DOE G 424.1-1C, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements

AVAILABLE ONLINE AT: INITIATED BY: www.directives.doe.gov Office of Nuclear Safety DOE G 424.1-1C 7-27-2022 IMPLEMENTATION GUIDE FOR USE IN ADDRESSING UNREVIEWED SAFETY QUESTION REQUIREMENTS [This Guide describes suggested non-mandatory approaches for meeting requirements. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with the parent Policy, Order, or Notice.] U.S. Department of Energy Office of Environment, Health, Safety and Security NOT MEASUREMENT SENSITIVE http://www.directives.doe.gov/ DOE G 424.1-1C i (and ii) 7-27-2022 FOREWORD This Department of Energy (DOE) Implementation Guide is available for use by all DOE components and contractors. Beneficial comments (recommendations, additions, deletions, and any pertinent data) that will improve this document should be sent to: Office of Environment, Health, Safety and Security, Office of Nuclear Safety EHSS-30/GTN U.S. Department of Energy Washington, D.C. 20585 Phone: (301) 903-7440 Facsimile: (301) 903-6172 nuclearsafety@hq.doe.gov DOE Guides are part of the DOE Directives System and are issued to provide supplemental information regarding the Department’s requirements as contained in rules, Orders, and Notices. Guides also provide acceptable methods for implementing these requirements. This Guide may be used by all contractors for DOE Hazard Category 1, 2, or 3 nuclear facilities, including contractors for the National Nuclear Security Administration (NNSA) Hazard Category 1, 2, or 3 nuclear facilities. Throughout this document, references to a contractor apply to DOE and NNSA contractors. This Guide was developed in support of Title 10 Code of Federal Regulations (CFR) Part 830, Nuclear Safety Management. It provides guidance for the requirements defined in 10 CFR §830.203, “Unreviewed Safety Question Process.” This Guide imposes no requirements. about:blank DOE G 424.1-1C iii (and iv) 7-27-2022 Contents 1 INTRODUCTION .............................................................................................................................. 1 2 TERMINOLOGY ............................................................................................................................... 3 2.1 ACRONYMS AND ABBREVIATIONS ......................................................................... 3 2.2 MUST, SHOULD, AND MAY .......................................................................................... 3 2.3 DEFINITIONS ....................................................................................................................... 3 3 APPLICATION ................................................................................................................................... 5 3.1 TEMPORARY OR PERMANENT CHANGES IN A FACILITY ............................ 5 3.2 TEMPORARY OR PERMANENT CHANGES IN THE PROCEDURES .............. 8 3.3 TESTS OR EXPERIMENTS NOT DESCRIBED IN THE EXISTING DSA ......... 9 3.4 POTENTIAL INADEQUACY OF THE (DOCUMENTED) SAFETY ANALYSIS (PISA) ............................................................................................................... 9 4 IMPLEMENTATION OF THE USQ PROCESS .................................................................. 12 4.1 INTEGRATION WITH CHANGE CONTROL AND WORK CONTROL PROCESSES ........................................................................................................................ 12

4.2 SCREENING ........................................................................................................................ 14 4.3 CATEGORICAL EXCLUSION ...................................................................................... 14 4.4 UNREVIEWED SAFETY QUESTION DETERMINATIONS ................................ 15 4.5 DOCUMENTATION AND RETENTION .................................................................... 18 4.6 TRAINING AND QUALIFICATIONS ......................................................................... 18 ATTACHMENTS A. UNREVIEWED SAFETY QUESTION DETERMINATIONS B. UNREVIEWED SAFETY QUESTION PROCESS LESSONS LEARNED C. GUIDANCE ON PROCESSING POTENTIAL INADEQUACIES OF THE DOCUMENTED SAFETY ANALYSIS D. EXAMPLE OF INCORPORATING CATEGORICAL EXCLUSIONS INTO WORK CONTROL FIGURE FIGURE 1. USQ PROCESS FOR PISAS ........................................................ C-10 AND C-11 DOE G 424.1-1C 1 7-27-2022 1 INTRODUCTION This Guide, including its attachments, provides information to assist in the implementation of Title 10 Code of Federal Regulations (CFR) Section 830.203, “Unreviewed Safety Question Process” of the Nuclear Safety Management Rules for Hazard Category 1, 2, and 3 nuclear facilities owned or operated by or for the Department of Energy (DOE), including the National Nuclear Security Administration (NNSA). Section 830.203 allows contractors to make physical and procedural changes and to conduct tests and experiments without prior DOE approval, provided these changes are already described within the safety basis or they do not otherwise involve an Unreviewed Safety Question (USQ). A USQ is defined in 10 CFR § 830.3 as “a situation where: (1) The probability of the occurrence or the consequences of an accident or the malfunction of equipment important to safety previously evaluated in the documented safety analysis could be increased; (2) The possibility of an accident or malfunction of a different type than any evaluated previously in the documented safety analysis could be created; or (3) The documented safety analysis may not be bounding or may be otherwise inadequate.” The USQ process provides a contractor with the flexibility needed to conduct day-to-day operations by requiring that only those changes, tests, and experiments with a potential to impact the safety basis (and therefore the safety of the nuclear facility) be approved by DOE. This allows DOE to focus its review on those changes significant to safety. The USQ process helps keep the safety basis current by ensuring appropriate review of, and response to, situations that might adversely affect the safety basis. The USQ process is defined in 10 CFR § 830.3 as “the mechanism for keeping a safety basis current by reviewing potential unreviewed safety questions, reporting unreviewed safety questions to DOE, and obtaining approval from DOE prior to taking any action that involves an unreviewed safety question.” A primary purpose of the USQ process is to keep the safety basis current by ensuring changes or a Potential Inadequacy of the (Documented) Safety Analysis (PISA) are appropriately recognized, reviewed, and incorporated into the safety basis. The USQ process provides a method for contractors to determine if a USQ is involved and the actions to take if the situation involves a USQ. A significant element of the USQ process is to determine who has authority to approve changes – DOE or the contractor. Those proposed changes determined to involve USQs are required to be brought to the attention of DOE for review and approval before changes are made.

Section 830.203 requires the contractor to review proposed changes, tests, experiments, or a PISA because the analysis potentially may not be bounding or may be otherwise inadequate, to determine whether they involve a USQ and to obtain DOE approval prior to taking any action determined to involve a USQ. The USQ process reviews proposed changes, tests, and experiments against a facility’s approved Documented Safety Analysis (DSA). Throughout this Guide, DSA is understood to include DOE-approved and implemented amending documents such as Safety Basis Amendments and Safety Evaluation Reports (SERs) containing Conditions of Approval. Changes associated with approved USQ Determinations (USQDs) and associated safety analyses, including supporting safety analyses for any DOE-approved changes to a facility; Evaluations of the Safety of the Situation (ESSs); and Justifications for Continued Operations (JCOs) are treated as part of the safety basis until incorporated into the approved DSA. 2 DOE G 424.1-1C 7-27-2022 Section 830.203 requires contractors to submit for DOE approval a procedure governing its USQ process. Changes to the procedure also require approval unless those changes are limited to editorial or format changes. This Guide provides DOE’s expectations for an acceptable USQ process. Application of the USQ process depends on facility-specific information; results of the process in one facility generally cannot be extrapolated to other facilities. DOE approves procedures to implement the USQ process as required by 10 CFR § 830.203. Where site level and facility level USQ procedures are used, both site and facility level procedures are required to be approved by DOE. A proposed change, test, or experiment involves a USQ if: • The probability of the occurrence or the consequences of an accident or the malfunction of equipment important to safety previously evaluated in the DSA could be increased; or • The possibility of an accident or malfunction of a different type than any evaluated previously in the DSA could be created. In looking at accidents and malfunctions, the USQ criteria apply to the same receptors as covered by the approved DSA safe harbors, namely: (1) the public, (2) co-located workers, (3) facility workers, and (4) the environment. The discovery or identification of a PISA could also result in a USQ if the criteria are met above. In accordance with 10 CFR § 830.203(f), when a contractor responsible for a Hazard Category 1, 2, or 3 DOE nuclear facility discovers or is made aware of a PISA, the contractor is required to take specified actions. DOE G 424.1-1C 3 7-27-2022 2 TERMINOLOGY 2.1 Acronyms and Abbreviations CFR Code of Federal Regulations DOE Department of Energy DSA Documented Safety Analysis EITS Equipment Important to Safety ESS Evaluation of the Safety of the Situation G Guide HDBK Handbook JCO Justification for Continued Operations NNSA National Nuclear Security Administration O Order PISA Potential Inadequacy of the (Documented) Safety Analysis SAC Specific Administrative Control SER Safety Evaluation Report SMP Safety Management Program SC Safety Class SS Safety Significant SSCs Structures, Systems, and Components STD Standard TSR Technical Safety Requirement USQ Unreviewed Safety Question USQD Unreviewed Safety Question Determination 2.2 Must, Should, and May

The word “must” denotes a requirement; but none are included in this Guide. The word “should” denotes a recommendation. The word “may” denotes permission, neither a requirement nor a recommendation. This Guide does not create any requirements, but restates some requirements from 10 CFR Part 830. 2.3 Definitions The origins of the definitions are indicated by references shown in square brackets [ ]. Other definitions related to safety basis can be found in DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, or in DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook. Accidents. For the purposes of answering USQD questions, an event or sequence of events that have the potential to result in undesirable consequences. Change. For the purposes of answering USQD questions, a modification or addition to, or removal from, the facility or procedures that affects a design function, a method of performing or controlling the function, or an existing evaluation that is relied upon to demonstrate that intended functions will be accomplished. 4 DOE G 424.1-1C 7-27-2022 Documented Safety Analysis. A documented analysis of the extent to which a nuclear facility can be operated safely with respect to workers, the public, and the environment, including a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety. [10 CFR § 830.3]. For the purposes of answering USQ Screening Questions and USQD Questions, the DSA is understood to include DOE-approved and implemented amending documents, such as, Safety Basis Amendments and SERs containing Conditions of Approval. Changes associated with USQ determinations and associated safety analyses, including supporting safety analyses for any DOE-approved changes to a facility, ESSs, and JCOs, are treated as part of the safety basis until incorporated into the approved DSA. Equipment Important to Safety. For the purposes of answering USQD questions, equipment important to safety is any equipment whose function, malfunction, or failure can affect safety functions of safety Structures, Systems, and Components (SSCs) or Specific Administrative Controls (SACs) described in the DSA. Negative USQD. A USQD that concludes a USQ is not involved. Positive USQD. A USQD that concludes a USQ is involved. Safety Management Program. A program designed to ensure a facility is operated in a manner that adequately protects workers, the public, and the environment by covering a topic such as: quality assurance; maintenance of safety systems; personnel training; conduct of operations; inadvertent criticality protection; emergency preparedness; fire protection; waste management; or radiological protection of workers, the public, and the environment. [10 CFR § 830.3] Unreviewed Safety Question (USQ). A situation where (1) The probability of the occurrence or the consequences of an accident or the malfunction of equipment important to safety previously evaluated in the documented safety analysis could be increased; (2) The possibility of an accident or malfunction of a different type than any evaluated previously in the documented safety analysis could be created; or (3) The documented safety analysis may not be bounding or may be otherwise inadequate. [10 CFR § 830.3] Unreviewed Safety Question Process. The mechanism for keeping a safety basis current by reviewing potential unreviewed safety questions, reporting unreviewed safety questions to DOE, and obtaining approval from DOE prior to taking any action that involves an unreviewed safety question. [10 CFR § 830.3]

