a ""Steady state condition"" at 
  the end of the mission time or ""Core Damage"") 
   The link between the various headings / nodes of the event tree and 
  the relevant thermal-hydraulic analyses performed to support the 
  event sequence modelling is transparent. 
   The link is clear between the various headings / nodes of the event 
  tree and the relevant operational and emergency procedures to be 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 33 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   used.  
   MET? 
   Any basic event used to replace an integrated time dependent 
  function (such as the failure to recover off-site power before a certain 
  time interval has elapsed given that the diesel generators have failed 
  to supply power) is properly described and substantiated. 
  Confirmation is included that potential dependencies have been 
  examined and also explanation of how these have been dealt with (if 
  applicable) included.  
   The treatment of consequential initiators within the event trees is 
  clear, as well as the transfer of the end state of sequences in one tree 
  to initiators in other event trees. 
   Appropriate explanations are included of the functional fault trees 
  developed to link the event tree headings with the system fault trees. 
  The link between the functional fault trees and the relevant success 
  criteria is stated.  
   The functional fault trees are correct. They provide an adequate 
  representation of the functional failures intended. 
   The information required to set up the boundary conditions for the 
  quantification of each sequence is transparent. 
   The event trees have been constructed correctly and provide 
  adequate representations of the evolution of the accident sequences 
  following all the initiating event groups under consideration. 
   Table A1-2.4  Systems Analysis 
   Table A1-2.4.1  General 
   The approach used for the definition of system boundaries is 
  transparent and adequate. 
   The approach used to define component boundaries in the 
  mechanical, I&C and electrical subsystems is transparent and 
  adequate. 
   The general approach applied for the inclusion of unavailabilities due 
  to test and maintenance activities, in the system models is 
  transparent and adequate. 
   The general approach used for the inclusion of pre-accident human 
  failure events (e.g. individual and common cause component 
  misalignments and mis-calibrations of instrument and protection 
  channels) into the system models is clear and adequate. 
   The general approach used for the inclusion of post-accident human 
  failure events (detection, decision errors, omission errors, commission 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 34 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   errors, etc, and common cause human failures) into the system 
  models is clear and adequate.  
   The general approach used for the inclusion of (hardware / software) 
  common cause failure (CCF) events into the system models is clear. 
  The approach is adequate and includes consideration of both intra-
  system and inter-system CCF events.  
   The general approach applied for the inclusion of structural failures 
  into the system models is clear and adequate. 
   The general approach applied for the inclusion of passive component 
  failures into the system models is clear and adequate. 
   The event naming scheme is clear and consistent throughout the 
  models. 
   Generally applicable modelling assumptions, e.g. those related to 
  inclusion or exclusion of passive components, criteria for inclusion or 
  exclusion of diversion paths, etc, are defined up-front and properly 
  justified. 
   The list of failure modes applicable to each component type is 
  identified up-front and complete.  
   The descriptive text for all fault tree gates and basic events is clear 
  and it is consistently expressed as functional failure, e.g., “2oo3 HHSI 
  pumps fail to inject”, “Pump X fails to start”, etc). 
   A description of the way in which circular logics (also known as logic 
  loops) have been dealt with in the fault tree models is provided and is 
  adequate. 
   The level of detail of the system fault tree models is consistent 
  throughout the system analysis. 
   The level of detail of the fault trees is sufficient to ensure: that they 
  are realistic; that the logic of the models is correct; that all the 
  dependencies are captured; that the resulting cutsets for failures of 
  the system reflect combinations of failures that can be easily 
  understood; and that the data used is applicable to the boundary 
  selected for each component basic event in the PSA. 
   The fault trees do not have asymmetries artificially built in.  This is of 
  upmost importance to ensure the suitability of the PSA to support a 
  number of applications such as Risk Monitoring and those 
  applications based on evaluation of the results of Importance 
  Analysis. 
   Table A1-2.4.2  Specific for each System Model 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 35 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   A description of the system is available that covers: the description of 
  the system and its operation modes, its normal configuration when 
  the reactor is at power, its configuration(s) following reactor trip, and 
  its configuration for non-power states.  
   A simplified system diagram is presented that includes all the 
  components modelled (adequately labelled, and without omission) 
  and that clearly indicates the system boundaries and interfaces with 
  other systems.  
   The references to all design information / characteristics, including 
  environmental qualification of all system components are listed and 
  up-to-date. 
   The system boundaries are clearly identified and there are no gaps 
  and / or overlaps at the interface with other systems modelled in the 
  PSA. 
   System success criteria are stated. 
  The success criteria applied in the PSA model (e.g. the applied front-
  line system success criteria) are consistent with those obtained in the 
  task on determination of success criteria.  
  The success criteria for support systems are consistent with the 
  outcome from the task analysis of front line systems. 
   The information on dependencies for each component is transparent 
  (including the support systems / actuation signal interface points).  
  Any dependency on room / cabinet cooling is considered when 
  necessary for normal and post trip conditions for all initiators.  
  No dependencies are missing. 
   The resulting success criteria for the system’s support systems based 
  on the above is stated.  
   Information on system tests is provided (including, for each system 
  test, relevant aspects such as test frequency, components and failure 
  modes tested, system realignments and component unavailabilities 
  due to test). 
   Information on system maintenance for all components is provided 
  (including the mechanical and electrical tag out boundaries, i.e. an 
  identification of all the mechanical, electrical, instrumentation, etc, 
  components which are functionally unavailable or isolated in order to 
  perform the maintenance). 
   Fault tree modelling assumptions specific to the system (including all 
  those assumptions made to simplify the model) are described, 
  justified and reasonable. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 36 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   Appropriate explanations are included to facilitate understanding of 
  the fault tree logic. This should also include descriptions of the way in 
  which specific circular logics have been removed. 
   All dependencies are captured in the fault tree and have been 
  modelled correctly. 
   All relevant component failures have been correctly included in the 
  fault tree.  
   The events that represent unavailabilities due to testing and 
  maintenance have been modelled correctly. 
  All configurations allowed by the NPP procedures are represented in 
  the models. 
  The chosen modelling “solution” to avoid combinations of 
  maintenance activities forbidden by rules and procedures has been 
  implemented properly.  
   Hardware failures that contribute to the Human Failure Events (e.g. 
  failure of the alarms or indications) have been included in the model.   
  Justification has been provided for any cases where these hardware 
  failures have not been included based on the assumption that the 
  HFE dominates. 
   All relevant human failure events have been correctly included in the 
  fault tree  
   All house events used to deal with asymmetry in the system 
  alignment or to enable the single fault tree model to be used for the 
  various possible system configurations are listed and described.  
  The purpose of each house event is clear.  
  A table is included that lists the house events modelled in the system 
  fault trees and their settings in each heading, sequence or event tree. 
  The settings are correct. 
   The use of lumped, module events or super-components has been 
  avoided or minimised to the extent possible. 
   If lumped, module events or super-components (beyond the pre-
  established component boundaries) are used in the fault trees, the 
  contents included within the boundary of the event are clearly 
  identified (in terms of components, failure modes and interrelations).  
   If lumped, module events or super-components are used in the fault 
  trees, information on dependencies (outside the event boundary) is 
  transparent. These dependencies are properly captured in the fault 
  tree models. No dependencies are missing. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 37 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   All intra-system and inter-system CCFs to be modelled in the system 
  fault tree have been identified in conformance with the general 
  approach to the analysis of CCFs. 
   All hardware recoveries modelled are described and justified. 
   All the system fault trees (top gates) are listed together with their 
  description.  
   All the gates which are transfers to other system models (e.g. support 
  system top gates) are listed together with their description. 
   All the modelled events are listed together with their descriptions. This 
  list is traceable to the fault trees and the system simplified diagram 
  and description. 
   The fault tree logic is correct. No events are missing. The fault trees 
  provide an adequate representation of the system failures for the 
  facility under evaluation. 
   Table A1-2.5  Human Reliability Analysis (HRA) 
   Note: The expectations in this table are consistent with the guidance 
  provided in the TAG on Human Reliability Analysis NS-TAST-GD-063 
   The methodology/ies selected for the HRA, and in particular for the 
  evaluation of human error probabilities (HEP), including the choice of 
  human reliability data sources, is / are justified.  
   The types of human failure events, HFEs, (i.e. those basic events in 
  the fault trees and event trees which represent the human-induced 
  failures of functions, systems or components) that are included in the 
  logic model structure are identified up-front. Important types of HFEs 
  have not been omitted. 
   Pre-initiating event HFEs include individual and common-cause 
  misalignments and mis-calibrations. The identification of these events 
  is complete.  
  If some potential pre-initiating event HFEs are not included in the 
  model, adequate justification is provided.  
  The modelling of pre-initiating event HFEs events is correct. 
   If HFEs associated with initiating events are embedded in the data 
  used in the analysis of initiating event frequencies for the Full Power 
  PSA, justification is provided that these human actions have been 
  adequately captured. 
  Explicit analysis of HFEs associated with the initiating event is 
  generally performed for the PSA for Low Power and Shutdown modes 
  (see Table A1- 2.8 below). 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 38 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   Post-initiating event HFEs include failures to carry out required 
  actions in response to procedures, alarms and other cues and un-
  required human actions in response to situations that have been 
  diagnosed incorrectly. The identification of these events is complete.  
  If cases exist where the HFE related to the detection / decision part of 
  the human action has been modelled separately from the HFE/s 
  related to the manual actuation part of the human action, the rationale 
  for this is clear. 
  If some potential post-initiating event HFEs are not included in the 
  model, adequate justification is provided.  
  The modelling of post-initiating event HFEs events is correct. 
   For each pre-initiating event HFE, all the operational activities which 
  could lead to the human error are identified (e.g. surveillance tests, 
  calibrations, maintenance activities or operational realignments).  
   For each pre-initiating event HFE, all the alarms, indications, 
  surveillances or tests credited to contribute to the recovery of the mis-
  alignment / mis-calibration are identified. The ability to recover the 
  HFE is clear in each case. 
   For each pre-initiating event HFE which involves failure to respond to 
  procedural steps, equipment failures, alarms or other cues, the cues 
  are identified. 
   Occasions for misdiagnosis of the situation by the operators have 
  been analysed systematically.  
  HFEs resulting from identified credible mis-diagnosis have been 
  modelled correctly (e.g. human actuations due to mis-diagnosis that 
  change the course of an accident sequence will normally be modelled 
  in the event trees. Un-required switching off of systems due to mis-
  diagnosis will normally be modelled in the fault trees). 
   The human reliability quantification method/s selected is / are suitable 
  for the specific type of HFEs addressed with the method.  
   Specific human error contributors to each HFE are identified:  
   
  The 
  task 
  analysis 
  is 
  complete: 
  sub-tasks 
  included 
  as 
  possible 
  contributors 
  to 
  the 
  HFE 
  and 
  the 
  ones 
  which 
  are 
  not 
  included 
  are 
  identified. The rationale for the exclusion of sub-tasks is clear. 
   Facility-specific and HFE-specific influences of the factors required by 
  the quantification model (Performance Shaping Factors, PSFs) are 
  identified.  
  Facility-specific information obtained from observations made during 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 39 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   walk-downs and simulator exercises, review of procedures, 
  discussions with, and interviews and questionnaires to personnel, etc, 
  is used to characterise the PSFs for each HFE. The sources of 
  information are identified and auditable. The way in which this 
  information is used is transparent.  
   Time windows are correctly assigned; justification is given for the 
  choice of events that mark the start and end of the time windows 
  (cues and limiting times), dead times and time spent on other tasks 
  are accounted for and adjustments made as appropriate.  
   Specific expectations for the assessment of the HRA in Low Power 
  and Shutdown PSA are included in Table A1- 2.8 below. 
   Specific expectations for the assessment of the HRA for the Hazards 
  PSA are included in Table A1- 2.7 below. 
   The quantification of all the HFEs is transparent.  
  The quantification of all the HFEs has been done correctly and in 
  accordance with the HRA method/s selected. 
   If the probabilities for some HFEs in the models have not been 
  calculated using detailed HRA analyses (as above), an adequate 
  justification for the generic (screening) values used is provided. 
   Dependencies between HFEs appearing in the same accident 
  sequence are identified and accounted for.  
  The process by which the candidates for dependency were identified 
  is transparent. 
  Any assumptions made in the dependency analysis are described 
  and justified. 
  The determination of the degree of dependency is transparent and 
  justified. 
  The method by which the conditional probabilities of dependent HFEs 
  are calculated is clear.  
  The dependency analysis is adequate.  
   A list of all the HFEs included in the PSA, and their associated mean 
  probabilities and uncertainty ranges is included. This list is traceable 
  to all the supporting analysis. 
   Table A1-2.6  Data Analysis 
   Table A1-2.6.1  Initiating Event Frequencies 
   The initiating event definitions used in the data analysis task are fully 
  consistent with those used in the list of initiating events. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 40 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The criteria for selection of analysis methods are stated.  
  The approaches used to quantify initiating event frequencies are 
  suitable for each type of initiating event addressed.  
  The approach/es used to quantify frequencies of consequential 
  initiating events is / are correct.  
   The criteria for selection / precedence of data sources are stated. 
   Facility-specific event data has been used to the extent possible. 
  For cases where facility-specific event data is used, the source of 
  event records is available, comprehensive and auditable. 
  Facility-specific records have been interpreted correctly. 
   For cases where operational experience from NPPs of similar design 
  is used, its applicability is justified and the data used is auditable. 
   In all cases where either NPP-specific data or data from NPPs of 
  similar design has been used, information on the operating history of 
  the facility/ies where the event/s occurred has been used in the 
  determination of the denominators for the evaluation of initiating event 
  frequencies. This information is auditable. 
   For cases where generic reactor type initiating event frequencies are 
  used, this is justified and documented in an auditable fashion. 
   For cases where several sources of data are combined, the method 
  of combination is mathematically correct and has identified and taken 
  into consideration possible overlaps between the various data 
  sources. 
   For cases where logical models are used to calculate the initiating 
  event frequencies, these include all the foreseen inputs leading to the 
  initiating event. 
  The fault trees, human reliability analyses or other models used to 
  calculate initiating event frequencies are documented. In order to 
  review these, inspectors can use the relevant tables of this Appendix. 
   The initiating event groups are assigned frequencies equal to the 
  summed frequency of all the events in the group.  
   A list of all the initiating events, together with their frequencies, is 
  included. Each initiating event frequency is represented by a mean 
  value and a statistical representation of its uncertainty. This list is 
  traceable to the supporting analyses.  
   A list of all the initiating event groups, together with their frequencies, 
  is included. Each initiating event group frequency is represented by a 
  mean value and a statistical representation of its uncertainty. This list 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 41 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   is traceable to the supporting analyses.  
   Table A1-2.6.2  Random Component Failure Probabilities 
   MET? 
   The component populations together with their characteristics (e.g 
  those that define each population and make it a coherent set) are 
  clearly identified. The component populations defined are adequate. 
   The component boundaries (for each component population) used in 
  the data analysis task are shown to be exactly the same as those 
  used in the fault tree models.  
   The criteria for selection / precedence of data sources are stated. 
   For each component population that has been assigned failure rates 
  from a generic data source (or a source other than the facility itself), 
  justification is provided that the source is appropriate. Evidence is 
  included that the component boundaries (for the particular component 
  population) in the PSA and in the generic source of data are 
  consistent. 
   For cases where several sources of generic data are combined: the 
  method of combination is transparent; it has identified, and correctly 
  taken into consideration, possible overlaps between different sources 
  of generic data; and it is mathematically correct. 
   Facility-specific data has been used to the extent possible. 
  Where facility-specific data has been used either in isolation or 
  combined with generic data to calculate failure rates for component 
  populations, (including the use of multiple subcomponent data within 
  the fault tree component boundary) the event records, engineering 
  data, and operating history data (e.g., records of operating / stand-by 
  hours, of test / maintenance / repair time history) which have been 
  used are available and traceable.  
  The collection of facility records is comprehensive and exhaustive.  
  Evidence is provided that the PSA data analysts have checked the 
  quality and reliability of the facility-specific records used to support the 
  PSA.  
   Facility-specific records have been interpreted correctly (in particular 
  to identify the failure modes modelled in the fault tree) 
  The interpretation of historical records to reconstruct demand counts, 
  operational times, etc. is clear.  
   The method used for estimating failure rate parameters from raw data 
  is transparent and mathematically correct. No calculation errors are 
  identified. 
   The method used for estimating failure rate parameters from 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 42 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   combinations of generic and facility-specific data (or of pre-existing 
  and new facility-specific data) is transparent, mathematically correct 
  and state-of-the-art. No calculation errors are identified. 
   For component types where manufacturer’s data or expert-judgement 
  has been used, a robust justification is provided that neither facility-
  specific, nor generic data are available.  
  In instances where expert judgement has been used to estimate 
  component failure rates, the process is transparent and robust and 
  the outcome of the process is reasonable. Error factors are assigned 
  commensurate with the uncertainty in the process. 
  Instances where manufacturer’s data has been used are clearly 
  stated and the resulting failure rates are reasonable. Error factors are 
  assigned commensurate with the uncertainty in the data used. 
   Facility-specific information on test intervals is used to calculate 
  probabilities for the failure modes of the components on standby. The 
  tests selected are suitable for the failure modes of concern. This 
  information is consistent with the information on system testing 
  recorded in the documentation of the system analysis.  
   The mission times (used to calculate the probabilities of failure to 
  operate of components) are correct and consistent with the 
  information on mission times recorded in the documentation of the 
  Success Criteria Determination task. 
   The methodology used for the calculation of structural failure 
  probabilities is justified. The details of the analysis are transparent. 
  If use is made of data from structural (e.g. pipework) failure 
  databases, the sources of data and the way in which this data has 
  been used are clear. The applicability of the data is justified. 
  If use is made of a probabilistic fracture mechanics code, the code is 
  state of the art. Evidence is provided that the code has been validated 
  against operational experience and / or experiments. Evidence is 
  provided that the code users are sufficiently qualified and experienced 
  to be aware of the code’s capabilities and limitations.  
  The range of loads and combinations of loads that could lead to the 
  structural failures of concern should be adequate to represent the 
  conditions which are possible for the NPP under evaluation. 
  Inspectors should refer to TAGs NS-TAST-GD-016 and NS-TAST-
  GD-016017 for further guidance here. 
   Assumptions on the reliability of passive systems / features are 
  substantiated by appropriate and sufficient analysis covering the full 
  range of fault and accident conditions for which they are required and 
  by appropriate tests. The supporting evidence is available. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 43 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The methodology used for the estimation of failure probabilities for 
  computer-based systems is transparent and meets industry-accepted 
  practices. 
  The analysis of the software reliability carried out by the dutyholder 
  has identified the influencing factors that affect the quality of the 
  software. The results of these analyses have been taken into account 
  in the reliability calculation in a transparent manner. 
  If the software system has been separated into parts that are treated 
  individually in the reliability analysis, the dependencies between the 
  various parts are addressed explicitly. 
  The reliability analysis of the computer-based hardware is 
  documented.  
  Any self-checking built into the systems is taken into account in an 
  adequate manner. 
  The dependencies between diverse software systems are dealt with 
  explicitly. 
  Inspectors should refer to NS-TAST-GD-046 for further guidance on 
  computer-based systems. 
   A list of all the basic events that represent random component failures 
  together with their parameter estimates is included. 
  Each parameter estimate is represented by a mean value and a 
  statistical representation of its uncertainty.  
  This list is traceable to the supporting analyses. 
   Table A1-2.6.3  Unavailabilities Due to Testing and Maintenance  
   The descriptions of events that represent unavailabilities due to 
  testing and maintenance (planned and unplanned) in the data 
  analysis task are fully consistent with the unavailability events 
  modelled in the system fault trees. 
   The criteria for selection / precedence of data sources are stated. 
   For cases where generic data has been used, a justification is 
  provided. 
  Assumptions regarding unavailability time are stated and are 
  reasonable. 
   Use of facility-specific data is traceable to existing records. 
  Justification is provided that the time span of the facility-specific data 
  used in the PSA is sufficient to obtain realistic estimates of the 
  unavailabilities. 
   The probabilities assigned to events that represent configurations not 
  observed during the data collection period are reasonable best 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 44 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   estimates. 
   MET? 
   The calculation of unavailabilities due to testing and maintenance 
  (planned and unplanned) is correct and applicable for the operational 
  state of the facility to which they are applied. 
   A list of all the basic events that represent unavailabilities due to 
  testing and maintenance (planned and unplanned) together with their 
  parameter estimates is included.  
  Each parameter estimate is represented by a mean value and a 
  statistical representation of its uncertainty.  
  This list is traceable to the supporting analyses. 
   Table A1-2.6.4  Common Cause Failures (CCFs) 
   The approach selected for the CCF basic event modelling and 
  analysis is justified.  
  The method chosen for CCF parameter estimation is transparent and 
  meets good international practice. 
   The approach selected for the CCF modelling and analysis is detailed 
  enough to adequately represent all levels of redundancy provided for 
  in the specific facility design and to obtain appropriate CCF parameter 
  estimates for such levels of redundancy. 
  The approach selected for modelling CCFs addresses both intra-
  system and inter-system CCF events. 
   The CCF event names and definitions are the same as those used in 
  the fault tree models. 
   The criteria for selection / precedence of data sources are stated. 
  The applicability of the CCF data sources used is justified.  
   If a screening approach has been adopted to narrow down the 
  number of detailed analysis to be performed, the screening criteria 
  used is stated. The screening values for the CCF model parameters 
  are justified.  
   If generic CCF parameters are used, the reasons why these values 
  are considered appropriate are clear. Evidence is provided that the 
  component boundaries, failure modes and failure root causes are 
  consistent with those assumed in the generic data sources.  
   If CCF evaluation has been performed using a pseudo-facility-specific 
  database for which industry-wide data has been reinterpreted for the 
  specific conditions of the NPP under evaluation, the analysis of NPP-
  specific defences against CCFs relative to those expected for the 
  facility from which the data were originally taken is traceable and 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 45 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   appropriate.    
   MET? 
   If CCF raw data or information available internationally is used (e.g. 
  data from the International Common Cause Failure Data Exchange, 
  ICDE, project), its applicability is justified and the way in which the 
  data or information is used is transparent. 
   For cases where expert-judgement has been used for CCF parameter 
  estimation, a justification is provided that no better source of data is 
  available.  
  The expert judgement process is transparent and robust and the 
  outcome of the process is reasonable. Error factors are assigned 
  commensurate to the uncertainty in the process. 
   The quantification of all the CCF events is transparent and has been 
  done in accordance with the CCF method/s selected. No errors are 
  apparent.  
   A list of all the CCF events, together with their parameter estimates is 
  included. Each CCF parameter estimate is represented by a mean 
  value and a statistical representation of its uncertainty. This list is 
  traceable to the supporting analyses. 
   Table A1-2.7  Analysis of Hazards  
   Table A1-2.7.1  General 
   The analysis of hazards starts from a complete list of internal and 
  external (natural and man-made) hazards. 
   The approach and criteria for the screening of hazards are auditable 
  and justified.  
   The reasons why the hazards selected for further analysis are 
  applicable to the NPP under evaluation are included.  
  The reasons why the hazards excluded from the analysis are not 
  applicable to the NPP under evaluation are clear and justified. 
   The frequencies and magnitude of all hazards selected for analysis 
  are identified.  
   The hazard impact analysis (as a function of the magnitude of the 
  hazard if appropriate) is auditable and covers possible initiating 
  events, damage to equipment and structures, and impact on human 
  performance.  
  The hazard impact analysis has been undertaken using an adequate 
  method and is auditable. 
   The hazard analyses reflect facility-specific and site-specific features 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 46 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   appropriately. 
   MET? 
   Specific modifications made to the internal events PSA models (event 
  trees and fault trees) and parameters (e.g. HEPs), or any new models 
  and parameters developed to analyse the risk associated with the 
  hazard under evaluation are auditable. 
   Tables A1-2.7.2, A1-2.7.3 and A1-2.7.4 provide specific expectations 
  when assessing PSA for internal fires, internal flooding and seismic 
  events. This guidance may also be applied by inspectors assessing 
  PSA for other types of internal or external hazard, provided care is 
  taken to ensure its applicability.   
   Table A1-2.7.2  Analysis of Internal Fires 
   The method selected for the analysis of internal fires is justified.  
   The approach chosen is sufficiently detailed to allow a realistic 
  estimation of the fire risk and the identification of specific strengths 
  and vulnerabilities.  
   Evidence that walk-downs have been conducted is included and 
  documented in detail (since fire risk analyses can only be realistic 
  when supported by local walk-downs). The link between the 
  information compiled during the walk-downs and the various aspects 
  of the Fire PSA is apparent throughout. 
   General assumptions of the fire analysis are stated and properly 
  justified. 
   If screening processes are undertaken during the various steps of the 
  Fire PSA to reduce the amount of detailed analysis to be performed, 
  the qualitative and quantitative criteria applied for screening fire 
  compartments are stated.  
  The qualitative and quantitative screening criteria are adequate to 
  ensure that the risk from individually screened-out scenarios and their 
  cumulative contribution to the risk (in terms of contributions to the 
  frequencies of core damage and significant releases) are acceptably 
  low.  
  Assumptions made in support of the initial quantification of fire 
  compartments for the purpose of quantitative screening are 
  transparent (e.g. assumptions on the impact of fires on equipment, 
  human reliability, etc) and adequate. 
   The global boundary of the analysis is defined so that this includes all 
  locations at the NPP relevant to the risk calculations (e.g. all areas of 
  the facility associated with normal and emergency reactor operating 
  plant and support systems, with power production, areas associated 
  with a sister unit containing shared equipment etc).  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 47 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The Fire PSA is based upon a subdivision of the NPP into well-
  defined compartments with non-combustible barriers (i.e. which 
  substantially confine the heat and products of combustion associated 
  with a fire). In cases where the barriers are not fire-rated, these are 
  identified and addressed in the inter-compartment analysis.   
  Details of the compartmentalisation of the facility are transparent and 
  include a description of the partitioning elements or features which 
  have been assumed.  
  A list of all compartments is included using a consistent identification 
  scheme.  
  Up-to-date drawings or references showing compartment boundaries 
  are available.  
   The process to identify essential equipment has identified all 
  equipment whose failure or mal-operation will cause an initiating 
  event or will adversely impact credited functions or operator actions. 
  The location of this equipment, together with its normal, desired and 
  failed positions on loss of services are identified.  
   Established procedures are in place and implemented for evaluating 
  circuits and selecting cables required to support the operation of 
  essential equipment. 
   Equipment circuits and cables required to support the credited 
  functionality of essential equipment are identified.   
  All potentially impacting power supplies are identified. This may 
  include power supplies not evaluated in the internal events PSA. For 
  example, the power supply to a normally closed valve which is 
  required to remain in position and which would remain closed on loss 
  of power would have been excluded from the fault trees for internal 
  events. However, these power supplies need to be identified for the 
  analysis of internal fires, since a fire may lead to spurious 
  energisation and opening of the valve. 
  Cable routing information (including associated equipment, cable IDs, 
  raceways, locations etc) is stored in a database.  This information 
  should be readily retrievable and kept up-to-date. 
   If a first qualitative screening of fire compartments is undertaken, the 
  details of this are transparent.  
  The screening has been performed in accordance with established 
  criteria.  
  A list of all compartments screened-in is included.  This list includes 
  all compartments that could make a potential contribution to the risk 
  from fire. 
   Descriptions of all fire compartments qualitatively screened-in are 
  available. The descriptions include information on equipment 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 48 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   allocation, potential fire sources and targets, fire load, passive 
  protection, detection and suppression equipment, fire spreading paths 
  (e.g. failed barriers or ventilation ducts and fire dampers) and other 
  information necessary for the analysis, such as the control 
  programmes for combustible and ignition sources for the specific 
  compartment.    
   Evaluation of fire frequencies has been performed for all the 
  compartments qualitatively screened-in. 
  The method for the calculation of fire frequencies, including the input 
  data and information used, is clear.  
  Generic and NPP-specific fire history information is used to establish 
  fire frequencies associated with individual fire source types. The use 
  of data from generic sources and facility-specific sources is justified 
  and transparent.  
  If fire severity is used as a criterion to screen generic and NPP-
  specific events from frequency evaluations, then this should be 
  transparent and justified. 
  NPP-specific fire characteristics (such as the type and number of fire 
  ignition sources and evaluation of transient combustibles) are used to 
  apportion the expected influence on the likelihood of ignition in 
  specific fire compartments in a transparent and adequate manner. 
  Assumptions made in lieu of facility-specific information are only 
  made for NPPs not yet built and when used, are identified explicitly.  
  Fire suppression is not taken into account in the calculation of fire 
  frequencies. 
  The calculation of fire frequencies for all fire compartments is 
  documented explicitly. No errors are apparent.  
  A list of all the compartments together with their fire frequencies is 
  included. Each fire frequency is represented by a mean value and a 
  statistical representation of its uncertainty. This list is traceable to the 
  supporting analyses. 
   If a quantitative screening of fire compartments is undertaken, the 
  details of this are transparent.  
  The screening has been performed in accordance with established 
  criteria.  
  A list of all compartments with an indication of whether they have 
  been quantitatively screened-out (and the reason why), or screened-
  in (retained for detailed compartment analysis) is included. 
   Detailed analysis has been performed for all the compartments 
  quantitatively screened-in.  
  The fire scenario (or scenarios) associated with each compartment is 
  properly characterised in terms of source, propagation, detection, 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 49 of 81 
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
    
