Bruce Hamilton, Chairman

Jessie H. Roberson

Joyce L. Connery

DEFENSE NUCLEAR FACILITIES

SAFETY BOARD 

Washington, DC 20004-2901

 February 21, 2020 

The Honorable Dan Brouillette 

Secretary of Energy

US Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-1000 

Dear Secretary Brouillette:

On December 17, 2019, the Defense Nuclear Facilities Safety Board received and 

considered your response to draft Recommendation 2020-1, Nuclear Safety Requirements. 

On February 20, 2020, the Board—in accordance with 42 U.S.C. § 2286d(a)(3)—approved 

Recommendation 2020-1, which is enclosed for your consideration. 

The Board reviewed your response carefully and strengthened several areas of the 

Recommendation. Notably, the Board decided to remove the fifth sub-recommendation 

regarding safety basis quality assurance and document control from this Recommendation. 

Recommendation 2020-1 is intended to strengthen DOE’s regulatory framework in its 

current form, including DOE’s orders, standards, and implementation. The Board agrees with 

DOE that 10 CFR 830 requires an update, but believes that the Notice of Proposed Rulemaking 

would actually erode the regulatory framework. DOE’s nuclear enterprise has grown since the 

original issuance of the rule; however, DOE’s regulatory framework has not been updated to 

include requirements for key concepts and safety control strategies upon which your defense 

nuclear facilities rely. Specifically, the framework lacks sufficient requirements to ensure 

consistent and appropriate implementation across the complex for unreviewed safety questions, 

technical safety requirements, specific administrative controls, and the defense-in-depth 

construct. 

The Board understands that DOE has a number of directives and program-specific 

initiatives to address aging infrastructure. However, DOE does not have a consistent formal 

process for identifying and performing infrastructure upgrades that are necessary to ensure that 

structures, systems, and components can perform their safety functions. 

The Administrator of the National Nuclear Security Administration testified to the 

Subcommittee on Energy and Water Development Senate Committee on Appropriations on 

April 11, 2018, that “NNSA’s infrastructure is in a brittle state that requires significant and 

sustained investments over the coming decade to correct. There is no margin for further delay in 

RECOMMENDATION 2020-1 TO THE SECRETARY OF ENERGY

Nuclear Safety Requirements

Pursuant to 42 U.S.C. § 2286a(b)(5) 

Atomic Energy Act of 1954, As Amended

Dated: February 20, 2020 

Introduction. The Department of Energy’s (DOE) defense nuclear facilities and 

associated infrastructure are aging, but DOE will continue to use many of the facilities and much 

of the infrastructure for the foreseeable future. Consequently, the safety systems and features 

that were designed into the buildings or installed during construction are also aging. At the same 

time, DOE is proposing, designing, and building new defense nuclear facilities to support its 

continued mission. DOE needs to maintain a robust safety posture and strong regulatory 

framework to ensure that both its aging facilities and infrastructure and its new facilities provide 

adequate protection of public health and safety. DOE will need clear requirements and guidance 

for its staff to follow and enforce. 

Background. DOE Policy 420.1, Nuclear Safety Policy, states, “It is the policy of the 

Department of Energy to design, construct, operate, and decommission its nuclear facilities in a 

manner that ensures adequate protection of workers, the public, and the environment.” Title 10 

Code of Federal Regulations (CFR) 830, Nuclear Safety Management, provides a foundation of 

requirements upon which DOE relies to ensure adequate protection of workers, the public, and 

the environment. With this rule, DOE has developed a robust regulatory framework—including 

orders, guides, and standards—to provide the requirements and guidance for the safe design, 

construction, operation, and decommissioning of its defense nuclear facilities. 

10 CFR 830 captures the fundamental requirements for nuclear safety management to 

ensure contractors perform work “with the hazard controls that ensure adequate protection of 

workers, the public, and the environment.” DOE provides additional requirements in orders and 

standards. These additional requirements may be imposed on contractors by reference in 

regulations or by contract. DOE also provides non-mandatory guidance in guides, handbooks, 

and manuals. 

In its initial Notice of Proposed Rulemaking creating 10 CFR 8301

, DOE noted: 

The [Price-Anderson Amendments Act of 1988], coupled with DOE efforts to

improve the assurance of safety in its nuclear operations, led DOE to conclude that 

basic DOE nuclear safety requirements should be established through rulemaking. 

These requirements would revise and supplement the existing requirements, and in

particular, establish specific requirements for applicable DOE nuclear facilities

and provide a structured means for measuring the adequacy of the implementation

and compliance on a facility-specific basis. Compliance would be measured

against specific requirements and against provisions of programs required by these

requirements and approved by DOE.

As specified in its enabling legislation, the first function of the Defense Nuclear Facilities 

Safety Board (Board) is to “review and evaluate the content and implementation of the standards 

 

1 56 FR 64316, December 9, 1991.
2 

relating to the design, construction, operation, and decommissioning of defense nuclear facilities 

of the Department of Energy (including all applicable Department of Energy orders, regulations, 

and requirements) at each Department of Energy defense nuclear facility.”2 Since its creation, 

the Board has provided several recommendations that focus on creating a standards-based safety 

management system for DOE’s defense nuclear facilities. DOE issued a notice of proposed 

rulemaking for 10 CFR 830 in August 2018. In this recommendation, the Board recommends to 

the Secretary of Energy specific measures that DOE should retain or adopt as requirements in its 

regulatory framework, including 10 CFR 830 and associated orders and standards, to include the 

implementation thereof, to ensure that public health and safety are adequately protected. 

The Board notes a fundamental principle of responsibility and delegation in 

Recommendation 2004-1, Oversight of Complex, High-Hazard Nuclear Operations: 

In any delegation of responsibility or authority to lower echelons of DOE or to 

contractors, the highest levels of DOE continue to retain safety responsibility. 

While this responsibility can be delegated, it is never ceded by the person or 

organization making the delegation. Contractors are responsible to DOE for safety 

of their operations, while DOE is itself responsible to the President, Congress, and 

the public.