DOE G 424.1-1C 5 7-27-2022 3 APPLICATION Title 10 CFR § 830.203 applies to Hazard Category 1, 2, and 3 DOE nuclear facilities. In accordance with 10 CFR § 830.203(c), the USQ procedure is required to be implemented for situations where there is a: (1) Temporary or permanent change to the facility as described in the existing DSA; (2) Temporary or permanent change in the procedures as described in the existing DSA; (3) Test or experiment not described in the existing DSA; or (4) Potential inadequacy of the DSA because the analysis potentially may not be bounding or may be otherwise inadequate. Whenever one of these situations exists, the USQ process is applied to review the change, test, experiment, or potential inadequacy. Some changes can be screened out from a detailed USQD. The methodology for entry into the USQ process is defined in the DOE-approved USQ procedure. The USQ procedure may discuss certain situations in which the USQ process is not required, such as when a decision to request DOE approval of safety basis changes has already been made [such as technical safety requirements (TSRs) changes or safety basis amendments]. The USQ process is conducted in coordination with change control and work control processes. The USQ process does not govern change and work control processes, but rather the change control and work control processes typically identify situations where the USQ process is applied.1 The work control processes with the potential for changes that require USQ determinations should identify when and how the USQ process is involved. Sections 3.1 through 3.4 below provide an overview of the USQ procedure’s four entry conditions identified in 10 CFR § 830.203(c). 3.1 Temporary or Permanent Changes in a Facility Title 10 CFR § 830.203(c)(1) requires the contractor to implement the USQ procedure in situations where there is a temporary or permanent change in the facility as described in the existing DSA. Structures, systems, and components (SSCs) are considered changed if any of the following are altered: Design, Function(s), or Method of performing those function(s)2. 1 The USQ process cannot serve as a substitute for proper safety management program implementation, quality assurance, and configuration management. Change control and work control processes address many issues that do not require entry into the USQ process. Certain activities initiated as part of change control and work control do not result in a change to the facility. Likewise, not all procedure changes are relevant to the safety basis or maintaining its validity. 2 Considerations should include any SSC feature that could potentially affect SSC reliability. A change in condition, including operating environment, could potentially affect SSC function. 6 DOE G 424.1-1C 7-27-2022 The applicability of 10 CFR § 830.203 is broad. Although DSAs include descriptions of many SSCs, a nuclear facility also contains many SSCs not explicitly described. These can be components, subcomponents of larger components, or even entire systems. Changes to SSCs that are not explicitly discussed in the safety basis should not be excluded from the USQ process since changes to these SSCs can have the potential to alter the function of an SSC that is explicitly described in the DSA.

A change to an SSC that does not involve equipment important to safety could also initiate a new malfunction of equipment important to safety or affect the course of an accident. For example, rerouting a potable water line above a safety motor control center could create a new failure mechanism. The same is true of installing a non-seismically supported piece of equipment above a safety SSC. Therefore, such changes cannot be excluded from the USQ process. Temporary Changes and Interim Conditions. Interim conditions that temporarily change how the facility is configured should also be considered in the USQ process. Examples of such interim conditions could include rerouting ventilation to use temporary ducting; temporary changes such as jumpers and lifted leads; temporary blocks and bypasses; and equipment used on a temporary basis in lieu of installed equipment. Interim conditions can also involve the temporary presence of a unique, high energy release initiator not covered by the safety basis. For example, a crane that is temporarily installed adjacent to the facility or a critical lift of an extremely heavy object installed over a glovebox where the potential accidental impact in question might exceed impacts analyzed in the safety basis or could represent a new accident initiator.3 For safety class/safety significant (SC/SS) SSCs, TSRs typically specify allowable outage times, permissible mode conditions, and permitted reduction in redundancy for systems or components removed from service. Such outages do not constitute an interim condition. Departure from these specifications is a departure from the TSRs. The facility contractor is not permitted to authorize departures from the TSRs. Any TSR change or temporary departure requires DOE approval by definition and does not enter the USQ process. In some cases, specific outage times for equipment not credited as SC/SS will not be specified in the TSRs. Authorizing such outages for maintenance and repair is generally within the purview of the facility contractor. The possibility of an interim condition that is outside the facility’s safety basis would be considered. Change vs. Maintenance. The applicability of the USQ process related to physical changes is primarily focused on the distinction between an actual change in the facility and maintenance. For the purposes of the USQ process, maintenance consists of those activities that preserve or restore SSCs to their as- 3 Modifications that are performed in separate, distinct stages (usually for cost, schedule, or operational considerations) could temporarily leave affected SSCs in conditions not addressed in the DSA. In such instances, a USQD cannot evaluate only the final end state. It would also consider the interim state left in each stage. Alternatively, one or more USQDs could be prepared for each stage, as needed. DOE G 424.1-1C 7 7-27-2022 designed condition and do not change their as-designed physical configuration. Maintenance activities typically include troubleshooting, calibration, refurbishment, maintenance-related testing, identical replacements, lockouts, housekeeping, and similar activities that do not permanently alter the design, performance requirements, operation, or control of SSCs. Maintenance activities also typically include temporary alterations to the facility or procedures that directly relate to and are necessary to support maintenance. Examples of temporary alterations that support and are directly related to maintenance include jumpering terminals, lifting leads, or removing internal barriers, bypasses, and supports.

Standard maintenance issues are typically addressed in the safety basis and do not raise USQ issues. The performance of maintenance activities typically can be screened out (as discussed in Section 4.2) from having a USQD performed. This conclusion presumes maintenance procedures have been reviewed in the USQ process to verify that no significant interim conditions exist. Maintenance activities are typically conducted in the work-control process documents, termed as work packages or similar, so procedures in this context is a broad term. If an actual change to the SSC being serviced is deemed necessary during the performance of maintenance, that change constitutes a new activity separate from the original maintenance. The change identified would be required to enter the USQ process. For example, suppose a maintenance activity determined that it was necessary to plug heat exchanger tubes, but the safety basis provided no pre-existing allowance for a reduction in the nominal heat exchanger capacity; that change would require a USQ review. The plugging action would constitute a change. Replacement with non-equivalent components is another example of a change potentially evolving from a maintenance activity. Temporary Facility Changes to Facilitate Maintenance. DOE relies on the contractor’s normal work control procedures, not the USQ process, to address worker hazards involved in the actual installation of a modification. These procedures implement safety management program (SMP) requirements including radiation protection (e.g., 10 CFR Part 835); hazardous material protection; work planning and control; basic industrial safety (e.g., 10 CFR Part 851); general rigging and scaffolding; and lockout/tagout. The USQ process would be entered when a given activity involves a substantially new hazard potential that is not addressed in the DSA (e.g., high energy initiator like a falling crane). This activity would constitute a change to the facility as described in the DSA. On the other hand, dropping a fluorescent light fixture on a glovebox or waste container would typically be within the evaluation of general impact hazards already presented. Procurement. Procurement issues are generally not considered to represent a physical change to the facility. Procurement nonconformance reports do not necessarily represent a change to the facility. It is the physical change to SSCs in a nuclear facility that is subject to the USQ process with respect to the facility’s DSA, not whether the procurement process accurately specifies and obtains the SSC that is consistent with DSA requirements. If the SSC is judged as suspect due to a failure of the procurement process, this is addressed by the Quality Assurance process. This could 8 DOE G 424.1-1C 7-27-2022 potentially lead to a PISA if the situation is discovered after the SSC is installed and declared operational (see discussion of PISAs in Section 3.4). 3.2 Temporary or Permanent Changes in the Procedures Title 10 CFR § 830.203(c)(2) requires the contractor to implement the USQ procedure in situations where there is a temporary or permanent change in the procedures as described in the DSA for a DOE Hazard Category 1, 2, or 3 nuclear facility. Changes to facility procedures include revisions to existing procedures, developing new procedures, and cancelling existing procedures.

Only changes to those facility procedures as described in the DSA are subject to the USQ requirements of 10 CFR Part 830, Subpart B. Procedures define or describe activities or controls over the conduct of facility work. Facility work includes activities and process steps that are generally described in the DSA, although specific procedures might not be explicitly described. For example, the DSA might describe that spent nuclear fuel is only to be moved around in a spent fuel pool by use of a spent fuel handler. In such a case, using a different process or procedure to move spent fuel other than using the spent fuel handler would be a change to a procedure as described in the DSA and would require a USQ review.4 Procedures as described in the DSA include, but are not limited to, those procedures that direct: (1) radioactive and hazardous material handling, processing, and storage activities described in the safety basis; (2) operation and control of SSCs (including testing, surveillance and maintenance); (3) implementation of Specific Administrative Controls (SACs) described in the DSA (including assumed operator action and response times); (4) implementation of the safety management programs described in the DSA for a facility; and (5) implementation of key elements of safety management programs. Key elements of safety management programs are those that: (1) are specifically assumed to function for mitigated scenarios in the hazard evaluation, but not designated a SAC; or (2) recognized by facility management as an important capability warranting special emphasis (see DOE-STD-3009-2014 for further discussion). Changes to any safety management program procedures that define or affect such key elements would be required to be reviewed by the USQ process. For example, changes to chemical SMP procedures related to screening chemical hazards from DSA hazard evaluations would be reviewed if this chemical screening is identified as a key element. Examples of safety management programs that could be important to assure safety functions of safety SSCs and SACs can be performed include maintenance and in-service surveillance programs. DOE Order 433.1B, Maintenance Management Program for DOE Nuclear Facilities, contains a requirement (see Section 4.c.) to review changes to Nuclear Maintenance Management Programs under the USQ process to ensure that SSCs are maintained and operated within the approved safety basis. The USQ process is not used to review incorrect performance of a procedure at variance with the written instructions provided. The review is focused on whether the new, revised, or cancelled procedure could introduce new hazards or failure mechanisms or affect the frequency or 4 USQ review includes USQDs, and USQ screenings and categorical exclusions, if applicable. DOE G 424.1-1C 9 7-27-2022 consequence of analyzed hazard scenarios or failure mechanisms. For example, the review of a procedure for a chemical process line does not consider the potential for human error adding chemicals other than those specified. The review does consider if one of the chemicals specified has a new reaction potential. Procedures under consideration in this section do not include calculations, drawings, and similar documents relied upon in the safety basis. Administrative Documents.

