DOE G 226.1-2, Federal Line Management Oversight of Department of Energy Nuclear Facilities

AVAILABLE ONLINE AT: INITIATED BY: www.directives.doe.gov Office of Health, Safety and Security DOE G 226.1-2 6-21-2012 FEDERAL LINE MANAGEMENT OVERSIGHT OF DEPARTMENT OF ENERGY NUCLEAR FACILITIES [This Guide describes acceptable, non-mandatory means for meeting requirements. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with associated rules or directives.] U. S. DEPARTMENT OF ENERGY Washington, DC NOT MEASUREMENT SENSITIVE http://www.directives.doe.gov/ DOE G 226.1-2 i (and ii) 6-21-12 FOREWORD This Guide is approved for use by all Department of Energy (DOE), including National Nuclear Security Administration, organizations. Beneficial comments (recommendations, additions, deletions, and any pertinent data) that may improve this document should be sent to: Dr. Patricia Worthington HS-10 U.S. Department of Energy Washington, D.C. 20585 Phone (301) 903-5926 DOE guides are part of the DOE Directives System and are issued to provide supplemental information regarding the Department’s expectations of its requirements as contained in rules, Orders, Notices, and regulatory standards. This Guide does not establish or invoke any new requirements. This Guide was developed in support of DOE Order 226.1B, Implementation of Department of Energy Oversight Policy. It provides guidance that may be useful to DOE line management organizations in meeting the provisions of that order when applied to nuclear facilities. DOE G 226.1-2 iii 6-21-12 Table of Contents Acronyms .........................................................................................................................................v 1. INTRODUCTION ................................................................................................................... 1 1.1 Purpose ............................................................................................................................ 1 1.2 Scope ............................................................................................................................... 1 1.3 Background ..................................................................................................................... 2 1.4 Applicability and Exclusions .......................................................................................... 2 2. OVERVIEW OF DOE SAFETY OVERSIGHT PROGRAM ................................................ 3 2.1 Contractor Assurance System ......................................................................................... 4 2.2 DOE Line Management Oversight ................................................................................. 5 2.2.1 DOE Field Element Safety Oversight ....................................................................... 6 2.2.2 DOE Program Office Safety Oversight .................................................................... 7 2.2.3 Central Technical Authorities and Chief of Nuclear Safety/Chief of Defense Nuclear Safety ......................................................................................................................... 7 2.2.4 Federal Training and Qualifications ......................................................................... 8 2.3 Independent Oversight and Other DOE and External Reviews ...................................... 8

2.4 Overview of General and Detailed Guidance for Federal Line Management Safety Oversight of Nuclear Facilities ................................................................................................... 8 3. GUIDANCE FOR FEDERAL LINE MANAGEMENT SAFETY OVERSIGHT OF NUCLEAR FACILITIES ............................................................................................................. 11 3.1 Scope of DOE Line Management Program for Safety Oversight of Nuclear Facilities 11 3.2 Tailoring to Facilities, Activities, and Hazards ............................................................ 15 3.3 Designing and Implementing DOE Field Element Oversight Programs ...................... 17 3.3.1 Field Element Oversight Objectives for Nuclear Facilities .................................... 17 3.3.2 Field Element Mechanisms for Oversight of Nuclear Facilities ............................. 19 3.3.3 Field Element Nuclear Facility Oversight Plan ...................................................... 20 3.3.4 Integrated Oversight Plan ....................................................................................... 20 3.4 Designing and Implementing DOE Program Office Oversight Programs.................... 22 3.4.1 Program Office Oversight ....................................................................................... 22 3.4.2 CTA Oversight Functions ....................................................................................... 23 3.5 Evaluation Processes ..................................................................................................... 23 iv DOE G 226.1-2 6-21-12 3.5.1 Operational Awareness Activities........................................................................... 