3

DOE is responsible for designing, constructing, operating, and decommissioning its 

defense nuclear facilities in a manner that ensures adequate protection of the public. Therefore, 

DOE prescribes the requirements for its operating contractors to follow and implement, approves 

the facilities’ safety bases,

4 and oversees compliance through line management and independent 

oversight. 

Analysis. 

Aging Infrastructure—When DOE first issued 10 CFR 830, the majority of its defense 

nuclear facilities were already a few decades old, and DOE had launched an effort to construct 

new facilities to replace them. The Replacement Tritium Facility at the Savannah River Site 

(now known as Building 233-H) is an example. However, nearly three decades after 

construction and startup of the replacement facility, DOE continues to rely on some older 

facilities to support its tritium operations, and will continue to do so for the indefinite future. 

Similarly, DOE has embarked upon the design and construction of the Uranium 

Processing Facility at the Y-12 National Security Complex, but intends to operate two associated

50-plus year old facilities for another several decades to support its production commitments for 

national security purposes. Also, the time from concept to startup of a new defense nuclear 

facility has increased dramatically in recent years, placing further emphasis on the need for 

continued operation of aging facilities.

 

2 42 United States Code (USC) § 2286a(b)(1). 3 Recommendation 2004-1, Oversight of Complex, High-Hazard Nuclear Operations. May 21, 2004. 4 From 10 CFR 830.3, “Safety basis means the documented safety analysis and hazard controls that provide 

reasonable assurance that a DOE nuclear facility can be operated safely in a manner that adequately protects 

workers, the public, and the environment.”
3 

As facilities age, concerns develop over whether DOE can still safely operate and 

maintain them. Safety structures, systems, and components may degrade and not be able to 

reliably perform their safety functions. Older facilities continue to update their safety bases to 

comply with 10 CFR 830 without ensuring the reliability of safety systems, comprehensively 

evaluating the need for refurbishment or replacement of those systems, reconsidering the design 

or integrity of structures, or conducting a backfit analysis of equipment important to safety. 

Aging impacts are especially concerning for passive features (e.g., facility structures and fire 

walls) that are not required to be surveilled to ensure they can perform their safety function. 

While DOE performs some upgrades and retrofits at aging facilities, it lacks a formal, complexwide regulatory structure for identifying and performing upgrades necessary for the adequate 

protection of public and workers. 

In addition, as the infrastructure supporting safety systems (e.g., utilities and site 

services) ages, the supporting infrastructure may also degrade and impact the reliability of safety 

systems. DOE has taken action to address specific issues at particular sites, such as the Extended 

Life Program (ELP) at Y-12. However, the Board’s concerns about aging infrastructure extend 

across the complex. Efforts such as the Y-12 ELP are laudable, but a much more systematic 

approach is required to address the needs across the complex. The Board has previously 

communicated its concerns regarding age-related degradation of infrastructure. 

In a 2018 report5

, DOE’s Infrastructure Executive Committee noted that deferred 

maintenance had increased by 25 percent between 2013 and 2017 to a total of $5.9 billion dollars 

for operational facilities. Also, the report noted that 17 of the Department’s 79 core capabilities6

were potentially at risk due to inadequate infrastructure, including 5 core capabilities related to 

defense nuclear facility infrastructure and operation. 

The Administrator for the National Nuclear Security Administration (NNSA) recognized 

the challenges NNSA faces with regards to its aging infrastructure in her April 11, 2018, 

testimony to the Subcommittee on Energy and Water Development Senate Committee on 

Appropriations, “NNSA’s infrastructure is in a brittle state that requires significant and sustained 

investments over the coming decade to correct. There is no margin for further delay in 

modernizing NNSA’s scientific, technical, and engineering capabilities, and recapitalizing our 

infrastructure needed to produce strategic materials and components for U.S. nuclear weapons.” 

In addition to financial investment, a strong regulatory framework is needed to manage 

aging infrastructure investments and priorities. Accordingly, the Board believes that DOE needs 

to review its priorities and establish department-level policy and guidance for managing aging 

infrastructure. 

Hazard Categories—In 10 CFR 830, DOE applies a graded approach to the preparation 

of the safety basis for defense nuclear facilities, provides the criteria to be used for such 

gradation, and defines three Hazard Categories grouped by the significance of their 

 

5 Annual Infrastructure Executive Committee Report to the Laboratory Operations Board, March 27, 2018. 6 Core capability is defined in DOE Order 430.1C, Real Property Asset Management, as the ability to conduct 

programmatic activities that would be degraded should the asset fail to perform as intended.
4 

consequences to different receptors (i.e., offsite/public, onsite/collocated workers, and 

local/facility workers). In its proposed revision to 10 CFR 830, DOE proposes to delete the 

specific definitions of Hazard Categories and replace them with a generic definition in the future. 

If it removes the Hazard Category definitions from 10 CFR 830 and the rulemaking 

process, DOE fundamentally undermines important nuclear safety processes established in the 

rule. Hazard categorization is an important aspect of 10 CFR 830 because the process 

determines what safety basis requirements are applicable to a facility. When combined with the 

lack of an aging management program, this could enable contractors to increase the radiological 

hazards present in an aging facility without an adequate understanding of the ability of the 

facility’s safety structures, systems, and components to control the higher level of risk. 

DOE Approvals—Both DOE and the Board have observed that the current requirement 

for updating a facility’s documented safety analysis on an annual basis has been problematic at 

some defense nuclear facilities with complex activities. This is compounded when DOE and its 

contractors defer correcting known deficiencies until the next annual update instead of correcting 

the deficiencies within the current cycle. The Board also has observed situations where there 

have been multiple “review iterations” by the contractors and their DOE approval authorities. 

This could be a sign of disagreement between DOE and its contractor, or the lack of adequate 

technical quality or content in the safety basis documents submitted to DOE for approval. 

Difficulties in the annual update process also could indicate that DOE’s contractors are not 

implementing the unreviewed safety question (USQ) process consistent with DOE requirements. 

The Notice of Rulemaking does not provide an analysis of the problems that DOE is 

attempting to address, so it is not clear that DOE’s proposed change to remove the requirement 

for DOE to approve annual documented safety analysis (DSA) updates is an effective solution. 