For purposes of the USQ process, administrative documents are non-technical documents that define organizational policies and structures in a nuclear facility. Examples include payroll, finance, timecards, human resources, and travel instructions. These documents typically do not define activities or controls over the conduct of work in nuclear facilities and therefore are not subject to the USQ process. Some administrative documents, such as those dealing with staffing levels of operations personnel, could require USQ process evaluation. Ancillary Procedures. For purposes of the USQ process, ancillary procedures are written instructions that, while associated with work, do not significantly define the work in question and do not involve or affect safety SSCs or SACs in a nuclear facility. Such procedures are incidental tools for operator utility. Examples include forms, checklists, datasheets, logbooks and other instructions limited to quality assurance verifications, data recording, oversight, and training. These types of instructions typically are not within the scope of the USQ process unless they can affect the performance of safety SSCs or SACs. 3.3 Tests or Experiments Not Described in the Existing DSA Title 10 CFR § 830.203(c)(3) requires the contractor to implement the USQ procedure in situations where there is a test or experiment not described in the DSA. Tests and experiments should be broadly interpreted to include new activities or operations not described in the safety basis. During normal operations or anticipated transients, such activities could degrade the ability of SSCs or SACs to prevent accidents or mitigate accident conditions. The USQ process is not applicable every time routine preoperational, surveillance, functional, and startup tests are performed (see Section 3.1), provided that the test procedures are not changed from previously reviewed versions. However, one-of-a-kind tests that measure the effectiveness of a new technique or a new system configuration that might affect safety SSCs or SACs would be required to be evaluated through the USQ process before the tests may be conducted. Post-modification testing should be included in the USQ review for the modification; otherwise, the associated testing procedures would be required to be reviewed within the USQ process. 3.4 Potential Inadequacy of the (Documented) Safety Analysis (PISA) The USQ process is required to be applied to a PISA. The response to a PISA is outlined in 10 CFR § 830.203(f). The USQ process is required to be implemented when a contractor responsible for a Category 1, 2, or 3 nuclear facility discovers or is made aware of a condition 10 DOE G 424.1-1C 7-27-2022 where the currently approved DSA may not be bounding or may be otherwise inadequate. In general, PISAs can arise from the following entry conditions: • A discrepant as-found condition; • An operational event or incident; or • New information, including discovery of an error, sometimes from an external source. The main consideration is that the analysis does not match the current physical configuration, or the analysis is inappropriate or contains errors. The analysis might not match the facility configuration because of a discrepant as-found condition (e.g., the DSA states that there are 3 pumps, but the facility actually has 2 pumps). Analytical errors might involve incorrect input values, invalid assumptions, improper models, or calculation errors. Investigation of a PISA starts when facility management has information suggesting the facility DSA might not be bounding or might otherwise be inadequate.

If an SSC failure or non-conformance has already been explicitly assumed and analyzed in the safety basis, then such a failure or nonconformance does not constitute a PISA situation. Resolution that restores the nonconforming SSC to the approved configuration or replaces it with approved equivalent parts would not be considered a change (see Section 3.1 for additional discussion regarding changes in a facility). However, upon discovery of a failure or nonconformance (including unacceptable aging degradation) that renders an SSC incapable of performing its safety function, a PISA should be declared and evaluated based on the ‘discrepant as-found condition’ entry criterion, if the cause of the SSC failure or non-conformance is outside the assumptions in the DSA. Because an inadequate safety analysis has the potential to call into question information on which the authorization of operations is based, 10 CFR § 830.203(f) requires the contractor to: • Take action, as appropriate, to place or maintain the facility in a safe condition until an evaluation of the safety of the situation is completed; • Notify DOE of the situation;5 • Perform a USQD6 and notify DOE promptly of the results; and • Submit the evaluation of the safety of the situation to DOE prior to removing any operational restrictions that were initiated. 5 An Occurrence Reporting and Processing System report is an acceptable notification of DOE, if identified as such in the approved USQ procedure. It is also a good practice to immediately notify the DOE Facility Representative and/or other DOE management responsible for the facility’s safety basis. 6 In the case of a PISA, 10 CFR § 830.203(f) requires performance of a USQD. When a PISA arises, such as from an as-found condition, the six USQD questions can be used in a backward-looking manner as if the current configuration were a proposed modification. (See Section 4.4 and Attachment C of this Guide). If the USQD is found to be negative, the contractor could have approved the discrepant condition without DOE involvement. This would resolve the discrepancy and provide adequate justification for the current configuration. DOE G 424.1-1C 11 7-27-2022 Attachment C provides additional guidance on processing a PISA, including guidance on the timing of processing multiple PISAs found during audits, and the development of an ESS and JCO. The USQ process should include a defined mechanism for dispositioning safety basis issues requiring DOE involvement. PISA refers to identification of a “potential” inadequacy; an actual inadequacy is not required in order to declare a PISA and enter the process. Evaluation of whether a PISA exists should not be construed as a judgment of inappropriate contractor performance. On the other hand, failure to properly evaluate PISAs could reflect on contractor performance. New Requirements and New Methods. A PISA does not need to be considered when new requirements or different analysis methods are being implemented that result in changes to accident consequences or probabilities. However, if it becomes apparent during the implementation of new requirements or new methods that the existing safety basis may not be bounding or may be otherwise inadequate, the USQ process applies and an evaluation would be required to be made to determine whether an inadequacy of the safety basis exists.

A PISA does not need to be considered for DSA upgrades in response to new requirements or to the use of new or different analytical tools during the upgrade process. New requirements typically follow implementation plans and are incorporated into DSA updates accordingly. For example, if new aircraft accident guidance was being implemented and resulted in the addition or removal of DSA controls, the possibility of a PISA does not need to be evaluated. Similarly, if the 10-year Natural Phenomena Hazards review identifies the need to use new, updated data sets or assessment methods, this would not be a PISA. Following this review, after a new or revised hazard analysis is completed, the results would be compared against existing facility design and a determination of whether a PISA exists might be necessary. If a design or safety basis reconstitution effort is being undertaken, it should include a clearly defined process for promptly sorting questions and issues between those that can be addressed as a normal part of the reconstitution project and those that will be handled more promptly as PISAs. This process should be sufficiently timely to ensure that the expectations for PISAs are met. 12 DOE G 424.1-1C 7-27-2022 4 IMPLEMENTATION OF THE USQ PROCESS DOE relies on contractor implementation of the USQ process to preserve the integrity of the safety basis while allowing flexibility in operations. The contractor responsible for DOE Hazard Category 1, 2 or 3 nuclear facilities is required to submit the procedure that defines its USQ process to DOE for approval. Contractors develop USQ procedures that describe the USQ process. The contractor’s USQ procedures should: • Define the purpose of the USQ process; • Set forth applicability of the USQ process; • Provide definitions of relevant terms, USQ screening criteria, and the bases for their application; • Include detailed directions on what is to be considered and evaluated when performing a USQ review (including USQDs, and USQ screenings and categorical exclusions, if applicable); • Define the qualifications and responsibilities of personnel performing and reviewing USQ reviews; • Define how new information is investigated and PISAs are declared, relevant time periods, and how DOE is notified of PISAs; and • Identify documentation and retention requirements for each USQ review. Contractors are allowed to make changes to DOE-approved USQ procedures without obtaining DOE approval if these changes are only editorial or formatting in nature. An example of an editorial change is a change in organizational title for identified responsible offices. However, if such changes are made to reflect actual significant changes in organizational functions and reporting relationships, the change should be treated as substantive rather than editorial and submitted to DOE for approval. In cases of editorial changes to DOE-approved USQ procedures, the contractor should provide a copy of the revised USQ procedure to DOE for information. Once the USQ procedure is established and approved, the contractor is required to implement the DOE-approved USQ procedure in situations as identified in 10 CFR § 830.203(c). 4.1 Integration with Change Control and Work Control Processes The USQ process should be integrated into technical aspects of the contractor’s organization responsible for design, engineering, maintenance, inspection, operations, and assessment of the nuclear facility or activity. Individuals involved in these aspects of the facility should have a general familiarity with the requirements of Section 830.203 and the activities that might be required to enter the USQ process.

DOE G 424.1-1C 13 7-27-2022 The USQ process should be integrated into the facility’s change control and work control processes.7 The contractor should identify the potential methods for making facility changes, for example, planned modifications, correction of non-conformances, or maintenance activities. The contractor maintains control of these methods, and performs and documents facility changes in accordance with approved procedures. For example, performing a facility modification as part of a maintenance activity would not be acceptable unless proper control processes to analyze the proposed change and document its outcome were implemented in approved procedures. All reasonable means for performing a change should be identified because each one constitutes a potential entry point into the USQ process and should be integrated accordingly. The USQ process is intended to be implemented along with a change control process8 that includes generalized steps for: • Identifying and describing the temporary or permanent change; • Technical reviews of the change; • Management review and approval of the change; • Implementation of the change; and • Documenting the change. Change control processes for both temporary and permanent changes to SSCs and procedures should be described by a governing policy, procedure, flowchart, or other description to define clear relationships between the USQ process and change control procedures. Areas of consideration include design change, configuration control, temporary change, and procedures governing the preparation, review, and approval of procedures. Contractor USQ procedures should provide that USQDs and USQ screens are prepared by one individual and are given independent technical review by another person who has not been involved in the proposed activity preparation. That person does not need to be organizationally independent. In order to perform work safely and efficiently, and focus attention appropriately on changes requiring USQDs, the USQ process may have multiple levels of review: • USQ Screening (Section 4.2) of proposed changes that were not categorically excluded to determine if a USQD is required; • Categorical Exclusions (Section 4.3) that have been approved by DOE; and 7 The contractor’s work processes (e.g., change control) typically determine whether or not a proposed change is safe and technically accurate prior to entry into the USQ process. 8 As part of the technical reviews of a change and separate from the USQ process, the contractor will typically perform the appropriate type of safety review to ascertain whether the change is indeed safe and technically adequate. Change documentation is typically collected and checked, procedures are walked down, and other technical reviews conducted as part of this safety review prior to submittal of the change to the USQ process. 14 DOE G 424.1-1C 7-27-2022 • USQD (Section 4.4) applies to PISAs, new tests or experiments, and proposed changes to DOE nuclear facilities or facility procedures that were not Categorically Excluded, screened out, or determined not to be a USQ in the other levels of the USQ process. 4.2 Screening USQ screening is intended to identify new tests or experiments or those proposed changes to DOE nuclear facilities or facility procedures that do not materially affect the approved DSA. In such cases, expending the time and effort associated with a USQD is not warranted. However, screening is optional, and the process may proceed directly to a USQD, if desired.

