Regulatory Guide - When to seek approval to make a change with significant implications for safety (ARPANSA-GDE-1751)

Last updated date:	Reason for update:
01 May 2020	Administration update – no change to content

Associated forms

Request for approval to make a change with significant implications for safety

1. Introduction

Section 63 of the Australian Radiation Protection and Nuclear Safety Regulations 2018 (the Regulations) requires the holder of a licence to seek the CEO’s approval to make certain changes that will have significant implications for safety.

If a change has significant implications for safety, the licence holder must seek approval to do either of the following:

a) change anything described in the application for the licence

b) modify the controlled source, apparatus or facility described in the licence

Examples of such changes can include: the alterations of processes; introduction or removal of equipment; modifications to structures systems or components; changes in the way processes are undertaken or to the organisation; and resourcing of a source or facility.

ARPANSA considers that an implication for safety is a suggested or inferred effect on safety which, even if it is not easily derivable, possesses some degree of probability. A significant implication is one which is important, notable, or of consequence, having regard to its context or intensity.

In relation to this definition, this guide provides advice on when ARPANSA will consider that a change has significant implications. Where there is any doubt remaining on whether a change needs to be managed under section 63, applicants are encouraged to seek further advice from ARPANSA.

2. Document structure

This guide consists of four main sections. The first discusses ‘General Principles’ which must be considered when assessing the safety implications of a change. The second section provides a table of consequence thresholds above which ARPANSA will expect to receive an application for approval. Sections 3 & 4 provide some practical examples of changes considered to fall under section 63 of the Regulations for both facilities and sources.

3. General principles

ARPANSA’s approach to determine whether or not a change has a significant implication for safety is to consider the potential consequences of the proposed change, including an assessment of any credible consequence that may result if proposed change is improperly conceived or executed. In broad terms these consequences may include a radiological impact on people or the environment, a loss of control of a source or facility, or a reduction in defence in depth¹.

To obtain a licence, the applicant was required to provide ARPANSA with plans and arrangements to demonstrate acceptable levels of safety and security. The holder of a licence must comply with their plans and arrangements for managing safety. Those aspects of the plans and arrangements that formed the basis for ARPANSA’s decision to grant a licence are called the ‘licensing basis’. The licensing basis describes the controlled activity and establishes the boundary of activities within which safety is demonstrated.

Plans and arrangements describing how the licence holder maintains effective control, manages safety, provides radiation protection, deals with radioactive waste, manages security and prepares for and responds to emergencies will be part of the licencing basis. In the case of a facility, the safety analysis report (SAR), and the operating limits and conditions (OLC) will also be key documents of the licensing basis.

In general, proposed changes to a facility that are within the bounds of its approved licensing basis have already been approved by ARPANSA and are therefore unlikely to have significant implications for safety. However, the significance of any changes that could impact on the boundary established by the licensing basis should be assessed against the criteria of this guide.

In addition, if any of the following apply to the proposed change, it is likely to have a significant implication for safety (and therefore requires prior approval):

Results in more than a minimal increase in the likelihood or consequences of an accident or malfunction previously evaluated in the SAR.
Create the possibility of an accident or malfunction of a different type to what was evaluated in the SAR.
Results in a radiological consequence as described in the SAR being increased.
Involves departure from a method of evaluation described in the SAR used in establishing the design or in the safety analysis.

It should be noted that reviews by the licence holder to determine the applicability of section 63 or 64 of the Regulations do not necessarily aim to determine if the proposed change is good or bad. The licence holder is expected to have other processes for determining if the proposed change is justified or warranted. The review focuses merely on whether prior approval by ARPANSA is required.

A cumulative effect of two or more relevant changes that individually do not have significant implications for safety must also be considered. This principle addresses the scenario where successive minor changes can, over time, lead to a significant change in the safety of controlled sources or facilities (organisational drift). Licence holders should be able to show that cumulative effects have been considered when making relevant changes.