Removal of this requirement also complicates DOE’s ability to ensure the configuration of the 

facility, the processes, and the documentation, and to evaluate the cumulative impact of 

temporary or permanent changes on the safety of the facility. The lack of an annual approval 

process could result in increasing latent risks as facilities and infrastructure age, due to the 

reduced frequency of DOE’s approval of the evaluation of the reliability of their safety 

structures, systems, and components. As the Board noted in Recommendation 2004-1, 

“Contractors are responsible to DOE for safety of their operations, while DOE is itself 

responsible to the President, Congress, and the public.” 

Safety Basis Process and Requirements—10 CFR 830 captures the fundamental 

requirements for nuclear safety management to ensure contractors perform work “with the 

hazard controls that ensure adequate protection of workers, the public, and the environment.” 

DOE provides additional requirements in orders and standards. These additional requirements 

may be imposed on contractors by reference in regulations or by contract. DOE also provides 

non-mandatory guidance in guides, handbooks, and manuals. 

DOE uses a number of processes for implementing an approved safety basis. The USQ 

process determines the approval authority for proposed changes to DSAs. Technical safety 

requirements (TSR) ensure that important operating parameters are maintained, and that safety 

structures, systems, and components are available and able to perform their defined safety 
5 

functions under all types of conditions. Specific administrative controls (SACs) are higher level 

administrative controls that have safety importance equivalent to engineered controls that would 

be classified as safety-class or safety-significant. 

USQs, TSRs, and SACs are all very important aspects of implementing and maintaining 

the safety basis at defense nuclear facilities. However, DOE does not provide specific 

implementation requirements in its regulatory framework, including 10 CFR 830, for contractor 

implementation of USQs, TSRs, and SACs. Instead, DOE provides non-mandatory guidance for 

USQ and TSR implementation via guidance documents and some requirements for SACs via a 

standard.

7

 This lack of implementation requirements leads to inconsistent implementation across 

the complex. Therefore, the Board concludes DOE should incorporate specific implementation 

requirements for USQs, TSRs, and SACs, in its regulatory framework, including 10 CFR 830. 

The attached Findings, Supporting Data, and Analysis document provides the Board’s 

supporting analysis for this recommendation. 

Conclusion. DOE needs to have a robust regulatory framework that provides sufficient 

structure such that both aging and new defense nuclear facilities continue to provide adequate 

protection of workers and the public. This recommendation is intended to strengthen DOE’s 

regulatory framework in its current form, including DOE’s orders, standards, and 

implementation. The Board agrees with DOE that 10 CFR 830 requires an update, but believes 

that the Notice of Proposed Rulemaking would actually erode the regulatory framework. DOE’s 

nuclear enterprise has grown since the original issuance of the rule; however, DOE’s regulatory 

framework has not been updated to include requirements for key concepts and safety control 

strategies upon which its defense nuclear facilities rely. 

Recommendation. To ensure adequate protection at defense nuclear facilities, the Board 

recommends that DOE revise its regulatory framework, to include requirements in 10 CFR 830, 

Nuclear Safety Management, associated orders and standards, and implementation thereof, as 

follows: 

1. Aging Infrastructure.

a. Develop and implement an approach including requirements to aging 

management that includes a formal process for identifying and performing 

infrastructure upgrades that are necessary to ensure facilities and structures, 

systems, and components can perform their safety functions. 

2. Hazard Categories. 

a. Retain qualitative definitions of hazard categories in 10 CFR 830. 

b. Revise 10 CFR 830 to mandate use of a single version of Standard 1027 when 

performing facility hazard categorization. 

 

7 DOE Standard 1186-2016, Specific Administrative Controls, contains requirements; however, those requirements 

are only enforceable if Standard 1186-2016 is included in a contract. 

RECOMMENDATION 2020-1 TO THE SECRETARY OF ENERGY

Nuclear Safety Requirements

Risk Assessment for Recommendation 2020-1 

This risk assessment supports the Defense Nuclear Facilities Safety Board’s (Board) 

Recommendation 2020-1, Nuclear Safety Requirements. Board’s Policy Statement 5, Policy

Statement on Assessing Risk, states:

Risk assessments performed in accordance with the Board’s revised enabling statute 

will aid the Secretary of Energy in the development of implementation plans focused on 

the safety improvements that are needed to address the Board’s recommendations.

This recommendation identifies deficiencies with the Department of Energy’s (DOE) 

proposed Nuclear Safety Management rule, 10 CFR 830, and with the implementation of the current 

rule’s requirements. Subpart B of the rule, Safety Basis Requirements, applies to the highest hazard 

defense nuclear facilities across the complex. The application of the changes DOE has proposed will 

have a far-reaching impact on those facilities posing the greatest risks to worker and public health 

and safety.

The Secretary of Energy is required to ensure adequate protection of the public. DOE 

established 10 CFR 830 as a fundamental part of the Secretary of Energy’s ability to ensure adequate 

protection. Given the weaknesses in the existing rule and further weaknesses in DOE’s proposed 

rulemaking, the Secretary of Energy cannot consistently ensure adequate protection. Therefore this 

recommendation is justified and necessary.
RECOMMENDATION 2020-1 TO THE SECRETARY OF ENERGY

Nuclear Safety Requirements

Findings, Supporting Data, and Analysis 

Background. The Department of Energy (DOE) developed the first draft of Subpart B to 

10 Code of Federal Regulations (CFR) Part 830, Safety Basis Requirements, in the mid-1990s 

using subject matter expertise from the Nuclear Regulatory Commission (NRC). DOE designed 

its format and contents similar to NRC’s 10 CFR 50, Domestic Licensing of Production and 

Utilization Facilities. To that end, DOE created the concept of a safety basis, which is a series of 

documents comprising a documented safety analysis (DSA), a technical safety requirements 

(TSR) document, and a safety evaluation report (SER). DOE would review and approve the 

contractor developed DSA and TSR documents, and issue the SER to document its review and 

approval. 