    
    
    
   
   
    
   is 
  to 
   by 
   flame, 
   plume, 
   arcing 
   high-energy 
   human response and damage:  
   
  For 
  each 
  compartment, 
  details 
  of 
  the 
  specific 
  fire 
  sources 
  and 
  targets are transparent. Evidence that all potential 
  ignition sources 
  have been addressed is provided. 
  The 
  analysis 
  of 
  fire 
  growth 
  within 
  each 
  compartment 
  transparent. 
  Evidence 
  is 
  provided 
  that 
  the 
  fire 
  model 
  used 
  analyse fire growth has been validated and verified. 
  The analysis of fire impact in each 
  fire compartment is transparent 
  and takes into account: 
   
  Equipment 
  damaged 
  in 
  the 
  compartment 
  ceiling jet, hot gases and radiant heat. 
  Electrical 
  faults 
  (open 
  circuits, 
  shorts 
  to 
  ground, 
  short 
  circuits 
  and 
  hot 
  shorts) 
  and 
  their 
  impact, 
  e.g., 
  loss 
  of 
  equipment 
  function, 
  spurious 
  actuation 
  of 
  equipment 
  (e.g., 
  undesired 
  reconfiguration of valves or actuation of standby systems), loss 
  and / or false signals and indications. 
  Explosions 
  and 
  their 
  impact, 
  including 
  faults. 
  Collapse of structures and their impact. 
  Missiles and their impact. 
  Smoke 
  and 
  heat effects 
  and 
  compartments. 
  Identification 
  of 
  initiating 
  result of the fire. 
  For 
  each 
  compartment, 
  a 
  fire 
  progression 
  tree 
  (or 
  equivalent) 
  has 
  been 
  developed 
  that 
  shows 
  the 
  fire 
  source, 
  defined 
  fire 
  growing 
  stages, 
  success 
  / 
  failure 
  of 
  fire 
  suppression 
  before 
  reaching 
  a 
  given 
  damage 
  stage 
  or 
  triggering 
  of 
  an 
  initiating 
  event. 
  The 
  end 
  points 
  of 
  these 
  analyses 
  are 
  one 
  or 
  more 
  fire 
  damage 
  states 
  for 
  each 
  compartment 
  with 
  associated 
  frequencies. 
  These 
  are 
  taken 
  forward for quantification. 
  The 
  reliability 
  of 
  the 
  various 
  fire 
  terms 
  of 
  equipment 
  as 
  well 
  substantiated. 
  For compartments where more than one fire scenario has been 
  identified, clear and unambiguous identification of the various fire 
  scenarios in the compartment is included. Individual analyses for the 
  separate fire scenarios in the compartment is provided (the above 
  bullets also apply to individual scenarios). 
  In cases where compartments have been further divided into sub-
  compartments for the detailed analysis, the rationale for this is 
  transparent and details of this are documented explicitly. The design 
  features and the automatic and manual actions that prevent fire 
   protection 
  measures 
  (both 
  as 
  human 
  performance) 
   compartment 
   their propagation 
   to neighbouring 
   events 
   in 
   each 
   as 
   the 
   in 
  is 
    
    
    
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 50 of 81 
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   propagation between sub-compartments are identified explicitly. 
  Adequate justification of the effectiveness of these measures is 
  provided. Individual analyses for the separate sub-compartments is 
  provided (the above bullets also apply to individual sub-
  compartments). 
   The analysis of inter-compartment fire propagation is documented 
  explicitly. 
  The requirements listed above for fire modelling of single 
  compartments are applied to the modelling of multi-compartment 
  scenarios. 
  Evidence is provided that passive fire barriers credited for preventing 
  inter-compartment propagation (in the absence of suppression 
  activities) are adequately rated and properly installed and maintained. 
  The effectiveness and reliability of any active fire barrier (e.g. damper, 
  suppression system) is explicitly addressed in the fire risk model and 
  the risk contribution associated with its failure is evaluated. 
  Details of the fire barrier and propagation analysis (barrier penetration 
  analysis) are transparent.   
  Scenarios involving two or more compartments are identified and 
  characterised explicitly. Screening criteria applied to multi-
  compartment analysis are consistent with the single compartment 
  qualitative criteria.   
  Multi-compartment scenarios which cannot be screened-out are 
  carried onto the next stages of the Fire PSA.  
    
   Details of the accident sequence modelling and quantification for 
  each identified scenario are transparent.  In particular: 
   
  The 
  most 
  onerous 
  initiating 
  event 
  has 
  been 
  selected 
  to 
  be 
  the 
  basis 
  for 
  the 
  quantification 
  of 
  each 
  fire 
  scenario. 
  The 
  rationale 
  for 
  this selection is clear. 
  The 
  internal 
  events 
  PSA 
  model 
  has 
  been 
  suitably 
  modified 
  so 
  as 
  to 
  be 
  capable 
  of 
  representing 
  fire-induced 
  equipment 
  failures 
  and 
  mal-operations 
  or 
  degraded 
  human 
  errors 
  in 
  combination 
  with 
  non-fire-related, 
  random 
  failures. 
  For 
  example 
  potential 
  failures 
  or 
  combinations of 
  failures may have been neglected on 
  the grounds 
  of 
  low 
  probability 
  in 
  the 
  internal 
  events 
  analysis, 
  which 
  may 
  be 
  significant in the event of a fire. 
  Details 
  of 
  the 
  human 
  reliability 
  analysis 
  in 
  fire 
  scenarios 
  are 
  auditable. 
  The 
  impact 
  of 
  specific 
  actions 
  that 
  operators 
  may 
  take 
  in 
  accordance 
  with 
  post 
  fire 
  procedures, 
  or 
  erroneously 
  due 
  to 
  spurious 
  indications 
  following 
  a 
  fire, 
  which 
  may 
  degrade 
  credited 
  PSA 
  functions, 
  have 
  been 
  modelled 
  appropriately. 
  The 
  impact 
  of 
  fire 
  on 
  human 
  performance, 
  for 
  example 
  in 
  terms 
  of 
  potential 
  enhanced 
  stress, 
  accessibility 
  for 
  local 
  actuations 
  (e.g. 
  in 
  scenarios 
  of 
  CCR 
  abandonment), 
  etc, 
  is 
  analysed 
  fully 
  and 
    
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 51 of 81 
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
    
    
   transparently. The HRA for fire scenarios is adequate. 
  The 
  quantitative 
  and 
  qualitative 
  results 
  of 
  the 
  quantification 
  each fire scenario are included.  
  The 
  results 
  of 
  the 
  Fire 
  PSA 
  also 
  include 
  an 
  estimate 
  of 
  the 
  core 
  damage 
  and 
  significant 
  release 
  frequency 
  arising 
  from 
  the 
  set 
  of 
  compartments screened-out from the analysis. 
   of 
   Table A1-2.7.3  Analysis of Internal Flooding 
   The approach to Flooding PSA adopted is sufficiently detailed to allow 
  a realistic estimation of the risk from flooding and the identification of 
  specific strengths and vulnerabilities.  
   Evidence that walk-downs have been conducted is included and 
  documented in detail (since flooding risk analyses can only be 
  realistic when supported by local walk-downs). The link between the 
  information compiled during the walk-downs and the various aspects 
  of the Flooding PSA is apparent throughout. 
   General assumptions of the flooding analysis are explicitly stated and 
  properly justified. 
   If screening processes are undertaken during the various steps of the 
  Flooding PSA to reduce the amount of detailed analysis to be 
  performed, the qualitative and quantitative criteria applied for 
  screening flood compartments are stated.  
  The qualitative and quantitative screening criteria are adequate to 
  ensure that the risk from individually screened-out scenarios and their 
  cumulative contribution to the risk (in terms of contributions to the 
  frequencies of core damage and significant releases) are acceptably 
  low. 
  Assumptions made in support of the initial quantification of flood 
  compartments for the purpose of quantitative screening are 
  transparent (e.g., assumptions on the impact of floods on equipment, 
  human reliability, etc) and adequate. 
   The global boundary of the analysis is defined so that this includes all 
  locations at the NPP relevant to the risk calculations (e.g. all areas of 
  the facility associated with normal and emergency reactor operating 
  plant and support systems, with power production, areas associated 
  with a sister unit containing shared equipment etc.). 
   The Flooding PSA is based upon the subdivision of the NPP into well-
  defined compartments (physically separate areas where flood is 
  generally viewed as independent of other areas in terms of impact).  
  Details of the compartmentalization of the facility are available 
  including physical barriers (walls, floors, bunds etc), mitigating 
  features (sumps, drains) adjacent compartments and propagation 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 52 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   paths (open hatches, etc).  
  A list of all compartments showing compartment boundaries is 
  included. Up-to-date drawings or references to these are included. 
   Descriptions of the content of all flood compartments are available. 
  The descriptions include information on all equipment susceptible to 
  flood located in each of compartment, the minimum water volume 
  needed to affect water-sensitive equipment by immersion / splashing, 
  internal flood barriers and spray shields, potential flood sources and 
  types (e.g. high energy steam pipework), automatic and manual flood 
  detection and isolation means, possible flood effects in each 
  compartment (e.g. initiating events, damage to safety equipment) and 
  in compartments to which the flooding may propagate, etc. 
   The susceptibility of each type of component appearing in the PSA to 
  flood-induced failure mechanisms is identified and justified (e.g. 
  submergence, jet impingement, pipe whip, humidity, condensation, 
  temperature) 
   For each flood source, the propagation path from the source 
  compartment to the point of accumulation is identified, including the 
  potential for structural failures of walls, doors, back flow device 
  failures, HVAC ducts, etc. 
   Details of the first qualitative screening of flood compartments and 
  flood sources are auditable.  
  The screening has been performed in accordance with established 
  criteria.  
  A list of all compartments screened-in is included. This includes all 
  compartments that could make a potential contribution to the risk from 
  internal flooding. 
   Evaluation of flooding frequencies has been performed for all the 
  compartments qualitatively screened-in. 
  Generic and NPP-specific flood history information is used to 
  establish flood frequencies and severities associated with individual 
  flood source types. The use of data from generic sources and NPP-
  specific sources is justified and transparent.  
  The method for the calculation of flood frequencies, including the 
  input data and information used, is clear.  
  For each compartment, the nature of possible flood causes is 
  identified, e.g. maintenance activities, pipe breaks, expansion joint 
  breaks, etc. Assumptions made in lieu of facility-specific information 
  are only made for NPPs not yet built and when used are identified 
  explicitly.  
  For each compartment, the location and characterisation of flood 
  sources, describing e.g. the system that is the source of the flooding, 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 53 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   source location, flow rate maximal flood volume and flood frequency, 
  are transparent. Assumptions made in lieu of facility-specific 
  information are only made for NPPs not yet built and when used are 
  identified explicitly.  
  Similar flood cases are adequately grouped in the modelled 
  scenarios. All the assumptions made in this process are transparent. 
  The calculation of flood frequencies for all identified flooding 
  scenarios is documented explicitly. No errors are apparent.  
  A list of all the identified flooding scenarios, together with their 
  frequencies, is included. Each frequency is represented by a mean 
  value and a statistical representation of its uncertainty. This list is 
  traceable to the supporting analyses. 
   Details of the quantitative screening of flood scenarios are 
  transparent.  
  The screening has been performed in accordance with established 
  criteria.  
  A list of all flood scenarios with indication of whether they have been 
  quantitatively screened out (and the reason why), or screened in 
  (retained for detailed analysis) is included. 
    
    
    
   Detailed analysis has been performed for all the flood scenarios 
  quantitatively screened-in, including:  
   
  For 
  each 
  compartment 
  where 
  a 
  flooding 
  scenario 
  has 
  been 
  identified, the rate at which a flood could develop is provided. 
  The 
  equipment which 
  is 
  assumed 
  to 
  be 
  damaged 
  by water 
  spray, 
  jet 
  impingement, 
  pipe 
  whip 
  etc. 
  due 
  to 
  the 
  flood 
  source 
  is 
  identified. 
  Flood 
  effects 
  in 
  the 
  compartment 
  due 
  to 
  e.g. 
  equipment 
  immersion, 
  humidity 
  and 
  temperature 
  are 
  identified. 
  These 
  cover 
  both initiating events and equipment damage. 
  Adverse 
  effects 
  in 
  compartments 
  affected 
  by 
  floods are identified.   
  For 
  each 
  flooding 
  scenario, 
  a 
  flood 
  progression 
  tree 
  (or 
  equivalent) 
  has 
  been 
  developed 
  that 
  identifies 
  flood 
  progression 
  stages 
  reached 
  (leading 
  to an 
  initiating event or 
  to damage 
  to any 
  relevant 
  system) 
  depending 
  on 
  the 
  success 
  or 
  failure 
  of 
  flood 
  isolation actions. 
  Indications, 
  events 
  and 
  any 
  other 
  cues 
  which 
  can 
  provide 
  flood 
  symptoms and allow for flood detection are identified explicitly.  
  Actions needed for flood isolation before a given flood progression 
  stage is reached are described explicitly.  
  The reliability of the flooding protection measures (both in terms of 
  equipment as well as human performance) are substantiated. 
   propagation 
   the 
    
    
   of 
    
    
    
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 54 of 81 
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
    
   Details of the accident sequence modelling and quantification for 
  each identified scenario are transparent.  In particular: 
   
  The initiating event identified for each flood scenario is justified. 
   
  The modifications made 
  to 
  the 
  internal event PSA event 
  trees and 
  fault 
  trees 
  (and 
  any 
  new 
  models 
  developed) 
  to 
  calculate 
  the 
  probability 
  of 
  core 
  damage 
  and 
  significant 
  release 
  at 
  various 
  evaluated 
  progression 
  stages, 
  taking 
  into 
  account 
  the 
  impact 
  of 
  the 
  flood 
  on 
  safety 
  systems 
  and 
  operating 
  crew 
  actions 
  are 
  transparent. The resulting models are correct. 
  Details 
  of 
  the 
  human 
  reliability 
  analysis 
  for 
  flooding 
  scenarios 
  are 
  transparent. 
  The 
  flood-related 
  factors 
  that 
  may 
  influence 
  human 
  performance are 
  identified explicitly. The analysis 
  is complete and 
  transparent. The HRA for flooding scenarios is adequate. 
  The 
  quantitative 
  and 
  qualitative 
  results 
  of 
  the 
  quantification 
  each flooding scenario are included.  
  The 
  results 
  of 
  the 
  Flooding 
  PSA 
  also 
  include 
  an 
  estimate 
  of 
  the 
  core 
  damage 
  frequency 
  and 
  significant 
  release 
  frequency 
  arising 
  from 
  the 
  set 
  of 
  flooding 
  compartments 
  / 
  scenarios 
  screened-out 
  from the analysis. 
   of 
    
    
    
   Table A1-2.7.4  Seismic Analysis  
   The approach used to evaluate and represent the hazard from 
  earthquakes is described and appropriate 
   The seismic hazard analysis is documented in detail. 
  The assumptions and models used for aspects such as the 
  characterisation of sources and attenuation relationships are clearly 
  identified. 
  All the values for the parameters used in the model are identified and 
  the way the final hazard curves have been constructed is auditable. 
  The mean curve for the site is represented together with its 
  uncertainty bounds. This is traceable to the underlying analyses. 
   All the references to historical data used are identified and auditable. 
   The approach used to evaluate the impact of earthquakes on the NPP 
  structures and components is described and appropriate. 
   All the equipment that requires analysis of the probability of failure 
  against earthquake magnitudes is identified, i.e. all equipment 
  required to trip, shutdown, cool and monitor the reactor, all structures 
  whose failure could hamper core cooling, and all equipment and 
  structures required to mitigate severe accidents or whose failure 
  could impact releases (Level 2 PSA), etc. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 55 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   This list is traceable to safety case / internal events PSA sources. 
   If the number of components for which detailed fragility analysis has 
  been performed has been limited using some type of screening, the 
  screening criteria is defined and is adequate. 
  The screening analysis is traceable. 
   The design parameters used for the derivation of fragilities of 
  equipment and structures are identified. 
   The method used to evaluate seismic fragilities is described. 
  If different methods have been to evaluate the fragilities for different 
  components or structures, the methods lead to consistent results.  
   The fragility analysis is auditable. 
   The results of the screening analysis of relay and contactor chatter for 
  the safety systems are included with a list of relays and associated 
  fragilities included in the final model.  
   The initiating events arising from the full range of earthquakes are 
  identified. 
   If the number of earthquake-induced initiating events considered in 
  the Seismic PSA quantification has been limited using some type of 
  screening, the screening criteria is defined and is adequate.  
  The screening analysis is traceable. 
   The potential for secondary hazards, e.g. earthquake-induced fires 
  and floods has been analysed systematically during the seismic walk-
  down and the results are auditable. 
   The way in which the seismic failures and successes and random 
  component failures have been combined is traceable.  
  If seismic damage states have been developed, each of them 
  correctly represents the frequency of the associated seismic failures 
  by the mathematically correct inclusion of the combination of failure 
  and success paths. 
  Any modifications to the event and fault tree logic models to 
  incorporate the impact of earthquakes on the NPP are auditable and 
  correct. 
  The potential for the correlation of seismically-induced component or 
  structural failures has been addressed and any assumptions made 
  regarding the correlation are identified and justified.  
  The Human Reliability Analysis has been revisited to address the 
  operator response following the seismic events of concern. Details of 
  this analysis are auditable. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 56 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The quantitative and qualitative results of the quantification are 
  included. 
  Sensitivity, uncertainty and importance analyses are provided. 
   Table A1-2.8  Low Power and Shutdown Modes 
   Note: The expectations listed in the tables A1-2.1 to A1-2.7 above are 
  also applicable to the Low Power and Shutdown parts of the PSA. 
  Table A1- 2.8 therefore only deals with additional expectations 
  applicable specifically to this part of the analysis. 
   The identification of the Plant Operational States (POS) during non-
  full power modes is justified.  
  There are no gaps and / or overlaps between the POS addressed in 
  the Low power and Shutdown PSA and those covered in the PSA for 
  full power. 
  All the characteristics considered for the identification of possible 
  stages during low power and shutdown (pre-POS) are clear. No 
  important characteristic is missing. 
  The grouping of pre-POS into the final list of POS is justified and 
  visible. The grouping is adequately justified. 
   A table listing all the POS with their characteristics is included. The 
  information about all the POS’ characteristics is presented and 
  complete.  
  Information about plant configuration (decay heat removal method, 
  cooling circuit configuration, etc) in each POS, frontline system 
  availability in each POS, length of time in each POS, assumed decay 
  heat levels is presented. 
   The definition and characterisation of each POS is traceable to 
  facility-specific information. 
   The analysis of initiating events for each POS is transparent. 
  The analysis of initiating events has considered events based on 
  plant failures, those triggered by operator interactions and those 
  caused by internal and external hazards. The details of the analysis 
  are transparent. 
   A systematic examination of NPP procedures for changing 
  configurations, equipment testing and maintenance procedures has 
  been carried out to identify potential human errors during the 
  execution of such normal procedures that are, or may lead, to 
  initiating events. The analysis process is transparent. 
   A table showing the initiating event groups defined and their 
  applicability to each POS is presented. No errors are apparent 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 57 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The derivation of the frequency of the initiating events is specific for 
  each POS (i.e. it has taken into consideration the specific 
  characteristics of each POS). The analysis is transparent. 
  The models used to calculate IE frequencies are presented. 
  The frequency of each initiating event is calculated on a per calendar 
  year basis (so that the risks associated with each POS can be 
  compared). Otherwise the units used are explained.  
   If screening of combinations of initiating event groups / POS is 
  undertaken to reduce the amount of detailed analysis to be 
  performed, the screening approach, criteria and process are clear and 
  acceptable. The screening process does not lead to the removal of 
  events that may be significant for the intended applications of the 
  PSA. 
   The thermal-hydraulic, neutronics (or any other) analyses performed 
  to support the determination of success criteria for the Low Power 
  and Shutdown PSA are presented.   
  The thermal-hydraulic analyses performed to support the 
  determination of success criteria for the Low Power and Shutdown 
  PSA have taken into consideration the specific characteristics of 
  these operating modes, e.g. reactor coolant system water inventory, 
  steam generator availability, core inventory, decay heat curve. The 
  boundary conditions used in these analyses are stated. 
  The success criteria for the Low Power and Shutdown PSA are 
  developed on a realistic basis. 
   Event trees have been developed for each combination initiating 
  event-POS that has been screened-in.  
   System models have been developed taking into consideration the 
  specific characteristics of each POS. Details of this are transparent. 
   References to all maintenance procedures and work plans which are 
  used to define the event tree boundary conditions and system status 
  modelled in the fault trees are explicitly stated. 
   The HRA method selected can adequately represent the aspects of 
  the NPP shutdown relevant to human reliability which may be 
  different to when the reactor is operating at power, e.g. long time 
  windows for operator actuation, status of procedural guidance and 
  training, familiarity with shutdown accident transients, levels of 
  supervision, availability of indications / status of the control room, 
  difficulties in diagnosing events, increased workload, etc. 
  The HRA has considered all the aspects of the NPP shutdown 
  relevant to human reliability mentioned above clearly and 
  systematically.  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 58 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
    
   Specific aspects of the low power and shutdown modes that may 
  affect the risk due to hazards (which may differ from when the reactor 
  is operating at power) have been clearly and systematically 
  addressed.  
  Examples of specific aspects that inspectors should expect the PSA 
  to address are: 
   
  Internal 
  fires: 
  amount 
  of 
  hot 
  work; 
  additional 
  inventories 
  of 
  combustible 
  materials 
  introduced 
  into 
  some 
  areas; 
  status 
  of 
  automatic 
  fire 
  suppression 
  systems, 
  fire 
  barriers, 
  fire 
  doors 
  and 
  penetration seals, etc. 
  Internal 
  flooding: 
  temporary water 
  systems 
  and hose 
  connections; 
  different 
  plant 
  configurations 
  and 
  possibilities 
  of 
  valve 
  misalignments 
  leading 
  to 
  flooding; 
  status 
  of 
  drainage 
  systems, 
  doors 
  in 
  segregation 
  barriers 
  and 
  penetration 
  seals, 
  increased 
  possibility of maintenance errors leading to floods, etc. 
  Dropped 
  loads: 
  number 
  of 
  heavy 
  loads 
  lifted 
  during 
  maintenance 
  outages; 
  potential 
  for 
  dropped 
  loads 
  to 
  directly 
  affect 
  spent 
  fuel 
  during the refuelling, etc.  
    