24 3.5.2 Assessments of Facilities, Operations, and Programs ............................................ 25 3.5.3 Assessments of the Contractor Assurance System ................................................. 26 3.5.4 Self-Assessment ...................................................................................................... 27 3.6 Issues/Corrective Action Management Program .......................................................... 27 3.6.1 Issue Identification and Resolution ......................................................................... 29 3.6.2 Feedback ................................................................................................................. 31 3.7 Performance Measures and Communications ............................................................... 32 4. DETAILED GUIDANCE FOR FEDERAL LINE MANAGEMENT SAFETY OVERSIGHT OF NUCLEAR FACILITIES................................................................................ 35 4.1 Detailed Guidance for DOE Line Management Oversight of Core and Cross Cutting Performance Areas for Nuclear Facilities ................................................................................. 35 4.1.1 Safety System Operability ...................................................................................... 35 4.1.2 Technical Safety Requirements Implementation .................................................... 38 4.1.3 Safety Management Program Implementation ....................................................... 44 4.1.4 Safety Management System Implementation ......................................................... 46 4.1.5 Formality of Operations Programs.......................................................................... 49

4.1.6 Safety Culture ......................................................................................................... 51 4.2 Application of Criteria Review and Approach Documents .......................................... 54 4.2.1 Description of a CRAD ........................................................................................... 55 4.2.2 Available Sets of CRADs ....................................................................................... 56 Appendix A1: List of DOE Hazard Category 1, 2 and 3 Nuclear Facilities ............................... A-1 Appendix B1: Rules and Directives Applicable to Nuclear Facilities Line Management Oversight ............................................................................................................. A-2 Appendix C1: Criteria Review and Approach Documents ......................................................... A-3 LIST OF FIGURES Figure 1. DOE’s Multi-Tiered Approach to Safety Oversight ........................................................4 Figure 2. Overview of DOE Federal Line Management Oversight .................................................6 Figure 3. Framework for Nuclear Facility Oversight ....................................................................13 1 The appendices are available at http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html DOE G 226.1-2 v (and vi) 6-21-12 ACRONYMS AC Administrative Control CAP Corrective Action Plan CAS Contractor Assurance System CDNS Chief of Defense Nuclear Safety CFR Code of Federal Regulations CNS Chief of Nuclear Security CRAD Criteria Review and Approach Document CRD Contractor Requirements Document CTA Central Technical Authority DNFSB Defense Nuclear Facilities Safety Board DOE U.S. Department of Energy DRB Directives Review Board DSA Documented Safety Analysis EFCOG Energy Facility Contractors Group G Guide HDBK Handbook HSS Office of Health, Safety and Security IG Inspector General IOP Integrated Oversight Plan ISM Integrated Safety Management IV Independent Verification IVR Implementation Verification Review LOI Line of Inquiry M Manual NNSA National Nuclear Security Administration NQA Nuclear Quality Assurance NRC Nuclear Regulatory Commission O Order P Policy PSO Program Secretarial Officer QA Quality Assurance SAC Specific Administrative Control SCWE Safety Conscious Work Environment SMP Safety Management Program SR Surveillance Requirement SSC Structures, Systems, and Components SSO Safety System Oversight STD Standard STSM Senior Technical Safety Manager TSR Technical Safety Requirement USQ Unreviewed Safety Question DOE G 226.1-2 1 6-21-12 1. INTRODUCTION 1.1 Purpose The purpose of this Guide is to provide U.S. Department of Energy (DOE) line management organizations with guidance that may be useful to them in effectively and efficiently implementing the requirements of DOE O 226.1B, Implementation of Department of Energy Oversight Policy, dated April 25, 2011, as applied to Federal line management of hazard category 1, 2, and 3 nuclear facilities. This Guide describes acceptable, non-mandatory means for meeting requirements contained in DOE regulations and directives. This Guide provides flexible guidance that is intended to help DOE organizations in their efforts to sustain effective line management oversight of nuclear facilities. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with associated rules or directives.