A proposed change to a facility or a procedure is screened using the following questions to determine if a USQD is required. Is the change: • A temporary or permanent change in the facility as described in the existing DSA? • A temporary or permanent change in the procedures as described in the existing DSA? • A test or experiment not described in the existing DSA? Affirmative response to one or more of the screening questions requires the preparation of a USQD in accordance with Section 4.4. If all three screening questions can be answered “No,” a USQD is not required. The rationale for screening should be documented. Screening typically requires only a comparative reading of the change against the DSA description (including text, figures, and tables) and does not take on the character of asking and/or answering the six USQD questions (see Section 4.4 and Attachment C to this Guide, below). Types of changes that may be screened could include: • Changes fully covered by a previous USQ document; • Changes to documents that are purely editorial and make no technical change; and • Changes when common commercial practices would suffice (for example, changing out fluorescent lighting fixtures in a control room with like-for-like replacements). USQ screens should be performed and reviewed by personnel with USQ qualifications and training and who have appropriate facility experience and who are familiar with the DSA for the facility to perform these functions. 4.3 Categorical Exclusion Categorical Exclusions are optional, and the process may proceed directly to a USQD if desired. Categorical Exclusions are a mechanism to define categories of changes (plans, programs, activities, systems, or equipment) determined to present no reasonably foreseeable capability for creating a USQ. Categorical Exclusions are to be addressed in the contractor’s USQ procedure DOE G 424.1-1C 15 7-27-2022 and as such require DOE approval.9 The USQ Procedure may specify the approved Categorical Exclusions or the process by which the contractor proposes Categorical Exclusions, gains DOE approval, and makes approved Categorical Exclusions available for use. The USQ process should identify and document the specific Categorical Exclusion that is applicable to each proposed change being Categorically Excluded under this provision. The documentation that an item is excluded from USQ process review may be developed as part of the normal work control process. Categorical exclusions should be performed and reviewed by USQ reviewers with qualifications and training to perform these functions. No additional processing through the USQ process is required when one or more approved Categorical Exclusions have been identified and documented for the proposed change. Candidate items for Categorical Exclusion include: • Changes physically confined to office and administrative areas; • Changes to a particular group of procedures (e.g., administrative) whose content cannot affect safety basis assumptions/conclusions or equipment important to safety (i.e., physical configuration or safety function); and • Changes to portions of multi-facility or institutional procedures that only affect non- nuclear facilities. See Attachment D for an example for incorporating Categorical Exclusions into the work control process. 4.4 Unreviewed Safety Question Determinations

A significant result of a USQD is to determine what organization may approve the change – the contractor or DOE. Specific guidance on how to conduct a USQD is provided in Attachment A. As stated in 10 CFR § 830.3, a USQ is identified when a situation meets any one of three criteria provided in the definition. Two of these three criteria can be addressed by answering the six questions below. The third criterion is the PISA criterion, which also invokes the six questions as described further in Attachment C. • Could the proposed change increase the probability of occurrence of an accident previously evaluated in the facility’s DSA? • Could the proposed change increase the consequences of an accident previously evaluated in the facility’s DSA? • Could the proposed change increase the probability of a malfunction of equipment important to safety previously evaluated in the facility’s DSA? 9 Written justification should provide formal documentation of the rationale for each Categorical Exclusion. A good practice in justifying Categorical Exclusions is to answer each of the USQD questions for the categorical exclusion, describing the rationale for each question; submittal of a formal USQD is not required. 16 DOE G 424.1-1C 7-27-2022 • Could the proposed change increase the consequences of a malfunction of equipment important to safety evaluated in the facility’s DSA? • Could the proposed change create the possibility of an accident of a different type than any evaluated previously in the facility’s DSA? • Could the proposed change create the possibility of a malfunction of equipment important to safety of a different type than any evaluated previously in the facility’s DSA? If the answer to any of these questions is “Yes,” the change is considered a USQ. Consistent with 10 CFR § 830.203, the six questions refer to those potential situations considered in the DSA. These questions refer not only to the explicit description of the analyses in the DSA, but also any analyses performed to support the safety basis documents. When a potential event is discovered that is not evaluated in the DSA, it should be considered as a possible new event (see 5th bullet, above) or as an indicator of a PISA issue. USQ determinations should be performed and reviewed by USQ reviewers with qualifications and training to perform these functions. In documenting a USQD, the USQD does not need to restate the text contained in the DSA; specific references are acceptable. It is also acceptable for subsequent reviewers to ask for clarifications of USQD contents or DSA details. The USQD should be targeted towards an audience that is a degreed engineer or scientist with appropriate facility knowledge and experience. The USQD should provide defensible technical explanations based on sound engineering judgement for each of the answered questions (i.e., for all six questions for a negative USQD and for at least one question for a positive USQD). 4.4.1 Discernible Increase in Frequency or Consequence The first four USQD questions address increases in frequency or consequence. Changes are reviewed by evaluating the direction of any potential frequency or consequence shift. If the expected direction is neutral (i.e., no shift) or decreasing, the relevant first four USQD questions are answered “No.” If there is a discernible increase, the relevant USQD question(s) is/are answered “Yes.” This section provides guidance on what constitutes a “discernible increase” for the purposes of the USQD.

USQDs should not expect hazard and accident analysis to be performed at a greater level of detail than that required to be specified in the safety basis. The intent is not to use a “prove the negative” approach in which routine details of operation and modification are hypothesized to generate small increases. What constitutes a clearly discernible increase is a function of the degree of resolution required in DOE guidance for hazard and accident analysis.10 10 The USQ Process derives from the 10 CFR § 50.59 evaluation process defined by the U.S. Nuclear Regulatory Commission. The 10 CFR § 50.59 process distinguishes the concept “change” in terms of relative significance, with licensees being allowed to make changes that involve only minimal increases in consequence or frequency. The intent of this distinction is to more effectively focus licensee and regulator resources on clearly discernible increases associated with potentially meaningful technical issues. This concept is analogous to DOE’s focus on a clearly discernible increase. DOE G 424.1-1C 17 7-27-2022 Distinguishing changes in this regard is acceptable while still providing assurance that changes potentially affecting the safety basis are properly identified. For most safety basis documents, consequence and frequency estimates are presented qualitatively in the hazard analysis. In DSAs for facilities that have hazard scenarios with the potential to exceed the evaluation guideline, the accident analysis to satisfy the applicable DSA development methodology typically presents quantitative consequence estimates for a subset of the most significant events. The accident analysis may also present quantitative frequency estimates. Hazard and accident analyses bin consequence and frequency into relatively broad categories (e.g., Low, Moderate and High for consequence, Anticipated, Unlikely, Extremely Unlikely, and Beyond Extremely Unlikely for frequency).11 For example, a change from one bin to the next represents a clearly discernible increase. On occasion, a discernible increase can be qualitatively obvious even if a bin change does not occur. For example, suppose that a safety interlock identified as safety significant will be exposed to a harsher environment than described in the DSA and exceed its equipment qualification. In such a case, engineering judgement would suggest a discernible increase in frequency of failure. A conclusion that the frequency remains essentially the same as before (i.e., same frequency bin with no discernible increase in frequency) is adequate to support a negative USQD. For example, if the safety significant interlock is being replaced with a newer model, there is no expectation that a detailed probabilistic evaluation will be performed to support the USQD. For quantitative accident analysis, a discernible increase in probability or consequences is based on a comparison to the values cited in the DSA. The DSA-reported values represent the risk that DOE has approved. 4.4.2 New Hazard Controls with Nuclear Safety Functions When implementation of a proposed change would require new hazard controls, administrative or engineered, that would be credited in the DSA with a safety-significant or safety-class function, the USQD would be positive because the change will result in either an increase in probability or in consequence absent additional protective measures, or create an accident/malfunction of a different type. The contractor is required to involve DOE in evaluating such controls. Reasons for DOE review include: (1) to verify that the degree of protection is adequate; (2) to ensure that the safety basis and TSRs are properly revised to include the additional protective measures; and (3) to verify that the safety classification (i.e., SC/SS) of the new hazard controls involved is appropriate.

4.4.3 Seeking DOE Approval Prior to Changes Involving Positive USQDs Title 10 CFR § 830.203(d) requires contractors responsible for a Hazard Category 1, 2, or 3 DOE nuclear facility to obtain DOE approval prior to taking any action determined to involve a USQ. 11 For further discussion, see Section 3.1.3.1 in DOE-STD-3009-2014. 18 DOE G 424.1-1C 7-27-2022 Positive USQDs should be approved by facility management prior to seeking DOE approval on proposed actions associated with a positive USQD. Any necessary DSA changes associated with a positive USQD should be submitted to the DOE Safety Basis Approval Authority along with the purpose and technical basis for the proposed change. 4.5 Documentation and Retention The contractor is required by 10 CFR § 830.121(a) to retain records of USQ actions taken pursuant to Section 830.203 to substantiate compliance. USQ records should be retained for the full operational lifetime of the facility, including deactivation, long term surveillance and maintenance, and decommissioning, until the facility is categorized as a “below Hazard Category 3” nuclear facility. USQ documents to be retained consist of Categorical Exclusions, USQ Screens, and USQDs. When the contractor operating a facility changes, the outgoing contractor should turn over all USQ records to the incoming contractor. Contract provisions typically contain requirements so that USQ records are turned over from outgoing to incoming contractors. The DOE Records Schedules (including organizational-specific requirements) define the minimum documentation retention requirements. The contractor is required to maintain the facility DSA and update it to ensure it is kept current. The contractor is required to annually provide to DOE a current DSA or a letter indicating that no changes have been made to the DSA since the prior submittal. Changes at the facility should be reflected in these submittals at an appropriate level of detail, including those that were authorized through the USQ process. A good practice is to maintain DSAs continuously up-to- date through a change process; such a practice assures DSAs are continuously up-to-date and supports the USQ process reviews. Some contractors have opted for the strategy of updating the DSA continuously through page changes. Although changes implemented through positive USQDs and associated DOE approvals become part of the safety basis as soon as they are implemented, changes to the DSA also result from revisions that the contractor implements through negative USQDs. The continuous page change process can be helpful in ensuring that the DSA always reflects the current facility configuration. Contractors responsible for Hazard Category 1, 2, and 3 nuclear facilities are required by 10 CFR § 830.203(e) to annually provide to DOE a summary of USQDs performed since the prior submittal. Items that were categorically excluded or screened out (i.e., a USQD was not necessary) do not need to be included in the annual summary. This annual summary should be submitted on a schedule commensurate with annual submittal of the DSA. 4.6 Training and Qualifications Implementing procedures should establish the training and qualification requirements for personnel performing various roles in the USQ process. These requirements should cover educational background, years and/or types of work experience and knowledge of the facility, understanding of DOE facility safety basis requirements (including the USQ process), and familiarity with the facility-specific safety basis. Training and qualifications should be specific to preparers, reviewers and approvers of USQ screenings, Categorical Exclusions, and USQDs.