4. Consequence thresholds for section 63

The table below provides the thresholds above which ARPANSA considers a change to have significant implications for safety. In order to categorise changes, licence holders must have systems in place to evaluate the risk of certain changes. ARPANSA may ask licence holders to provide documentation to support their evaluation of a change considered unlikely to have significant implications for safety.

Note: Appropriate review allows licence holders to know and manage the risks associated with their operation

Implication for safety	Threshold for section 63
Radiological hazard outside of a controlled facility or building containing a source	Release activity at levels above discharge authorisations. Release activity that may increase long term radiation levels off site to 20 µSv/yr or more (above background). Release activity that may lead to a person being exposed to more than the annual dose limit to the public. For further information on radiation limits refer to Regulations, Division 2 – Dose limits.
Exposure of people to radiation	Expose a member of the public to radiation in excess of the statutory annual limit (1 mSv). Expose workers to radiation in excess of an annual dose limit. Expose people to non-ionizing radiation at levels above appropriate exposure limits. For further information on radiation limits refer to Regulations, Division 2 – Dose limits.
Impact on structures systems or components important to safety	Cause failure or reduce the reliability or availability of any system, structure or component that forms a primary means of ensuring radiation or nuclear safety, even where there is defence in depth remaining.
Impact on organisational controls or resourcing important to safety	Degrade safety management in a manner which removes organisational “checks and balances” for safety as described in the SAR or degrades defence in depth by failing to achieve adequate performance of staff in safety important roles.
To introduce or affect the likelihood or consequence of a dangerous occurrence	Increase the risk of operating outside of approved operating limits and conditions (where these are in place) or operational safety constraints. Introduce a risk of an accident not previously considered, change consequences of an existing risk or affect the likelihood of a known risk. Any change to an approved operating limit or condition (OLC) other than an editorial or typographical change. Note that the editorial or typographical change must NOT impact the safety case as presented in the Safety Analysis Report. Any change that uses an alternative evaluation method from that relied on in the licence application or safety case.
Impact on the security of controlled facilities and apparatus	Potential to cause failure, or reduce the reliability or availability of a: system (including human systems); or structure or component that provides a primary protective security function (deterrence, detection, assessment, delay and response)—even where there are layers of defence remaining. Potential to increase the threat level above that previously catered for by the protective security system and arrangements in place.

5. Examples of changes with significant implications for safety - facilities

The following examples of changes are provided for guidance only. It is important to relate any changes to the potential result of an unexpected outcome with a specific controlled facility.