1.2 Scope For the purposes of this Guide, “nuclear facilities” refers to facilities and related activities authorized by the DOE Approval Authority within the scope of an approved safety basis for nuclear facilities. Nuclear facilities currently include approximately 194 hazard category 1, 2, and 3 nuclear facilities managed by the National Nuclear Security Administration (NNSA) and the DOE Offices of Environmental Management, Science, and Nuclear Energy. These facilities are listed in Appendix A (which is available at http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html). Designation of facilities as hazard category 1, 2, or 3 may change as missions within facilities change. Federal line management safety oversight programs include: • Maintaining operational awareness and evaluating safety performance of both contractor- and government-operated nuclear facilities, • Evaluating the effectiveness of Federal line management safety oversight programs and functions, such as self-assessments and Facility Representative programs, • Central Technical Authority (CTA) and Chief of Nuclear Safety (CNS)/Chief of Defense Nuclear Safety (CDNS) oversight of program offices, field elements, and contractors, and • Managing issues and corrective action management systems. This Guide is intended to complement, but not duplicate, other DOE guidance on safety management, governance, quality assurance (QA), and oversight processes. For instance, oversight of design and construction of a new, and major modification of an existing, nuclear facility is covered by DOE-STD-1189-2008, Integration of Safety into the Design Process; review and approval of nuclear facility safety basis documents is covered by DOE-STD-1104- 2009, Review and Approval of Nuclear Facility Safety Basis and Safety Design Basis Documents; and activities associated with DOE authorization in the startup or restart process is covered by DOE O 425.1D, Verification of Readiness to Start Up or Restart Nuclear Facilities. http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html 2 DOE G 226.1-2 6-21-12 This Guide focuses on the requirements that apply solely to nuclear facilities, such as Title 10 Code of Federal Regulations Part 830, Nuclear Safety Management (10 CFR 830), Subpart A, Quality Assurance and Subpart B Safety Basis requirements to develop and implement quality assurance programs, documented safety analyses (DSAs), technical safety requirements (TSRs), and an unreviewed safety question (USQ) process. This Guide addresses only hazard category 1, 2, and 3 nuclear facilities. It does not address accelerator, radiological, and non-nuclear chemical or industrial facilities, nor does it include guidance on oversight of security programs or business elements. This Guide focuses on nuclear safety (i.e., programs and processes designed to prevent or mitigate a release of radioactive materials or prevent uncontrolled or unmonitored radiation exposure) and does not address industrial or worker safety within nuclear facilities (except to the extent that industrial safety programs, such as electrical safety and maintenance, interface with systems and mechanisms that ensure nuclear safety). However, DOE and contractor management may find some of the information in this Guide useful in developing other aspects of oversight programs.

Section 2 of this Guide provides an overview of the overall current DOE oversight program to provide context for the guidance relevant to the scope of this Guide. Sections 3 and 4 provide general and detailed guidance for DOE line management oversight of nuclear facilities, which, as stated above, is a subset of the DOE’s overall oversight program. 1.3 Background DOE policy includes the expectation that safety oversight programs be established and maintained to ensure that all aspects of nuclear-related work are conducted with the highest standards of quality and safety. The essential requirements to implement that policy are contained in DOE O 226.1B. This Guide provides guidance for implementing those requirements. The scope and content of this Guide are governed by DOE’s Directives Review Board (DRB). In the justification memorandum for this Guide, the DRB established that the scope be limited to Federal line management oversight of nuclear facilities and provide narrowly scoped information for developing and implementing effective oversight processes. DOE G 450.4-1C, Integrated Safety Management System Guide, and DOE HDBK 1188-2006, Glossary of Environment, Safety and Health Terms, provide definitions of terms used in this Guide. In a few cases, footnotes are used to provide additional information about terms used in this Guide in the context of nuclear facility safety oversight. 