To maintain configuration control of the DSA while allowing some operational flexibility 

for the contractors, DOE established the unreviewed safety question (USQ) process so that 

contractors could make some changes to their activities as long as the changes were within the 

bounds of the DOE-approved DSA. Thus, three distinct sections were created in the main body 

of the rule, with the USQ process dedicated to the configuration control of the DSA; and any 

changes to the TSR document were to be submitted to DOE for approval prior to 

implementation. DOE Standard 1104, Review and Approval of Nuclear Facility Safety Basis and 

Safety Design Basis Documents established DOE’s process for its review and approval activities 

and the development of the SER. 

DOE provided additional details on these concepts in Appendix A to Subpart B as 

“DOE’s expectations for safety basis requirements of 10 CFR 830, acceptable methods for 

implementing these requirements, and criteria DOE will use to evaluate compliance with these 

requirements.” This concept was also modeled on NRC’s issuance of appendices to “establish 

minimum requirements” that need to be met in order to comply with 10 CFR 50. For example, 

Appendix A to Part 50 provides the general design criteria and Appendix R provides fire 

protection requirements. Neither NRC nor DOE intended to consider the contents of an 

appendix to a Code of Federal Regulations section to be subject to the users’ discretion. NRC 

provided additional detailed guidance in the regulatory guides that utilities use to comply with 

Part 50. Similarly, DOE provided a list of standards in Appendix A to Part 830 that contractors 

should use as acceptable methodologies for compliance with 10 CFR 830, Subpart B. These are 

known as the safe harbor standards. 

Introduction. As part of the DOE’s regulatory reform activities under Executive Order 

13777, Enforcing the Regulatory Reform Agenda, DOE directed its Office of Environment, 

Health, Safety and Security1

, working with the Office of the General Counsel, to initiate a 

rulemaking to revise 10 CFR 830 to address the following areas (amongst others): 

a. Regulatory Treatment of Hazard Category 3 Facilities. Differentiate the treatment 

of Hazard Category 2 and Hazard Category 3 nuclear facilities by developing a new 

 

1 Memorandum from Dan R. Brouillette, Deputy Secretary, to heads of elements, Initiate a Rulemaking to Revise 

10 CFR 830, dated August 15, 2017.
2 

subpart to 830 for Hazard Category 3 that provides an appropriate graded 

approach to the implementation of the requirements in 830 for both contractors and 

the Department. 

b. Safe Harbor Standards. Table 2 of Appendix A of 10 CFR 830, Subpart B, should 

be removed from the rule and become a separate standard (or other mechanism) 

referenced in the Rule. 

c. Standard 1027 (STD) Successor Document. Add the term ‘or successor document’ 

to the 10 CFR 830 requirement to categorize nuclear facilities consistent with DOE 

STD 1027-92. The [working] Team recommends that DOE initiate a new revision to 

DOE STD 1027 (in addition to the existing 1027-92 revision effort) that updates the 

hazard categorization methodology and can be synched with the eventual revision to 

830. 

d. Updates to Documented Safety Analyses (DSAs). Increase the periodicity from the 

existing annual requirement to either 2 or 3 years; the current (arbitrary) annual 

requirement is problematic for complex facilities (e.g., the DOE review/approval 

can take several months and overlap with contractor delivery of the annual update 

for the subsequent year). In addition, appropriately scoped updates should not 

require DOE approval. 

f. Unreviewed Safety Question (USQ). Set appropriate USQ approval levels, 

improving operational flexibility, and clarifying terminology. 

g. Limiting Analyses of Chemical Hazards. Limiting the requirement for the analysis 

of chemical hazards in DSAs, unless the chemicals, for example, are an initiator to a 

nuclear event, or inhibit responses to nuclear events. [Note: chemical hazards are 

already addressed in 10 CFR 851, Worker Safety and Health Program.]

These activities were to “result in significant improvements in efficiency and/or decrease 

in cost in Laboratory and DOE operations, while maintaining accountability and contractor 

performance standards [and] an appropriate level of DOE oversight.” 

Findings. DOE issued the notice of proposed rulemaking for 10 CFR 830 in August 

2018. The following paragraphs provide the Board’s findings and analysis of DOE’s proposed 

changes to 10 CFR 830, Subpart B, Safety Basis Requirements, and its referenced documents. 

1. Aging Infrastructure. 

DOE’s memorandum that initiated the rulemaking relied on input and proposals from a 

working group to “identify internal DOE reforms that could result in significant improvements in 

efficiency and/or decrease in cost...while maintaining accountability and contractor performance 

standards.” From the working group’s proposal, DOE identified several focus areas, including 

reform of 10 CFR 830, for further development of actions that may achieve the goal of 

improving efficiency and decreasing cost. This effort did not identify issues with the aging 
3 

infrastructure, including lack of DOE guidance or requirements for maintenance, or the adequacy 

of safety posture for indefinite continued operation. 

It is clear that as defense nuclear facilities age, their safety bases will become more 

complex. In some cases, DOE introduced new missions into old facilities, which are dependent 

upon dated technological infrastructure. Complexity has been shown to drive the contractors to 

heavily rely on administrative controls, instead of engineered features, to overcome the inherent 

difficulties involved in trying to comply with the requirements of 10 CFR 830, Subpart B. 

At the time when 10 CFR 830 was crafted, the majority of defense nuclear facilities were 

only a few decades old, and DOE had launched an aggressive effort to construct new facilities to 

replace them. Facilities such as the Replacement Tritium Facility (RTF, now known as Building 

233-H) at the Savannah River Site were examples of this vision in the early 1990s. However, 

three decades after the construction and startup of RTF, DOE continues to rely on some older 

facilities to support its tritium operations for the indefinite future. Similarly, DOE embarked 

upon design and construction of the Uranium Processing Facility at the Y-12 National Security 

Complex, but plans to continue to rely on operation of two other 50-plus year old facilities for 

another several decades to support its production commitments for national security purposes. 

A significant number of defense nuclear facilities in the complex are now more than 

50 years old and have surpassed their design life by decades. Concerns over whether facilities

can still be operated and maintained safely develop as facilities age. Safety structures, systems, 

and components may degrade and be unable to perform their safety functions reliably. As the 

infrastructure supporting those safety systems (e.g., passive features, utilities, and site services) 

ages, it may also degrade and impact the reliability of those safety systems. 