Proposed change	Implications for safety
Replacement of Safety Interlock System Following a fault, it is necessary to replace a safety interlock system. The original interlock is no longer manufactured. The new device is different in fit, form or function.	The replacement interlock component offers improved maintainability and introduces new technology without changing the overall safety function of the system. The interlock is described in the SAR and is a primary means of ensuring radiation safety. Poor implementation of the change has the potential to effect reliability or performance of the system.
Safety System Logic It is found that instrumentation and control logic in the first of two independent safety systems does not meet its full safety function requirements. A modification of the control logic is necessary to correct the deficiency.	The modification must, as described in the SAR, correct an error in the original system design or implementation. A modification of the control logic is planned. There is a potential for the change to fail to meet its required safety function or introduce a loss of function/reliability elsewhere if the change is poorly conceived or executed. Despite being one of two independent safety systems fulfilling essentially the same function, the potential risk of computer logic failure makes this a change with significant implications for safety based on the theoretical reduction in defence in depth level 3.
Increase Production of Radio-Isotopes A licence holder wishes to increase the production rates by more frequent process runs in the existing facility. There is no need to change manufacturing methods.	An assessment of the change finds that the likelihood of an accident remains within the design basis authorised by the licence. However, increased processing may also increase the consequences of a design basis accident due to higher radionuclide inventory of the isotope and higher quantities of radioactive waste. The change therefore has significant implications for safety.
New radiation store A licence holder plans to redesign and extend a radiation store to hold long-term radioactive waste and store radioactive materials. Existing controlled material will be centralised at the modified store.	The existing store is described in the SAR. An assessment of the design and proposed management of the radiation store is necessary to ensure that it complies with relevant codes and standards. A poorly designed and managed radiation store has the potential to expose workers to radiation in excess of the annual dose limit and to release activity to the environment.
Relocation of Radioactive Waste Store For operational reasons it is decided to relocate a radioactive waste store.	During the course of relocation of radioactive materials to a new store, a potential exists for exposure and/or contamination of personnel and the environment. The SAR does not describe the movement of the store or its content. A risk assessment is undertaken which conservatively finds that damage to a container(s) during the movement may result in doses to workers at levels above the annual dose limits.
Changes to Working Hours To improve customer service, it becomes necessary to alter worker shift rosters from an 8 hours working day (commencing at 9am) to a 12 hour working day (commencing at 6am). The average hours worked per week by staff will not be increased.	Assessment of the safety functions undertaken by workers shows that they are required to: operate controlled apparatus; maintain intended operational states; and detect and respond to process and equipment failures. Workers also have responsibility for emergency intervention and accident management. Assessment of shift working indicates that disturbances to sleeping patterns can lead to fatigue. Fatigue is known to increase human error and accident rates by reducing alertness, slowing response time and impairing cogitative function. Failure mode and effects analysis identifies that human errors could cause loss of control, exposure to workers and releases of radioactivity above threshold values. The change is categorised as significant to safety on the basis that, if not properly managed, it may degrade the safety function/performance of staff in roles that are important to safety.
Organisational Restructure A review of operational priorities and resourcing has resulted in a number of recommended efficiencies. The changes include: a change to management structures, as described in the SAR, to decentralise quality assurance activities and better align the associated resources with scientific research; a change to the terms of reference for a number of management committees including the safety review committee and; a change to various financing initiatives.	A review and risk assessment of each individual change is undertaken. This finds each to be a relevant change without significant implications for safety. A review of the cumulative effect of the changes is also undertaken that compares the overall post change safety management practices with those in place at the time the licence was issued. The review finds that cumulatively checks and balances present when the licence was issued have been altered or removed and that safety and resource accountabilities have become blurred. Cumulatively it is assessed that the changes equate to being significant to safety as there is a possibility that staff performance may fail to meet required standards.

Proposed change

Implications for safety

Replacement of Safety Interlock System

Following a fault, it is necessary to replace a safety interlock system. The original interlock is no longer manufactured. The new device is different in fit, form or function.

The replacement interlock component offers improved maintainability and introduces new technology without changing the overall safety function of the system.

The interlock is described in the SAR and is a primary means of ensuring radiation safety. Poor implementation of the change has the potential to effect reliability or performance of the system.

Safety System Logic

It is found that instrumentation and control logic in the first of two independent safety systems does not meet its full safety function requirements. A modification of the control logic is necessary to correct the deficiency.

The modification must, as described in the SAR, correct an error in the original system design or implementation. A modification of the control logic is planned. There is a potential for the change to fail to meet its required safety function or introduce a loss of function/reliability elsewhere if the change is poorly conceived or executed. Despite being one of two independent safety systems fulfilling essentially the same function, the potential risk of computer logic failure makes this a change with significant implications for safety based on the theoretical reduction in defence in depth level 3.

Increase Production of Radio-Isotopes

A licence holder wishes to increase the production rates by more frequent process runs in the existing facility. There is no need to change manufacturing methods.

An assessment of the change finds that the likelihood of an accident remains within the design basis authorised by the licence. However, increased processing may also increase the consequences of a design basis accident due to higher radionuclide inventory of the isotope and higher quantities of radioactive waste. The change therefore has significant implications for safety.

New radiation store

A licence holder plans to redesign and extend a radiation store to hold long-term radioactive waste and store radioactive materials. Existing controlled material will be centralised at the modified store.