1.4 Applicability and Exclusions This Guide applies to all DOE organizational elements, including NNSA organizational elements, that: (1) are covered by DOE O 226.1B and (2) have line management responsibility for overseeing nuclear facilities. For simplicity, “DOE,” as used throughout this Guide, includes the NNSA. The lists of DOE nuclear facilities and nuclear safety requirements applicable to nuclear facilities are maintained in the web sites referenced in Appendices A and B. DOE G 226.1-2 3 6-21-12 2. OVERVIEW OF DOE SAFETY OVERSIGHT PROGRAM It is DOE policy to use a graded approach in safety programs. In the graded approach, the level of rigor and resources needed to effectively provide oversight of a safety program is commensurate with the magnitude of the hazards associated with the facilities. The graded approach is established in such DOE regulations and directives as 10 CFR 830.3, Nuclear Safety Management, Definitions; DOE O 414.1D, Quality Assurance; and DOE O 226.1B, Implementation of Department of Energy Oversight Policy. These regulations and directives have more detailed and stringent requirements for high hazard facilities than for low hazard facilities. Similarly, DOE uses a graded approach to implement safety oversight. More oversight rigor and resources are applied to facilities with high hazards than to facilities with low hazards. In addition, DOE uses a multi-tiered approach to safety oversight in which a high priority is placed on DOE line management and independent oversight of high hazard facilities such as nuclear facilities. Figure 1 illustrates DOE’s multi-tiered approach to safety oversight as established in DOE O 226.1B (contractor assurance system, DOE field element oversight, and program office oversight). The DOE Office of Health, Safety and Security (HSS) performs independent oversight of all three tiers and may perform independent reviews concurrently with DOE line organizations’ conduct of oversight at all three tiers or may support DOE line management oversight activities at the request of line management in some circumstances (when such assistance does not degrade independent oversight’s independence and when the support is in line with HSS independent oversight priorities and in the best interest of the DOE). The rest of this section describes the roles and responsibilities of each organizational tier, provides background about special requirements for safety oversight and related Federal training that apply to nuclear facilities, and sets the stage for the guidance provided in Sections 3 and 4.

4 DOE G 226.1-2 6-21-12 2.1 Contractor Assurance System The contractor requirements document (CRD) in DOE O 226.1B requires contractors to establish a contractor assurance system (CAS)2 to monitor site safety performance (Tier 1). The CRD in DOE O 226.1B requires that the CAS describe assurance processes and address appropriate processes and mechanisms, including: • Flowing down the requirements of the CRD to subcontractors to ensure subcontractors’ commitment to compliance with facility safety requirements, • Monitoring and evaluating safety performance, • Assigning management responsibilities and accountabilities, • Compiling and analyzing results of assurance processes, • Validating the effectiveness of assurance system processes by using third-party audits, peer reviews, independent assessments, etc., • Identifying, performing, and documenting periodic self-assessment and feedback and improvement activities, • Ensuring timely communication to the Contracting Officer, including electronic access to assurance-related information, • Providing evidence to assure DOE and contractor management that work is being performed safely, that risks are being identified and managed, and that control systems are effective, and • Performing trending and analysis to support appropriate, proactive decisions. 2 Most DOE CASs are developed and implemented by DOE contractors. However, DOE has a small number of nuclear facilities/activities that are operated by DOE personnel. DOE O 226.1B requires DOE Headquarters program offices to develop and implement oversight processes for these facilities consistent with requirements for CASs. For simplicity, the term “CAS,” as used in this Guide, includes CASs for nuclear facilities operated by DOE personnel. Figure 1. DOE’s Multi-Tiered Approach to Safety Oversight DOE Program Office Oversight- Tier 3 DOE Field Element Oversight- Tier 2 Contractor Assurance System-Tier 1 Other Site Activities Nuclear Facilities HSS Independent Oversight DOE G 226.1-2 5 6-21-12 The results of CAS activities are an important source of information for DOE line management’s oversight activities. DOE line management tailors its oversight program based on the effectiveness of CASs. However, regardless of the strength of a CAS, DOE directives require DOE line management to perform various oversight functions to validate the effectiveness of safety controls at nuclear facilities. 2.2 DOE Line Management Oversight DOE O 226.1B requires that DOE line management: • Maintain sufficient technical capability and knowledge of site and contractor activities to make informed decisions about hazards, risks, and resource allocation; provide direction to contractors; and evaluate contractor performance; • Evaluate contractor and DOE programs and management systems, including site assurance systems, for effectiveness of performance (including compliance with requirements) using written plans and schedules for planned assessments; • Conduct Headquarters oversight processes that are focused on the DOE field element activities to determine the effectiveness of line management oversight of the contractors; • Establish an issues management process that is capable of categorizing findings based on risk and priority, ensuring that relevant findings are effectively communicated to the contractors, and ensuring that problems are evaluated and corrected on a timely basis; and