As facilities age, concerns develop over whether DOE can still safely operate and 

maintain them. Safety structures, systems, and components may degrade and not be able to 

reliably perform their safety functions. Older facilities continue to update their safety bases to 

comply with 10 CFR 830 without ensuring the reliability of safety systems, comprehensively 

evaluating the need for refurbishment or replacement of those systems, reconsidering the design 

or integrity of structures, or conducting a backfit analysis of equipment important to safety. 

Aging impacts are especially concerning for passive features (e.g., facility structures and fire 

walls) that are not required to be surveilled to ensure they can perform their safety functions. 

While DOE performs some upgrades and retrofits at aging facilities, DOE lacks a formal, 

complex-wide regulatory structure for identifying and performing upgrades necessary for the 

adequate protection of public and workers. 

In addition, as the infrastructure supporting safety systems (e.g., utilities and site 

services) ages, the supporting infrastructure may also degrade and impact the reliability of safety 

systems. DOE has taken action to address specific issues at particular sites, such as the Extended 

Life Program (ELP) at Y-12. However, the Board’s concerns about aging infrastructure extend 

across the complex. Efforts such as the Y-12 ELP are laudable, but a much more systematic 

approach is required to address the needs across the complex. The Board has previously 

communicated its concerns regarding age-related degradation of infrastructure. For example, in 

prior communications the Board has expressed concerns with age-related degradation in:
4 

• General-service water distribution systems that provide water to safety-significant or 

safety-class fire suppression systems;

• General-service electrical distribution systems that could impact the reliability of 

safety-significant confinement ventilation systems; and

• Building structures and internal systems that cannot withstand the seismic loads 

required to meet their designated performance categories.2

In a 2018 report3

, DOE’s Infrastructure Executive Committee noted that deferred 

maintenance had increased by 25 percent between 2013 and 2017 to a total of $5.9 billion dollars 

for operational facilities, and that 17 of DOE’s 79 core capabilities4 were potentially at risk due 

to inadequate infrastructure (see Table 1 for examples).

Table 1. Core Capabilities Potentially at Risk Due to Infrastructure Deficiencies5

Core Capability 

Replacement Plant 

Value6 assessed as 

Inadequate

Decontaminate and Decommission 

Facilities and Infrastructure

74%

Uranium 45%

Nuclear Material Accountability, Storage, 

Protection, and Handling

43%

Plutonium 40%

Weapons Assembly/Disassembly 36%

In recognition of the general situation of aging infrastructure in DOE and its potential 

impacts on the defense nuclear facilities, the Board is concerned that DOE needs to review its 

priorities and establish department-level policy and guidance for managing the aging 

infrastructure supporting those facilities.

 

2 See Board correspondence dated March 13, 2007; February 6, 2009; September 10, 2010*; September 30, 2011*; 

March 27, 2012; October 31, 2012*; February 25, 2013; October 30, 2013*; February 4, 2015; October 29, 2015; 

December 16, 2015; May 11, 2017; September 7, 2018; and July 2, 2019. The four dates with an asterisk are annual 

aging infrastructure reports the Board issued to Congress and forwarded to DOE. The dates are from the cover letter 

forwarding the report to DOE.

3 Annual Infrastructure Executive Committee Report to the Laboratory Operations Board; March 27, 2018. 4 Core capability is defined in DOE Order 430.1C, Real Property Asset Management, as the ability to conduct 

programmatic activities that would be degraded should the asset fail to perform as intended.

5 Data is from Table C of Annual Infrastructure Executive Committee Report to the Laboratory Operations Board; 

March 27, 2018.

6 Replacement Plant Value (RPV) is defined in DOE Order 430.1C, Real Property Asset Management, as the cost to 

replace the existing structure with a new structure of comparable size using current technology, codes, standards, 

and materials.
5 

DOE has not conducted a comprehensive analysis of the difficulties facing its aging 

infrastructure at defense nuclear facilities. Without this analysis, DOE’s efforts will not address 

the fundamental reasons for increased cost or other difficulties of maintaining old facilities in 

operational condition; nor will it assess the reduction in their margin of safety that may occur as 

the facilities age. 

DOE needs to evaluate the state of its aging facilities, identify their required operational 

life to meet their mission needs, and develop an integrated plan for replacement or refurbishment 

of those facilities to maintain their safety posture and ensure adequate protection of the public, 

the workers, and the environment. DOE does not have any DOE-wide policies, directives, or 

requirements in place for implementing an effective aging management program. Accordingly, 

DOE needs to develop requirements and criteria for dealing with its aging infrastructure. 

2. Hazard Categories. 

Definition of Hazard Categorization—In 10 CFR 830, DOE requires application of a 

graded approach to the preparation of DSAs and provides the criteria to be used for such 

gradation in Section 830.3 of Subpart B. Table 1 in Appendix A to Subpart B defines three 

hazard categories that are grouped by the significance of their consequences to different 

receptors (i.e., offsite/public, onsite/collocated workers, and local/facility workers). 

In the proposed revision to 10 CFR 830, DOE deletes Table 1 and the specific definitions 

of hazard categorization, and states that it intends to provide a generic definition in the future 

that is not described at this time. DOE Standard 3009, safe harbor for preparation of a DSA, is 

formulated using the concept provided in Table 1 of the existing Subpart B. By removing the 

definitions of hazard categories from Part 830 and the rulemaking process, DOE’s proposed 

revisions fundamentally undermine important nuclear safety processes established in the rule. 