DOE G 424.1-1C 19 (and 20) 7-27-2022 The contractor should maintain a list of personnel who are currently qualified to perform and review USQ reviews (including USQ determinations, and USQ screenings and categorical exclusions, if applicable). Personnel responsible for preparing, reviewing, or approving USQ documents should receive training on the application of Section 830.203, including any facility-specific procedures. The training should be commensurate with the responsibilities of assigned roles in the USQ process. The recommended interval for retraining is every 2 years or when the USQ procedure is amended, whichever is shorter. USQ reviews (i.e., Screenings, Categorical Exclusions, and USQDs) should be performed by personnel qualified in accordance with the DOE-approved USQ procedure. Documents that result from USQ reviews should be independently reviewed and approved by USQ-qualified individuals. Screening and Categorical Exclusions are important activities because a mistake could allow bypass of full USQDs for potential changes to the facility safety basis; training and qualification for performance of these functions is essential. DOE G 424.1-1C Attachment A 7-27-2022 Page A-1 ATTACHMENT A UNREVIEWED SAFETY QUESTION DETERMINATIONS A.1 Unreviewed Safety Question Determination (USQD)1 The USQD is not a substitute for a safety evaluation. The USQ review serves as an important tool for keeping the safety basis current by ensuring changes are appropriately reviewed and incorporated into the safety basis. A safety evaluation could show that a proposed change is safe, yet the unreviewed safety question (USQ) determination could find that the change creates a USQ and therefore requires Department of Energy (DOE) approval prior to implementation. Contractor procedures should differentiate between the concepts supporting analysis of the safety of a change and those used for a USQD. Once it has been determined that a USQD is required, the USQD can be performed by providing an answer to each of the six questions (or until any one question is answered “Yes”). If any of these questions are answered “Yes,” the change is considered a USQ. An adequate technical basis for each answer should be recorded. The examples given in the following subsections are provided to help the reviewer identify potential USQs. They are not meant to be examples of USQs. That determination requires consideration of the DSA for the nuclear facility or other DOE-approved documentation that provides the safety basis for operations or other activities and the specific details of the activity. A.1.1 Could the proposed change increase the probability of the occurrence of an accident previously evaluated in the facility’s DSA? In the following discussion, the term “accident” refers to the anticipated operational transients and postulated accident scenarios considered in the DSA. The first step in answering this question is to determine the accident scenarios, which have been evaluated in the previously approved DSA, that are potentially affected by the proposed change. The next step is to carefully examine the initiators of these accident scenarios to see if the proposed change affects any initiator. By focusing on the initiators of the previously evaluated accident scenarios, it can be determined whether there is increased likelihood that a given accident would occur. The following questions provide a useful approach in making this determination. a) Will the proposed change meet the design (including safety functional requirements and performance criteria as described in the DSA), material, and construction standards applicable to the structures, systems, and components (SSCs) being modified? This question may be answered by the technical review of the design change package. If the answer is “Yes,” one may conclude that the proposed change does not increase the likelihood of the occurrence of an accident. If the answer is “No,” the effects of the design discrepancy on the DSA are required to be analyzed.

1 Note that this discussion does not include PISAs. PISAs are discussed in Attachment C Attachment A DOE G 424.1-1C Page A-2 7-27-2022 b) Could the proposed change affect overall SSC performance to a degree that increases the probability of a previously analyzed accident? Possible questions to ask are: • Could the proposed change use instrumentation with accuracies or response characteristics that are different from those of existing instrumentation and could make an accident more likely to occur? • Could the proposed change cause SSCs to be operated outside their design or testing limits? Examples include the following: overloading electrical systems, over pressurizing a piping system, or operating a motor outside its rated voltage and amperage. • Could the proposed change cause system vibration, water hammer, fatigue, corrosion, thermal cycling, or degradation of the environment for SSCs that would exceed the design limits? • Could the proposed change cause a change to any SSC interface in a way that could increase the likelihood of an accident? A.1.2 Could the proposed change increase the consequences of an accident previously evaluated in the facility’s DSA? In answering this question, the first step is to determine which accidents analyzed in the DSA could have different radiological and hazardous material consequences as a result of the change. For these accident scenarios, the next step in the analysis is to determine whether the change of consequences is in the direction of an increase. Consequences to workers (both facility and co- located workers), the public and the environment are required to be considered. Examples of questions that assist in this determination are as follows: • Could the proposed change degrade or prevent safety functions described or assumed in the existing DSA? • Could the proposed change alter any inputs or assumptions previously made in evaluating the radiological and hazardous material consequences in the existing DSA? • Could the proposed change play a direct role in mitigating the radiological or hazardous material consequences assumed in the existing DSA? • Could the proposed change affect the integrity or function of radioactive or hazardous material barriers? A.1.3 Could the proposed change increase the probability of a malfunction of equipment important to safety previously evaluated in the facility’s DSA? The safety analyses for the facility assume that the risk of safety SSCs not properly functioning has been analyzed, and the results are acceptable. The proper functioning of other systems, including support systems, is generally assumed, unless specifically affected by the hazard scenario. The scope of the USQ determination should include these other systems. For example, DOE G 424.1-1C Attachment A 7-27-2022 Page A-3 a change that does either of the following is a change that increases the probability of a malfunction of equipment important to safety: • Degrades the performance of equipment important to safety, assumed to function in the accident analysis, to below the performance level assumed in the existing DSA; or • Increases the challenge to equipment important to safety assumed to function in the accident analysis (for example, more rapid pressure rise), degrading performance to a level below that assumed in the existing DSA.

In answering this question, the first step is to determine the safety SSCs that could be affected by the proposed change. Next, the direct and indirect effects of this change on equipment important to safety are evaluated. Direct effects are those in which the change affects the equipment important to safety, while indirect effects are those affecting one piece of equipment which in turn can affect equipment important to safety. An example of indirect effects would be one piece of equipment falling on safety equipment. After the effect of the change on equipment important to safety is identified, a determination is made whether an increase in the probability of a malfunction of the SSCs exists. The following are examples of questions that can be used in making this determination. (a) Will the proposed change meet the original design specifications for materials and construction practices when the following questions are considered? (1) Are the seismic specifications met (for example, use of proper supports, proper lugging at terminals, and isolation of lifted leads)? (2) Are separation criteria met (for example, minimum distance between circuits in separate divisions, channels in the same division, and jumpers run in conduit)? (3) Are the environmental criteria met (for example, use of materials suitable for the radiation or thermal environment in which they will be used)? (b) Will the proposed change degrade equipment important to safety reliability by— (1) Imposing additional loads not analyzed in the design? (2) Deleting or reducing system or equipment protection features? (3) Downgrading the support system performance necessary for reliable operation of the equipment? (4) Reducing system or equipment redundancy or independence? (5) Increasing the frequency of operation of systems/equipment? (6) Imposing increased or more severe testing requirements on systems or equipment? Attachment A DOE G 424.1-1C Page A-4 7-27-2022 If the change adversely affects the equipment important to safety, the likelihood of equipment malfunction would be increased. This would indicate a potential USQ requiring further analysis to determine if it is a discernable increase, consistent with the guidance in Section 4.4.1 of this Guide. A.1.4 Could the proposed change increase the consequence of a malfunction of equipment important to safety previously evaluated in the facility’s DSA? This question asks whether, assuming a malfunction of equipment important to safety, the change would result in increased hazardous material or radiological consequences. For example, consider a change that results in a valve in a safety (SC/SS) system to fail in the closed position where previously it was assumed to fail in the open position. If this change results in a discernible increase in consequences of an accident, the change involves a positive USQD. A.1.5 Could the proposed change create the possibility of an accident of a different type than any evaluated previously in the facility’s DSA? An accident that involves an initiator or failure not considered in the existing DSA is potentially an accident of a different type. An example would be turbine missiles from a gas turbine added as an alternate power source. Certain accidents or malfunctions are not treated in the DSA because their effects are bounded by similar events within the same analyzed control set.

However, a change that increases the probability of an accident from “not plausible” to “plausible” creates a possible accident of a different type. In answering this question, the first step is to determine the types of accidents evaluated in the existing DSA. The types of new or different plausible2 accidents that the change could create can then be identified and listed. Evaluating the differences between the two lists will determine the answer to the question. The accidents evaluated in the existing DSA are generally chosen to be bounding for a broad class of plausible accidents. Thus, comparison of a new accident to the existing DSA could require referral to the underlying hazard analyses. A.1.6 Could the proposed change create the possibility of a malfunction of equipment important to safety of a different type than any evaluated previously in the facility’s DSA? To answer this question, begin by identifying the types of failure modes of equipment important to safety evaluated in the DSA and that would be affected by the change. Then identify the types of failure modes that the change could create. Comparing the two lists can provide insight for answering the question. An example of a change that might create a malfunction of a different type is the relocation of equipment so that it becomes susceptible to flooding. Another example is the replacement of a mechanical control system with a digital control system that could fail in a different mode. 2 Section 3.2.1 of DOE-STD-3009-2014 provides a discussion of plausibility. DOE G 424.1-1C Attachment A 7-27-2022 Page A-5 (and A-6) A.2 Preparing a USQD In performing USQDs, the basis for the conclusion for the USQD should be documented, consistent with the documentation requirements in the contractor’s DOE-approved USQ procedures. This documentation should be complete in the sense that a qualified independent reviewer (qualified for the facility and in the USQ process) could draw the same conclusion. The importance of the documentation is emphasized by the fact that experience and engineering knowledge, rather than models and experimental data, are frequently relied on to make the USQ determination. Since the primary goal of the USQ determination is to demonstrate that the safety basis is being maintained, the items considered by the evaluator should be clearly stated. Documentation of the effects considered will enable the independent reviewers to assess the adequacy of the USQ determination and its conclusions. DOE G 424.1-1C Attachment B 7-27-2022 Page B-1 ATTACHMENT B UNREVIEWED SAFETY QUESTION PROCESS LESSONS LEARNED The following list of lessons learned on specific details of the unreviewed safety questions (USQ) process has been developed from experience in applying the USQ process. B.1 Purpose of USQ Process The USQ process does not serve as a safety review of the proposed change to a DOE nuclear facility or facility procedures. The change should already be known to be safe before it enters the USQ process. The safety implications of a change should be reviewed, analyzed, understood, addressed, evaluated for acceptability, and documented by the contractor separately from the USQ process. The technical adequacy and safety of the change would typically be documented in the applicable work control or change control process document. Using the USQ process instead of the safety evaluation of the change is inappropriate. The USQ process determines if contractor approval of a change is sufficient or if Department of Energy (DOE) review and approval are required. The contractor is required to obtain DOE approval of those changes that involve a USQ (that is, when the USQ determination is positive) to verify that the hazard controls are adequate to provide an acceptable level of safety to the public, workers and environment. The existence of a positive USQD does not mean that a change is unsafe, but only that DOE is required to approve any final action taken by the contractor that could change the approved safety basis of the facility.