    
   Table A1-2.9  Uncertainty analyses, Quantification and Interpretation of the Level 1 
  PSA Results 
   Table A1-2.9.1  Uncertainty and Sensitivity Analyses 
   The sources of uncertainty in the Level 1 PSA are identified explicitly. 
  Suitable methods are chosen to address the various types of 
  uncertainty, to evaluate their impact on the results of the PSA and to 
  interpret their significance. 
   Sensitivity studies have been carried out to evaluate the risk 
  significance of assumptions.  
  The sensitivity studies address the effects of key assumptions and 
  combinations of assumptions.  
  The sensitivity studies and their results are transparent. 
   Uncertainties in input probability and frequency values have been 
  estimated. 
  Uncertainties in input probability and frequency values have been 
  propagated through the models to generate uncertainty distributions 
  for the results of the Level 1 PSA.  
  The means resulting from the uncertainty propagation are the values 
  that have been compared against the relevant numerical criteria 
  (rather than using the point estimate means which result from a 
  simple arithmetic evaluation of the PSA cutsets). 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 59 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   Based on the uncertainty and sensitivity evaluations, an 
  understanding has been gained of which parametric and modelling 
  uncertainties most contribute to the overall uncertainty of the results 
  of the Level 1 PSA. This analysis is transparent. 
  The results of the uncertainty and sensitivity evaluations demonstrate 
  that the overall conclusions obtained from the Level 1 PSA are still 
  valid. 
  Steps have been taken to reduce the most important uncertainties 
  (and hence the uncertainties in the overall PSA results). These are 
  explicitly described.  
   Table A1-2.9.2  Quantification of the Level 1 PSA 
   The results obtained from the quantification are reproducible: 
   
  The type of quantification and related approximations are explicitly 
  stated. 
  The 
  cut-offs 
  adequate.  
  Any minimal cutset editing performed is transparent.  
  A 
  description of 
  the way 
  in which 
  circular 
  logic 
  has 
  been 
  removed 
  between 
  front 
  line 
  / 
  support 
  and 
  support 
  / 
  support 
  system 
  fault 
  trees if done within the quantification process is provided. 
   quantification 
   explicitly 
   stated 
   used 
   and 
   for 
   the 
   are 
    
    
   
    
    
    
    
   Complete results of the quantification are provided. These include: 
   
  Minimal cutsets with numerical results and description of 
  the basic 
  events. 
  Lists 
  of 
  basic 
  events 
  and 
  associated 
  importance 
  measures, 
  as 
  a 
  minimum 
  fractional 
  contributions 
  (Fussell 
  Vesely 
  Importance) 
  and 
  risk increase factors (Risk Achievement Worth). 
  Lists 
  of 
  relevant 
  groups 
  of 
  components 
  or 
  basic 
  associated importance functions as for basic events.  
   events 
   and 
    
   Quantification has been carried out (and results provided) at different 
  levels: 
   
  Level 1 PSA (for full power operation). 
   
  Level 1 PSA (for operation at low power and shutdown).  
   
  Individual initiating event groups (event trees). 
   
  Individual accident sequences (in the event trees). 
   
  Individual hazards for power operation and non-power conditions. 
   
  Individual 
  hazard 
  scenarios 
  for 
  power 
  operation 
  and 
  non-power 
  conditions. 
  Total annual contribution from all NPP operations (power and non-
    
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 60 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   the breakdown of 
   operational 
   state 
   power) 
  for all 
  internal 
  initiators and hazards and 
  this for the different operational states. 
  The 
  estimated 
  level 
  of 
  risk 
  associated with 
  in order to support the ALARP arguments. 
   each 
    
   A survey of the PSA results has been carried out by the dutyholder to 
  confirm the correctness of the Level 1 PSA quantification. 
   Table A1-2.9.3  Presentation and Interpretation of the Level 1 PSA Results 
   A summary of the Level 1 PSA results is included in the PSA 
  documentation.  
  The summary of the Level 1 PSA results together with any 
  accompanying discussions are sufficient for PSA and non-PSA 
  specialists to get a clear understanding of how big the risk of core 
  damage is, where this risk comes from and which are the most 
  significant uncertainties.  
   All vulnerabilities identified by the PSA are transparent. The corrective 
  actions proposed to address these vulnerabilities are described 
  explicitly.  The PSA has been used to support the optioneering 
  analysis and details of this are auditable.  
  An evaluation of the risk improvements expected from the proposed 
  corrective actions is documented explicitly. This has been used as an 
  input to assigning the level of priority of these proposals.  
  A formal process is in place to ensure that the proposed corrective 
  actions are captured, as appropriate, in the NPP design or design 
  modification processes, in the NPP process for procedure 
  development or modification, etc. 
   A demonstration is included that the risk of core damage for the 
  facility under evaluation is ALARP. 
   3. 
   Table A1-3.  Level 2 PSA  
   The basis for the definition of LARGE RELEASE is presented and 
  explained. 
   The basis for the definition of LARGE EARLY RELEASE is presented 
  and explained. 
   If a design target for LARGE RELEASE FREQUENCY has been 
  used, this is stated explicitly. 
   If a design target for LARGE EARLY RELEASE FREQUENCY has 
  been used, this is stated explicitly. 
   The Level 2 PSA has been designed so that its output forms an 
  adequate input to perform a Level 3 PSA. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 61 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   Table A1-3.1  Interface between Level 1 and Level 2 PSA 
   The entirety of the Level 1 PSA has been taken forward to the Level 2 
  analysis (Internal initiating events, internal and external hazards for 
  the reactor at power, low power and shutdown, and for the fuel route) 
   The analysis of the interface between Level 1 and Level 2 PSA has 
  addressed systematically all the attributes of the Level 1 core damage 
  sequences that can affect the accident progression.   
  The analysis has identified all attributes of the Level 1 core damage 
  sequences that can affect the mode and timing of containment failure, 
  containment bypass or affect the source term. Steps have been taken 
  to give confidence that a complete set of attributes has been 
  identified, including as appropriate, the investigation of attributes 
  identified in other studies and justifications for inclusion or exclusion 
  of features are presented. 
  The analysis is performed in a way which, together with the Level 2 
  model and the mechanism for transferring information between the 
  two parts of the analysis, ensures that all dependencies between 
  Level 1 core damage sequences and the Level 2 model (including 
  event logic, system-related and human error dependencies) are 
  correctly represented. 
  The analysis is transparent.  
   Based on the above, a complete set of Plant Damage States (PDS) is 
  defined, each of which represents a set of core damage sequences 
  with a unique expected severe accident progression and set of source 
  term characteristics. 
  The characterisation of each PDSs is clearly presented in terms of the 
  attributes of the Level 1 sequences it represents and the status of 
  each of these attributes. 
  The identification and characterisation of PDSs is adequate.  
  A sufficient number of PDS has been defined to avoid masking 
  important ways of accident progression while ensuring a manageable 
  scope of analysis. 
   Any modification made to the original Level 1 PSA event trees to 
  address Level 2 issues (features that can affect the accident 
  progression but were not considered originally in the Level 1 PSA 
  models), is clear.  
  The models are correct. 
   Relevant systems not already covered in the Level 1 PSA are 
  analysed to the same specification and level of detail as the other 
  systems included in the Level 1 PSA.  
  All the dependencies are properly captured.  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 62 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   Relevant human failure events not already covered in the Level 1 
  PSA are analysed to the same specification and level of detail as the 
  HFEs included in the Level 1 PSA. 
   The criteria used to group the (Level 1 - Level 2 interface) event tree 
  sequences into the defined PDSs are identified explicitly and correct. 
  The process of mapping the resulting accident sequences from the 
  modified event trees to the relevant Pant Damage States is 
  transparent.  
  If the binning process (allocation of sequences to end state 
  categories) is automated, an auditable record exists of this process.  
  The identification and characterisation of PDSs is traceable in both 
  directions, i.e. Level 1 cutset / sequence to PDS and PDS back to 
  Level 1 sequence. No errors are identified in the grouping of accident 
  sequences into the defined PDSs. 
   Each PDS has been assigned a frequency equal to the summed 
  frequency of all the sequences in the group. 
  For the follow-up Level 2 analysis, each PDS is represented by the 
  most onerous sequence. In general, if the PDS structure is a proper 
  one, there should not be any significant differences in the sequences 
  within a PDS, and therefore, the PDS representative sequence would 
  be the one with the highest frequency. 
   If a separate code is used for Level 2 PSA, the way in which the 
  sequence or cutset definitions and frequencies from the Level 1 – 
  Level 2 interface have been transferred to the Level 2 PSA is 
  transparent.  
   Table A1-3.2  Deterministic Accident Progression Analysis 
   The code/s used for analysing the progression of severe accidents 
  has / have been qualified for the design of the NPP under evaluation. 
  For example, the computer model has been successfully used to 
  simulate steady state operating behaviour and a variety of initiating 
  events (such as unanticipated transients).  Alternatively, the code has 
  been applied to experimental facilities or to other NPPs of similar 
  design with equivalent fidelity. 
  The code and inputs meet ONR quality expectations (e.g. as 
  described in Table A1- 1.4 of this Appendix). The input data used by 
  the code represents the facility in sufficient detail and with sufficient 
  fidelity to provide the output required by the Level 2 PSA model. 
  The code/s used include deterministic models for all known severe 
  accident phenomena that could occur with high probability and have a 
  first-order impact on the response to the postulated fault. 
  The analytical models contained in the computer code have been 
  sufficiently validated (both individually and collectively; i.e. against 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 63 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   separate effects and integral experimental measurements) to provide 
  reasonable confidence in the calculated results. 
  The codes have been used within their limit of applicability. 
   Modelling options (if any) selected by the code user reflect ‘best-
  practice’ recommendations of the code developers or a recognised 
  and experienced user community. 
  Deviations from best-practice choices of options are documented and 
  justified. 
   The modelling options available in the computer code are applied 
  consistently throughout the calculations performed for different fault 
  sequences. 
  Differences in the codes, models or modelling options used (if any) 
  are documented and justified. 
   In cases where some of the severe accident phenomena have not 
  been addressed directly via code calculations, the applicability of the 
  sources of information used to address these phenomena is justified. 
   No relevant and potentially important phenomena have been 
  neglected or dismissed without an adequate technical justification. 
   All the assumptions made are stated explicitly. 
  All the assumptions made are justified, i.e. the rationale for choosing 
  these assumptions and for rejecting alternatives is clear and 
  reasonable. 
  The way in which each assumption may bias the outcomes of the 
  analysis is indicated, or the effect(s) of alternative, reasonable 
  assumptions on the calculated results is demonstrated to be 
  negligible. 
   The accident progression analyses have been performed on a best-
  estimate basis and are specific to the facility. 
   In the absence of facility-specific details, all the assumptions 
  regarding facility design and construction are stated. 
  A process is in place to ensure that these assumptions are captured 
  to support the future design and construction. 
   The accident scenarios selected as input to the accident progression 
  calculations are appropriate and transparent throughout the various 
  accident progression analyses.  
  The accident scenarios selected as input to the accident progression 
  calculations are consistent with the Level 1 PDS sequences (which 
  are the starting point for the accident scenarios evaluated) and with 
  the Level 2 event tree sequences to which they are applied. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 64 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   Assumptions made in the accident progression analyses regarding 
  operator actions are consistent with the operator actions in the 
  corresponding Level 2 PSA accident progression event tree 
  sequences. 
   The accident progression analyses are documented and traceable. 
   The regulator may choose to review in depth a representative subset 
  of the accident progression analyses. In these cases no significant 
  errors have been found. 
   The regulator may choose to independently perform a representative 
  subset of accident progression analyses. In these cases, the results 
  obtained are consistent with those presented by the dutyholder.    
   Table A1-3.3  Containment Performance Analysis 
   The method used for analysing the probability of failure of the 
  containment (i.e. the method used for analysing the containment 
  structural response) under different stress conditions caused by the 
  severe accidents is transparent. 
  The method is state-of-the-art and meets accepted industry 
  standards. 
   The code and inputs used for analysing containment structural 
  integrity meet ONR quality expectations as described in Table A1-1.4 
  of this Appendix. 
  The input data used by the code represents the facility in sufficient 
  detail and with sufficient fidelity to provide the quality of output 
  required by the Level 2 PSA model. 
   The models used to characterise the loss of containment integrity 
  (e.g. the models used for thresholds and / or leak before break) are 
  explicitly stated and justified. 
   The way in which analysis of the failure of penetrations has been 
  performed is transparent and adequate. 
   The loads and combinations of loads studied are clear.  
  The range of loads and combinations of loads addressed is adequate 
  to represent the conditions of the severe accident sequences, which 
  are possible for the facility under evaluation. Temperature effects are 
  addressed and the assumptions made are consistent with the 
  conditions arising in the accident sequences for which the results of 
  the analysis are used. 
   In the absence of facility-specific details, all the assumptions 
  regarding containment geometry, construction and materials are 
  transparent. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 65 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   A process is in place to ensure that these assumptions are captured 
  to support the future design and construction. 
   The material properties assumed are realistic. 
   A systematic review of the containment structure has been performed 
  to identify plausible and credible failure modes. 
   Failure criteria for containment structures are clearly defined. 
   Uncertainties associated with the capacity of the containment under 
  extreme loads have been identified explicitly. 
  Uncertainties have been appropriately treated and the results of the 
  analysis are presented in a form consistent with their use in the 
  probabilistic accident progression models. ONR expectation is that 
  the results of the structural analysis would be presented as 
  probabilistic fragility curves, unless it has been justified that the 
  uncertainties are small enough for the use of a bounding point-value 
  structural capacity to be used. 
   Any expert judgement used to derive the containment capacity and 
  uncertainty parameters has been documented.  
  The expert judgement process adopted is appropriate. 
   The containment performance analyses are thoroughly documented 
  and fully traceable. 
   Table A1-3.4  Probabilistic Modelling Framework – Accident Progression Event 
  Trees (APET) 
   The approach used for the delineation of the severe accident 
  sequences (accident progression event trees, APETs, or equivalent) 
  is transparent. That is, the chronological progression of events can be 
  traced either via graphical diagrams or an equivalent method, and the 
  logical end-states of individual accident sequences (e.g., pathways 
  through an event tree) are associated with a single, unique outcome 
  (e.g. a release category). 
   The Level 2 PSA code used to develop the APETs provides the 
  necessary capability to support the modelling approach selected, e.g. 
  the capability to handle multiple branches for a single event tree 
  node, headings represented by models other than fault trees (e.g. 
  event trees, user defined code), global variables (e.g. to allow 
  tracking of hydrogen generation and combustion at different points in 
  an accident sequence), etc.  
  If the Level 2 PSA code does not provide the necessary capability to 
  support all aspects of the probabilistic modelling approach selected, 
  the way in which these aspects of the model have been handled in 
  the quantification is clear. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 66 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   An APET has been developed for each PDS. 
   The APETs are clearly described (i.e. structure and headings). 
  The phenomena addressed are clearly identified. All relevant 
  phenomena significantly affecting the accident progression or source 
  term magnitudes (as far as required to comply with table A1-3.5) have 
  been included. The selection of phenomena for inclusion has followed 
  a systematic process which addresses generic accident phenomena 
  and specific plant issues, and no relevant phenomena have been 
  neglected or dismissed without an adequate technical justification. 
  The time frames depicted are transparent and organised in the 
  correct order with proper treatment of chronological dependencies. 
  When uncertainties are addressed via the APET structure, the way in 
  which this has been done is transparent. 
  All assumptions are described and justified. 
  All simplifications (e.g. issues excluded from the APET) are described 
  and justified. 
  The dependencies between / among phenomena are explicitly 
  identified and properly captured in the logic model and in the 
  assignment of event probabilities. 
  Dependencies within the Level 1 core damage sequences are 
  adequately modelled. 
  The structure of each APET, and associated event probabilities, are 
  traceable to the underlying deterministic accident progressions 
  analyses carried out to support their development. 
   The APET includes HFEs for severe accident management actions. 
  Table A1-.2.5 of this appendix applies for the assessment of these 
  actions. 
  The dependencies with the HFEs in the Level 1 PSA are identified 
  and treated appropriately. 
  Potential adverse effects of severe accident management actions are 
  modelled. 
   The method used to assign probabilities to the events of the APET is 
  described. The approach selected is valid and is used to assign 
  probabilities consistently throughout the Level 2 PSA.  In particular:  
   
  Event 
  probabilities which 
  represent 
  random 
  events 
  (i.e. 
  events 
  representing 
  aleatory 
  or 
  stochastic 
  uncertainty, 
  such 
  as 
  those 
  similar 
  to 
  the 
  ones 
  included 
  in 
  the 
  Level 
  1 
  PSA 
  models, 
  e.g., 
  equipment 
  random 
  failures) 
  are 
  calculated 
  using 
  methods 
  consistent with similar events in the Level 1 PSA. 
  Event 
  probabilities 
  which 
  represent 
  uncertainty 
  about 
  deterministic 
  outcomes 
  (i.e. 
  events 
  representing 
  so-called 
    
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 67 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   epistemic 
  uncertainty, 
  such 
  as 
  the 
  likelihood 
  of 
  structural 
  failure 
  due 
  to 
  temperature 
  and 
  pressure 
  loads 
  from 
  an 
  energetic event) are assigned based on a clear and consistent 
  method. 
  If 
  expert 
  judgment 
  is 
  used 
  to 
  assign 
  event 
  probabilities, 
  the 
  rationale 
  for 
  numerical 
  values 
  chosen 
  is 
  clearly described and applied consistently throughout the Level 
  2 PSA. 
   In cases where APET probability values represent uncertainty about 
  deterministic outcomes, the analyses performed to generate have: 
   
  Identified 
  the 
  relevance 
  of 
  the 
  defined 
  severe 
  accident 
  time 
  frames and has taken this into account adequately 
  Used up-to-date information on accident phenomenology. 
  Justified the applicability of the sources of information used. 
  Used facility-specific information wherever possible. 
  Used 
  an 
  acceptable 
  analysis 
  method 
  - 
  for 
  decomposition 
  event 
  trees, Monte Carlo 
  simulation, 
  method justified as adequate. 
  Been performed in a transparent and consistent manner. 
   example, 
  or 
  another 
    
   
   
   
    
   APET drawings are included.  
  Computer files for the APETs are provided. 
   System design, operability and survivability modelling is described 
  clearly and justified. 
  In cases where the environment or operating conditions for system(s) 
  exceed their design or qualification limits, assumptions on system 
  design, operability and survivability are explicitly stated.  
  A process is in place to ensure that these assumptions are captured 
  to support the future system design, installation and qualification. 
   Table A1-3.5  Source Term Analysis 
   The parameters that influence fission product release, retention and 
  transport through each of the major barriers to the environment are 
  identified explicitly. 
  The attributes that define the characteristics of the radiological 
  releases and potential off-site consequences are identified explicitly. 
  The attributes required in order to perform a Level 3 PSA are 
  identified explicitly, e.g. magnitude of radionuclides, isotopic 
  composition, release timing, height and frequency of the release, 
  physical and chemical characteristics of the release, heat content of 
  the release (plume), etc. 
   Based on the above, an adequate set of release categories (RCs) has 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 68 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   been defined and justified, each one representing a different way of 
  radiological release.  
  The time periods considered for the release and the rationale for their 
  choice are transparent and adequate. 
  The characterisation of each RC is clear. All the attributes relevant to 
  each RC are identified explicitly. 
  The identification and characterisation of RCs is adequate.  
  A sufficient number of RCs has been defined to avoid masking 
  important source terms while maintaining a manageable scope for the 
  analysis. 
   The method or criteria used to group the severe accident sequences 
  from the APETs into the defined RCs is stated explicitly and is 
  justified. 
  The process of mapping the resulting severe accident sequences 
  from the APETs to the relevant RCs is transparent.  
  If the binning process (allocation of sequences to end state 
  categories) is automated, an auditable record exists of this process.   
  No errors are identified in the grouping of severe accident sequences 
  into the defined RCs. 
   Each RC has been assigned a frequency equal to the summed 
  frequency of all the severe accident sequences in the group. 
  Each RC provides an adequate representation of the individual 
  sequences within the group.  
   The code and inputs meet ONR quality expectations as described in 
  Table A1-1.4 of this Appendix.  
   The modelling method/s used to perform source term analysis are 
  clear.  
  The radionuclide grouping scheme used for the source term analysis 
  is consistent with current state-of-the-art practice. 
  All the assumptions made to obtain source terms are described and 
  justified. 
  The computer code calculations used as the basis for estimating 
  facility-specific source terms for selected accident sequences are 
  documented.  
  If there are cases where facility-specific computer code calculations 
  were not performed, the method by which source terms have been 
  estimated is described and justified. Also the relationship between the 
  deterministic accident progression analyses and deterministic source 
  term analyses are clearly described and justified. 
   A set of sensitivity analyses has been performed to explore the 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 69 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   impact of the assumptions made in the source terms analysis. 
   The source term analyses are thoroughly documented and fully 
  traceable. 
   The regulator may choose to review in depth a representative subset 
  of the source term analyses. In these cases no significant errors have 
  been found. 
   The regulator may choose to independently perform a representative 
  subset of source term analyses. In these cases, the results obtained 
  are consistent with those presented by the dutyholder.    
   Table A1-3.6 Quantification of the Level 2 PSA 
   The quantification process is adequately documented and 
  reproducible. 
  The quantification setup, settings and any approximations are 
  adequately documented. The quantification results are reproducible. 
  Any cut-offs used for the quantification are documented and 
  adequate. 
  Any minimal cutset editing or other post-processing performed is 
  transparent and reproducible. 
  To the extent relevant, descriptions are provided of the way in which 
  circular logic has been removed for any systems modified or 
  developed for the Level 2 PSA. 
   Complete results of the quantification are provided, including: 
   
  Minimal cutsets with numerical results and description of the basic 
  events. 
  Basic event importance measures. 
  Importances for relevant groups of components or basic events. 
  Contribution of significant accident sequences to the Release 
  Categories and risk metrics. 
    
   
   
   Results are summarised at different levels (to the extent consistent 
  with the scope of the PSA): 
   
  Full power operation 
   
  Low power and shutdown 
   
  Individual initiating event groups 
   
  Hazards during power operation and non-power conditions 
   
  Plant operational states 
   
  Point in time risk for each operational state (to support ALARP) 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 70 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   A review of results has been carried out to confirm their correctness. 
  A review of why the risk profile is similar or different to that of similar 
  plants has been performed, to the extent practicable given the 
  availability of results for similar plants. 
   The treatment of success branches is sufficiently accurate and the 
  approach taken is justified, especially for headings where failure 
  probabilities are large. 
   The summated total RC frequency (including RCs with minimal or no 
  release) has been compared to the Level 1 CDF. A justification is 
  provided that the magnitude of any differences is acceptable. Any 
  significant differences are explained. 
   Uncertainties are propagated to generate uncertainty bounds on the 
  RC results and on the values of the risk metrics generated. 
  Uncertainty propagation includes both Level 1 and Level 2 
  uncertainties. 
  The Level 2 and Level 1 models may use event probabilities which 
  represent random events (sometimes referred to as aleatory events) 
  and event probabilities that represent uncertainties about 
  deterministic outcomes (sometimes referred to as epistemic events).  
  The distinction between these types of events is recognised in the 
  uncertainty propagation and uncertainty distributions are assigned 
  following a method that is appropriate to the type of event. 
  For aleatory events, the method used to generate uncertainty 
  distributions is consistent with the methods applied in the Level 1. 
  Deviations from or inconsistencies with the Level 1 methodology are 
  described and justified. 
  For epistemic events, the method used to generate uncertainty 
  distributions used in for the uncertainty propagation takes account of 
  the uncertainty information and modelling used to generate the mean 
  values for those events. The assigned distribution is consistent with 
  that modelling. 1/0 (or double delta) sampling (for binary or multiple 
  branchings) is used where appropriate; otherwise the approach used 
  is explained, justified and mathematically sound. 
  Where different events modelled in the Level 2 PSA depend on 
  shared or similar parameters, the effect of the correlation introduced 
  by these parameters is modelled unless a justification is provided that 
  the correlation is not significant or is adequately bounded. If the latter 
  bounding approach is used, a justification is provided that the realism 
  of the overall models is not compromised. 
   Table A1-3.7  Presentation and Interpretation of the Level 2 PSA Results 
   The Level 2 PSA results are clearly and thoroughly presented in the 
  PSA documentation.  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 71 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The results of the uncertainty and sensitivity evaluations provide a 
  high degree of confidence that the overall conclusions obtained from 
  the Level 2 PSA are valid. 
  A summary of the Level 2 PSA results together with accompanying 
  discussions is included. This summary is sufficient for PSA and non-
  PSA specialists to get a clear understanding of the risk of the defined 
  categories of radioactive releases, where this risk comes from and 
  which are the most significant uncertainties.  A clear explanation is 
  included of why the results of the Level 2 PSA are considered valid 
  despite the identified uncertainties.  
   All vulnerabilities identified by the Level 2 PSA are documented 
  explicitly. The corrective actions proposed to address the 
  vulnerabilities are clear.  
  An evaluation of the risk improvements expected from the proposed 
  corrective actions has been carried out and is documented explicitly. 
  This has been used as the basis for assigning a level of priority to 
  these proposals.  
  A formal process is in place to ensure that the proposed corrective 
  actions are captured, as appropriate, in the NPP design or design 
  modification processes, or in the NPP process for procedure 
  development or modification, etc. 
   A demonstration that the risk of radioactive release for the NPP is 
  ALARP is included. 
   4. 
   Table A1-4.  Level 3 PSA 
   Table A1-4.1  Assessment of the Level 3 analysis 
   The interfaces between the output of the Level 2 PSA and the input to 
  the Level 3 PSA (approach and code/s used) are consistent.  
   The end-point(s) of the Level 3 PSA are unambiguously stated and 
  the scope is clearly defined. 
  The range of consequences addressed by the Level 3 PSA and the 
  way in which these consequences are to be presented are identified. 
  These are adequate to allow comparison against the relevant targets 
  in the SAPs 
   The calculation methods used in the Level 3 PSA are auditable and 
  reflect the current state of knowledge. These include: 
   
  The 
  method(s) 
  used 
  to 
  address 
  the 
  relevant 
  phenomena 
  and 
  pathways, 
  e.g. 
  for 
  calculation 
  of 
  atmospheric 
  dispersion, 
  surface 
  deposition, 
  re-suspension, 
  migration 
  through 
  food 
  chains, etc. 
  The 
  method(s) 
  used 
  for 
  the 
  irradiation, 
  irradiation 
  from 
   of 
  dose 
  (external 
  irradiation 
  from 
    
   calculation 
  inhalation, 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 72 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   ingestion). 
  The 
  method(s) 
  used 
  for 
  the 
  calculation 
  of 
  health 
  effects 
  (deterministic, stochastic somatic, stochastic hereditary). 
  The 
  method(s) 
  used 
  for 
  the 
  calculation 
  of 
  the 
  economic 
  consequences. 
  The selection and justification of parameter values. 
    