The existing store is described in the SAR.

An assessment of the design and proposed management of the radiation store is necessary to ensure that it complies with relevant codes and standards.

A poorly designed and managed radiation store has the potential to expose workers to radiation in excess of the annual dose limit and to release activity to the environment.

Relocation of Radioactive Waste Store

For operational reasons it is decided to relocate a radioactive waste store.

During the course of relocation of radioactive materials to a new store, a potential exists for exposure and/or contamination of personnel and the environment. The SAR does not describe the movement of the store or its content.

A risk assessment is undertaken which conservatively finds that damage to a container(s) during the movement may result in doses to workers at levels above the annual dose limits.

Changes to Working Hours

To improve customer service, it becomes necessary to alter worker shift rosters from an 8 hours working day (commencing at 9am) to a 12 hour working day (commencing at 6am). The average hours worked per week by staff will not be increased.

Assessment of the safety functions undertaken by workers shows that they are required to: operate controlled apparatus; maintain intended operational states; and detect and respond to process and equipment failures. Workers also have responsibility for emergency intervention and accident management.

Assessment of shift working indicates that disturbances to sleeping patterns can lead to fatigue. Fatigue is known to increase human error and accident rates by reducing alertness, slowing response time and impairing cogitative function. Failure mode and effects analysis identifies that human errors could cause loss of control, exposure to workers and releases of radioactivity above threshold values.

The change is categorised as significant to safety on the basis that, if not properly managed, it may degrade the safety function/performance of staff in roles that are important to safety.

Organisational Restructure

A review of operational priorities and resourcing has resulted in a number of recommended efficiencies.

The changes include: a change to management structures, as described in the SAR, to decentralise quality assurance activities and better align the associated resources with scientific research; a change to the terms of reference for a number of management committees including the safety review committee and; a change to various financing initiatives.

A review and risk assessment of each individual change is undertaken. This finds each to be a relevant change without significant implications for safety.

A review of the cumulative effect of the changes is also undertaken that compares the overall post change safety management practices with those in place at the time the licence was issued. The review finds that cumulatively checks and balances present when the licence was issued have been altered or removed and that safety and resource accountabilities have become blurred. Cumulatively it is assessed that the changes equate to being significant to safety as there is a possibility that staff performance may fail to meet required standards.

6. Examples of changes with significant implications for safety - sources

The following examples of changes are provided for guidance only. It is important to relate any changes to the potential result of an unexpected outcome with a specific source.

Proposed change	Implications for safety
New radiation source store A licence holder plans to redesign and extend a radiation store to hold long-term radioactive waste and store radioactive materials. Existing controlled material will be centralised at the modified store.	An assessment of the design and proposed management of the radiation store is necessary to ensure that it complies with relevant codes and standards. A poorly designed and managed radiation store has the potential to expose workers to radiation in excess of the annual dose limit and to release activity to the environment.
Relocation of Radioactive Waste Store For operational reasons it is decided to relocate a radioactive waste store.	During the course of relocation of radioactive materials to a new store, a potential exists for exposure and/or contamination of personnel and the environment. A risk assessment is undertaken which conservatively finds that damage to a container(s) during the movement may result in doses to workers at levels above the annual dose limit.
Class 4 laser used in the field A licence holder plans to incorporate a Class 4 laser into an analyser which is to be used in the field in remote locations. The laser beam is not enclosed. The licence holder is currently licensed to deal with Class 4 lasers, with the original licence application relating to lasers used in the laboratory.	The laser will be used in a situation not assessed in the original application. Unless the change is implemented with appropriate safety measures there is the potential to expose a person to levels above the appropriate exposure limit.
Use of radioactive tracers A licence holder is currently licensed to undertake tracer studies in the environment measuring C-14 uptake in plants. The licence holder then wishes to undertake another environmental study which involved release of Tc-99m tracer into a city harbour to study mixing current flows to establish how sewage outfall is being dispersed.	If inappropriately implemented, there is a potential for release of Tc-99m into the environment at concentrations such that the dose to a member of the public could exceed 1 mSv. The previously approved safety assessment did not address release to city harbour. ARPANSA was also consulted by the licence holder on the regulatory implications of an environmental study that investigated critical pathways, and assessed the impact of uptake by flora and fauna. Advice was sought on the basis that the safety implications were notable (sensitive) even though under the threshold for environmental impact.
Organisational Restructure A review of operational priorities and resourcing has resulted in a number of recommended efficiencies. The changes include: a change to management structures, as described in the plans and arrangements, to decentralise quality assurance activities and better align the associated resources with scientific research; a change to the terms of reference for a number of management committees including the safety review committee and; a change to various financing initiatives.	A review and risk assessment of each individual change is undertaken. This finds each to be a relevant change without significant implications for safety. A review of the cumulative effect of the changes is also undertaken that compares the overall post change safety management practices with those in place at the time the licence was issued. The review finds that cumulatively checks and balances present when the licence was issued have been altered or removed and that safety and resource accountabilities have become blurred. Cumulatively it is assessed that the changes equate to being significant to safety as there is a possibility that staff performance may fail to meet required standards.