B.2 Change Control and Tenant/Landlord Relationships Although not intended as literal, the terms “landlord” and “tenant” are used here to describe situations where one contractor conducts operations in a facility and has overall responsibility for the facility safety basis but another contractor also conducts operations in the facility. In these situations, the operations of both the first and the second contractor would be described and analyzed in the facility DSA in order to comply with 10 Code of Federal Regulations (CFR) Part 830, Subpart B. However, usually the landlord contractor is fully responsible for maintaining the integrity of the safety basis. Whether or not a contractual relationship exists between the contractors, it is important that practical operational means exist to ensure disciplined and coordinated implementation of the USQ process for all operations within the facility. In these cases, the recommended approach to allow flexibility for the tenant’s activities and still protect the facility documented safety analysis (DSA) via the USQ process is to (1) ensure that a hazards analysis (or other governing safety analysis) exists for each tenant activity such that the collective hazards analyses for all tenant activities are encompassed by the facility DSA, (2) procedurally require that the tenant review any changes in its activities that are being considered against the corresponding hazards analysis and key hazard controls and assumptions, and then (3) in conjunction with the landlord, submit the change to the USQ process against the facility DSA. Attachment B DOE G 424.1-1C Page B-2 7-27-2022 There is a potential conflict between requiring that all changes within a facility be considered within a formal change control process and allowing researchers and other tenants the flexibility to conduct their activities without undue restrictions that might stifle the desired creativity. The objective should be to impose the formality necessary to ensure that all activities are conducted safely within the approved safety basis for the facility without applying any unnecessary restrictions on the activities. Having the tenant take an active role in development of an adequate activity level safety envelope for the activities within the facility safety basis can promote familiarity with the safety envelope. This participation can also enhance safety responsibility without limiting the activities. The tenant may also establish a USQ coordinator or resource person to answer USQ questions and facilitate effective USQ process implementation. B.3 Unified and Consolidated Procedures Contractors should consider the desirability of requiring that operations at each nuclear facility or at the site under the contract to adhere to a single site-wide USQ procedure and site-wide USQ training and qualification requirements. Facility-specific considerations, such as identifying the safety basis documents, could be addressed by appendices to the site-wide procedure. A single contract-wide or site-wide USQ procedure and training can promote consistency and proper application. A DOE field office assessment found that a root cause of USQ problems was the lack of a common procedure and common USQ training. A single contract-wide or site-wide USQ procedure can improve the quality of the USQ process by taking advantage of the best aspects of each of the different facility procedures. Using the same USQ forms for screens and USQ determinations and using the same training and qualification requirements can help develop a high-quality USQ process across the site.

B.4 USQ and Criticality Safety Evaluations A USQ process review is required to be performed for proposed new or changed processes involving criticality safety that necessitate a new or revised Criticality Safety Evaluation, including those in an experimental facility. DOE-STD-3007-2017, Preparing Criticality Safety Evaluations at Department of Energy Non- Reactor Nuclear Facilities, specifies an evaluation of hazard controls for Nuclear Criticality Safety to identify which controls, if any, require elevation to the DSA and associated technical safety requirements (TSR) for the facility. The results of the USQ process review define the need for DOE approvals of changes. B.5 Transportation Activities under 10 CFR § 830.203 USQ Requirements Nuclear materials transportation activities are regulated under 10 CFR Part 830, except for those activities regulated by the Department of Transportation. This guidance can be applied directly to transportation activities. Non-routine transfers should be subject to the USQ process. DOE G 424.1-1C Attachment B 7-27-2022 Page B-3 In most cases, positive USQDs only result when a proposed change in a nuclear materials transportation activity leads to using packaging in conditions that could lead to exceeding its performance envelope. Changes that potentially expose transfers to new hazards or increased likelihood of accidents would be expected to result in positive USQDs. B.6 Graded Approach Title 10 CFR § 830.7 states, “The graded approach may not be used in implementing the unreviewed safety question (USQ) process...” The graded approach may be used in developing the DSA; however, no steps of the USQ process may be eliminated or adjusted based on grading. B.7 Expert Unreviewed Safety Question Determinations At some facilities, expert-based USQDs have been implemented and proven useful. An expert- based USQD approach is optional and, if used, should be reflected in the USQ procedure. A short form, expert-based USQD, tailored to review simpler proposed changes, can potentially increase the efficiency of performing the USQD. The objective of an Expert USQD is to quickly determine, with minimal documentation, whether the change is not a USQ, or requires further review in a standard USQD. The Expert USQD approach could be applied to certain proposed changes where it is readily apparent to safety basis personnel the change cannot create a USQ. The Expert USQD incorporates a review checklist, modeled after the USQD questions in Appendix A. The outcomes of the Expert USQD are either (1) the proposed change does not represent a USQ, or (2) the change requires additional review via a standard USQD. For those proposed changes found not to represent a USQ, the expert preparer documents the bases deemed relevant as to why it is readily apparent a USQ would not exist. Documentation for Expert USQDs is briefer and more focused. Because the associated changes are simpler and the determinations are more readily apparent, expert USQDs do not require the level of detail for a standard USQD. Expert USQDs still require the same review and approval as a standard USQD, although when used, the USQ procedure should require the USQD to be designated as “Expert USQD.” If the expert preparer/reviewer has any doubts about a definitive answer, then the outcome is that the change requires additional review via a standard USQD.

The contractor’s USQ procedure should specify stricter qualification requirements for “experts.” The qualifications for expert USQD preparers/reviewers should be stricter than those for standard USQD preparers/reviewers. It is not appropriate to insert any qualified preparer available into a rotating “expert” slot. Experts should have lengthier career experience than the average USQD preparer, thorough knowledge of the facility, its operations, and its safety basis, as demonstrated by documented, sustained experience at the facility, and a history of preparing USQDs for that facility. For example, experts should have at least one year of safety basis experience at the specific facility and should have a demonstrated history of preparing acceptable USQDs. Attachment B DOE G 424.1-1C Page B-4 7-27-2022 The contractor’s USQ procedure should describe how and when expert-based USQDs will be used, what procedures or checklists will be used, the qualifications for expert preparers/reviewers and a mechanism for a formally defined list of experts that is approved by the contractor’s institutional safety basis organization. Stringent qualification requirements for “experts” are key to implementation. Only the most experienced and trained personnel in the facility, its processes, and Safety Basis should be qualified as an Expert USQD preparer/reviewer. B.8 Equipment Important to Safety The USQD questions refer to “equipment important to safety,” sometimes abbreviated as EITS. EITS includes the SC/SS SSCs identified in the DSA. For the purposes of answering USQD questions, “equipment important to safety” is any equipment whose function, malfunction, or failure can affect safety functions of safety SSCs or SACs described in the DSA. EITS identified in addition to SC/SS SSCs, if any, may consist of preventive and mitigative features with generic applicability (e.g., non-SC/SS fire suppression), significant detection and monitoring systems (e.g., non-SC/SS continuous air monitors), support systems that provide defense-in-depth, SSCs that support implementation of Specific Administrative Controls (but do not rise to the level of or have the pedigree for being designated as safety-class or safety- significant “support SSCs”), or passive design capabilities and other systems that perform defense-in-depth functions (e.g., such as providing multiple barriers to prevent or mitigate the unintended release of radioactive materials). For the purpose of additional assurance in preserving the safety basis, the facility DSA may, but is not required to, explicitly identify additional EITS from other equipment not credited as SC/SS SSCs in the DSA.1 If the DSA explicitly identifies other EITS in addition to SC/SS, these are included in the scope of EITS for answering the USQD questions. 1 See DOE-STD-3009-2014, Section 3.3.3 for additional discussion on other hazard controls. DOE G 424.1-1C Attachment C 7-27-2022 Page C-1 ATTACHMENT C GUIDANCE ON PROCESSING POTENTIAL INADEQUACIES OF THE DOCUMENTED SAFETY ANALYSIS C.1 Introduction This attachment provides guidance on the performance of each of the four steps required per 10 Code of Federal Regulations (CFR) § 830.203(f) upon discovery of a Potential Inadequacy of the (Documented) Safety Analysis (PISA). In addition, this attachment discusses an acceptable method for evaluating new information to determine whether a PISA exists, and discusses the use of Justifications for Continued Operation (JCO). This attachment also discusses situations involving multiple PISAs. Figure 1 provides a schematic of the USQ process related to PISAs.

C.2 Processing Information to Determine Whether a PISA Exists A PISA can result from situations that indicate that the documented safety analysis (DSA) may not be bounding or may be otherwise inadequate because of discrepant as-found conditions, operational events, or the discovery of new information (note: hereafter, all three conditions are referred to as “new information”). The main consideration is that the analysis in the DSA does not match the current physical configuration, or is inappropriate or contains errors. A short period of time (hours or days but not weeks) is acceptable to investigate the conditions to confirm that a DSA is potentially inadequate before declaring a PISA. A short period of time is acceptable to investigate and confirm the discovery of new information because it is contrary to both safety and mission goals to inappropriately and prematurely determine whether a PISA exists. The contractor may determine that temporary hazard controls are appropriate to ensure facility safety during the investigation. The USQ procedure should specify the time allowed for investigation of new information to determine whether a PISA exists. This time should not exceed 7 calendar days. The USQ procedure should also specify any notification requirements to be provided to DOE when new information is discovered (or the contractor is made aware) and the new information is being investigated. The USQ procedure may allow for DOE to approve additional time to investigate on a case-by-case basis with an appropriate technical basis. If it is immediately clear that a PISA exists, then the PISA should be declared without delay. Sites implementing DOE-STD-3016, Hazard Analysis Reports for Nuclear Explosive Operations, may require Design Authority input for resolution and thus may specify different reporting requirements. New information may become known anywhere along a continuum of completeness from unconfirmed or unverified opinions to confirmed fact to approved reports. DOE contractors may implement an initial confirmatory process to determine if the information is valid. The determination of whether a PISA exists should begin as soon as there is credible reason to believe that the DSA is potentially inadequate, but it does not need to begin if the information is unconfirmed or unverified. The urgency of the process and the degree of confirmation should be commensurate with the seriousness of the potential inadequacy gauged by expert judgment. This initial confirmatory process should be restricted only to determining if the DSA is potentially inadequate. That decision should not be delayed by extensive analysis to determine the degree of inadequacy or to tailor compensatory actions. Attachment C DOE G 424.1-1C Page C-2 7-27-2022 C.3 Placing or Maintaining the Facility in a Safe Condition