    
    
   The sources of specific items of data needed to perform probabilistic 
  consequence analysis (meteorological, population, agricultural 
  production, land, food distribution data, etc) are auditable and valid. 
  The approach used for meteorological sampling is appropriate. 
  The data used is up-to-date.  
  The site-specific data used to perform the consequence calculations 
  is auditable.  
  Assumptions made are justified. 
   The input information used in the Level 3 PSA calculations regarding 
  countermeasures and protective actions is stated. 
  The countermeasure strategies modelled are either reasonable 
  bounding assumed strategies (in which case the countermeasures 
  are feasible and consistent with national requirements) or are based 
  on the NPP’s existing emergency plan. 
   Where default data provided by the code is used, its applicability is 
  justified explicitly. 
  The usage of default data is documented in an auditable fashion. 
   The method by which the full spectrum of severe accident source 
  terms generated in the Level 2 PSA are linked to a limited number of 
  actual consequences in the Level 3 PSA is documented and 
  auditable. 
   The calculations performed are auditable. 
   The computational process used to integrate the entire PSA model 
  (Level 1 through Level 3) is appropriate. 
   Sensitivity analyses have been performed and are documented. The 
  sensitivity analyses capture key assumptions and combinations of 
  assumptions. 
  Uncertainties associated with the input parameters have been 
  quantified using an acceptable method. 
  Based on the uncertainty and sensitivity evaluations, an 
  understanding has been gained of which parametric and modelling 
  uncertainties contribute most to the overall uncertainty in the results 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 73 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   of the Level 3 PSA. This analysis is documented. 
  The results of the uncertainty and sensitivity evaluations demonstrate 
  that the overall conclusions obtained from the L3 PSA are still valid. 
   The regulator may choose to review in depth a representative subset 
  of Level 3 calculations. In these cases no significant errors have been 
  found. 
   The regulator may choose to independently perform a representative 
  subset of Level 3 calculations. In these cases, the results obtained 
  are consistent with those presented by the dutyholder.    
   Table A1-4.2  Presentation and Interpretation of the Level 3 PSA Results 
   The Level 3 PSA results are clearly presented in the PSA 
  documentation.  
  A summary of the Level 3 PSA results together with accompanying 
  discussions is included. This summary is sufficient for PSA and non-
  PSA specialists to get a clear understanding of the risk of various 
  types of consequences, where this risk comes from and which are the 
  most significant uncertainties.  A clear explanation is included of why 
  the results of the Level 3 PSA are considered valid despite the 
  identified uncertainties.  
   All issues or vulnerabilities identified by the Level 3 PSA are 
  documented explicitly. The corrective actions proposed to address the 
  vulnerabilities are clear.  
  An evaluation of the risk improvements expected from the proposed 
  corrective actions has been carried out and is documented explicitly. 
  This has been used as the basis for assigning a level of priority to 
  these proposals.  
  A formal process is in place to ensure that the proposed corrective 
  actions are captured, as appropriate, in the emergency procedures 
  and arrangements 
   A demonstration that the individual and societal risks from the facility 
  under evaluation are ALARP is included. 
   5. 
   Table A1-5   Overall Conclusions from the PSA 
   The PSA is documented thoroughly. The PSA documentation enables 
  the event and fault tree model, assumptions and quantification results 
  to be traceable to the design documentation, drawings, analyses, 
  operating procedures, and any other supporting information. 
   All aspects of the PSA have been subject to sufficient level of 
  independent review by the dutyholder to provide confidence in its 
  technical adequacy. These reviews are documented. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 74 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The PSA has a credible and defensible basis.  
   The PSA reflects the design of the NPP at the freeze date. 
   The PSA reflects the operation of the NPP up to the freeze date. 
   A process is in place to ensure that the assumptions regarding design 
  and operation of the facility reflected in the PSA are captured in the 
  development of future procedures, policies and strategies, design, 
  design modifications and back-fits, etc.  
   The PSA is fully accepted by the NPP operator. 
   A process is in place to keep the PSA living, i.e. to be updated as 
  necessary (at least every three years) to reflect the current design 
  and operational features / practices and to incorporate feedback from 
  internal and external operational experience, improved understanding 
  of physical processes or accident progression and advances in 
  modelling techniques.  
   The PSA has enabled a judgement to be made as to the acceptability 
  of the overall risk of the facility against the SAPs numerical targets, 
  and in particular targets 7 (individual risk) and 9 (societal risk). 
   The PSA has demonstrated that a balanced design has been 
  achieved, such that no particular class of accident or feature of the 
  facility makes a disproportionate contribution to the overall risk. 
   The PSA has been used effectively to demonstrate that the risk 
  associated with the design and operation of the NPP is ALARP 
   6. 
   Table A1-6.  Use of PSA to Support Decision-Making 
   Note: This table is only generic. Detailed guidance on how to review 
  specific PSA applications will be added as appendices to this TAG. 
  Alternatively, stand-alone TAGs will be released for each application. 
   Table A1-6.1  Expected uses of PSA 
   The PSA has been used to support the NPP design process.  There 
  is evidence that this has been done iteratively, i.e. that the PSA has 
  been used to inform all the stages of the design. 
   The PSA has been used to support design modifications and back-
  fits, including the analyses of options considered during the 
  preparatory stages of modifications projects.  
   The PSA has been used to provide an input to the development of, 
  and changes to, operating rules / technical specifications and testing, 
  inspection and maintenance schedules of the NPP. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 75 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   The PSA has been used to provide an input to the optimal planning of 
  testing, inspection and maintenance activities and to the daily 
  management of plant configuration (i.e. when releasing plant for 
  testing, inspection or maintenance). 
   The PSA has provided an input to the justification for any change to 
  the way in which the facility is operated. 
   The PSA has been used to produce performance measures to 
  demonstrate that the NPP is operated in such a way as to ensure that 
  the numerical risk is kept ALARP. 
   The PSA is used to understand the risk significance of any abnormal 
  occurrences at the NPP and to identify measures to avoid future re-
  occurrences of safety significant events. 
   The PSA has been used to support and inform Periodic Safety 
  Reviews of the Facility. 
   The PSA has been used to support development of, and changes to, 
  operating procedures for managing all stages of incidents and 
  accidents (including severe accidents). 
   The PSA has been used to provide an input to the design of, and 
  changes to, operator-training programmes for management of 
  incidents and accidents (including severe accidents). 
   The results of the PSA have been used to provide an input for off-site 
  emergency planning and response including a demonstration of the 
  effectiveness of countermeasures. 
   Table A1-6.2  Quality of the safety submissions supported by PSA 
   The issue being evaluated using the PSA is explicitly defined. 
  The type of results required as input to the decision-making are 
  identified up-front.  
  Any applicable numerical criteria are identified up-front. 
  (In general, the inspector should expect that the impact of the issue 
  on the overall risk should have been addressed by evaluating the 
  Core Damage Frequency, Large Release Frequency, and Societal 
  Risk). 
   All aspects of the PSA model and data potentially affected by the 
  issue under study are identified explicitly.  
   All aspects of the PSA model and data identified as being potentially 
  affected by the issue under study have been analysed for impact and 
  modified if necessary. The analysis is transparent. The modifications 
  are adequate. 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 76 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
   All the assumptions in the PSA have been checked for validity against 
  the issue under study and modified if appropriate. The analysis is 
  documented explicitly. 
   Sensitivity analyses have been carried out to evaluate the sensitivity 
  of the risk to changes in relevant assumptions and areas of modelling 
  uncertainty. The analyses are documented explicitly. 
   Sensitivity analyses have been carried out to check the risk impact of 
  different options under consideration. The analyses are documented 
  explicitly. 
   Sensitivity analyses have been performed to address ‘what if’ 
  scenarios. The analyses are documented explicitly. 
   The results of the sensitivity analyses have been used to inform the 
  final decision. The way in which the final decision has been informed 
  by the results of the sensitivity analyses is transparent. 
   Uncertainties in input probability and frequency values have been 
  estimated and propagated through the models to generate uncertainty 
  distributions on the resulting risk figures. 
  The means resulting from the uncertainty propagation have been 
  compared against the numerical criteria relevant to the application 
  (rather than using the point estimate means which result from a 
  simple arithmetic evaluation of the PSA cutsets). 
   Based on the results of the sensitivity and uncertainty analyses, it has 
  been shown that the most important modelling and parametric 
  uncertainties have been minimised, or that the results of the 
  application are not affected by these uncertainties, or that the 
  decision based on the results of the application takes account of the 
  uncertainties by application of the precautionary principle (as 
  described in R2P2). Details of this are documented explicitly. 
   If the issue under study affects aspects of the risk not covered within 
  the scope of the existing PSA. These limitations in the PSA in relation 
  to the issue under evaluation have been recognised and identified 
  explicitly.  
  In such cases, the PSA models have been adequately extended and / 
  or enhanced to cover the missing aspects. The new models and data 
  are adequate. 
  If extending the PSA is considered not to be practicable (e.g., due to 
  time constraints), the risk impact of the issue associated with areas 
  outside the scope of the existing PSA has been analysed 
  qualitatively. The analysis of this is transparent and adequate.  
   The outcome of the PSA studies performed to evaluate issues is 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 77 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   ASSESSMENT EXPECTATION 
   MET? 
    
   
    
   of 
   key 
   areas 
   including 
   any 
   undertaken 
   clear, comprehensive and traceable.  
  The outcome of the PSA studies performed to evaluate issues 
  includes the following: 
   
  A description of the issue under study. 
   
  A 
  description 
  of 
  the 
  PSA 
  evaluations 
  numerical criteria established. 
  A description of the new (or modified) assumptions. 
  A description of the modifications 
  to models and data and relevant 
  drawings.   
  The 
  identification 
  issue. 
  Relevant numerical results. 
  Lists of cutsets and importance measures. 
  Risk 
  profile 
  (identification 
  of 
  dominant 
  initiating 
  sequences, and protection failures). 
  Results 
  of 
  the 
  sensitivity 
  and 
  conclusions obtained from these. 
  Qualitative risk arguments used. 
  A 
  clear 
  interpretation 
  of 
  all 
  the 
  information 
  above 
  and 
  unambiguous 
  recommendations 
  based 
  on 
  a 
  systematic 
  application 
  of 
  decision-making 
  criteria 
  applied 
  to 
  the 
  results 
  of 
  the 
  PSA evaluations.  
   uncertainty 
   events, 
   accident 
   uncertainty 
   in 
   analyses 
    
   
   
   relation 
   to 
   the 
    
    
   
   of 
   and 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 78 of 81 
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   10. 
   APPENDIX 2 – NS-TAST-GD-030 – MAPPING BETWEEN ISSUE O 
  (PROBABILISTIC SAFETY ANALYSIS) OF THE WENRA REFERENCE LEVELS 
  AND THE REQUIREMENTS OF THIS TAG 
   TABLE A2: COMPARISON WITH THE WENRA REFERENCE LEVELS 
   TAG 
   COMMENTS 
   4.5 
  describes 
  SAP FA.12 
  Note: 
  a 
  Level 
  3 
  PSA 
  is 
  required 
  to 
  address 
  some 
  of 
  the numerical 
  targets 
  of 
  the 
  SAPs 
   Specific, 
  detailed 
  requirements 
  to 
  address scope and level in PSAs for 
  NPPs 
  are 
  spread 
  throughout 
  Appendix 1, e.g. Tables A1-1.2, A1-
  2.1, 
  A1-2.7.1, 
  A1-2.8 
  and 
  A1-5 
  (paragraph 
  starting 
  The 
  PSA 
  has 
  enabled…) 
   WENRA REFERENCE LEVELS 
  (ISSUE O) 
   1. Scope and content of PSA  
   1.1 For each plant design, a specific 
  PSA 
  shall 
  be 
  developed 
  for 
  level 
  1 
  and 
  level 
  2, 
  considering 
  all 
  relevant58 
  operational 
  states, 
  covering 
  fuel 
  in 
  the 
  core 
  and 
  in 
  the 
  spent 
  fuel 
  storage 
  and 
  all 
  relevant 
  internal 
  and 
  external 
  initiating 
  events. 
  External 
  hazards 
  shall 
  be 
  included 
  in 
  the 
  PSA 
  for 
  level 
  1 
  and 
  level 
  2 
  as 
  far 
  as 
  practicable, 
  taking 
  into 
  account 
  the 
  current 
  state 
  of 
  science 
  and 
  technology. 
  If 
  not 
  practicable, 
  other 
  justified 
  meth-
  odologies 
  shall 
  be 
  used 
  to 
  evaluate 
  the 
  contribution 
  of 
  external 
  hazards 
  to the overall risk profile of the plant.  
   1.2 
  PSA 
  shall 
  dependencies.  
   include 
   relevant 
   4.6 
  (Sections 
  and 3)  
   2 
   1.3 
  The 
  Level 
  1 
  PSA 
  shall 
  contain 
  sensitivity and uncertainty analyses. 
  The 
  Level 
  2 
  PSA 
  shall 
  contain 
  sensitivity 
  analyses 
  and, 
  as 
  appropriate, uncertainty analyses.  
   Section 
   4, 
   4.6 
  4.7 
   Specific 
  requirements 
  to 
  address 
  dependencies in PSAs for NPPs are 
  spread 
  throughout 
  Appendix 
  1, 
  e.g. 
  Table 
  A1-2.3.2 
  (paragraph 
  starting 
  “All 
  dependencies…”, 
  Table 
  A1-
  2.4.1 
  paragraph 
  starting 
  “The 
  general 
  approach 
  for 
  the 
  inclusion 
  on 
  (hardware/software) 
  common 
  cause 
  failure 
  events…”. 
  Table 
  A1-
  2.4.2 
  paragraph 
  starting 
  “The 
  information 
  on 
  dependencies…” 
  and 
  paragraph 
  starting 
  “all 
  intra-
  system 
  and 
  inter 
  system 
  common 
  cause failures…)   
   Specific 
  requirements 
  to 
  perform 
  sensitivity 
  and 
  uncertainty 
  analyses 
  in 
  PSAs 
  for 
  NPPs 
  are 
  spread 
  throughout 
  Appendix 
  1, 
  e.g. 
  Table 
  A1-2.9.1, 
  and 
  Table 
  A1-3.6. 
  See 
  also 
  Tables 
  A1-3.i 
  for 
  expectations 
  on 
  sensitivity 
  and 
  uncertainty 
  analyses in the Level 2 PSA  
   1.4 
  PSA 
  realistic 
   shall 
  be 
  modelling 
   based 
  of 
   on 
  a 
  plant 
   4.6 Section 2 
   Specific requirements to ensure that 
  in 
  PSAs 
  for 
  NPPs 
  the 
  models 
  and 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 79 of 81 
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   TABLE A2: COMPARISON WITH THE WENRA REFERENCE LEVELS 
   WENRA REFERENCE LEVELS 
  (ISSUE O) 
   response, 
  using 
  data 
  relevant 
  for 
  the 
  design, 
  and 
  taking 
  into 
  account 
  human 
  action 
  to 
  the 
  extent 
  assumed 
  in 
  operating 
  and 
  accident 
  procedures. 
  The 
  mission 
  times 
  in 
  the PSA shall be justified. 
   1.5 
  Human 
  reliability 
  analysis 
  shall 
  be 
  performed, 
  taking 
  into 
  account 
  the 
  factors 
  which 
  can 
  influence 
  the 
  performance 
  of 
  the 
  operators 
  in 
  all 
  plant states 
   2. Quality of PSA  
   2.1 
  PSA 
  shall 
  be 
  performed, 
  documented, 
  and 
  maintained 
  according 
  to 
  the 
  quality 
  management 
  system 
  of 
  the 
  licensee.  
   2.2 
  PSA 
  shall 
  be 
  performed 
  according 
  to 
  an 
  up 
  to 
  date 
  proven 
  methodology, 
  taking 
  into 
  account 
  international 
  experience 
  currently 
  available.  
   TAG 
   COMMENTS 
   data 
  are 
  realistic 
  are 
  spread 
  throughout 
  Appendix 
  1, 
  e.g. 
  Table 
  A1-2.2 
  and 
  A1-2.6. 
  Table 
  A1-2.3.2 
  includes 
  specific 
  expectations 
  for 
  mission 
  times 
  (as 
  does 
  SAP 
  para 
  652) 
   Specific 
  requirements 
  for 
  the 
  Human 
  Reliability 
  Analysis 
  in 
  PSAs 
  for 
  NPPs 
  are 
  included 
  in 
  Table 
  A1-
  2.5 
   4.6 Section 3 
   4.11, 
   4.12, 
   3.6, 
  4.15 
   LC 
  17 
  requires 
  an 
  licensee QA system 
   appropriate 
   2.5, 4.11  
   The 
  TAG 
  taken 
  as 
  a 
  whole 
  will 
  ensure 
  that 
  the 
  PSA 
  is 
  performed 
  according 
  to 
  an 
  up 
  to 
  date 
  proven 
  methodology. 
  A 
  large 
  amount 
  of 
  International 
  experience 
  is 
  embodied in the TAG (see A1-4 and 
  A1-5) 
   3. Use of PSA  
   3.1 
  PSA 
  shall 
  be 
  used 
  to 
  support 
  safety 
  management. 
  The 
  role 
  of 
  PSA in the decision making process 
  shall be defined.  
   4.7 
   3.2 PSA shall be used to identify the 
  need 
  for 
  modifications 
  to 
  the 
  plant 
  and 
  its 
  procedures, 
  including 
  for 
  severe 
  accident 
  management 
  measures, 
  in 
  order 
  to 
  reduce 
  the 
  risk from the plant.  
   4.7. Section 1 
   Specific 
  in 
  Table 
  6.1. 
   expectations 
  are 
  A1-2.9.3, 
  A1-3.6, 
   included 
  and 
  A1-
   3.3 PSA shall be used to assess the 
  overall 
  risk 
  from 
  the 
  plant, 
  to 
  demonstrate 
  that a balanced design 
  has 
  been 
  achieved, 
  and 
  to 
  provide 
  confidence 
  that 
  there 
  are 
  no 
  ""cliff-
  edge effects"".  
   4.3 
  Section 
  2 
  see 
  also 
  SAP 
  FA.25 
  and 
  paras 
  676 
  and 
  677 
  for 
  “cliff 
  edge 
  effects” 
   3.4 PSA shall be used to assess the 
  adequacy 
  of 
  plant 
  modifications, 
   4.7. Section 1 
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 80 of 81 
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   TABLE A2: COMPARISON WITH THE WENRA REFERENCE LEVELS 
   WENRA REFERENCE LEVELS 
  (ISSUE O) 
   changes 
  to 
  operational 
  limits 
  and 
  conditions 
  and 
  procedures 
  and 
  to 
  assess 
  the 
  significance 
  of 
  operational occurrences.  
   3.5 
  Insights 
  from PSA shall be used 
  as 
  input 
  to 
  development 
  and 
  validation 
  of 
  the 
  safety 
  significant 
  training 
  programmes 
  of 
  the 
  licensee, including simulator training 
  of control room operators.  
   3.6 
  The 
  results 
  of 
  PSA 
  shall 
  be 
  used 
  to 
  ensure 
  that 
  the 
  items 
  are 
  included 
  in 
  the 
  verification 
  and 
  test 
  programmes 
  if 
  they 
  contribute 
  significantly to risk. 
   TAG 
   COMMENTS 
   4.7. Section 1 
   4.7. Section 1 
   4. Demands and conditions on the use of PSA  
   4.1 
  The 
  limitations 
  of 
  PSA 
  shall 
  be 
  understood, 
  recognized 
  and 
  taken 
  into 
  account 
  in 
  all 
  its 
  use. 
  The 
  adequacy 
  of 
  a 
  particular 
  PSA 
  application 
  shall always be 
  checked 
  with respect to these limitations.  
   4.2 
  When 
  PSA 
  is 
  used, 
  for 
  evaluating 
  or 
  changing 
  the 
  requirements 
  on 
  periodic 
  testing 
  and 
  allowed 
  outage 
  time 
  for 
  a 
  system or a 
  component, all 
  relevant 
  items, 
  including 
  states 
  of 
  systems 
  and 
  components 
  and 
  safety 
  functions 
  they 
  participate 
  in, 
  shall 
  be included in the analysis.  
   4.3 
  The 
  operability 
  of 
  components 
  that 
  have 
  been 
  found 
  by 
  PSA 
  to 
  be 
  important 
  to safety shall be ensured 
  and 
  their 
  role 
  shall 
  be 
  recorded 
  in 
  the SAR.   
   4.7. Section 2 
   4.7. Section 2 
   4.7. Section 1  
   Report : NS-TAST-GD-030 
  CM9 Ref: 2018/408246 
   Page 81 of 81 
    
    
    
    
    
    
    
    
    
    
    
    
    
  "
  Procedure Design and Administrative Controls	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Procedure Design and Administrative Controls.pdf	" Title of document 
   OFFICIAL 
   ONR GUIDE 
    Procedure Design and Administrative Controls 
   Document Type: 
   Nuclear Safety Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   NS-TAST-GD-060 Revision 3 
   November 2017 
   Review Date: 
   November 2020 
   Approved by: 
   E Vinton 
   Professional Lead 
   Record Reference: 
  Revision commentary: 
   TRIM Folder 1.1.3.776. (2017/438046) 
  Revision  
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
   5. 
  6. 
  7. 
  8. 
   INTRODUCTION ................................................................................................................. 2 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION ......................... 3 
  RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS, AND IAEA SAFETY 
  STANDARDS ....................................................................................................................... 3 
  ADVICE TO INSPECTORS ................................................................................................. 5 
  REFERENCES .................................................................................................................. 14 
  GLOSSARY AND ABBREVIATIONS ................................................................................ 15 
  ANNEXE A ......................................................................................................................... 16 
   © Office for Nuclear Regulation, 2017 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 11/17 
   NS-TAST-GD-060 - Revision 3 
   Page 1 of 16 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   1. 
   1.1 
   2. 
   2.1 
   2.2 
   2.3 
   2.4 
   2.5 
   INTRODUCTION 
   The Office for Nuclear Regulation (ONR) has established its Safety Assessment 
  Principles (SAPs) which apply to the assessment by ONR specialist inspectors of 
  safety cases for nuclear facilities that may be operated by potential licensees, existing 
  licensees, or other duty-holders.  The principles presented in the SAPs are supported 
  by a suite of guides to further assist ONR’s inspectors in their technical assessment 
  work in support of making regulatory judgements and decisions.  This Technical 
  Assessment Guide (TAG) is one of these guides. 
   PURPOSE AND SCOPE 
   ONR has the responsibility for regulating the safety of nuclear installations in Great 
  Britain. The SAPs for Nuclear Facilities [1] provide a framework to guide regulatory 
  decision-making in the nuclear permissioning process. The SAPs are supported by 
  TAGs which further aid the decision-making process.  
   This TAG provides guidance to aid Inspectors in the interpretation and application of 
  SAPs related to procedure design and the use of administrative controls, specifically 
  SAPs EHF.4 and EHF.9. It also assists with the application of other SAPs which set 
  out expectations regarding administrative safety measures and procedures designed 
  and implemented by a dutyholder, including those related to compliance with 
  Operating Rules.  
   The TAG provides broad expectations on key points that the experienced Human 
  Factors (HF) Inspector may wish to consider when judging whether a licensee’s 
  procedures and administrative safety controls are designed and implemented 
  effectively. This TAG is not intended to be a detailed design guide for procedures and 
  administrative controls; nor does it prescribe specific methods and approaches for 
  assessing them or offer guidance on how to judge the adequacy of their technical 
  content. Inspectors should exercise their own judgement and discretion in the depth 
  and scope to which they apply the guidance, but should be cognisant of the safety 
  reliance that is placed on human action and the contribution that failure to implement 
  the administrative controls and procedures makes to risk.  
   Procedures and Administrative Control  
   SAP EKP.5 sets out a hierarchy of preferred options for delivering safety functions and 
  maintaining the plant within its safe operating envelope. The SAP identifies the 
  preference for passive safety measures, but sets out alternatives including the use of 
  administrative safety measures where an engineered control is not possible or 
  reasonably practicable to implement. Where administrative safety measures are 
  proposed, the safety case should include a robust justification demonstrating why 
   alternative measures are not reasonably practicable, and showing that claims on the 
  administrative safety measure can be substantiated.  
   Procedures form an essential part of any administrative safety measure. The 
  mechanisms in place to ensure that procedures are designed in accordance with good 
  practice HF guidelines, such that they support the end user and reflect safety case 
  requirements will influence the reliability with which safety significant tasks are 
  controlled and should form part of the substantiation. Administrative safety measures 
  may be defined as Operating Instructions in accordance with Licence Condition (LC) 
  24(1). 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 2 of 16 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   Definitions  
   2.6 
   2.7 
   3. 
   3.1 
   3.2 
   3.3 
   This TAG uses the term ‘procedures’ to refer to all written instructions that describe the 
  way in which operations affecting safety should be carried out. The term ‘Operating 
  Instruction’ is used within LC 24. Licensees use a range of terminology for LC 24 
  operating instructions and this term is generally taken to mean, but is not limited to, 
  procedures. As much of what is carried out on operating sites is controlled by lower 
  level documents that support ‘operating instructions’ the term ‘procedures’ has been 
  used to indicate the broader application of the guidance within this TAG.  
   Administrative control within this TAG refers to a safety measure that is claimed to 
  maintain operations within the plant’s safe operating envelope derived from the safety 
  case, and which is implemented by operator action  
   RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION  
   The Nuclear Site LCs [2] place legal requirements on the licensee to make and 
  implement arrangements to ensure that safety is being adequately managed. The 
  licence conditions provide a legal framework which can be drawn on in assessment.  
   LCs 23 (limits and conditions in the interests of safety) and 24 (Operating Instructions) 
  particularly apply. Also of relevance are LCs 14 and 15 (preparation and review of 
  safety cases), LC 11 (emergency arrangements), LC 17 (quality management), and LC 
  28 (examination, inspection, maintenance and testing). Most other licence conditions 
  also touch on the topic of procedures and administrative controls. Procedures 
  providing guidance and instruction to staff are instrumental in ensuring that all activities 
  throughout the life cycle of an installation are carried out reliably and efficiently such 
  that the potential for introduction of errors is minimised.  
   Regulation 3(1) of The Management of Health and Safety Work Regulations 1999 
  places a legal requirement on dutyholders to produce suitable and sufficient risk 
  assessments and Regulation 4 the requirement to introduce preventive and protective 
  measures to control risk. In order to be considered suitable and sufficient, such 
  assessments may need to identify and consider the need for and influence of, suitable 
  and sufficient procedures and administrative controls as part of the dutyholder’s 
  measures for controlling risk.  
   4. 
   RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS, AND IAEA SAFETY 
  STANDARDS  
   SAPS  
   4.1 
   ONR’s expectations concerning the adequacy of administrative controls and 
  procedures are set out in a number of SAPs. The primary references relating to 
  procedures and administrative controls are contained in the following SAPs [1]:  
   4.2 
   EHF.4. Identification of administrative controls:  
   “Administrative controls used to remain within the safe operating envelope should be 
  systematically identified”.  
   4.3 
   Para 448 expands upon EHF.4:  
   The design of these controls should be such that the requirements for personnel action 
  are clearly identified and unambiguous to those responsible for their implementation.  
   4.4 
   EHF.9 Procedures 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 3 of 16 
    