Proposed change

Implications for safety

New radiation source store

An assessment of the design and proposed management of the radiation store is necessary to ensure that it complies with relevant codes and standards.

A poorly designed and managed radiation store has the potential to expose workers to radiation in excess of the annual dose limit and to release activity to the environment.

Relocation of Radioactive Waste Store

For operational reasons it is decided to relocate a radioactive waste store.

During the course of relocation of radioactive materials to a new store, a potential exists for exposure and/or contamination of personnel and the environment.

A risk assessment is undertaken which conservatively finds that damage to a container(s) during the movement may result in doses to workers at levels above the annual dose limit.

Class 4 laser used in the field

A licence holder plans to incorporate a Class 4 laser into an analyser which is to be used in the field in remote locations. The laser beam is not enclosed.

The licence holder is currently licensed to deal with Class 4 lasers, with the original licence application relating to lasers used in the laboratory.

The laser will be used in a situation not assessed in the original application.

Unless the change is implemented with appropriate safety measures there is the potential to expose a person to levels above the appropriate exposure limit.

Use of radioactive tracers

A licence holder is currently licensed to undertake tracer studies in the environment measuring C-14 uptake in plants.

The licence holder then wishes to undertake another environmental study which involved release of Tc-99m tracer into a city harbour to study mixing current flows to establish how sewage outfall is being dispersed.

If inappropriately implemented, there is a potential for release of Tc-99m into the environment at concentrations such that the dose to a member of the public could exceed 1 mSv. The previously approved safety assessment did not address release to city harbour.

ARPANSA was also consulted by the licence holder on the regulatory implications of an environmental study that investigated critical pathways, and assessed the impact of uptake by flora and fauna. Advice was sought on the basis that the safety implications were notable (sensitive) even though under the threshold for environmental impact.

Organisational Restructure

A review of operational priorities and resourcing has resulted in a number of recommended efficiencies.

The changes include: a change to management structures, as described in the plans and arrangements, to decentralise quality assurance activities and better align the associated resources with scientific research; a change to the terms of reference for a number of management committees including the safety review committee and; a change to various financing initiatives.

A review and risk assessment of each individual change is undertaken. This finds each to be a relevant change without significant implications for safety.

1 Defence in Depth is a commonly used practice of associating various safety barriers with different operational and accident states. The barriers can be physical or organisational and cover areas such as: design; maintaining intended operational states protection against accidents; and accident management and emergency off site response. Further information on defence in depth can be obtained from IAEA General Safety Requirements Part 3: Radiation Protection and Safety of Radiation Sources: International Basic Safety Standards and IAEA General Safety Requirements Part 4: Safety Assessment for Facilities and Activities.