Upon declaration of a PISA, in accordance with 10 CFR § 830.203(f)(1), the contractor is required to place and/or maintain the facility in a safe condition, consistent with the approved USQ process. The contractor determines what constitutes a safe condition and takes conservative action to impose operational restrictions to ensure the facility is in a safe condition. Operational restrictions may include restrictions on work activities for the affected part of the facility, imposition of additional controls (such as fire watches if the adequacy of a fire protection control is in question), or placing the facility into a different technical safety requirement (TSR) mode. Conservative actions that are imposed to ensure safe conditions are required to be maintained until the evaluation of the safety of the situation (ESS) is submitted to DOE and demonstrates that they can be removed and the facility can be operated within the approved safety basis. In addition, in accordance with requirements in the TSRs, the contractor is required to evaluate the operability of any affected safety systems and components and enter any applicable TSR conditions/action statements. Operability determinations are routinely made by operations personnel for complying with TSR action statements. Situations can exist where an SSC has been degraded such that there is a loss of quality or functional capability, or a nonconforming condition exists with the SSC or its documentation, but the SSC has not been determined to be inoperable. These situations can constitute a PISA if the cause of the SSC failure or non-conformance undermines assumptions in the DSA. Despite the degraded or nonconforming situation, a safe condition may include continued facility operation when supported by an evaluation that determines the SSC can meet required safety functions, possibly aided by operational restrictions, and the TSRs are still being met in terms of required operable equipment for the given MODE of operations. The evaluation of the degraded SSC (typically performed by operations personnel with input from nuclear safety and engineering subject matter experts, as needed) should determine whether the degraded or nonconforming condition affects the ability of a safety SSC or SAC to satisfy its credited safety function. Upon declaration of a PISA, an immediate determination of whether the credited safety function can be met should be made based on the best available information and operational restrictions imposed, if necessary, upon confirmation of the condition. Subsequently, a final determination may be necessary following a thorough engineering evaluation, which should include: • Description of the degraded or nonconforming condition of the SSC; • Description of the degraded or nonconforming condition on safe operations and the safety function of the SSC; • Description of any operating restrictions that have been imposed and the effect of these restrictions in relation to the degraded SSC and its safety function; and • Evaluation of the operability of the SSC given its condition, using analysis, tests, operating experience, and/or engineering judgment, and considering conservatisms and margins, availability of other equipment, and cumulative effects of other outstanding degraded or nonconforming conditions. DOE G 424.1-1C Attachment C 7-27-2022 Page C-3

Restoration actions for the degraded or nonconforming condition are to be developed by the contractor and scheduled at the first available opportunity commensurate with the safety significance and extent of restoration actions in an integrated manner with other facility commitments and resources. If a PISA was declared, the final operability determination may be included as part of the ESS required to be submitted to DOE before removal of any operational restrictions. C.4 Expeditiously Notifying DOE When the PISA is Declared After the PISA has been identified and the facility is in a safe condition, the contractor is required to notify DOE of the situation. This required notification may be provided through an established site level reporting process or system. The USQ procedure should describe acceptable notifications. Acceptable notification should be in writing (documented by letter or electronic mail) and should include the applicable DOE Field Element Manager and the applicable DOE Chief of Nuclear Safety. It is also a good practice to immediately notify the DOE Facility Representative and/or other DOE management responsible for the facility’s safety basis. This DOE notification should clearly identify any operational restrictions that were imposed to ensure the facility is in a safe condition. No DOE approval of the operational restrictions is required; however, DOE may ask questions and may direct that other restrictions be implemented if deemed necessary. C.5 Performing a USQD and Notifying DOE of the Results Another action required for a PISA is the preparation of a USQ determination for the situation. This should be performed within a short period of time (hours or days, not weeks) following identification of the PISA. The time taken should be commensurate with the seriousness of the potential inadequacy gauged by expert judgment. The USQD should be performed as soon as possible after the PISA is declared because it is important to formally determine whether any DOE-approved changes to the safety basis are needed. As part of performing the USQD or developing the ESS, new information can arise that results in the contractor identifying additional or different operational restrictions to be imposed. The contractor is required by 10 CFR § 830.203(f)(3) to notify DOE of the results of the USQD, regardless of whether the USQD is positive or negative. Updating the Occurrence Reporting and Processing System report per DOE O 232.2A is an acceptable method to meet this notification requirement. Submitting a separate report or letter to DOE is also an acceptable notification method. The USQ procedure should describe acceptable notifications. The USQ procedure should specify the time allowed for performing the USQD after a PISA is declared and this time should not exceed 7 calendar days. The USQ procedure may allow for DOE to approve additional time to perform USQD evaluations on a case-by-case basis with an appropriate technical basis. Attachment C DOE G 424.1-1C Page C-4 7-27-2022 C.6 Completing an Evaluation of the Safety of the Situation (ESS) C.6.1 Processing of the ESS Contractors are required by 10 CFR § 830.203(f)(4) to submit an ESS to DOE “prior to removing any operational restrictions” imposed as the result of the PISA. The contractor should develop an ESS following completion of the PISA USQD, since input from the USQD analysis is useful in developing the ESS.1

The timing of the ESS is a function of whether the USQD is positive or negative. The ESS associated with positive USQDs should be developed within a short period of time, as soon as practicable (within days to weeks) and not more than 30 calendar days. This timing should be based on the safety risk presented by the situation and the effectiveness of operational restrictions imposed. However, if the facility is placed in a TSR safe MODE (i.e., a MODE where the PISA condition does not represent a hazard), there is no specific recommended time limit for submittal of the ESS in this situation. Also, there is no recommended time limit for submittal of an ESS for a negative PISA USQD, because the condition of the facility is such that DOE approval would not have been needed (per the USQ requirements) if the facility had been intentionally put into this condition. Title 10 CFR § 830.203(f)(4) requires the contractor to submit the ESS to DOE prior to lifting any operational restrictions. The ESS is provided for DOE review regarding whether the facility (with any remaining operational restrictions in place) is in a safe condition. Further, it is a good practice to resolve the cause of the PISA (i.e., identify and correct discrepant conditions and/or update safety basis) and return the facility to normal operations as soon as practicable. DOE approval of the ESS is not needed for the negative PISA USQD. DOE approval is needed for any positive USQDs and should include approval of the ESS that results (see DOE-STD-1104 for further discussion of DOE review of ESSs). DOE review of the ESS will focus on the analysis of the impact of the PISA on the safety of the facility and the capability of the operational restrictions/controls to mitigate the hazards and to compensate for any potential decreases in the facility safety caused by the PISA. Any subsequent proposed changes to the facility or its operations would be expected to be within the agreed upon ESS restrictions or else the ESS would need to be revised and re-approved by DOE. In situations where (1) the USQD is positive and (2) operations are to continue for an extended period of time (i.e., greater than a month) under the restricted conditions of other than a TSR safe MODE, then the contractor should evaluate whether further (more detailed) analysis is necessary to justify that continuance. This further analysis and justification may take the form of a JCO (see Section C.7), a DSA change, or an exemption from one or more 10 CFR Part 830, Subpart B requirements. If an updated ESS is used in lieu of a JCO, the contents of that updated ESS should address the contents described in Section C.7. 1 10 CFR §830.203(f)(1)-(4) identifies four actions that the contractor is required to perform when a PISA is discovered. Although 10 CFR §830.203(f)(1)-(4) does not require these actions be performed in order, this order is logical and recommended. DOE G 424.1-1C Attachment C 7-27-2022 Page C-5 As needed, the contractor should incorporate changes to resolve the USQ into a safety basis change submitted for DOE approval. C.6.2 Content of the ESS If the PISA USQD is negative, the ESS should document the assessment and justify removal of interim operational restrictions, if any. If the PISA USQD is positive, the ESS should document the assessment and provide the basis for how the actions taken or planned (including implementation of operational restrictions) ensure safety.

The following is acceptable content of an ESS: • Title. • Description of occurrence or discovery and any immediate compensatory actions taken (i.e., operational restrictions). • Date PISA was discovered and reported. • Results of the immediate safety assessment and the USQD (positive/negative). (Reference relevant documents.) • Results of any subsequent safety analysis developed to further support conclusions as to safety of the facility with and/or without operational restrictions/compensatory measures. • Path forward. Discuss if additional work is to be performed to resolve the issue, and anticipated completion date. Additional content for an acceptable ESS in the case of a positive USQD: • Current operational status of the facility. • Clear identification of all operational restrictions needed to maintain the facility in a safe condition. • Analysis that addresses the safety implications of the PISA with the operational restrictions removed (or with the operational restrictions in place if their removal is not proposed). • Path forward for restoring the facility into compliance with the DSA (e.g., by revising the DSA or by correcting the discrepant condition). • Summary of recommendations and conclusions. The ESS should be bounding and the level of detail sufficient to provide confidence that the facility is being maintained in a safe condition. Attachment C DOE G 424.1-1C Page C-6 7-27-2022 C.7 Justification for Continued Operation (JCO)2 A JCO may be used as a mechanism by which a contractor that has a situation outside the facility safety basis, may request that DOE review and approve temporary operations. The JCO would allow the facility to continue operating during a specific and unexpected situation, considering the safety significance of the situation and any compensatory measures being applied during this period while the contractor is actively working to resolve the positive USQD3. With regard to the USQ process, a JCO is associated only with situations where the PISA USQD is positive. However, as discussed in Section C.6.1, it may also be appropriate to update the ESS with JCO information in lieu of developing a separate JCO, if the JCO information described below is addressed. If the PISA arises from the situation where analytical errors in the DSA are identified or the analysis is otherwise inappropriate, a proposed change to the safety basis should be prepared and submitted to DOE. However, if the positive USQD cannot be resolved (i.e., so that no PISA exists) within a short period of time, such as one month, and a strong safety or programmatic need exists to continue operations, a JCO that defines specific operational restrictions or other compensatory measures that will be maintained should be submitted to DOE for review and approval. A PISA could also arise from a discrepant as-found condition (e.g., installed equipment not meeting design specifications). In this case, the process for restoring a nonconforming SSC should be executed. However, situations can arise where a PISA is declared and it is not possible to align the facility configuration with the approved safety basis in a timely manner (e.g., within a month), and there is a need to continue operations. In this situation, a JCO that defines specific operational restrictions or other compensatory measures that will be maintained should be submitted to DOE for approval.