    
    
    
    
   Office for Nuclear Regulation  
   “Procedures should be produced to support reliable human performance during 
  activities that could impact on safety”.  
   4.5 
   Para 458 expands upon EHF.9:  
   Procedures should be accurate and designed and presented in a format that is 
  compatible with the needs of the end user and suitable for the task that they are 
  designed to support.  
   4.6 
   References to procedures and administrative controls, either implicit or explicit, are 
  also noted throughout the SAPs in general, and these are presented in Annexe A.  
   WENRA Reactor Safety Reference Levels  
   4.7 
   4.8 
   The objective of The Western European Nuclear Regulators Association (WENRA) is 
  to develop a common approach to nuclear safety in Europe by comparing national 
  approaches to the application of International Atomic Energy Agency (IAEA) safety 
  standards.  
   The guidance in this TAG is consistent with the following harmonisation issues from 
  the WENRA Reactor Safety Reference levels [3], which represent good practices in 
  the WENRA member states, are relevant and should be taken into account by the 
  inspector:  
   • Issue H: Operational Limits and Conditions (OLCs).  
  • Issue K: Maintenance, In-Service Inspection and Functional Testing.  
  • Issue L/M: Emergency Operating Procedures and Severe Accident Management 
  Guidelines.  
  • Issue O: Probabilistic Safety Analysis (PSA). 
  • Issue Q: Plant Modifications.  
  • Issue S: Protection against Internal Fires.  
   IAEA Safety Standards  
   4.9 
   The guidance is also consistent with the following IAEA safety requirements and 
  guidance:  
   NS-R-2: Safety of Nuclear Power Plants: Operation Safety Requirements, 2000 [4] 
   SSR-2/2: Safety of Nuclear Power Plants: Commissioning and Operation 
  Specific Safety Requirements, 2016 [5].  
   NS-G-2.4: The Operating Organisation for Nuclear Power Plants Safety Guide, 
  2001 [6].  
   NS-G-2.14: Conduct of Operations at Nuclear Power Plants Safety Guide, 2008 
  [7].  
   4.10 
   The IAEA Safety Standards (Requirements and Guides) were the benchmark for the 
  revision of the SAPs in 2014 and are recognised by ONR as relevant good practice. 
  They should therefore be consulted, where relevant, by the Inspector. 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 4 of 16 
    
    
    
    
    
    
    
    
     
    
    
    
    
    
    
   Office for Nuclear Regulation  
   5. 
   ADVICE TO INSPECTORS  
   Introduction  
   5.1 
   LC 24 requires that all operations which may affect safety are carried out in 
  accordance with written instructions. The licensee should be able to demonstrate that 
  its administrative controls and procedures are designed and implemented such that 
  they support reliable human performance of actions that keep the plant within the safe 
  operating envelope. The guidance provided in this section can be used to assess all 
  types of procedures and administrative controls.  
   General Expectations  
   5.2 
   Inspectors should seek to gain confidence that safety claims made upon administrative 
  controls and procedures can be substantiated. This may involve considering:  
   • 
   • 
   • 
   • 
   the dutyholder’s process for identifying the need for administrative controls and 
  procedural support within the safety case;  
  its capability – often embedded in its HF resource - to support effective 
  specification and design of administrative controls and procedures, drawing 
  upon a proportionate use of task analysis;  
  the processes in place to ensure that administrative controls and procedures 
  are implemented effectively and are subject to suitable management controls, 
  for example configuration control and review of modifications; 
  learning from experience, for example implementing appropriate improvements 
  following events, feedback for personnel following use (during operation, 
  training, drills, etc.), periodic reviews of safety, etc.   
   5.3 
   Claims on administrative control should be identified and assessed from a HF 
  perspective in all operating states commensurate with their risk. Where a high reliance 
  is placed upon the administrative control, it would be expected that a detailed HF 
  assessment involving the use of task analysis would be conducted and robust 
  justification made for the usability and reliability of that control. ONR expects 
  HF/ergonomics principles and practices to be incorporated in the design, specification, 
  implementation and through-life management of procedures and administrative 
  controls. It should be noted that procedures are only one of the factors affecting the 
  reliability of operator action associated with implementation of administrative controls. 
  Other factors such as Human-Machine Interface (HMI), task design, supervision and 
  training will also be relevant, and the Inspector should recognise this when defining 
  interventions.  
   5.4 
   Key elements for ensuring the provision of suitable and sufficient administrative control 
  and procedures to support the safe operation of nuclear plant include explicit 
  consideration of:  
   • 
  • 
   • 
   The safety goal to be achieved,  
  The nature of the task and human-based safety claim related to the delivery of 
  administrative safety functions  
  The needs of the end user  
   5.5 
   Inspectors may consider whether:  
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 5 of 16 
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   • 
   • 
   • 
   • 
   • 
   • 
   • 
   • 
   • 
   The dutyholder’s process for the identification of administrative control 
  requirements draws upon the safety case and covers all plant operational 
  modes/states including maintenance, testing and calibration activities, override 
  facilities, fault and emergency response.  
  Where appropriate, the dutyholder’s administrative controls take into account 
  the need to demonstrate compliance with conditions and limits necessary in 
  the interests of safety; detect non-compliance and facilitate the successful 
  performance of recovery actions. This includes factors such as supervision and 
  surveillance tasks, compliance records, alarm set points, the communication of 
  time constraints associated with non-compliance, operator awareness and 
  training about the safety limits and conditions.  
  Administrative controls and the associated safety-related activities that 
  operators need to carry out to achieve compliance with operating rules are 
  clearly identified as such in operating instructions. The instructions clearly state 
  what needs to done, when, by whom, under what circumstances, the success 
  criteria for each activity and actions to be taken if an operating rule is 
  breached.  
  The specification and design of administrative control (and procedures) is 
  included as part of the dutyholder’s Human Factors Integration (HFI) process 
  (see Technical Assessment Guide NS-TAST-GD-058 – Human Factors 
  Integration [8]).  
  The dutyholder has declared and justified the standards/guidelines used for the 
  design/modification and substantiation of its administrative controls.  
  The actions being claimed are 
  feasible, 
  potential for human error is identified and minimised to As Low As 
  Reasonably Practicable (ALARP) and 
  the actions can be carried out with an appropriate level of reliability given 
  the equipment, procedures and operator interfaces provided.  
  The dutyholder has considered each individual administrative control to 
  consider management of safety issues that can contribute to the adequate 
  implementation of the controls, such as competency assurance and 
  management actions to ensure compliance. The following aspects should be 
  evident in the dutyholder’s design of administrative controls:  
  Task requirements, potential for errors/violations and demands placed 
  upon operators are clearly identified and understood;  
  Adequacy of the supporting systems, such as the interfaces and 
  procedures that operators are reliant on to implement the administrative 
  control;  
  Competence levels and training of operators to perform the task;  
  Task environment/context including Performance Shaping Factors and 
  the prevailing safety culture to support operator performance.  
  The dutyholder’s arrangements include elements of evaluation, verification, 
  validation and review.  
  The dutyholder has carried out an operational experience review (existing or 
  similar plants), including a review of any simulations or mock-ups of its 
  proposed administrative controls.  
   o 
  o 
   o 
  o 
   o 
   o 
   o 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 6 of 16 
    
    
    
    
   Office for Nuclear Regulation  
   • 
   • 
   The dutyholder can demonstrate that the design and specification of 
  administrative controls has been used as an input to the design of procedures 
  and operator training needs/competence requirements.  
  The dutyholder has conducted suitable evaluation and testing/trials of the 
  design, specification, implementation and use of administrative controls and 
  procedures to demonstrate their effectiveness in the context of the safety case 
  claims and assumptions.  
   Dependency in claims on administrative control  
   5.6 
   The impact of dependency on the reliability of the administrative control should be 
  considered as this is an importance failure mechanism that is often overlooked or 
  inadequately defended against. Whilst the design of administrative controls should aim 
  to minimise dependency, it can be difficult to identify, or eliminate, all forms of 
  dependency in human actions, such that claims on multiple human actions to offer high 
  levels of protection are likely to be unrealistic. Claims on several ‘independent’ 
  administrative controls in order to claim an unrealistically high level of protection 
  should therefore be avoided.  
   5.7 
   Inspectors may consider whether:  
   • 
   The dutyholder has identified dependent failure mechanisms associated with 
  its administrative controls and has implemented credible defences and 
  mitigations against dependency where these effects are identified.  
   Assessment of administrative controls  
   5.8 
   This section provides general advice to the Inspector regarding good practice 
  expectations for the assessment and substantiation of administrative controls. The 
  guidance provided in T/AST/063 on Human Reliability Analysis is also relevant.  
   5.9 
   Inspectors may consider whether:  
   • 
   o 
   o 
   Where a high reliance is placed on administrative control or it delivers an 
  important safety function, the dutyholder has used task analysis and drawn 
  upon end user input to understand the task and demonstrate the suitability, 
  feasibility and reliability of the associated operator actions and managerial 
  arrangements. These include but are not limited to:  
  The operating instructions and the extent to which they clearly and 
  unambiguously prescribe any required actions and success criteria for 
  the administrative controls.  
  Performance shaping factors and error mechanisms associated with 
  context in which administrative controls are implemented including, 
  where appropriate, the dynamic nature of these.  
  The provision of adequate human-system interfaces; in providing 
  indication of safety-related parameters and their associated operating 
  limits, whether in a central control room or local-to-plant.  
  Operator awareness of the required actions and their role as defined 
  within the safety case.  
  Operator training and competence for the specific tasks to be performed.  
   o 
   o 
   o 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 7 of 16 
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   • 
   o 
   The prevailing culture within the relevant parts of the operating 
  organisation.  
  Where feasible, the dutyholder has used simulator trials to support the analysis 
  of administrative controls. Alternatively, the dutyholder has conducted walk-
  through/talk-through or observation of the use of administrative controls to 
  confirm that users are familiar with the controls and fluent in their use.  
   Other Administrative Controls  
   5.10 
   The Inspector should note that administrative controls with an impact on safety extend 
  beyond those directly involved in the execution of activities such as operations or 
  maintenance. These include, for example, controls such as Permit to Work, use of 
  waivers, temporary instructions etc. The Inspector should seek confidence that the 
  licensee’s arrangements for these other controls are adequate.  
   5.11 
   Inspectors may consider whether:  
   • 
   • 
   • 
   o 
   o 
   o 
   The dutyholder has a system to identify and assess administrative controls 
  indirectly or implicitly claimed to provide assurance of the level of protection 
  assumed within the safety case.  
  The dutyholder has adequately substantiated the robustness and reliability of 
  the following where they are claimed, either implicitly or explicitly, to provide 
  adequate nuclear safety:  
  Administrative controls used for configuration and surveillance and 
  maintenance of automatically initiated engineered safety systems.  
  Administrative controls used as a substitute for an engineered safety 
  system e.g. during a planned or unplanned outage, or for short-term high 
  risk activities.  
  Temporary instructions, workarounds and/or Permit-to-Work systems that 
  may be used to implement temporary safety measures as an alternative 
  to provide adequate safety during unplanned engineered safety system 
  outages, or to act as the controls for non-routine hazardous activities.  
  Override facilities; safe use of overrides and vetoes is dependent on 
  effective administrative control. Inspectors should check that the 
  administrative control arrangements ensure that operators understand 
  the plant state and any change in plant state associated with the 
  requirement for and application of an override and that is recognised by 
  all personnel who may at risk in order to avoid inadvertent actions being 
  taken and unintentionally creating a significant hazard.  
  The dutyholder has adequate arrangements for conducting periodic audit to 
  ensure that the level of control can be (and is being) maintained over a period 
  of time.  
   o 
   Procedures  
   5.12 
   This section is intended to supplement Technical Inspection Guide (TIG) NS-INSP-GD-
  024 [9] (LC 24 Operating Instructions) rather than repeat the information contained 
  therein. It is recommended that the reader also refers to NS-INSP-GD-024 as part of 
  their inspection and/or assessment.  
   General Expectations  
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 8 of 16 
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   5.13 
   All activities which may affect safety should be carried out in accordance with written 
  procedures. However, carrying out activities in accordance with procedures does not 
  necessarily mean that there must be a procedure in hand, followed step by step for 
  every task. Decisions on the way that procedures are used to support consistent and 
  reliable task performance must be based on the nature of the task, its safety 
  significance, the potential for error and the experience of the user. The inspector 
  should consider whether:  
   • 
   The dutyholder’s operating instructions are consistent with any operating rules 
  they implement. This includes any procedures that provide indirect support to 
  operating rules, such as those involved in the maintenance of safety related 
  plant.  
  The dutyholder’s procedures define how plant should be brought back within 
  operating rule limits and conditions if discovered to be outwith these.  
  Management arrangements  
   • 
   5.14 
   It is also important for the inspector to recognise the role of lower level procedures in 
  assuring safety, as the presence and use of these is often implicitly assumed within the 
  safety case. The dutyholder is expected to consider the role of such procedures in 
  delivering safety. Inspectors may consider whether:  
   • 
   • 
   • 
   • 
   • 
   • 
   The dutyholder has a controlled process for the production, maintenance, 
  review, amendment and version control of procedures. Mechanisms are in 
  place to ensure that the safety case is not undermined by subsequent changes 
  to procedures and vice versa  
  The dutyholder has a process for validation and verification of procedures, 
  which includes: end user involvement, consideration of the way they are used 
  to confirm their technical accuracy and usability.  
  Consideration of assumptions within the safety case to ensure that the safety 
  case is not undermined.  
  The dutyholder has a process of learning from experience to ensure 
  procedures are appropriately revised based on use. Changes that are made as 
  a result of this process should be evaluated to ensure that the procedure has 
  delivered its intended improvement.  
  The dutyholder’s modification and change management process has the 
  capacity to identify all design, organisational and safety case changes that may 
  impact procedures and the process should have the capacity to identify 
  procedures that are obsolete.  
  The dutyholder can demonstrate the suitability and sufficiency of the procedure 
  to support safe and reliable task performance. For example, through 
  implementation of a hierarchy of procedure classification relating to the safety 
  significance of the operations, its complexity and frequency to inform the 
  assignment of a category of procedure format, use and availability. This may 
  include ‘use categories’ similar to the following:  
  Level 1 – Continuous use; where the procedure is ‘in-hand’ and referred 
  to step by step each time the task is performed.  
  Level 2 – Reference use; the procedure is available at the work location 
  and may be referred to periodically during the performance of a task and 
  relevant blocks of task steps are verified to confirm that all steps have 
  been completed.  
  Level 3 – Information use; the procedure is available for use as needed.  
   o 
   o 
   o 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 9 of 16 
    
    
    
    
    
   Office for Nuclear Regulation  
   • 
   • 
   The dutyholder maintains accurate records to demonstrate compliance with 
  operating procedures in line with LC 25(1)  
  The dutyholder’s procedures are clearly linked with the claims and 
  assumptions in the safety case and the procedures have been developed 
  based on the output of the Design Basis Analysis (DBA), PSA and Safety 
  Assessment (SA), appropriate to the specific procedures.  
  Procedure Design and Methods  
   5.15 
   The development of technically accurate and usable procedures will rely on the 
  application of appropriate methods such as task analysis and on the quality of the 
  verification and validation processes. Engaging procedure users in the development 
  and amendment of procedures will also increase both the accuracy and validity of the 
  procedure. The rigour applied to the development of procedures should reflect the 
  relative contribution to safety of the task being controlled. The methods adopted should 
  be appropriate to the nature of the task or process.  
   5.16 
   Inspectors may consider whether:  
   • 
   • 
   • 
   • 
   • 
   • 
   o 
   o 
  o 
   The dutyholder uses a systematic and defined process to develop procedures 
  and this includes proportionate use of internal and/or external standards or 
  guidelines and the practices listed below, to ensure the uptake of relevant 
  good practice in procedure writing and to ensure consistency of presentation 
  and format (see for example references [10], [11] & [12]).  
  Task analysis.  
  Desktop or walk-through/talk-through approaches, wherein operators use 
  the procedures and verify their accuracy and suitability for the task and 
  the options available to them at each step.  
  Simulator, or some other high fidelity method, is used wherever possible 
  and in particular for post-fault actions.  
  The dutyholder has a responsive approach for updating procedures, from the 
  user point of view. This is important to motivate change where it is needed. 
  This process identifies the safety implications of such changes to ensure that 
  the safety case is not undermined.  
  The dutyholder is able to demonstrate that the standard of procedures used by 
  contractors is commensurate with what is expected from the dutyholder’s own 
  internally developed procedures.  
  The dutyholder uses its procedures to inform the identification and delivery of 
  competence and training needs associated with particular tasks to ensure that 
  these are clearly defined and that associated procedures do not assume any 
  knowledge and skill for which the user has not been trained and is competent 
  to carry out. The process also includes any unfamiliar/infrequently used 
  procedures e.g. annual maintenance instructions, fault and emergency 
  response procedures.  
  The dutyholder has clearly identified roles and responsibilities with regard to 
  procedures. There is a reasonably practicable process for ensuring that 
  procedure compliance is assured and demonstrated and this covers 
  management expectations about compliance.  
  The dutyholder’s procedures are provided in an appropriate format. 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 10 of 16 
    
    
    
    
    
   Office for Nuclear Regulation  
   o 
   o 
   o 
   o 
   Procedures should provide suitable navigation aids and be consistent in 
  their use of cautions, warnings, hold points and independent verification 
  to control safety significant task steps.  
  A “one size fits all” approach to procedure formatting is unlikely to be 
  appropriate. For example, an appropriate procedure format for use in 
  normal operations might be very differently from one to be used following 
  an accident / incident.   Different formats might be appropriate to support 
  the specific task requirements (e.g. sequential for normal operations, 
  symptom-based for design base faults, state / event based for severe 
  accidents, etc.).   
  Procedures should also support their users through the potential difficult 
  transition between normal and abnormal conditions (and back again).  It 
  should be clear to the user the appropriate procedure they need to use in 
  response to the specific scenario they face. 
  Where independent verification is used, it should be clear what is being 
  checked and how, such that any sign-off is meaningful to the verifier. The 
  procedure user should be made aware of the significance of the step 
  through its clear demarcation within the procedure and through training.  
  The dutyholder can demonstrate an understanding of safety significant task 
  steps in the procedures and any errors that may occur; these have been given 
  consideration in the design and maintenance of procedure quality.  
  Plant Commissioning Procedures  
   • 
   5.17 
   5.18 
   5.19 
   5.20 
   The general expectations for procedures, their design and methods of production 
  equally apply to procedures that are used for commissioning. However, during 
  commissioning operations are often performed with the plant in unusual and changing 
  configurations. Procedures must still be available under such circumstances. 
  Commissioning procedures are likely to be more detailed and require the bases of the 
  contents of the procedure to be explicit. During later operation, once the procedures 
  have been tested in use, this additional detail may no longer be required within the 
  procedure itself. The dutyholder should detail the bases upon which the commissioning 
  procedure content is decided and verified. This should also be linked to the safety 
  case, training and competency assessments.  
   Computerised Operating Procedures  
   Advances in digital technology are resulting in increasing availability of Computerised 
  Operating Procedures (COPs), for assisting operators with various plant control tasks, 
  fault diagnosis and response [13], [14]. The purpose of this section is to provide high 
  level guidance to inspectors where the licensee proposes to use such systems.  
   ONR considers COPs to be any computer application that presents operating 
  procedures/instructions through electronic, rather than printed, media. This is taken to 
   include procedure-based automation whereby the evaluation and execution of a 
  predefined sequence of procedure steps is carried out by a computerised 
  operating system.  
   In their simplest form, computer-based procedures simply represent the procedure text 
  in electronic form. This type of COPs may include the ability to call up another relevant 
  procedure from a hyper-link in the procedure and allow the user to track progress 
  through the procedure steps. More sophisticated COPs may automate the gathering 
  and display of plant data relevant to a task and procedure step. They incorporate 
  additional functionality such as automated data gathering and processing capability, 
  evaluation of plant parameters and procedure step logic, and the display of the results 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 11 of 16 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   to the operator to support decision-making and/or prompt the operator to take a 
  specific action. This type of COP may also provide links to soft controls where 
  operators may take plant control actions.  
   5.21 
   5.22 
   5.23 
   Further advanced COPs include all the functionality above and also have the ability to 
  issue plant control commands and automatically carry out a pre-defined sequence of 
  procedure steps once authorised by the operator. This type of COP can make 
  decisions as to whether and when to execute each step in the procedure sequence 
  based on real time plant conditions.  
   Regardless of the type of COPs proposed by dutyholders, it is important to recognise 
  that operators are responsible for the proper application of any procedures and COPs 
  are an operator aid for controlling the plant. In the case of automatically executed 
  actions it is expected that this is flagged to the operator in such way that he can reach 
  a judgement on their suitability. Loss of an aid should not prevent the operator from 
  performing any required safety and control actions. In addition, failure of COPs should 
  not have any impact on safety systems or control systems.  
   The same general principles applied to the design of paper-based procedures also 
  apply to COPs in terms of presentation principles, processes for updating, verifying 
  and validating etc. However, there are other specific issues that must be addressed if 
  COPs are to be used including the consideration of Human Machine Interface (HMI) 
  and software design and verification [15] – [19]. (See also NS-TAST-GD-059 – Human 
  Machine Interface [20]).  
   5.24 
   Where the dutyholder uses, or proposes to use, COPs, Inspectors may consider 
  whether:  
   • 
   • 
   • 
   • 
   • 
   • 
   • 
   • 
   The choice and use of COPs is appropriate for the operational concept, tasks 
  and safety functions to be delivered.  
  The COPs are designed and implemented such that operators remain in 
  command of the plant and processes being operated. Operator pre-defined 
  hold-points are included in the COP that defines the start and end of any 
  automated sequences that are commanded by the operator.  
  The operator should be able to manually interrupt a COP execution safely and 
  at any point in a sequence of steps. Any automatic interrupts include a salient 
  alerting function and identify the cause of why the sequence has stopped. The 
  operator should be able to revert to manual control or resume automatic 
  procedure execution if desired.  
  COPs provide adequate information on initial plant conditions that must be met 
  before any automated sequence may be started.  
  COPs that process plant data and evaluate procedure-step logic can only 
  make deterministic decisions (e.g. yes/no) and all data evaluated by a COP is 
  available to the operator. The results evaluated by the COP are the same as 
  those expected from operator evaluations of the same procedure steps.  
  Failure modes or loss of the COP can be readily detected and identified by 
  operators and these do not affect the operator’s ability to safely recover and 
  operate the plant.  
  COPs should not determine what procedure should be used; the operator 
  should decide what procedure to be used for a given task in any given 
  situation.  
  Suitable back-up procedures are accessible and available (alternate COPs or 
  paper-based procedures) in case of COP failure. The structure and format of 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 12 of 16 
    
    
    