Hazard categorization is a fundamental element of the safety basis requirements of 

10 CFR 830 because the process determines whether the safety basis requirements of Subpart B 

are applicable to a facility. Based on the definition of hazard categories provided in Table 1, 

DOE referred to Standard 10277

 and mandated its use in Section 830.202 of the rule because 

“DOE want[ed] contractors to be consistent when determining the hazard classification for its 

nuclear facilities, hence we are requiring the consistent use of DOE-STD-1027 which has an 

established history for this purpose.”8 DOE’s proposed action to delete Table 1, without any 

detailed discussion regarding hazard categorization, and deferring to a future document to be 

developed: 

• Lacks the “established history” and a roadmap for preparation and implementation of 

the replacement approach; 

 

7 DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for compliance with DOE Order 

5480.23, Nuclear Safety Analysis Reports; Change Notice 1, September 1997. 8 Preamble to 10 CFR 830, Section III, Response to Comments on the Interim Final Rule, response to Comment N.
6 

• Does not provide the rationale for such a significant change in approach, which has 

been practiced for more than two decades without known degradation or deficiencies 

in implementation of nuclear safety requirements; 

• Creates an ambiguous and unclear domain of standards to be developed for 

compliance with nuclear safety requirements; and

• Undermines the fundamental principles of the graded approach and its 

implementation as described in the rule.

Reference to Standard 1027 Within the Rule—DOE’s memorandum to initiate the 

rulemaking recommended adding the phrase “or successor document” to 10 CFR 830.202(b)(3) 

and to “initiate a new revision [to Standard 1027] that updates the hazard categorization 

methodology.” 

DOE prepared Standard 1027 in 1992 to provide guidance on hazard categorization and 

on the performance of hazard analyses for preparation of safety bases for nonreactor nuclear 

facilities. It used the available technical information to develop screening criteria and grouping 

of the nuclear facilities based on their potential consequences to the immediate workers, site 

area, and offsite members of the public. DOE also based Standard 1027 on a survey of all DOE 

nuclear facilities and their potential hazards to arrive at a set of parameters that would 

realistically categorize those facilities based on their potential consequences. More updated 

technical information and recommendations by the International Commission on Radiological 

Protection (ICRP)9, 10 has resulted in some changes to those parameters. It would be prudent, 

and technically justified, to use the most up to date information in a DOE standard that is 

fundamental for graded implementation of nuclear safety requirements at defense nuclear 

facilities.

This DOE action, combined with the deletion of Table 1 from the rule that defines hazard 

categories, and deferring a new definition to be provided outside the rulemaking process, will 

create an uncertain, ambiguous, and unclear methodology for implementation of 10 CFR 830 at 

the defense nuclear facilities; and consequently, a potential for eroding the level of protection 

currently provided by those facilities. 

Additionally, both the existing version and the proposed revision of 10 CFR 830 state 

that a contractor must “categorize the facility consistent with” Standard 1027 rather than “in 

accordance with” Standard 1027. The words “consistent with” introduce flexibility in 

implementation to not actually follow the requirements in Standard 1027. This language has 

already led to the National Nuclear Security Administration (NNSA) issuing supplemental 

 

9 ICRP 68, 1994, Dose Coefficients for Intakes of Radionuclides by Workers, Replacement of ICRP Publication 61, 

International Commission on Radiological Protection, Pergamon Press, Oxford, Great Britain. 10 ICRP 72, 1995, Age-Dependent Doses to Members of the Public from Intake of Radionuclides, Part 5, 

Compilation of Ingestion and Inhalation Dose Coefficients, International Commission on Radiological Protection, 

Pergamon Press, Great Britain.
7 

guidance to its facilities to use a modification11 to Standard 1027 that is not cited by the rule and, 

therefore, not used by the Office of Environmental Management; resulting in an inconsistent 

gradation of defense nuclear facilities in the complex. 

The safety basis requirements in Subpart B apply to Hazard Category 1, 2, or 3 nuclear 

facilities. With DOE’s proposed revisions, 830 would not include any language that defines 

these terms, and DOE can change the definitions of these terms outside the rulemaking process. 

3. Submission and Approval of Safety Bases. 

Need for Root Cause Analysis and DOE Approval of Annual Updates to the DSA—The 

DOE memorandum that initiated the rulemaking directed DOE elements to “increase the 

periodicity from the existing annual requirement to either two or three years; the current 

(arbitrary) annual requirement is problematic for complex facilities. In addition, appropriately 

scoped updates should not require DOE approval.” In accordance with the memorandum, the 

notice of proposed rulemaking deletes the requirement for DOE review and approval of the 

annual updates to the DSAs. This DOE action weakens the safety basis construct created by 

DOE in establishing Subpart B. DOE required the preparation of safety basis for nuclear 

facilities to ensure that adequate protection of the public and the workers is implemented through 

compliance with its safe harbor standards. It also weakens the USQ process, which ensures that 

the safety bases are maintained under a defined configuration control program. 

The Board has noted that some defense nuclear facilities with complex activities have 

difficulty meeting the annual update commitments. Although this was not anticipated by DOE at 

the time when 10 CFR 830 was issued in January 200112, some sites rely on inter-related 

documents that comprise their safety bases and it might be difficult to ensure that the various 

elements of their safety bases are updated consistently in the allowed time.13 

The Board has also observed situations where there have been multiple “review 

iterations” by contractors and their DOE approval authorities. This could be a sign of 

disagreement between DOE and its contractor, or the lack of adequate technical contents of the 

DSAs submitted to DOE for approval. Difficulties in submitting an annual update also could 

indicate that DOE’s contractors are not implementing the USQ process consistent with the 

requirements. 

DOE’s notice of rulemaking does not identify the problems that DOE is attempting to 

address, so it is not clear that DOE’s proposed change is an appropriate solution. It would be 

prudent for DOE to evaluate the reasons why contractors and DOE experience significant 

challenges implementing the annual requirement. DOE needs to conduct a root cause analysis to 

determine why DOE and its contractors are having difficulties managing the review and approval 

 

11 NNSA Supplemental Guidance 1027, Guidance on Using Release Fraction and Modern Dosimetric Information 

Consistently with DOE STD 1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance 

with DOE Order 5480.23, Nuclear Safety Analysis Reports. 12 66 FR 1810, DOE response to Comment JJ, Section III of the final Rule, 10 CFR 830: “If the USQ process has 

been followed properly, the annual approval of the documented safety analysis should require minimal effort.”