The request for approval of a JCO should analyze the hazards and identify controls, appropriate for the hazards associated with the PISA, and the length of time the conditions that resulted in the PISA are expected to exist. The analysis supporting a JCO should be consistent with the approach in 10 CFR Part 830, Subpart B, Appendix A (or approved alternate methodology), for developing a documented safety analysis. Given that a JCO is intended to address emergent conditions in a timely manner; the associated analysis and controls/compensatory measures can be more simplified and conservative/bounding in nature. Relaxation of initial enhanced controls may be justified at a later time through additional analysis, if approved by DOE. [Note: In circumstances where no viable control strategy exists to prevent or mitigate the consequences of one or more postulated accident scenarios from exceeding the DOE Evaluation Guideline of 25 rem Total Effective Dose (TED), the contractor is required by DOE O 420.1C, Attachment 1, Contractor Requirements Document, paragraph 1.f., to submit to DOE the information described 2 The recommendations made in this Guide regarding JCOs are only provided for guidance and are not requirements under 10 CFR Part 830. 3 The guidance in this section applies only for HC-1, -2, and -3 DOE nuclear facilities with an approved DSA and an approved USQ procedure. For further information refer to Department of Energy Office of General Counsel Interpretation Regarding Exemption Relief Pursuant To 10 C.F.R. Part 820, Procedural Rules for DOE Nuclear Activities, Subpart E, Exemption Relief, And Non-Compliant “Documented Safety Analyses” Subject To 10 C.F.R. Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements, September 28, 2011. This interpretation states that the JCO does not constitute an exemption from the requirements of 10 CFR Part 830. DOE G 424.1-1C Attachment C 7-27-2022 Page C-7 in DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, Section 3.3.1 and obtain DOE approval of a DSA. DOE may require the same prior to approval of a JCO under similar circumstances.] When DOE approves a JCO, the JCO and any DOE-imposed conditions of approval temporarily allow operations to continue under the conditions specified, including a defined termination point. If the JCO is intended to amend, even temporarily, the facility’s safety basis, DOE O 420.1C requires review and approval of safety basis documents in accordance with DOE-STD-1104-2016, Review and Approval of Nuclear Facility Safety Basis and Safety Design Basis Documents. A JCO should define an appropriate set of temporary hazard controls/compensatory measures to be in effect during the life of the JCO. In some cases, these JCO controls are more stringent than the facility TSRs (e.g., TSR times or actions). A JCO should have a predefined, limited life determined by the time needed to allow for updating the safety basis documents on a permanent basis. The JCO should clearly define the termination point of the life of the JCO. In most cases, this would take the form of a functional point, such as the completion of turnover of a physical modification for routine operations, which would occur after implementing the modification, post-modification testing, updating critical documentation, and training of the operations staff. The contractor should take actions to resolve the conditions that require the JCO or modify the safety basis to make the JCO no longer necessary. JCOs should not continue past 12 months.

A JCO is not an acceptable means to request a change of the safety basis for a planned operation, planned maintenance, troubleshooting or maintenance, or after a DSA or TSR change request has already been declined by the Safety Basis Approval Authority. Similarly, a JCO is not an acceptable means to plan and obtain approval for new activities. For planned activities where changes to the DSA or TSR (e.g., controls or timeframes) are required, a request for a change to the facility safety basis should be prepared by the contractor and submitted to DOE for approval. A JCO should not be used in place of an exemption to 10 CFR Part 830 requirements. Because the JCO is an approval for temporary operations in response to a situation outside the facility’s currently approved safety basis, any subsequent proposed changes to the facility or its operations would be expected to be within the agreed upon and approved JCO restrictions or else the JCO would need to be revised and re-approved by DOE. JCOs should meet the established format and content guidance below, if a JCO is used to authorize continued operations following declaration of a PISA and positive USQD. The following is an acceptable format and content for the JCO. • Title. • Executive Summary (Optional, depending on length of document). • Purpose. Provide the rationale for the safety of operations while the PISA and positive USQD exists along with rationale for why the operations need to continue. Include a brief discussion on how the JCO was developed in accordance with 10 CFR Part 830 safety basis requirements. • Background. Summarize the condition(s) that led to the need for the JCO. Cite the ESS that transmits or precedes the JCO. Describe the PISA, facility status, and the steps taken Attachment C DOE G 424.1-1C Page C-8 7-27-2022 (including any operational restrictions put in place) to ensure the facility was in a safe condition. Also, discuss results of the USQ determination. • Authorized Operations. Describe what operations are authorized to occur during the time the JCO is in effect, provided that the additional compensatory measures/hazard controls are in place. • Compensatory Measures/Additional Hazard Controls. Describe the risk-reduction activities being applied immediately. Provide a detailed discussion of any existing or planned additional compensatory measures/hazard controls. Include a discussion of how the controls will be implemented. • Safety Assessment. Briefly discuss the results of the USQ determination and the effect on mitigated consequence and event frequency with any additional compensatory measures/hazard controls in place, and whether these risk factors are time dependent. This may be a qualitative assessment of the relative risk of operating the facility with the PISA and any compensatory measures/ hazard controls in place as compared to operating the facility as analyzed in the DSA. • Planned Corrective Actions. Describe actions that will be developed and implemented as the permanent solution to address the positive USQD. Discuss actions to take place to resolve the PISA and ensure that the facility can be safely operated in accordance with the currently approved safety basis. The JCO should include a summary of recommendations and conclusions, including the specific proposed path or action to terminate the JCO (e.g., safety basis amendment, restoring the facility configuration to the previously approved DSA, submitting an exemption request).

• Termination of JCO. Describe the events and/or timeframe that will define the termination of JCO. Discuss the expected date or events (e.g., correction of an issue) at which time the JCO will be terminated. Describe the actions and approvals that will be necessary to terminate the JCO. C.8 Situations Involving Multiple PISAs A special case exists when dealing with the possibility of multiple PISAs. This might occur, for example, when an external assessment team generates multiple concerns, each of which can indicate new information to be evaluated by the contractor for the existence of a PISA. In such cases, it might be impractical for facility staff to assess the situation quickly and disposition multiple concerns in the time frame normally expected for deciding whether a concern indicates a PISA (hours to days). In the face of multiple significant issues, it might be reasonable to shut down operations as a conservative course of action. As an option in these cases, except where it is apparent that an imminent hazard exists, the contractor should consult DOE without delay, and a mutually agreed-upon approach and schedule to handling the multiple concerns according to their safety significance, should be developed. Where it is apparent that an imminent hazard exists, the four steps for a potential inadequacy would be required to be undertaken without delay. A similar situation for design basis reconstitution projects where documentation on the original design bases is lost or outdated. In this case, a team of engineers could identify many questions DOE G 424.1-1C Attachment C 7-27-2022 Page C-9 or issues that do not have current documentation and which could potentially constitute PISAs. For the purposes of the USQ process, design reconstitution projects can be regarded as DSA upgrades. For DSA upgrades, the USQ process should not be applied to the use of new analytical tools or in response to new requirements. A reconstitution project should have a process for prompt sorting and prioritizing of questions and issues between those that should be addressed as a normal part of the reconstitution project and those that should be handled promptly as PISAs. This process should be sufficiently timely to ensure that the expectations for PISAs can be met. * The reference provided here (e.g., C.3) refers to the Section of this Guide that discusses this Step Hours to Days Hours to Days Problem identified PISA? Notify DOE of the Situation (C.4) Notify DOE in accordance with USQ procedure Submit ESS (C.6) Notify DOE promptly Of USQD results (C.5) Perform a USQ Determination Exit USQ process Place or maintain the facility in a safe condition (C.3) * A PISA is determined Positive USQD? Yes Yes No Immediate 830.203(f) Requirements (1) Place or maintain the facility in a safe condition (2) Notify DOE of the situation (3) Perform a USQD and Notify DOE promptly of the results (4) Submit the evaluation Of the safety of the Situation (ESS) to DOE Notification in accordance with USQ procedure Continue On Page 2 No Usually involves conservative Operational Restrictions Operational Restrictions may be a TSR Safe Mode May include an Operability Determination Notification in accordance with USQ procedure A qualitative safety analysis of PISA Notification includes initial Operational Restriction No DOE approval required, but DOE can direct other Restrictions May include additional Operational Restrictions

and updated Operability Determination No DOE approval required, but DOE can direct other Restrictions Submitted prior to removal of Operational Restrictions No DOE approval required FIGURE 1: USQ PROCESS FOR PISAs A ttachm ent C D O E G 424.1-1C Page C -10 7-27-2022 Submit ESS Can PISA USQ be promptly resolved or is facility in TSR safe mode? Final Evaluation of the problem. Resolution specifics of how facility has been/will be within the DSA DOE approval before removal of Operational Restrictions SER if DSA revision Incorporated into the DSA as needed Submit ESS (for longer resolution path) (C.6) Submit JCO (C.7) or updated ESS Submit Revision to Safety Basis Justification of adequacy of initial restrictions or proposed changes to Restrictions DOE approval required before removal of Operational Restrictions A temporary DSA addition with justification of temporary controls May be addressed in or simultaneous with ESS DOE approval required Near Term (within days to weeks) As specified by the JCO (not more than 12 months) FIGURE 1 (CONT): USQ PROCESS FOR PISAs Continued from Page 1 Yes No D O E G 424.1-1C A ttachm ent C 7-27-2022 Page C -11 (and C -12) E G 424.1-1C Attachment D 7-27-2022 Page D-1 (and D-2) ATTACHMENT D EXAMPLE FOR INCORPORATING CATEGORICAL EXCLUSIONS INTO THE WORK CONTROL PROCESS A block similar to the example listed below can be provided on the work package. USQ Process Categorical Exclusion Title: Indicate the applicable USQ categorical exclusion(s): Facility Manager* signature: Date: *or designee/USQ approver, [Facility(ies) name(s) inserted here] 1 INTRODUCTION 2 TERMINOLOGY 2.1 Acronyms and Abbreviations 2.2 Must, Should, and May 2.3 Definitions 3 APPLICATION 3.1 Temporary or Permanent Changes in a Facility 3.2 Temporary or Permanent Changes in the Procedures 3.3 Tests or Experiments Not Described in the Existing DSA 3.4 Potential Inadequacy of the (Documented) Safety Analysis (PISA) 4 IMPLEMENTATION OF THe USQ PROCESS 4.1 Integration with Change Control and Work Control Processes 4.2 Screening 4.3 Categorical Exclusion 4.4 Unreviewed Safety Question Determinations 4.5 Documentation and Retention 4.6 Training and Qualifications ATTACHMENT A Unreviewed Safety Question DeterminationS ATTACHMENT b UNREVIEWED SAFETY QUESTION PROCESS LESSONS LEARNED ATTACHMENT C GUIDANCE ON PROCESSING POTENTIAL INADEQUACIES OF THE DOCUMENTED SAFETY ANALYSiS ATTACHMENT D EXAMPLE FOR INCORPORATING CATEGORICAL EXCLUSIONS INTO THE WORK CONTROL PROCESS