    
   Office for Nuclear Regulation  
   the information in the back-up procedures is consistent and compatible with 
  that in the COP. Consideration has been given to the feasibility of the means of 
  transition to back-up procedures. The time required for the operator to 
  effectively transfer to back-up procedures should be known and demonstrated 
  to be feasible within required timeframes determined in the safety case. After 
  transferring to a back up procedure the operator should be able to safely stop 
  the processing of the COP.  
  COPs should be commanded and controlled by a single dedicated operator 
  with multiple read-only facilities displaying the COP elsewhere to assist the 
  operating team/crew situational awareness.  
  COPs provide adequate feedback to operators informing them of what the 
  current state of procedure execution is and what the system being controlled is 
  doing.  
  The COPs conspicuously display the current system mode and have the ability 
  to alert the operator should an unexpected mode or state change occur.  
  The characteristics and behaviours of any embedded soft controls in a COP 
  are consistent and compatible with other plant controls and user expectations.  
  There is a robust COP management and configuration control process to 
  ensure that COP content and functionality are fully verified and validated prior 
  to use and following any changes. This process also ensures that consistency 
  is maintained between COPs and back-up procedures. This process should 
  meet good practice expectations and standards for Control, Electrical and 
  Instrumentation (CE&I) systems.  
  The dutyholder has addressed the issue of the safety integrity level 
  requirements of the data display upon which the operator is required to 
  respond. The HF inspector should consult with the relevant Fault Studies and 
  CE&I discipline inspectors regarding substantiation of reliability claims.  
   • 
   • 
   • 
   • 
   • 
   • 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 13 of 16 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   6. 
   REFERENCES  
   1 
   2 
  3 
   4 
   5 
   6 
   7 
   8 
   9 
   10 
   11 
   12 
   13 
   14 
   15 
   16 
   17 
   18 
   19 
   20 
   Safety Assessment Principles for Nuclear Facilities. 2014 Edition Revision 0. ONR. 
  November 2014. http://www.onr.org.uk/saps/saps2014.pdf. 
  Licence condition handbook. ONR. February 2017.  http://www.onr.org.uk/silicon.pdf 
  WENRA Reactor Reference Safety Levels. Western European Nuclear Regulators’ 
  Association.  Reactor Harmonization Group. WENRA. September 2014. 
  www.wenra.org. 
  IAEA Safety Standards, Safety of Nuclear Power Plants: Operation Safety 
  Requirements, NS-R-2, IAEA, 2000. http://www-pub.iaea.org/books/ 
  IAEA Safety Standards, Safety of Nuclear Power Plants: Design, SSR-2/2 (Rev. 1), 
  IAEA, 2016. http://www-pub.iaea.org/books/ 
  IAEA Safety Standards, The Operating Organisation for Nuclear Power Plants Safety 
  Guide, NS-G-2.4, IAEA, 2001. http://www-pub.iaea.org/books/ 
  IAEA Safety Standards, Conduct of Operations at Nuclear Power Plants, Safety Guide, 
  NS-G-2.14, IAEA, 2008. http://www-pub.iaea.org/books/ 
  ONR How2 Business Management System. Human Factors Integration. NS-TAST-GD-
  058, Revision 3. ONR. March 2017. 
  http://www.onr.org.uk/operational/tech_asst_guides/index.htm 
  ONR How2 Business Management System. LC 24 Operating Instructions, NS-INSP-
  GD-024, Revision 3, ONR, February 2016. 
  http://www.onr.org.uk/operational/tech_insp_guides/index.htm 
  Good practices with respect to the development and use of nuclear power plant 
  procedures, IAEA-TECDOC-1058, IAEA, 1998. 
  Writer’s Guide for Technical Procedures. DOE-STD-1029-92, U.S. Department of 
  Energy, December 1998.  
  Procedures, Human Factors Briefing Note 4, HSE. 
  www.hse.gov.uk/humanfactors/topics/04procedures.pdf 
  Computer-based Procedure Systems: Technical Basis and Human Factors Review 
  Guidance. NUREG/CR-6634, USNRC, March 2000.  
  Human Factors Considerations with Respect to Emerging Technology in Nuclear 
  Power Plants, NUREG/CR-6947, USNRC, October 2008.  
  Human – System Interface Design Review Guidelines, NUREG 0700 Rev 2, May 
  2002.  
  IAEA SAFETY GUIDE - Design of Instrumentation and Control Systems for Nuclear 
  Power Plants, Standards Series No. SSG-39, IAEA, Vienna, 2016. http://www-
  pub.iaea.org/MTCD/publications/PDF/Pub1694_web.pdf 
  Functional safety of electrical/electronic/programmable electronic safety-related 
  systems, IEC 61508, International Electrotechnical Commission.  
  The Use of Computers in Safety-Critical Applications. Final Report of the Study Group 
  on the Safety of Operational Computer Systems. HSE Books ISBN 9780717616206  
  Implementing Digital Instrumentation and Control Systems in the Modernisation of 
  Nuclear Power Plants No. NP-T-1.4. IAEA, Vienna, 2009, http://www-
  pub.iaea.org/books/ 
  ONR How2 Business Management System. Human Machine Interface, NS-TAST-GD-
  059, Revision 3, ONR, November 2016. 
  http://www.onr.org.uk/operational/tech_asst_guides/index.htm 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 14 of 16 
    
    
    
    
   Office for Nuclear Regulation  
   7. 
   GLOSSARY AND ABBREVIATIONS 
   CE&I 
  COP 
  DBA 
  HF 
  HFI 
  HMI 
  IAEA 
  LC 
  OLC 
  ONR 
  PSA 
  SA 
  SAP 
  TAG 
  TIG 
  WENRA 
   Control, Electrical and Instrumentation 
  Computerised Operating Procedure 
  Design Basis Analysis 
  Human Factors 
  Human Factors Integration 
  Human Machine Interface 
  International Atomic Energy Agency 
  Licence Condition 
  Operational Limit(s) and Condition(s) 
  Office for Nuclear Regulation 
  Probabilistic Safety Analysis 
  Safety Assessment 
  Safety Assessment Principle(s)  
  Technical Assessment Guide(s) 
  Technical Inspection Guide(s) 
  Western European Nuclear Regulators’ Association 
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 15 of 16 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   8. 
   ANNEXE A 
   SAP  
   EHF.5  
   FA.6  
   FA.9  
   Area  
   Human Factors: Task 
  Analysis  
  Fault analysis: Design 
  basis analysis  
   Fault analysis: Design 
  basis analysis  
   FA.14  
   Use of PSA  
   AM.1  
   EMT.5  
   EMT.6  
   SC.4(h)  
   SC.6  
   MS.2  
   MS.4  
   Accident management: 
  Design and operation  
  Engineering principles: 
  maintenance, inspection 
  and testing 
  Engineering principles: 
  maintenance, inspection 
  and testing 
  The regulatory 
  assessment of safety 
  cases: Safety case 
  characteristics 
  The regulatory 
  assessment of safety 
  cases: Safety case 
  characteristics  
  Leadership and 
  management for safety: 
  Capable organisation 
  Leadership and 
  management for safety: 
  Learning from experience 
   EKP.5  
   Key principles: Safety 
  measures 
   ERL.3  
   Reliability claims: 
  Engineered safety features 
   Relevance to this TAG 
   In supporting task performance and providing the 
  basis for the design of procedures.  
  Claims on operator actions to be supported by 
  procedures, and compliance with procedures 
  assured.  
  Design Based Assessment input to limits and 
  conditions for safe operation; and the identification 
  of requirements for operator actions, and input to 
  operating instructions.  
  Use of PSA in developing and changing operating 
  procedures.  
  Procedures contribution to accident management 
  and emergency preparedness.  
  Inspection and test procedures  
   Testing, maintaining, monitoring and inspecting 
  and relevance of operating rules and instructions.  
   Operating and maintenance instructions; rules and 
  contingency and emergency instructions, in 
  relation to the management for safety and the 
  safety case.  
  The safety case in relation to maintenance, 
  inspection and testing regimes; operating limits 
  and conditions; emergency planning.  
   The design of procedures and the factors that 
  affect reliable performance of the organisation.  
   Learning from errors in safety procedures and 
  processes; monitoring, review and audit of 
  procedures; testing and validation of safety 
  procedures.  
  Safety assured by: Passive safety measures in 
  preference to automatically initiated engineered 
  safety measures, in preference to engineered 
  safety measures that need to be manually brought 
  into service in response to the fault in preference 
  to administrative safety measures.  
  Minimise the dependence on human action to 
  maintain a safe state. Use administrative control 
  for less demanding or longer timescale.  
   NS-TAST-GD-060 
  TRIM Ref: 2017/438046 
   Page 16 of 16 
    
    
    
    
    
    
  "
  Procurement cns-tast-gd-4.1	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Procurement cns-tast-gd-4.1.pdf	" Title of document 
   OFFICIAL 
   ONR GUIDE 
   PROCUREMENT AND INTELLIGENT CUSTOMER CAPABILITY 
   Document Type: 
   Nuclear Security Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   CNS-TAST-GD-4.1 Revision 0 
   March 2017 
   Review Date: 
   March 2020 
   Approved by: 
   David Pascoe 
   Professional Lead 
   Record Reference: 
  Revision commentary: 
   TRIM Folder 4.4.2.19074. (2017/104195) 
  New document issued 
   TABLE OF CONTENTS 
   1. 
  2. 
  3. 
  4. 
  5. 
  6. 
  7. 
  8. 
   INTRODUCTION ................................................................................................................. 2 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  RELATIONSHIP TO RELEVANT LEGISLATION ................................................................ 2 
  RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE ...................................... 2 
  RELATIONSHIP TO NATIONAL POLICY DOCUMENTS ................................................... 3 
  ADVICE TO INSPECTORS ................................................................................................. 3 
  PRINCIPLES AND EXPECTATIONS .................................................................................. 4 
  ESTABLISH AN EFFECTIVE COMMERCIAL AND SUPPLY CHAIN STRATEGY TO 
  ENABLE DELIVERY OF SUCCESSFUL REQUIREMENTS ............................................... 5 
  9. 
  EFFECTIVE PROCUREMENT CYCLE – SECURITY SPECIFICATION ............................ 6 
  10. EFFECTIVE PROCUREMENT CYCLE – DEVIATIONS FROM SPECIFIED 
  REQUIREMENTS ................................................................................................................ 8 
  11. EFFECTIVE PROCUREMENT CYCLE – COUNTERFEIT FRAUDULENT AND  SUSPECT 
  ITEMS (CFSI) ...................................................................................................................... 9 
  12. EFFECTIVE PROCUREMENT CYCLE – SUPPLY CHAIN OPERATIONAL   
  EXPERIENCE (OPEX) ...................................................................................................... 11 
  13. MAINTAINING AN INTELLIGENT CUSTOMER CAPABILITY .......................................... 12 
  14. REFERENCES .................................................................................................................. 14 
  15. GLOSSARY AND ABBREVIATIONS ................................................................................ 15 
   © Office for Nuclear Regulation, 2017 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 03/17 
   OFFICIAL 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 15 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   1. 
   1.1 
   1.2 
   2. 
   2.1 
   3. 
   3.1 
   3.2 
   4. 
   4.1 
   INTRODUCTION 
   The Office for Nuclear Regulation (ONR) has established a set of Security Assessment 
  Principles (SyAPs) (Reference 1). This document contains Fundamental Security 
  Principles (FSyPs) that dutyholders must demonstrate have been fully taken into 
  account in developing their security arrangements to meet relevant legal obligations. 
  The security regime for meeting these principles is described in security plans 
  prepared by the dutyholders, which are approved by ONR under the Nuclear Industries 
  Security Regulations (NISR) 2003 (Reference 2). 
   The term ‘security plan’ is used to cover all dutyholder submissions such as nuclear 
  site security plans, temporary security plans and transport security statements. NISR 
  Regulation 22 dutyholders may also use the SyAPs as the basis for Cyber Security 
  and Information Assurance (CS&IA) documentation that helps them demonstrate 
  ongoing legal compliance for the protection of Sensitive Nuclear Information (SNI). The 
  SyAPs are supported by a suite of guides to assist ONR inspectors in their 
  assessment and inspection work, and in making regulatory judgements and decisions.  
  This Technical Assessment Guidance (TAG) is such a guide. 
   PURPOSE AND SCOPE 
   This TAG contains guidance to advise and inform ONR inspectors in exercising their 
  regulatory judgment during assessment activities relating to a dutyholder’s supply 
  chain management arrangements.  It aims to provide general advice and guidance to 
  ONR inspectors on how this aspect of security should be assessed. It does not set out 
  how ONR regulates the dutyholder’s arrangements.  It does not prescribe the detail, 
  targets or methodologies for dutyholders to follow in demonstrating they have 
  addressed the SyAPs. It is the dutyholder’s responsibility to determine and describe 
  this detail and for ONR to assess whether the arrangements are adequate.  
   RELATIONSHIP TO RELEVANT LEGISLATION 
   The term ‘dutyholder’ mentioned throughout this guide is used to define ‘responsible 
  persons’ on civil nuclear licensed sites and other nuclear premises subject to security 
  regulation, a ‘developer’ carrying out work on a nuclear construction site and approved 
  carriers, as defined in NISR. It is also used to refer to those holding SNI. 
   NISR defines a ‘nuclear premises’ and requires ‘the responsible person’ as defined to 
  have an approved security plan in accordance with Regulation 4. It further defines 
  approved carriers and requires them to have an approved Transport Security 
  Statement in accordance with Regulation 16. Persons to whom Regulation 22 applies 
  are required to protect SNI. ONR considers supply chain management to be an 
  important component of a dutyholder’s arrangements in demonstrating compliance 
  with relevant legislation. 
   RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE 
   The essential elements of a national nuclear security regime are set out in the 
  Convention on the Physical Protection of Nuclear Material (CPPNM) (Reference 3) and 
  the IAEA Nuclear Security Fundamentals (Reference 4). Further guidance is available 
  within IAEA Technical Guidance and Implementing Guides. 
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 2 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   4.2 
   Fundamental Principle J of the CPPNM refers to quality assurance and states that ‘a 
  quality assurance policy and quality assurance programmes should be established and 
  implemented with a view to providing confidence that specified requirements for all 
  activities important to physical protection are satisfied’. The importance of issues 
  relating to assurance activities are also recognised in the Nuclear Security 
  Fundamentals, specifically: 
    
   Essential Element 12: Sustaining a Nuclear Security Regime – 3.12  
   h) Routinely performing assurance activities to identify and address issues 
  and factors that may affect the capacity to provide adequate nuclear 
  security including cyber security at all times. 
   A more detailed description of the elements is provided in Recommendations level 
  guidance, specifically Nuclear Security Series (NSS) 13, Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5) (Reference 5). 
   RELATIONSHIP TO NATIONAL POLICY DOCUMENTS 
   The SyAPs provide ONR inspectors with a framework for making consistent regulatory 
  judgements on the effectiveness of a dutyholder’s security arrangements.  This TAG 
  provides guidance to ONR inspectors when assessing a dutyholder’s submission 
  demonstrating they have effective processes in place to achieve SyDP 4.1 – 
  Procurement and Intelligent Customer Capability, in support of FSyP 4 – Nuclear 
  Supply Chain Management.  The TAG is consistent with other TAGs and associated 
  guidance and policy documentation. 
   The HMG Security Policy Framework (SPF) (Reference 6) describes the Cabinet 
  Secretary’s expectations of how HMG organisations and third parties handling HMG 
  information and other assets will apply protective security to ensure HMG can function 
  effectively, efficiently and securely. The security outcomes and requirements detailed 
  in the SPF have been incorporated within the SyAPs. This ensures that dutyholders 
  are presented with a coherent set of expectations for the protection of nuclear 
  premises, SNI and the employment of appropriate personnel security controls both on 
  and off nuclear premises.  
   The Classification Policy (Reference 7) indicates those categories of SNI, which 
  require protection and the level of security classification to be applied. 
   ADVICE TO INSPECTORS 
   This TAG informs regulatory assessment of Supply Chain Management (SCM) 
  arrangements and procurement activities for nuclear security related items or services. 
  It establishes ONR’s expectations of the purchaser, as the organisation at the top of 
  the Supply Chain. It considers the procurement of items or services in support of 
  construction, manufacture, repair, replacement, modification of plant and equipment. 
   The level of ONR scrutiny is dependent on the security significance of the items or 
  services being procured. This scrutiny might include confirmation of the adequacy of 
  the supplier’s quality management arrangements and/or be part of the manufacturing 
   4.3 
   5. 
   5.1 
   5.2 
   5.3 
   6. 
   6.1 
   6.2 
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 3 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   or construction inspection activities identified via the supplier’s quality planning 
  arrangements. 
   Regulatory Expectations 
   6.3 
   The regulatory expectation is that dutyholders will describe in the security plan how 
  they achieve effective procurement for items or services for nuclear security and 
  maintain an intelligent customer capability to support nuclear supply chain 
  management arrangements. 
   FSyP 4 - Nuclear Supply 
  Chain Management 
   Procurement and Intelligent 
  Customer Capability 
   SyDP 4.1 
   Dutyholders should maintain an ‘Intelligent Customer’ capability for all work carried 
  out on their behalf by suppliers that may impact upon nuclear security. 
   6.4 
   In delivering this principle, dutyholders should: 
    
    
    
    
    
    
   maintain the capability to recognise work of nuclear security significance to 
  ensure  it is subject to the appropriate procurement procedures 
   utilise an effective procurement cycle for work with nuclear security 
  significance 
   establish an effective commercial strategy to enable the delivery of security 
  plan requirements 
   maintain an intelligent customer capability, which is applied to all work 
  carried out on its behalf by suppliers that may impact upon nuclear security  
   develop appropriate specifications, with appropriate stakeholder input, to 
  support the procurement of items or services (including those relating to 
  cyber security or information assurance) of nuclear security significance 
   ensure appropriate arrangements are in place for all contracts involving 
  security classified information or equipment including that considered SNI in 
  accordance with FSyP 7 and its associated delivery principles  
   7. 
   7.1 
   PRINCIPLES AND EXPECTATIONS 
   ONR’s expectations for the principles to be applied to the procurement of goods and 
  services with nuclear security significance is summarised in Diagram 1 below. 
   Diagram 1 
   OFFICIAL  
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 4 of 15 
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   7.2 
   8. 
   8.1 
   8.2 
   The dutyholder should also ensure that suppliers protect all tender documentation, 
  specifications and operational requirements in accordance with their security 
  classification.   
   ESTABLISH AN EFFECTIVE COMMERCIAL AND SUPPLY CHAIN STRATEGY TO 
  ENABLE DELIVERY OF SUCCESSFUL REQUIREMENTS 
   The purchaser’s commercial and/or Supply Chain strategy will influence all 
  arrangements associated with the procurement of nuclear security related items or 
  services. An effective strategy, deployed through the organisation’s business planning 
  process should enable delivery of security plan requirements  
   The purchaser should plan to ensure their commercial and/or Supply Chain strategy 
  addresses current and future security plan requirements over the lifetime of the facility 
  including the decommissioning phase. The arrangements should be subject to routine 
  review as they could be impacted by multiple influences, for example:  
    
    
    
    
   parent body organisation ownership; aggregation of contracts across 
  multiple dutyholders or organisations under parent group ownership, 
  performance issues 
   changes in the Supply Chain; mergers, acquisitions, insolvency, capability 
  and performance issues 
   security of supply; business continuity issues, strategic/critical suppliers, 
  globalisation of Supply Chains 
   make/buy policy; outsourcing and in-house capability or supply  
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 5 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
    
   drive to improve efficiency and competitiveness while enhancing quality and 
  security performance 
   8.3 
   The purchaser’s commercial and/or Supply Chain strategy, policy and arrangements 
  should be appropriately resourced and include measures to mitigate the risks of 
  Supply Chain issues adversely impacting on the security plan. The arrangements 
  should be subject to routine review as part of the organisation’s business planning 
  processes to ensure they remain effective and are proportionate to mitigating the 
  identified risks.  
   Inspectors should consider: 
    
    
    
    
    
    
    
   Has the purchaser developed a commercial and/or Supply Chain strategy to 
  address current and future security plan requirements? 
   Does the purchaser have effective arrangements to manage their Supply 
  Chain including a clear strategy and/or policy, and is organised to deliver 
  with roles and responsibilities clearly defined?  
   Does the purchaser have the organisational capabilities to manage supply 
  chain delivery? 
   Are the purchaser’s SCM arrangements subject to routine review to ensure 
  they remain effective in addressing security plan requirements? 
   Has the Supply Chain strategy been developed cognisant of the learning 
  available from within the organisation, Supply Chain, nuclear and wider 
  industry? 
   Does the strategy encourage collaborative working with the Supply Chain, 
  sharing common security aims, objectives and success criteria? 
   Do the purchaser’s make/buy (i.e. outsourcing and in-house provision) 
  arrangements effectively consider current and future security plan 
  requirements as part of the decision making criteria? 
   9. 
   9.1 
   9.2 
   EFFECTIVE PROCUREMENT CYCLE – SECURITY SPECIFICATION 
   The purchaser should issue security specifications which adequately describe the 
  items or services, meet the security plan/operational requirements and identify the 
  associated level of quality assurance. 
   Establishing an effective security specification is of key importance in the procurement 
  cycle. An ineffective specification will mean that any contractor in the Supply Chain will 
  find it difficult to deliver the purchaser’s requirements right first time, regardless of their 
  own capabilities and processes.  The dutyholder should also have in place a process 
  to ensure that the supplier is reliable and can provide the equipment or service in an 
  acceptable timeframe.  
   9.3 
   Given the importance of the security specification, it is essential that those writing them 
  are Suitably Qualified and Experienced (SQEP) to perform the task and their work is 
  subject to the appropriate levels of verification, validation and approval commensurate 
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 6 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   9.4 
   9.5 
   9.6 
   9.7 
   9.8 
   9.9 
   with the security significance of the item or service being procured. At the pre-contract 
  stage, the purchaser should ensure that prospective suppliers fully understand that the 
  items or services being procured are a principal means of ensuring and maintaining 
  nuclear security.  
   The specification should detail any applicable design codes and standards that fully 
  describe the items or services to be procured together with other generic contractual 
  requirements. This combination of requirements should identify appropriate levels of 
  quality assurance requirements to be applied. These should include, where applicable, 
  assessment, audit, quality planning, quality control, inspection, surveillance, testing, 
  and release or handover of items and should fully detail the records package required 
  to be supplied with the item or service.  
   For items or services which are the principal means of ensuring nuclear security, 
  additional assurance and inspection arrangements may be required, which go beyond 
  basic compliance with established design codes and standards. ONR may wish to 
  assess the technical specification used as the basis for procurement prior to the 
  procurement action, taking into account any additional requirements.  
   Throughout the design process, appropriate assurance activities should be undertaken 
  to ensure that the design meets the requirements of the purchaser and applicable 
  codes or standards in addition to any regulatory expectations.  
   Where technical specifications are prepared for nuclear security significant items or 
  services by contractors on behalf of the purchaser, these should be reviewed by staff 
  from the purchaser’s organisation who are competent to confirm that the specifications 
  properly reflect the design intent, meet any design codes and standards and as such 
  meet security plan requirements. This review should be carried out before contract 
  placement.  
   On receipt of the purchase order, the supplier should carry out a review of the contract 
  documentation to ensure it can fulfil all the technical, procedural and commercial 
  requirements of the contract. For complex and high capital value security equipment, 
  discussions between the supplier (and sub-suppliers) and purchaser should normally 
  have covered these aspects prior to contract placement. The supplier should advise 
  the purchaser of any changes to its (or its sub-suppliers) ability to fulfil the contract as 
  such changes arise.  
   The purchaser should operate a change control process to ensure that any changes to 
  specification, design or contract are properly controlled and authorised, and the 
  implications for nuclear security and the manufacturing/delivery processes, including 
  changes to documentation (particularly process quality related, e.g. quality plans), are 
  fully considered prior to the implementation of the change. Where these changes 
  impact on the security plan, it may require further assessment by ONR. 
   Inspectors should consider: 
    
   Do specifications reflect the design intent, design codes and standards, and 
  meet security plan requirements?  
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 7 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
    
    
    
    
    
    
    
   Are specifications prepared by contractors reviewed by competent staff from 
  the purchaser’s organisation?  
   Are appropriate levels of quality assurance applied to the procurement of 
  items or services significant to nuclear security?  
   Do the purchaser’s specification and assurance arrangements address any 
  specific regulatory requirements?  
   Do suppliers fully understand that the items or services being procured are a 
  means of ensuring and maintaining nuclear security, and their significance? 
   Are variations to specification, design or contract properly conceived, 
  communicated, implemented and assessed for nuclear security implications 
  and authorised by SQEP staff? 
   Do suppliers notify the purchaser of any proposed changes and that they are 
  properly assessed and authorised by the purchaser? 
   Are supplier documents (e.g. quality plans and manufacturing instructions) 
  re-approved before a change is implemented?  
   10. 
   10.1 
   10.2 
   10.3 
   10.4 
   10.5 
   EFFECTIVE PROCUREMENT CYCLE – DEVIATIONS FROM SPECIFIED 
  REQUIREMENTS 
   The purchaser should ensure that suppliers identify and categorise any deviations from  
  specified requirements, referring to the dutyholder’s Design Authority (DA – as defined 
  in Security TAG 1.2) for assessment.  Where any deviations are made the purchaser 
  should ensure that these do not affect the proposed security outcome. 
   Non-conformances are unplanned deviations from the purchaser’s requirements and 
  can be identified in a number of ways including inspection, audit or surveillance. They 
  can occur at any level within the Supply Chain. Deviations can be associated with an 
  item or service or be the result of the inadequate implementation of the approved 
  process.  
   The identification, reporting and resolution of deviations should not be seen as 
  negative, but as an indication that the achievement of the purchaser’s requirements is 
  of prime importance. The control of any deviation from the technical specification is 
  fundamental to the achievement of quality and therefore the integrity of the item.  
   All organisations within the Supply Chain should, as part of their quality management 
  arrangements, operate consistent arrangements, overseen by the purchaser, for the 
  categorisation and disposition of deviations.  
   Purchasers at each level of the Supply Chain should ensure their suppliers have 
  adequate arrangements for the identification, categorisation and management of 
  deviations for items or services. These should include obtaining the approval of the 
  purchaser, or dutyholder’s DA, for the deviation in the form of a concession or 
  procedure for re-work. They should inform the ultimate purchaser and potentially ONR 
  (via the purchaser at the head of the Supply Chain) for deviations that are significant to 
  nuclear security.  
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 8 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   10.6 
   Technical Queries (TQs) are slightly different to a non-conformance. For the former, 
  the supplier is asking a question for approval prior to doing the work and for the latter, 
  the work has started and is found to be either outside the acceptance criteria for the 
  product, or the process has not been implemented as approved. TQs are raised during 
  the work planning stage and help inform or clarify the contract requirements. Once the 
  purchaser agrees to a TQ that requires a change in the design or other process, then 
  the purchaser should track the modification to completion with contract changes 
  through formal change control being communicated to the supplier if applicable. The 
  purchaser’s arrangements should ensure that both types of deviation from the 
  originally specified requirements are appropriately controlled and documented.  
   10.7 
   There should be an audit trail in work control documents for all approved deviations as 
  well as systematic overarching deviation tracking logs that show the status of each 
  deviation. Approved deviations should be used to update drawings to reflect ‘as built’ 
  status to aid configuration control for future modifications.  
   Inspectors should consider: 
    
    
    