13 For example, the Board has corresponded on PF-4 at LANL, Pantex, and the Tritium Facilities at the Savannah 

River Site among others.
8 

of annual updates, and use the results of that analysis to fix the underlying problems. While 

conducting the analysis, DOE should retain the requirement for contractors to develop and 

submit safety bases on an annual schedule for DOE approval. 

In the revised Appendix A to Subpart B, DOE proposes language to clarify that it will 

continue to review the DSA updates in some cases, and may even approve the annual update in 

some cases. The proposed language states, “DOE will review each documented safety 

analysis...if DOE has reason to believe a portion of the safety basis has substantially changed.” 

Another relevant new sentence is: “If additional changes are proposed by the contractor and 

included in the annual update that have not been previously approved by DOE or have not been 

evaluated as a part of the USQ process, DOE must review and approve these changes.” DOE’s 

notice of rulemaking does not include a detailed discussion of these changes, and therefore they 

do not alleviate concerns with removing DOE’s approval of the annual update. 

Temporary Authorization of Activities—10 CFR 830.202(g)(3) requires contractors to 

“Submit the evaluation of the safety of the situation to DOE prior to removing any operational 

restrictions initiated to meet [safe condition]” of the facility. Those operational restrictions (or 

other compensatory measures) may continue to be required for a long period of time. Per DOE 

Guide 424.1-1B, Implementation Guide for Use in Addressing Unreviewed Safety Question 

Requirements, the vehicle for operating under restrictions for “an extended period of time” until 

the next annual update of the DSA is issued, is the justification for continued operations (JCO), 

which is a “temporary change to the facility safety basis.” The DOE guide states that the 

contractor should submit the JCO to DOE for approval. However, the rule does not formally 

require DOE’s approval of a JCO. 

In some cases, contractors eventually incorporate the operational restrictions and 

accompanying analyses (or some revised version of them) into the DSA via the annual update. 

In other cases, JCOs continue to be a stand-alone part of the safety basis for several years. With 

DOE’s proposed revision to the rule, i.e., not requiring DOE approval of the annual updates to 

the DSA, there will be important changes to the safety basis with no requirement for their 

approval by DOE. 

Instead of a JCO, contractors may prepare an evaluation of the safety of the situation 

(ESS) that includes operational restrictions. DOE Guide 424.1-1B states that DOE should 

approve ESSs for potential inadequacies of the safety analysis (PISAs) that represent a positive 

USQ; however, the rule does not require DOE approval for this situation. Under DOE’s 

proposed revision to the rule, the ESS can represent a mechanism for the contractor to make 

important changes to the safety basis without any requirement for DOE approval. 

4. Safety Basis Process and Requirements.

Fundamental Elements of Safety Bases—Unlike the safe harbors for DOE nonreactor 

nuclear facilities and nuclear explosive facilities for compliance with the DSA requirements of 

the rule, the rule does not provide any standards for compliance with USQs or TSRs; instead, it 

refers to DOE guides on those subjects, DOE Guide 424.1-1B and DOE Guide 423.1-1B, 

Implementation Guide For Use In Developing Technical Safety Requirements, respectively. 
9 

DOE guides, however, “describe[s] acceptable, non-mandatory means for meeting 

requirements.” As a result, contractors’ implementation at the sites are diverse and inconsistent. 

The Deputy Secretary identified this issue in his memorandum as one to be addressed in the 

proposed rule. The Board has made similar observations that include lack of uniformity of 

implementation, and in some cases, inconsistency of implementation with the requirements of 

the rule. 

Requirements Regarding the USQ Process—DOE Guide 424.1-1B provides an example 

of guidance on USQs that should be examined for elevation to a requirement and inclusion in 

Subpart B. The guide includes expectations on the timeliness with which contractors process 

PISAs: 

It is appropriate to allow a short period of time (hours or days but not weeks) to

investigate the conditions to confirm that a safety analysis is potentially inadequate 

before declaring a PISA....If it is immediately clear that a PISA exists, then the 

PISA should be declared immediately14. 

This timeliness is important for safety, as it causes the contractor to formally declare a 

PISA and take actions to place the facility in a safe condition. Contractors do not always 

perform this step in a timely manner (i.e., within hours or days, but not weeks). This leads 

contractors to delay implementing the necessary compensatory measures to place or maintain the 

facility in a safe condition that provides adequate protection of the public. There are instances 

where contractors have delayed a PISA declaration beyond hours or days because they deemed 

the information to be not yet mature enough to merit that action. The DOE guidance quoted 

above already addresses this situation, saying that the contractors may take hours or days to 

investigate, but not weeks. It should be noted that a similar statement was made in resolution of 

comments received for the final rulemaking of 10 CFR 830: “the contractor’s USQ procedure 

should define the period for performance of a USQ determination related to a PISA and that time 

period should be on the order of days, not weeks or months.” However, not all contractors’ 

procedures comply with this expectation. 

DOE should formalize this guidance on timeliness into a requirement, to ensure that 

contractors place facilities into safe conditions when they discover PISAs. If DOE believes it is 

necessary to make some allowance for delaying action because the new information is immature, 

DOE should provide the criteria for defining “information maturity.” Declaring the information 

as “immature” and not declaring a PISA should be exceptional and subject to compliance with 

DOE criteria. Such criteria, however, do not exist and need to be developed. 

 

Additionally, the Board has observed that some contractors allow themselves a “grace 

period” to take action and return the facility into compliance with their safety bases without 

declaring a PISA.

15 As a result, the facility would be operating outside of its approved safety 

basis for the duration of the grace period without DOE knowledge or approval of the situation, 

 

14 DOE Guide 424.1-1B, Section C.2. 15 Board Recommendation 2019-1, Uncontrolled Hazard Scenarios and 10 CFR 830 Implementation at the Pantex 

Plant, February 20, 2019. 
10 

and without having to take safety precautions to put the facility in a safe configuration. Section 

830.202, Subpart B, does not allow this action, which may result in unsafe operation of defense 

nuclear facilities and a lack of adequate protection of the public. 