   Are deviations identified, characterised and formally sanctioned by 
  competent persons with the appropriate delegated authority? 
   Do suppliers bring all deviations of nuclear security significance to the 
  attention of the purchaser, dutyholder’s DA and ONR if appropriate, via the 
  purchaser at the head of the Supply Chain? 
   Is there a demonstrable audit trail for all approved deviations from the work 
  control document to logs showing the status of each deviation raised, 
  approved, rejected or reworked with links to required document changes? 
   11. 
   11.1 
   11.2 
   11.3 
   EFFECTIVE PROCUREMENT CYCLE – COUNTERFEIT FRAUDULENT AND 
  SUSPECT ITEMS (CFSI) 
   The purchaser should have arrangements to mitigate the risks of Counterfeit, 
  Fraudulent and Suspect Items (CFSI) entering their Supply Chain.  
   There should be recognition throughout all levels of the Supply Chain that there are 
  parties who might wish to substitute CFSI for genuine items or services for commercial 
  gain or with malicious intent. All purchasers should be aware of the risks and hazards 
  of CFSI entering the nuclear industry Supply Chain and understand their role in 
  mitigating this risk.  
   The purchaser or supplier should deploy appropriate mitigating measures to prevent 
  CFSI impacting on their Supply Chain depending on the scale, complexity, any 
  international involvement in and/or nuclear security application of their items or 
  services.  
   11.4 
   The following non-exhaustive list presents appropriate mitigation that should be 
  deployed as part of a purchaser/supplier’s management system, to defend against 
  CFSIs for high risk items or services:  
    
   robust SCM and procurement process arrangements including effective 
  Supply Chain oversight and assurance, including inspection and testing  
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 9 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
   competent staff involved in the acquisition processes from specification of 
  requirement through to inspection and receipt of items and services and 
  review of associated records 
   material or component traceability back to source supplier, including 
  verification testing by third party specialist organisations for high risk items  
   use of positive material identification and destructive testing methods during 
  product inspection, testing and receipt and as part of assurance sampling of 
  high risk proprietary items  
   product samples of known precision and authenticity available for 
  comparison with purchased items   
   training and awareness within purchasing organisation SCM teams (i.e. 
  Engineering, Procurement, Audit & Inspection), partners and suppliers. Staff 
  should be aware of the risks of CFSI and be trained in mitigation and 
  detection methods as appropriate  
   processes and procedures to identify, investigate, record incidences of CFSI 
  and share lessons learnt  
   benchmarking with other purchasers  
   liaison with Trading Standards and security agencies 
   requirements clearly defined in contract terms and conditions  
   the effective management of non-conforming items to prevent their re-entry 
  into the Supply Chain as genuine items  
   11.5 
   11.6 
   The purchaser should have arrangements in place to quarantine a suspect item or 
  service. Further investigation will be required by the purchaser or supplier to confirm 
  the item as conforming, non-conforming, counterfeit or fraudulent.  
   Examples of counterfeit or fraudulent items or services should be shared within the 
  purchaser and/or the dutyholder organisation, Supply Chain and wider industry as 
  appropriate to support learning, prevent use and encourage remedial measures in 
  other impacted facilities, but only when the purchaser has conducted sufficient 
  investigation to confirm if the item is CFSI or not.  ONR should be informed of all 
  examples of counterfeit or fraudulent items or services confirmed within the 
  purchaser’s Supply Chain that impact on high risk items or services or relate to 
  shortfalls in the purchaser’s SCM or procurement arrangements. 
   Inspectors should consider: 
    
   Does the purchaser have effective processes in place to prevent against 
  CFSI entering their Supply Chain at any level? 
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 10 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
    
    
    
    
    
   Is the purchaser employing positive material identification and effective 
  testing methods during its assurance arrangements, including sample testing 
  of proprietary high risk items?  
   Are staff that are involved in the purchaser’s acquisition processes 
  competent to perform their role, aware of the risks of CFSI and understand 
  and comply with the organisation’s mitigation methods?  
   Does the purchaser have appropriate arrangements in place to quarantine, 
  investigate and disposition suspect items as conforming, non-conforming, 
  counterfeit or fraudulent?  
   Has the purchaser established arrangements to raise awareness of CFSI 
  within their Supply Chain and is encouraging the open reporting of CFSI 
  examples to maximise learning and mitigate risks?  
   Can the purchaser provide examples of where they have identified CFSI and 
  taken appropriate remedial measures including notification to the ONR and 
  the sharing of learning through their Operational Experience (OPEX) 
  arrangements?  
   12. 
   12.1 
   12.2 
   12.3 
   12.4 
   12.5 
   EFFECTIVE PROCUREMENT CYCLE – SUPPLY CHAIN OPERATIONAL 
  EXPERIENCE (OPEX) 
   The purchaser should have arrangements to capture and act on OPEX feedback from 
  its Supply Chain and SCM activities, sharing learning as appropriate within the 
  organisation, its Supply Chain and wider industry.  
   The purchaser should have effective OPEX processes that capture and act upon cross 
  discipline (e.g. engineering, commercial, quality, inspection and test, safety & security 
  etc.) SCM issues associated with the sub-standard procurement of high-risk items or 
  services from specification of requirements, sourcing of suppliers, oversight of delivery, 
  inspection, test and installation or use.  
   The purchaser should ensure relevant learning is captured and acted upon from their 
  Supply Chain, related to the provision of high risk items and services. This could 
  include incidences of CFSI in their Supply Chain tiers, sub-standard Supply Chain 
  performance issues that could impact the purchaser at the top of the Supply Chain and 
  factors that might influence future commercial and/or Supply Chain strategy. 
   The purchaser should recognise that key suppliers (such as those providing niche 
  products or construction contractors) in the nuclear industry could provide items or 
  services to multiple dutyholders and as such, sub-standard performance from a key 
  industry supplier could have an impact on the nuclear security related activities of 
  multiple dutyholders. 
   The purchaser’s OPEX processes should enable the wider sharing of relevant Supply 
  Chain and SCM experience with other dutyholders and wider industry as appropriate. 
  Arrangements should be in place to evaluate OPEX shared by other dutyholders, and 
  wider related industry, for implications within the purchaser’s organisation and 
  management system arrangements. 
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 11 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   12.6 
   ONR should be informed of confirmed instances of sub-standard Supply Chain 
  performance in the provision of high-risk items or services, particularly where the 
  supplier is likely to form part of the Supply Chains of other dutyholders or future 
  dutyholders.  
   Inspectors should consider 
    
    
    
    
    
   Is the purchaser’s OPEX process established, capturing and acting upon 
  sub-standard performance issues associated with their SCM arrangements?  
   Is the purchaser’s OPEX process capturing and acting upon issues 
  occurring within their different Supply Chain tiers?  
   Are OPEX arrangements generating improvements in the purchaser’s SCM 
  arrangements and influencing commercial and/or Supply Chain strategy?  
   Does the purchaser evaluate relevant learning from other dutyholders, 
  purchasers and supplier organisations, nationally and internationally as 
  appropriate?  
   Does the purchaser share learning with its Supply Chain and wider industry 
  as appropriate?  
   13. 
   MAINTAINING AN INTELLIGENT CUSTOMER CAPABILITY 
   13.1 
   The concept of intelligent customer (IC) for safety is defined by the IAEA as follows: 
   ‘As an intelligent customer, in the context of nuclear safety, the management of 
  the facility should know what is required, should fully understand the need for a 
  contractor's services, should specify requirements, should supervise the work 
  and should technically review the output before, during and after implementation. 
  The concept of intelligent customer relates to the attributes of an organisation 
  rather than the capabilities of individual post holders’. 
   This equally applies to nuclear security and a dutyholder’s intelligent customer 
  capability for security will be a subset of its core capability. 
   13.2 
   The primary responsibility for the security of a nuclear premises rests with the 
  dutyholder. The dutyholder should be able to demonstrate sufficient knowledge of the 
  plant design and security plan for all plant and operations on the site. The dutyholder 
  must be in control of activities on its site, understand the hazards associated with its 
  activities and how to control them, and have sufficient competent resource within its 
  organisation to act as an ‘Intelligent Customer’ for any work it commissions externally.  
   13.3 
   In the context of effective SCM the dutyholder should maintain an ‘Intelligent 
  Customer’ capability to know what is needed, to fully understand the need for a 
  contractor’s services, at any level of the Supply Chain, specify requirements, supervise 
  work and technically review the output before, during and after implementation.  
   13.4 
   ONR’s regulatory expectations of a dutyholder’s arrangements for the use of 
  contractors, for retaining control of nuclear security and for discharging its other duties 
  are summarised as follows. The dutyholder should:  
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 12 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
     
   Office for Nuclear Regulation  
   OFFICIAL  
    
    
    
    
    
    
    
   have sufficient  SQEP in-house staff to ensure effective control and 
  management for nuclear security 
   retain overall responsibility for, and control and oversight of, nuclear security 
  and security of all of its business, including work carried out on its behalf by 
  contractors 
   ensure choices between sourcing work in-house or from contractors is 
  informed by a company policy that takes into account the nuclear security 
  implications of the selection 
   maintain an Intelligent Customer capability for all work carried out on its 
  behalf by contractors that may impact upon nuclear security;  
   ensure that it only lets contracts for work with nuclear security significance to 
  contractors with suitable competence, security standards, management 
  systems, culture and resources  
   ensure that all contractor staff are familiar with the nuclear security 
  implications of their work and interact in a well-coordinated manner with its 
  own staff 
   ensure that contractors’ work is carried out to the necessary level of security 
  and quality in practice 
   Inspectors should consider: 
    
   Does the dutyholder retain and maintain the core capability to understand, 
  specify, oversee and accept nuclear security related work undertaken on its 
  behalf by contractors at any level of the Supply Chain?  
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 13 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   14. 
   1.  
   2. 
   3. 
   4. 
   5.  
   6. 
   REFERENCES 
   Security Assessment Principles  
   Nuclear Industries Security Regulations 2003.  Statutory Instrument 2003 No. 403 
   Convention on the Physical Protection of Nuclear Material (CPPNM) 
   https://ola.iaea.org/ola/treaties/documents/FullText.pdf 
   IAEA Nuclear Security Series No. 20.  Objective and Essential Elements of a State’s 
  Nuclear Security Regime. http://www-
  pub.iaea.org/MTCD/Publications/PDF/Pub1590_web.pdf 
   IAEA Nuclear Security Series No. 13.  Nuclear Security Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5).  January 2011.  www-pub.iaea.org/MTCD/Publications/PDF/Pub1481_web.pdf 
   HMG Security Policy Framework. Cabinet Office.  
   https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/316182/
  Security_Policy_Framework_-_web_-_April_2014.pdf 
   7. 
   NISR 2003 Classification Policy – Trim Ref. 2012/243357. 
   Note: ONR staff should access the above internal ONR references via the How2 Business Management 
  System. 
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 14 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   15. 
   GLOSSARY AND ABBREVIATIONS 
   CFSI 
  CPPNM 
  CS&IA 
  FSyP 
  IAEA 
  IC 
  NISR 
  NSS 
  ONR 
  OPEX 
  OR 
  SC 
  SCM 
  SNI 
  SPF 
  SQEP 
  SyAPs 
  SyDP 
  TAG 
  TQ 
   Counterfeit, Fraudulent and Suspect Items 
  Convention on the Physical Protection of Nuclear Material 
  Cyber Security and Information Assurance 
  Fundamental Security Principle 
  International Atomic Energy Agency 
  Intelligent Customer 
  Nuclear Industries Security Regulations
  Nuclear Security Series 
  Office for Nuclear Regulation 
  Operational Experience 
  Operational Requirement 
  Supply Chain 
  Supply Chain Management 
  Sensitive Nuclear Information 
  Security Policy Framework 
  Suitably Qualified and Experienced 
  Security Assessment Principles 
  Security Delivery Principle
  Technical Assessment Guide 
  Technical Query 
   Report CNS-TAST-GD-4.1 
  TRIM Ref: 2017/104195 
   Page 15 of 15 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
  "
  Reliability and resilience of the security system cns-tast-gd-5.1	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Reliability and resilience of the security system cns-tast-gd-5.1.pdf	" Title of document 
   OFFICIAL 
   ONR GUIDE 
   RELIABILITY AND RESILIENCE OF THE SECURITY SYSTEM 
   Document Type: 
   Nuclear Security Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   CNS-TAST-GD-5.1 Revision 0 
   March 2017 
   Review Date: 
   March 2020 
   Approved by: 
   David Pascoe 
   Professional Lead 
   Record Reference: 
  Revision commentary: 
   TRIM Folder 4.4.2.19075. (2017/100306) 
  New document issued 
   TABLE OF CONTENTS 
   1. 
  INTRODUCTION ................................................................................................................. 2 
  2. 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  3. 
  RELATIONSHIP TO LEGISLATION .................................................................................... 2 
  4. 
  RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE ...................................... 2 
  5. 
  RELATIONSHIP TO NATIONAL POLICY DOCUMENTS ................................................... 3 
  6. 
  ADVICE TO INSPECTORS ................................................................................................. 4 
  7. 
  ELEMENTS OF SYSTEM RESILIENCE ............................................................................. 4 
  8. 
  SUITABLY QUALIFIED AND EXPERIENCED PERSONNEL ............................................. 7 
  9. 
  ESSENTIAL SERVICES AND THE SECURITY SYSTEM .................................................. 7 
  10. REFERENCES .................................................................................................................... 9 
  11. GLOSSARY AND ABBREVIATIONS ................................................................................ 10 
   © Office for Nuclear Regulation, 2017 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 03/17 
   OFFICIAL 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 10 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   1. 
   1.1 
   1.2 
   2. 
   2.1 
   3. 
   3.1 
   3.2 
   4. 
   4.1 
   INTRODUCTION 
   The Office for Nuclear Regulation (ONR) has established a set of Security Assessment 
  Principles (SyAPs) (Reference 7). This document contains Fundamental Security 
  Principles (FSyPs) that dutyholders must demonstrate have been fully taken into 
  account in developing their security arrangements to meet relevant legal obligations. 
  The security regime for meeting these principles is described in security plans 
  prepared by the dutyholders, which are approved by ONR under the Nuclear Industries 
  Security Regulations (NISR) 2003 (Reference 1).  
   The term ‘security plan’ is used to cover all dutyholder submissions such as nuclear 
  site security plans, temporary security plans and transport security statements. NISR 
  Regulation 22 dutyholders may also use the SyAPs as the basis for Cyber Security 
  and Information Assurance documentation that helps them demonstrate ongoing legal 
  compliance for the protection of Sensitive Nuclear Information (SNI). The SyAPs are 
  supported by a suite of guides to assist ONR inspectors in their assessment and 
  inspection work, and in making regulatory judgements and decisions.  This Technical 
  Assessment Guidance (TAG) is such a guide. 
   PURPOSE AND SCOPE 
   This TAG contains guidance to advise and inform ONR inspectors in exercising their 
  regulatory judgment during assessment activities relating to a dutyholder’s 
  arrangements to ensure their security systems have appropriate levels of reliability and 
  resilience. It aims to provide general advice and guidance to ONR inspectors on how 
  this aspect of security should be assessed. It does not set out how ONR regulates the 
  dutyholder’s arrangements.  It does not prescribe the methodologies for dutyholders to 
  follow in demonstrating they have addressed the SyAPs. It is the dutyholder’s 
  responsibility to determine and describe this detail and for ONR to assess whether the 
  arrangements are adequate.  
   RELATIONSHIP TO LEGISLATION 
   The term ‘dutyholder’ mentioned throughout this guide is used to define ‘responsible 
  persons’ on civil nuclear licensed sites and other nuclear premises subject to security 
  regulation, a ‘developer’ carrying out work on a nuclear construction site and approved 
  carriers, as defined in NISR. It is also used to refer to those holding SNI.  
   NISR defines a ‘nuclear premises’ and requires ‘the responsible person’ as defined to 
  have an approved security plan in accordance with Regulation 4. It further defines 
  approved carriers and requires them to have an approved Transport Security 
  Statement in accordance with Regulation 16. Persons to whom Regulation 22 applies 
  are required to protect SNI. ONR considers reliability, resilience and sustainability to 
  be important components of a dutyholder’s arrangements in demonstrating compliance 
  with relevant legislation.   
   RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE 
   The essential elements of a national nuclear security regime are set out in the 
  Convention on the Physical Protection of Nuclear Material (CPPNM) (Reference 4) and 
  the IAEA Nuclear Security Fundamentals (Reference 3). Further guidance is available 
  within IAEA Technical Guidance and Implementing Guides. 
   4.2 
   Fundamental Principle J of the CPPNM refers to quality assurance and states that a 
  quality assurance policy and quality assurance programmes should be established and 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 2 of 10 
   OFFICIAL 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   implemented with a view to providing confidence that specified requirements for all 
  activities important to physical protection are satisfied. The importance of issues 
  relating to quality assurance is also recognised in the Nuclear Security Fundamentals, 
  specifically: 
    
   Essential Element 12: Sustaining a Nuclear Security Regime – 3.12 A 
  nuclear security regime ensures that each competent authority and 
  authorised person and other organisations with nuclear security 
  responsibilities contribute to the sustainability of the regime by: 
   o 
   o 
   o 
   Allocating sufficient human, financial and technical resources to carry 
  out the organisation’s nuclear security responsibilities on a continuing 
  basis using a risk-informed approach 
   Routinely conducting maintenance, training and evaluation to ensure 
  the effectiveness of the nuclear security systems 
   Routinely performing assurance activities to identify and address 
  issues and factors that may affect the capacity to provide adequate 
  nuclear security, including cyber security, at all times  
   4.3 
   5. 
   5.1 
   5.2 
   A more detailed description of the quality assurance is provided in Recommendations 
  level guidance, specifically Nuclear Security Series (NSS) 13, Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5) (Reference 2). This document states “The quality assurance policy and 
  programme(s) for physical protection should ensure that a physical protection system 
  is designed, implemented, operated and maintained in a condition capable of 
  effectively responding to the threat assessment or design basis threat and that it meets 
  the State’s regulations, including its prescriptive and/or performance based 
  requirements.” 
   RELATIONSHIP TO NATIONAL POLICY DOCUMENTS 
   The SyAPs provide ONR inspectors with a framework for making consistent regulatory 
  judgements on the effectiveness of a dutyholder’s security arrangements.  This TAG 
  provides guidance to ONR inspectors when assessing a dutyholder’s submission 
  demonstrating they have effective processes in place to achieve SyDP 5.1 – Reliability 
  and Resilience, in support of FSyP 5 – Reliability, Resilience and Sustainability.  The 
  TAG is consistent with other TAGs and associated guidance and policy 
  documentation. 
   The HMG Security Policy Framework (SPF) (Reference 5) describes the Cabinet 
  Secretary’s expectations of how HMG organisations and third parties handling HMG 
  information and other assets will apply protective security to ensure HMG can function 
  effectively, efficiently and securely. The security outcomes and requirements detailed 
  in the SPF have been incorporated within the SyAPs. This ensures that dutyholders 
  are presented with a coherent set of expectations for the protection of nuclear 
  premises, SNI and the employment of appropriate personnel security controls both on 
  and off nuclear premises. 
   5.3 
   The Classification Policy (Reference 6) indicates those categories of SNI, which 
  require protection and the level of security classification to be applied. 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 3 of 10 
   OFFICIAL 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   6. 
   6.1 
   6.2 
   6.3 
   6.4 
   ADVICE TO INSPECTORS 
   It is particularly important to ensure, so far as possible, that the security system is 
  capable of performing its function with an adequate level of reliability. This objective 
  may be achieved by the adoption of a number of different provisions, together with the 
  use of techniques to demonstrate the adequacy of the specified measures. The 
  reliability of plant and systems to provide the security effect should be demonstrated by 
  the dutyholder to be consistent with the risks associated with the loss of this capability. 
  This should be informed by the Category of the security function and the Classification 
  of the security structure, system or component (SSC) concerned.  
   The security system design should incorporate an appropriate level of redundancy to 
  reduce the effects of random failure, and diversity and segregation to reduce the 
  effects of common cause failure and malicious actions. This should take account of the 
  site or facility the system is protecting and its vulnerability to threats described in the 
  Nuclear Industries Malicious Capabilities Planning Assumptions document (Reference 
  8). 
   In assessing the fitness for purpose of the security system, and particularly the ability 
  to deliver a particular effect, a number of issues relating to redundancy and diverse 
  provisions should be considered. Security plans should clearly identify the security 
  function of all SSCs so that this assessment can be carried out. 
   Regulatory Expectation 
   There is a regulatory expectation that dutyholders demonstrate in the security plan 
  how they ensure that the design and operation of the security system delivers 
  appropriate levels of redundancy, diversity and segregation. Dutyholders should 
  provide sufficient resources (including personnel) to inform the design, to maintain and 
  to restore nuclear security SSCs, thus building resilience to enable an appropriate and 
  effective incident response, and a recovery programme that reflects the risk of any loss 
  of service. Essential services critical to the correct functioning of the security system 
  should be given the same priority as the system itself and as such are required to have 
  appropriate levels of reliability and resilience. 
   FSYP 4 - Reliability, 
  Resilience and 
  Sustainability 
   Reliability and Resilience 
   SyDP 5.1 
   Security structures, systems and components should be appropriately qualified, with 
  design incorporating reliability and resilience through ‘failsecure’, redundancy, 
  diversity and segregation. There should also be sufficient resources available and 
  contingency arrangements developed to ensure continuity of security provision.  
   7. 
   ELEMENTS OF SYSTEM RESILIENCE 
   Redundancy 
   7.1 
   Redundancy is frequently defined as the provision of more than the minimum number 
  of equipment items required to perform a specific security function. Such redundancy 
  allows a specified security function to be delivered when one or more items (but not all) 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 4 of 10 
   OFFICIAL 
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   7.2 
   7.3 
   are unavailable, due to a variety of unspecified potential failure mechanisms or 
  maintenance (e.g. identified faults or hazards).  
   Experience dictates there are deterministic and probabilistic arguments to justify the 
  provision of redundancy in SSCs. A design which is considered acceptable will display 
  adequate levels of system redundancy to ensure it is fit for purpose and should 
  perform the required security function. These characteristics will include final 
  provisions to satisfy the deterministic and probabilistic requirements of any potential 
  design for SSCs important to security.  
   Dependent Failure 
   A possible threat to security system resilience is that posed by dependent failure. 
  These have the potential to prevent the performance of a required security function 
  through simultaneous loss of redundant provisions. Particular illustrations of this type 
  of failure are common-cause failures (CCF).The inspector should be satisfied that the 
  risk from dependent failures has been reduced to a level which is acceptable within the 
  limits set by design requirements. It is important to note that reliability does not 
  necessarily increase indefinitely in proportion to levels of redundancy, and this is 
  primarily due to common origin or common cause effects. This type of failure is often 
  referred to either as CCF or a common mode failure (CMF). A CCF is a dependent 
  failure event where approximately simultaneous multiple failures result from a single 
  shared cause (e.g. fire). A CMF is a common cause event where the multiple 
  equipment items fail in the same mode.  
   7.4 
   Multiple failures can occur due to common weaknesses or dependencies shared by 
  components. Such failures can cause failure of all redundant components in a single 
  security system or failure of components in more than one system. Dependent failures 
  can considerably reduce the reliability of the security systems relative to that expected 
  of random failures acting isolation.  
   7.5 
   The main types of dependencies which could cause potential loss of a security function 
  are described below. 
    