Several of the USQ procedures approved by DOE lack any requirements for training and 

qualification of USQ screeners. These individuals are the first line of defense against lack of 

compliance with the requirements of the rule, and their knowledge of the facility and its safety 

basis, as well as the USQ process, is of utmost importance. While preparation of safety bases 

throughout the complex has created a wealth of knowledgeable subject matter experts that the 

contractors rely on, implementation of USQ procedures and USQ screening sometimes relies on 

available personnel, making their training and qualification an important aspect of the safety of 

operations. 

The definition of USQ in the rule also warrants clarification. The proposed (and also 

existing) definition for USQ in Section 830.3 uses the term “equipment important to safety.” 

This term is not defined in 10 CFR 830, though it is defined in DOE Guide 424.1-1B. Proper 

and consistent implementation would be better achieved if the definition from the guide were 

also included in the rule. 

Finally, 10 CFR 830 does not specify what documentation a contractor is required to 

submit to DOE prior to obtaining approval for planned actions involving a USQ. Specifically,

section 830.203(d) states, “A contractor responsible for a Hazard Category 1, 2, or 3 DOE 

nuclear facility must obtain DOE approval prior to taking any action determined to involve a 

USQ.” This section does not specify whether a contractor must submit planned changes to the 

safety basis, a description of planned changes, or if no documentation is required and a verbal 

explanation would suffice. Accordingly, when DOE approves contractor action, it is not clear 

that DOE is specifically approving any planned changes to the safety basis. 

Requirements Regarding TSRs—DOE Guide 423.1-1B includes some aspect of the 

content of TSR documents that should be considered for elevation to the rule. In Appendix C to 

the Guide, DOE combines the Section 830.201 requirement for the contractor to “perform work 

in accordance with the DOE-approved safety basis” with the quality assurance requirements in 

Subpart A of the rule. From these two portions of the rule, DOE derives a need for the 

contractor to “independently confirm the proper implementation of new or revised safety basis 

controls.” This is an important concept for ensuring safe operation of the facility, and should be 

directly included in the rule. 

One area of difficulty for contractors preparing TSRs has been in the determination of 

“completion times.” TSRs typically define actions the contractor will take when safety 

structures, systems, and components (SSC) do not meet their limiting conditions for operation. 

This scenario can occur intentionally due to a maintenance outage, or unintentionally due to 

degradation of a safety-related SSC. TSRs define the required times (completion times) by 

which the contractor must take temporary actions to compensate for the loss of safety SSCs, or 

by which the contractor will restore SSCs. According to the guide, when developing completion 

times, the contractor should consider “the safety importance of the lost safety function” and “the 

risk of continued operations.” In practice, some completion times appear excessively long, with 
11 

no documented consideration of safety risk for DOE’s review and acceptance. DOE should 

revise Appendix A to Subpart B to include the concept that safety risks should be considered 

when developing completion times. 

Similarly, some contractors have prepared TSR documents that the action to be taken, 

when a safety SSC is inoperable or found to be unavailable, is simply to submit to DOE a 

“recovery plan.” Some of these recovery plans are open-ended, without any completion date or 

compensatory measures in place to achieve an equivalent level of safety as provided in the TSR. 

As a result, some defense nuclear facilities could be operating outside the bounds of their 

approved safety basis, relying on an approved “recovery plan” to be completed by some 

unspecified date. Such situations warrant explicit requirements in the rule to prevent nuclear 

facilities from operating with less than adequate levels of safety.

Fundamental Nuclear Safety Principles—10 CFR 830 provides the requirements for 

identification and analysis of hazards, identification of controls, and the quality assurance that 

must be applied to all stages of nuclear facility operations. However, it does not require 

implementation of the most fundamental nuclear safety principle, defense-in-depth, to ensure 

that no one layer of control is solely relied on for safety.

In a letter to the Deputy Secretary of Energy, dated July 8, 1999, the Board stated: 

Current requirements for nuclear safety design, criticality safety, fire protection 

and natural hazards mitigation are set forth in DOE Order 420.1, Facility Safety. 

This Order (Section 4.1.1.2), when contractually invoked, requires that: 

‘Nuclear facilities shall be designed with the objective of providing multiple layers 

of protection to prevent or mitigate the unintended release of radioactive materials 

to the environment.’ 

This “defense-in-depth” approach is the hallmark of nuclear facility and process 

designs. 

DOE Order 420.1C, Facility Safety, includes an expanded discussion of what the 

defense-in-depth concept entails. However, the requirements of Order 420.1C are not applied to 

the operation of existing defense nuclear facilities unless DOE’s contract with the management 

and operating contractor has specifically identified and stipulated its application. As a result, 

DOE does not routinely implement the defense-in-depth concept to ensure safe operation of 

nuclear activities. The controls identified in DSAs for existing facilities are usually a 

compilation of the existing controls, and rarely have led to the identification of new controls for 

ensuring that multiple layers of protection exist to defend against the release of radioactive 

materials. This weakness is more common when contractors rely on SACs to compensate for the 

lack of a safety-related engineered feature to prevent or mitigate an event. 

10 CFR 830, Subpart B, needs to require the defense-in-depth construct to ensure that all 

nuclear facilities and activities meet this fundamental nuclear safety construct, and provide 
12 

adequate protection of the public and the workers such that no one failure of a layer of protection 

would lead to the release of radioactive materials. 

Specific Administrative Controls—DOE created the concept of the SAC in response to 

the Board’s Recommendation 2002-3, Requirements for the Design, Implementation, and 

Maintenance of Administrative Controls. To provide guidance on this topic, DOE created a new 

standard, Specific Administrative Controls, and revised several other standards and guides to 

ensure consistency. SACs are a higher level administrative control that have safety importance 

equivalent to engineered controls that would be classified as safety-class or safety-significant. 

For this reason, SACs are an important tool for DOE to ensure adequate protection 

Although DOE created a new standard for SACs, DOE did not revise 10 CFR 830 to 

reflect the concept of implementing SACs as an equivalent TSR control. As a result, the 

discussion in 10 CFR 830 on safety controls is incomplete and does not fully reflect current DOE 

terminology and practice. Accordingly, DOE should include the concept of SACs within the 

requirements of 10 CFR 830, Subpart B.