    
    
    
   Functional 
   dependencies, 
   which 
  arise 
  from 
  shared 
  or 
  common 
  functional 
  features; 
  such 
  as 
  a 
  common 
  electrical 
  power 
  source, 
  common 
  wiring 
  or 
  a 
  shared communication node.  
   Spatial 
   dependencies, 
   which 
  arise 
  from 
  physical 
  features 
  shared 
  by 
  components 
  located 
  in 
  a 
  common 
  location; 
  such 
  as 
  common 
  radiation 
  or 
  chemical 
  conditions, 
  a 
  common 
  environment 
  and 
  common 
  support 
  structures, 
  and 
  vulnerability 
  to 
  leaks 
  of 
  dangerous 
  fluids 
  (high 
  temperature, 
  corrosive or toxic).  
   Inherent dependencies, which arise 
   of 
   operation 
   or 
   common 
  principle 
  overload.  
   from shared characteristics; 
  such as a 
  technical 
  feature 
  such 
  as 
  electrical 
   Human 
   error 
   related 
   affecting 
  some 
  shared 
  or 
  design 
  or 
  manufacture, 
  maintenance. 
   dependencies, 
   which 
  arise 
  from 
  common 
  human 
  process; 
  such 
  as 
  or 
  operating 
  staff 
  error 
  during 
   human 
  errors 
  human 
  error 
  in 
  operation 
  and 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 5 of 10 
   OFFICIAL 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   7.6 
   To provide protection against dependent failures, the inspector should seek 
  confirmation that the dutyholder has identified and, where necessary and practicable, 
  implemented measures in design, construction and operation to eliminate them or 
  reduce their potential effect. Examples of such measures are:  
    
    
    
    
   the provision of segregation to eliminate spatial dependencies; 
   the avoidance of functional dependencies by segregation of SSCs important 
  to security and their support services; 
   the provision of alternative and independent equipment to eliminate undue 
  reliance on any single system. The purpose of this element of the approach 
  is to provide protection against any 'hidden failure dependencies' that may 
  not be identified; and 
   approaches and procedures should be implemented to minimise the 
  possibility of failure dependencies arising during design, manufacture, 
  construction and operation, including dependencies due to operator and 
  other human error. 
   Diversity 
   7.7 
   7.8 
   7.9 
   7.10 
   Where a component of the security system is at potential risk from common cause 
  failures, one means of reducing the susceptibility is to employ diverse provisions in 
  separate redundant trains or systems. For example, the detect function over a given 
  area could be delivered by both fixed-line and pan-tilt-zoom closed circuit television 
  powered by segregated electricity supplies and a dual perimeter intruder detection 
  system utilising complementary technologies (for example infrared and microphonic 
  technologies). A dutyholder should consider appropriate measures to include diversity 
  within the components of the system which is designed to deliver an individual effect 
  and/or across the security systems in its entirety. Engineering diversity is defined as 
  the provision of dissimilar means of achieving the same objective; e.g. the use of 
  features which differ in the physical means of achieving a specific objective or use of 
  different equipment made by different manufacturers.  
   Diversity provides one means of protection against some dependent failure 
  mechanisms, by removing common features which may lead to failure dependencies. 
  Diversity particularly provides protection against inherent dependencies and human 
  error related dependencies.  
   The possibility of the physical co-location or the functional support of diverse systems 
  leading to dependencies which defeat the objective of providing diversity, should be 
  addressed in the layout and functional design of the security system where 
  appropriate. 
   Segregation 
   In a resilient security system and despite diverse provisions, the threat of common 
  cause failures from hazards such as fire or hostile intent may be reduced by system 
  segregation. This is the separation of components by distance or physical barriers, a 
  particular example being provision of principal fire barriers to delineate individual fire 
  zones; they may also serve as barriers to other hazards such as blast. Appropriate 
  levels of segregation should be present in a dutyholder’s provisions in order to 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 6 of 10 
   OFFICIAL 
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   7.11 
   7.12 
   8. 
   8.1 
   maximise the likelihood that a security function will be performed, despite the 
  occurrence of faults and hazards, possibly in combination. 
   Equipment segregation is the separation of redundant and/or diverse components by 
  distance or by barriers in order to prevent all (or sufficient to enable system failure) of 
  the components being damaged, particularly in the event of common hazards or 
  malicious action. Segregation is provided in the design to ensure internal hazards, 
  such as fire and certain external threats do not damage separate chains of security 
  equipment to the extent that its functional reliability is unacceptably reduced. The most 
  straightforward manner in which segregation can be achieved is through distance and 
  avoidance of co-locating components. 
   System Independence 
   Security systems may be subject to spurious operation in addition to operational 
  failures. These can arise because a given security system component does not 
  possess a sufficient level of independence from other separate systems. Measures 
  need to be employed by the dutyholder to ensure that, wherever possible, security 
  system components are not adversely affected by the spurious operation or failure of 
  other systems, especially through any potential for hidden dependency (for example, 
  by having a single system responsible for fire and security response). This is best 
  achieved by designing in both functional and physical isolation. 
   SUITABLY QUALIFIED AND EXPERIENCED PERSONNEL 
   The dutyholder’s security organisation should possess adequate Suitably Qualified and 
  Experienced (SQEP) personnel to support security systems. This includes having 
  sufficient personnel with the necessary competences and knowledge to provide 
  resilience and maintain the capability to manage, operate, maintain and repair security 
  systems at all times.  
   9. 
   ESSENTIAL SERVICES AND THE SECURITY SYSTEM 
   Where essential services (such as computer based security systems) are necessary to 
  support the functioning of a Physical Protection System (PPS), then these services 
  should be sufficiently resilient and secure to ensure that their loss or interruption does 
  not adversely affect the ability of the PPS to achieve the required outcome as defined 
  in SyAPs Annexes C and D. 
    Inspectors should consider: 
    
    
    
    
   Has reliability, resilience and sustainability been considered throughout the 
  design stage for any new facility or security system and incorporated within 
  relevant operational requirements? 
   Are requirements for security systems regularly reassessed in conjunction with 
  all stakeholders? 
   Are there sufficient SQEP and other resources to manage, operate, maintain 
  and repair the security system? 
   Does the design and operation of the security system display appropriate levels 
  of redundancy, diversity and segregation? 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 7 of 10 
   OFFICIAL 
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
    
    
    
    
    
    
    
   Do essential services (such as power) necessary for the correct functioning of 
  the security system have the appropriate levels of security, reliability and 
  resilience? 
   Have potential dependencies and/or vulnerabilities of the security system been 
  identified and mitigated? 
   Do security systems ‘fail secure’ and if they do not, are security requirements 
  appropriately balanced against safety requirements and are adequate 
  compensatory security measures available? 
   Does the dutyholder demonstrate the ability to learn from experience of 
  maintaining the security system? 
   Is there a process of continuous improvement in place in relation to the security 
  system’s reliability, resilience and sustainability? 
   Are appropriate quality performance and assurance mechanisms applied to 
  security systems? 
   Is the response to the failure or loss of part of or all of a SSC regularly 
  exercised or rehearsed? 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 8 of 10 
   OFFICIAL 
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   10. 
   REFERENCES 
   OFFICIAL 
   1. 
   2. 
   3. 
   4. 
   5. 
   6. 
   7. 
   8. 
   Nuclear Industries Security Regulations 2003.  Statutory Instrument 2003 No. 403 
   IAEA Nuclear Security Series No. 13.  Nuclear Security Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5).  January 2011.  www-pub.iaea.org/MTCD/Publications/PDF/Pub1481_web.pdf. 
   IAEA Nuclear Security Series No. 20.  Objective and Essential Elements of a State’s 
  Nuclear Security Regime. http://www-
  pub.iaea.org/MTCD/Publications/PDF/Pub1590_web.pdf 
   Convention on the Physical Protection of Nuclear Material (CPPNM) 
   https://ola.iaea.org/ola/treaties/documents/FullText.pdf 
   HMG Security Policy Framework. Cabinet Office.  
   https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/316182/
  Security_Policy_Framework_-_web_-_April_2014.pdf 
   NISR 2003 Classification Policy – Trim Ref. 2012/243357. 
   Security Assessment Principles – Trim Ref. 2017/121036   
   Nuclear Industries Malicious Capabilities Planning Assumptions.   
   Note: ONR staff should access the above internal ONR references via the How2 Business 
  Management System. 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 9 of 10 
   OFFICIAL 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL 
   11. 
   GLOSSARY AND ABBREVIATIONS 
   BC 
  CCF 
  CMF 
  CPNI 
  CPPNM 
  FSyP 
  IAEA 
  NIMCA 
  NISR 
  NSS 
  ONR 
  PPS 
  SNI 
  SPF 
  SQEP 
  SSC 
  SyAP 
  SyDP 
  TAG 
   Business Continuity 
  Common Cause Failure 
  Common Mode Failure 
  Centre for the Protection of National Infrastructure 
  Convention on the Physical Protection of Nuclear Material 
  Fundamental Security Principle 
  International Atomic Energy Agency 
  Nuclear Industries Malicious Capabilities Planning Assumptions 
  Nuclear Industries Security Regulations 
  Nuclear Security Series 
  Office for Nuclear Regulation
  Physical Protection System 
  Sensitive Nuclear Information 
  Security Policy Framework 
  Suitably Qualified and Experienced 
  Structure, System and Component 
  Security Assessment Principle 
  Security Delivery Principle 
  Technical Assessment Guide 
   Report CNS-TAST-GD-5.1 
  TRIM Ref: 2017/100306 
   Page 10 of 10 
   OFFICIAL 
    
    
    
    
    
    
    
  "
  Supplier capability cns-tast-gd-4.2	/Users/lawrence/Documents/GitHub/Data-Model-for-Project-Frameworks/Nuclear project data for use in generating example frameworks/Supplier capability cns-tast-gd-4.2.pdf	" Title of document 
   OFFICIAL 
   ONR GUIDE 
   SUPPLIER CAPABILITY 
   Document Type: 
   Nuclear Security Technical Assessment Guide 
   Unique Document ID and 
  Revision No: 
  Date Issued: 
   CNS-TAST-GD-4.2 Revision 0 
   March 2017 
   Review Date: 
   March 2020 
   Approved by: 
   David Pascoe 
   Professional Lead 
   Record Reference: 
  Revision commentary: 
   TRIM Folder 4.4.2.19074. (2017/106056) 
  New document issued 
   TABLE OF CONTENTS 
   1. 
  INTRODUCTION ................................................................................................................. 2 
  2. 
  PURPOSE AND SCOPE ..................................................................................................... 2 
  3. 
  RELATIONSHIP TO RELEVANT LEGISLATION ................................................................ 2 
  4. 
  RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE ...................................... 2 
  5. 
  RELATIONSHIP TO NATIONAL POLICY DOCUMENTS ................................................... 3 
  6. 
  ADVICE TO INSPECTORS ................................................................................................. 3 
  7. 
  SUPPLY CHAIN ORGANISATION AND TECHNICAL CAPABILITY .................................. 4 
  8. 
  SUPPLY CHAIN MANAGEMENT SYSTEMS ..................................................................... 5 
  9. 
  REFERENCES .................................................................................................................... 8 
  10. GLOSSARY AND ABBREVIATIONS .................................................................................. 9 
   © Office for Nuclear Regulation, 2017 
  If you wish to reuse this information visit www.onr.org.uk/copyright for details.  
  Published 03/17 
   OFFICIAL 
   Template Ref: ONR-DOC-TEMP-002 Revision 3 
   Page 1 of 9 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   1. 
   1.1 
   1.2 
   2. 
   2.1 
   3. 
   3.1 
   3.2 
   4. 
   4.1 
   INTRODUCTION 
   The Office for Nuclear Regulation (ONR) has established a set of Security Assessment 
  Principles (SyAPs) (Reference 1). This document contains Fundamental Security 
  Principles (FSyPs) that dutyholders must demonstrate have been fully taken into 
  account in developing their security arrangements to meet relevant legal obligations. 
  The security regime for meeting these principles is described in security plans 
  prepared by the dutyholders, which are approved by ONR under the Nuclear Industries 
  Security Regulations (NISR) 2003 (Reference 2). 
   The term ‘security plan’ is used to cover all dutyholder submissions such as nuclear 
  site security plans, temporary security plans and transport security statements. NISR 
  Regulation 22 dutyholders may also use the SyAPs as the basis for Cyber Security 
  and Information Assurance (CS&IA) documentation that helps them demonstrate 
  ongoing legal compliance for the protection of Sensitive Nuclear Information (SNI). The 
  SyAPs are supported by a suite of guides to assist ONR inspectors in their 
  assessment and inspection work, and in making regulatory judgements and decisions.  
  This Technical Assessment Guidance (TAG) is such a guide. 
   PURPOSE AND SCOPE 
   This TAG contains guidance to advise and inform ONR inspectors in exercising their 
  regulatory judgment during assessment activities relating to a dutyholder’s supply 
  chain management arrangements.  It aims to provide general advice and guidance to 
  ONR inspectors on how this aspect of security should be assessed. It does not set out 
  how ONR regulates the dutyholder’s arrangements.  It does not prescribe the detail, 
  targets or methodologies for dutyholders to follow in demonstrating they have 
  addressed the SyAPs. It is the dutyholder’s responsibility to determine and describe 
  this detail and for ONR to assess whether the arrangements are adequate.   
   RELATIONSHIP TO RELEVANT LEGISLATION 
   The term ‘dutyholder’ mentioned throughout this guide is used to define ‘responsible 
  persons’ on civil nuclear licensed sites and other nuclear premises subject to security 
  regulation, a ‘developer’ carrying out work on a nuclear construction site and approved 
  carriers, as defined in NISR. It is also used to refer to those holding SNI. 
   NISR defines a ‘nuclear premises’ and requires ‘the responsible person’ as defined to 
  have an approved security plan in accordance with Regulation 4. It further defines 
  approved carriers and requires them to have an approved Transport Security 
  Statement in accordance with Regulation 16. Persons to whom Regulation 22 applies 
  are required to protect SNI. ONR considers supply chain management to be an 
  important component of a dutyholder’s arrangements in demonstrating compliance 
  with relevant legislation. 
   RELATIONSHIP TO IAEA DOCUMENTATION AND GUIDANCE 
   The essential elements of a national nuclear security regime are set out in the 
  Convention on the Physical Protection of Nuclear Material (CPPNM) (Reference 3) and 
  the IAEA Nuclear Security Fundamentals (Reference 4). Further guidance is available 
  within IAEA Technical Guidance and Implementing Guides. 
   Report CNS-TAST-GD-4.2 
  TRIM Ref: 2017/106056 
   Page 2 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   4.2 
   Fundamental Principle J of the CPPNM refers to quality assurance and states that ‘a 
  quality assurance policy and quality assurance programmes should be established and 
  implemented with a view to providing confidence that specified requirements for all 
  activities important to physical protection are satisfied’. The importance of issues 
  relating to assurance activities are also recognised in the Nuclear Security 
  Fundamentals, specifically: 
   4.3 
   5. 
   5.1 
   5.2 
   5.3 
   6. 
   6.1 
    
   Essential Element 12: Sustaining a Nuclear Security Regime – 3.12  
   h) Routinely performing assurance activities to identify and address issues 
  and factors that may affect the capacity to provide adequate nuclear 
  security including cyber security at all times. 
   A more detailed description of the elements is provided in Recommendations level 
  guidance, specifically Nuclear Security Series (NSS) 13, Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5) (Reference 5). 
   RELATIONSHIP TO NATIONAL POLICY DOCUMENTS 
   The SyAPs provide ONR inspectors with a framework for making consistent regulatory 
  judgements on the effectiveness of a dutyholder’s security arrangements.  This TAG 
  provides guidance to ONR inspectors when assessing a dutyholder’s submission 
  demonstrating they have effective processes in place to achieve SyDP 4.2 – Supplier 
  Capability, in support of FSyP 4 – Nuclear Supply Chain Management.  The TAG is 
  consistent with other TAGs and associated guidance and policy documentation. 
   The HMG Security Policy Framework (SPF) (Reference 6) describes the Cabinet 
  Secretary’s expectations of how HMG organisations and third parties handling HMG 
  information and other assets will apply protective security to ensure HMG can function 
  effectively, efficiently and securely. The security outcomes and requirements detailed 
  in the SPF have been incorporated within the SyAPs. This ensures that dutyholders 
  are presented with a coherent set of expectations for the protection of nuclear 
  premises, SNI and the employment of appropriate personnel security controls both on 
  and off nuclear premises. 
   The Classification Policy (Reference 7) indicates those categories of SNI, which 
  require protection and the level of security classification to be applied. 
   ADVICE TO INSPECTORS 
   This TAG informs regulatory assessment of Supply Chain Management (SCM) 
  arrangements with a particular focus on the supplier’s capability. It should be read 
  together with the Safety TAG NS-TAST-GD 049 Rev 5 ‘Licensee Core and Intelligent 
  Customer Capabilities’.  That TAG defines key terms: ‘core capability’, ‘contractor’ and 
  ‘intelligent customer’.   The TAG also relates the use of contractors to several Licence 
  Conditions.   
   Regulatory Expectations 
   6.2 
   The regulatory expectation is that dutyholders will describe in the security plan how 
  they seek assurance of supplier capability to support effective nuclear supply chain 
  management arrangements. 
   Report CNS-TAST-GD-4.2 
  TRIM Ref: 2017/106056 
   Page 3 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   6.3 
   6.4 
   7. 
   7.1 
   7.2 
   7.3 
   FSyP 4 - Nuclear Supply 
  Chain Management 
   Supplier Capability 
   SyDP 4.2 
   For work with nuclear security significance, dutyholders should evaluate and confirm that 
  suppliers have the organisational and technical capability, capacity and culture to deliver 
  items or services to the specification prior to placing any contract. 
   The regulatory expectation from dutyholders is that they will evaluate and confirm 
  suppliers have the organisational and technical capability, capacity and culture to 
  deliver items or services to the specification prior to placing any contract for items or 
  services identified as being of nuclear security significance. This expectation is in 
  addition to the normal personnel security screening necessary for any contractor to 
  gain access to a site or operation.  That process aims to counter the ‘insider threat’ 
  and CPNI has produced a number of good practice guides on how this might be 
  mitigated, with specific reference to contractors.    
   The regulatory expectation from dutyholders is that they will ensure suppliers have 
  quality management arrangements which are appropriate and consistent with the 
  security significance of the procured items or services. In most cases dutyholders will 
  use established contractors with a good track record.  Such contractors are likely to 
  have the appropriate accreditations and associations.  For example: Security Industry 
  Association’s Approved Contractor Scheme, BS EN ISO 9001 Quality Management 
  Systems, membership of the Security Institute and related codes of practice and British 
  Standards.   
   SUPPLY CHAIN ORGANISATION AND TECHNICAL CAPABILITY 
   For work with nuclear security significance, the purchaser should evaluate and confirm 
  that suppliers have the organisational and technical capability, capacity and culture to 
  deliver items or services to specification, prior to placing any contract.  
   Suppliers should be selected by the purchaser after evaluation against pre-defined 
  criteria appropriate to the contract. The criteria will test the supplier’s ability to meet the 
  specified intent and should include information from the supplier that provides objective 
  evidence of their capability and capacity to deliver the required item or service. The 
  criteria for selection should be appropriately weighted to evaluate the supplier’s ability 
  to meet the required security performance (e.g. protection of SNI) of the contract. 
   Purchasers are expected to ensure that the supply chain has the organisational and 
  technical capability to deliver items or services in line with their requirements. 
  Suppliers’ organisational arrangements should include documented management 
  system arrangements appropriate to the items or services being supplied. These 
  systems should be implemented and be able to meet the requirements of any relevant 
  national or international management system standard for quality, environment and 
  security management. An evaluation of a potential supplier should include the potential 
  supplier’s nuclear security culture, ensuring that the organisation and its leaders 
  understand, or have the potential to understand, the importance of nuclear security 
  and the contribution of any high-risk item or service they may supply to achieving the 
  purchaser’s security plan requirements. 
   7.4 
   As part of the supplier selection process, the purchaser should confirm that suppliers 
  have adequate oversight and assurance arrangements for their own suppliers. The 
   Report CNS-TAST-GD-4.2 
  TRIM Ref: 2017/106056 
   Page 4 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   purchaser and suppliers should hold certification in accordance with recognised 
  management system requirements, issued by the UK Accreditation Service (UKAS), or 
  international equivalent, to ensure that appropriate quality management arrangements 
  are in place and are being applied throughout the Supply Chain. This approach should 
  not preclude purchasers from directly evaluating any level of the Supply Chain or 
  carrying out oversight and assurance when work is in progress. All contracts should 
  detail this right of access by the purchaser. 
   7.5 
   Purchasers should assure themselves that suppliers have competent personnel, 
  particularly those carrying out key functions such as contract review, fabrication and 
  inspection. The judgement on competency should be based on qualifications, training 
  and experience using the supplier organisation’s own criteria and any applicable 
  design code requirements for selection, employment and training of employees. A 
  responsible person within the supplier organisation should assess each person 
  involved for SQEPness against the post profiles and record acceptance and/or 
  limitations, identifying how the latter will be addressed.   
   Inspectors should consider: 
    
    
    
    
    
    
   Is the purchaser’s process for evaluating suppliers of security significant 
  items and services appropriately weighted to consider the quality and 
  security requirements as a key part of the contract selection and award 
  criteria? 
   Do suppliers of security significant items and services currently have, and 
  can maintain, sufficient SQEP personnel throughout the contract period? 
   Does the supplier have the capacity to provide an enduring source of high-
  risk items or services throughout the contract period?  
   Has the purchasing organisation promulgated the required nuclear security 
  culture with key suppliers? 
   Do suppliers of security significant items or services understand the role of 
  their products in achieving the dutyholder’s security plan requirements and 
  are well-coordinated with the purchasers’ staff? 
   Does the purchasing organisation and/or its suppliers monitor the 
  performance of key individuals who are responsible for providing security 
  significant high-risk items or services?  
   8. 
   8.1 
   8.2 
   SUPPLY CHAIN MANAGEMENT SYSTEMS 
   The purchaser should ensure that suppliers have quality management arrangements 
  appropriate and consistent with the security significance of the procured items or 
  services. 
   Purchasers should ensure that supply organisations have management system 
  arrangements appropriate to the items or services being supplied. These systems 
  should be implemented and be able to meet relevant national or international; quality, 
  environment and security management system requirements and be certified by UKAS 
  or an equivalent international organisation. 
   Report CNS-TAST-GD-4.2 
  TRIM Ref: 2017/106056 
   Page 5 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   8.3 
   8.4 
   8.5 
   8.6 
   8.7 
   8.8 
   8.9 
   The purchaser’s management system arrangements should ensure that effective SCM, 
  procurement, oversight and assurance arrangements are applied and are 
  proportionate to the nuclear security significance of the items or services being 
  procured. Arrangements should include comprehensive measures for the generation 
  and control of quality plans and records, detailed further below, as key requirements in 
  the effective procurement, manufacture and/or delivery of high-risk items and services. 
   Quality Plans 
   The purchaser should make clear in the contract the extent to which quality plans will 
  be utilised. Quality Plans should be agreed with the purchaser prior to their use. The 
  use of quality plans, developed by the supplier and agreed with the purchaser, is 
  essential to ensure that items are fabricated, manufactured, erected, tested and 
  inspected in a planned and controlled manner, and that the required levels of integrity 
  are achieved and can be demonstrated within the required record/evidence package. 
   Quality Plans allow the purchaser to check in advance that the supplier has fully 
  understood the detailed requirements of the technical specification, and that the 
  supplier has the necessary assurance activities to deliver items that will meet the 
  technical specification and applicable codes and standards. Quality Plans also allow 
  the purchaser, second party (supplier), independent third party inspection personnel, 
  and, in some instances, ONR, to insert inspection points, witness points, review points 
  or hold points into the manufacturing sequence. 
   Quality Plans should include the full sequence of steps to deliver the item or service 
  and details of hold point release. These need to be available for review by involved 
  parties before work commences and in sufficient time to allow these parties to review 
  and annotate them with hold, inspection, witness and review points and/or to question 
  the sequence or referenced documents. 
   Quality Plans, in identifying the sequence of activities required to satisfy the 
  requirements of the contract, should reference process or fabrication instructions, 
  tests, inspections and clearly identify the records required to be generated and 
  provided to the purchaser. They should enable each stage of work to be signed for as 
  being complete and also on the completion of work covered by each element of the 
  plan. Proposed changes to quality plans before and during work commencement 
  should be formally controlled and agreed by all the inspecting parties. 
   A completed Quality Plan should demonstrate that all appropriate steps have been 
  taken to deliver items or services to purchaser requirements, including details of the 
  organisations involved and references to control documents and appropriate records.  
   For complex items that are fabricated, manufactured or erected in stages, there may 
  be several Quality Plans which support a top level quality plan. Quality Plan operations 
  which are carried out by different organisations should make reference to the 
  arrangements for releasing items or services from one to the other and the quality 
  plans that control the ongoing work.  
   8.10 
   A quality plan should identify or reference all those documents which form the 
  purchaser’s document package and include such aspects as qualification of personnel, 
  fabrication procedures, material certification and traceability, consumable specification, 
  concessions and rework, manufacture, fabrication instructions, heat treatment records, 
   Report CNS-TAST-GD-4.2 
  TRIM Ref: 2017/106056 
   Page 6 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   inspection and test results (including those from the purchaser, second, and third party 
  inspection organisations). 
   8.11 
   Quality Plans should identify steps for release, transport, handover and the process 
  that will control the interfaces between organisations. The release process to the 
  purchaser from the supplier should identify and record any approved deviations from 
  contract requirements, specified intent and any outstanding actions. 
   Records 
   8.12 
   8.13 
   8.14 
   8.15 
   The importance of identification and retention of design, procurement, manufacturing, 
  fabrication and inspection records cannot be overstated as these ultimately support the 
  security plan. These should provide the evidence of assurance activities including 
  those carried out by the supplier and sub-suppliers and in some cases the purchaser. 
  Records also provide ONR with evidence of the application of assurance 
  arrangements and can be used to demonstrate compliance. 
   Records form part of the demonstration that structures, systems and components meet 
  the design intent and nuclear security requirements. The identification, generation, 
  timely completion, handover and retention of records associated with the supply of 
  items or services, should form part of the contractual arrangements between purchaser 
  and supplier at all levels of the Supply Chain.  
   The purchaser should identify all the records required to be delivered to the purchaser 
  during or on completion of the contract. Particular attention should be given to material 
  traceability and inspection, test and surveillance activities. 
   Tracking of record packages by unique reference and plant item unique numbers will 
  aid interim and full system sign off prior to pre and post commissioning testing. The 
  purchaser should develop the lifetime record package tracking process and ensure the 
  supplier’s contract arrangements identify this process and their role within that 
  process. 
   Inspectors should consider:  
    
    
    
    
    
   Are the supplier’s management system arrangements appropriate to the 
  risks of the items of services being supplied?  
   Are Quality Plans comprehensive and inclusive of the full sequence of steps 
  required to deliver the item or service, including references to assurance 
  activities and applicable codes and standards? 
   Do Quality Plans identify inspection/witness/review and hold points for all the 
  required inspection parties? 
   Are Quality Plans being adhered to and are they fully signed off after each 
  step has been completed? 
   Has the Purchaser put adequate contractual arrangements in place to 
  ensure that relevant records are identified and provided by the Supply Chain 
  in the correct form and to the required timescale?  
   Report CNS-TAST-GD-4.2 
  TRIM Ref: 2017/106056 
   Page 7 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   9. 
   1.  
   2. 
   3. 
   4. 
   5.  
   6. 
   REFERENCES 
   Security Assessment Principles – Trim Ref. 2017/121036   
   Nuclear Industries Security Regulations 2003.  Statutory Instrument 2003 No. 403 
   Convention on the Physical Protection of Nuclear Material (CPPNM) 
   https://ola.iaea.org/ola/treaties/documents/FullText.pdf 
   IAEA Nuclear Security Series No. 20.  Objective and Essential Elements of a State’s 
  Nuclear Security Regime. http://www-
  pub.iaea.org/MTCD/Publications/PDF/Pub1590_web.pdf 
   IAEA Nuclear Security Series No. 13.  Nuclear Security Recommendations on 
  Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 
  5).  January 2011.  www-pub.iaea.org/MTCD/Publications/PDF/Pub1481_web.pdf 
   HMG Security Policy Framework. Cabinet Office.  
   https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/316182/
  Security_Policy_Framework_-_web_-_April_2014.pdf 
   7. 
   NISR 2003 Classification Policy – Trim Ref. 2012/243357. 
   Note: ONR staff should access the above internal ONR references via the How2 Business Management 
  System. 
   Report CNS-TAST-GD-4.2 
  TRIM Ref: 2017/106056 
   Page 8 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
   Office for Nuclear Regulation  
   OFFICIAL  
   10. 
   GLOSSARY AND ABBREVIATIONS 
   CPPNM 
  CS&IA 
  FSyP 
  IAEA 
  NISR 
  NSS 
  ONR 
  OR 
  SC 
  SCM 
  SNI 
  SPF 
  SQEP 
  SyAPs 
  SyDP 
  TAG 
  UKAS 
   Convention on the Physical Protection of Nuclear Material 
  Cyber Security and Information Assurance 
  Fundamental Security Principle 
  International Atomic Energy Agency 
  Nuclear Industries Security Regulations 
  Nuclear Security Series 
  Office for Nuclear Regulation
  Operational Requirement 
  Supply Chain 
  Supply Chain Management 
  Sensitive Nuclear Information 
  Security Policy Framework 
  Suitably Qualified and Experienced 
  Security Assessment Principles 
  Security Delivery Principle 
  Technical Assessment Guide 
  United Kingdom Accreditation Service 
   Report CNS-TAST-GD-4.2 
  TRIM Ref: 2017/106056 
   Page 9 of 9 
   OFFICIAL  
    
    
    
    
    
    
    
    
    
    
  "
  