• Establish and communicate performance expectations to contractors through formal contract mechanisms and establish effective processes for communicating oversight results and other issues in a timely manner. Figure 2 shows a generic representation of a DOE line management oversight program. One of the keys to an effective oversight program is a systematic process for continually evaluating information from many sources. This information is used to design a comprehensive oversight program that includes a baseline oversight program (which can be defined as the minimum level of oversight to be conducted regardless of the contractor’s performance), as well as oversight in response to the results of processes for determining which areas warrant supplemental oversight commensurate with the hazards of the nuclear facility, i.e., informed oversight. DOE line management oversight includes both field element (Tier 2) and program office oversight (Tier 3) processes that perform complementary functions and are coordinated to eliminate unnecessary duplication. However, an appropriate degree of overlap is appropriate for oversight of high hazard nuclear facilities. Key attributes of effective DOE line management oversight that apply to both DOE field elements and program offices include: • Requirements Based. The baseline set of oversight activities required by DOE directives are rigorously conducted, and the results are relatable to the requirements. • Efficient in Application. To the extent possible, oversight processes appropriately utilize contractor assurance information to adjust the rigor and frequency of oversight in a particular area. Similarly, Headquarters (Tier 3) and HSS independent oversight processes appropriately utilize DOE line management oversight information to adjust the rigor and frequency of oversight of DOE field elements. 6 DOE G 226.1-2 6-21-12 Figure 2. Overview of DOE Federal Line Management Oversight 2.2.1 DOE Field Element Safety Oversight The major safety oversight functions performed by DOE field elements (Tier 2) include two broad categories: (1) DOE field element oversight of DOE contractor activities, and (2) DOE field element self-assessments of their own activities and functions. Field elements have the most experience with the activities and hazards at their sites and are in the best position to evaluate site status and contractor safety performance. Thus, field elements have primary responsibility for establishing and implementing DOE line management oversight of contractor performance. Routine DOE field element oversight of DOE contractor activities includes: • Maintaining safety-related operational awareness, • Identifying and addressing safety vulnerabilities and issues, • Confirming contractors’ implementation of safety-related contract provisions that are based on safety-related regulations and directives, • Reviewing event reports, • Observing work, • Attending meetings (e.g., plan-of-the-day/plan-of-the-week), • Reviewing Facility Representative and safety system oversight (SSO) assessments, and • Reviewing subject matter expert reports. In addition to the above day-to-day oversight activities, field elements perform a wide variety of safety-related activities, including: DOE G 226.1-2 7 6-21-12 • Establishing and approving the list of safety requirements in contracts, • Conducting independent reviews of safety basis documents and providing approval

recommendations to the Approval Authority, • Conducting independent reviews of nuclear safety in new or modified operations, • Reviewing changes in nuclear safety system designs resulting from a positive unreviewed safety question (USQ) determination, • Reviewing the hazard categorization determinations, • Participating in readiness reviews, and • Reviewing, and in some cases approving, safety management programs (SMPs). Field elements may arrange for additional technical assistance or reviews from outside organizations. Such organizations include their DOE program office’s safety organization; the applicable DOE CTAs and their technical support organizations, such as the CNS/CDNS office; HSS; or other field elements. 2.2.2 DOE Program Office Safety Oversight DOE program offices conduct oversight to ensure that the oversight systems for their nuclear facilities are working effectively. Program office oversight processes focus on their field elements, including reviewing contractor activities to the extent necessary to evaluate the effectiveness of their field element’s oversight of its contractors. DOE program office safety oversight (Tier 3) functions also include: • Ensuring that systemic safety issues affecting the DOE complex are identified and addressed, • Evaluating areas where the field element has not looked or where performance or vulnerability indicates the need for oversight beyond the scope of that conducted by the field element, and • Performing self-assessments of their own activities concerning the safety of their nuclear facilities. DOE O 226.1B requires program offices to establish their oversight activities with a planning process. That process includes scheduled assessments and may also include “for cause” reviews and reviews requested by the field element. 2.2.3 Central Technical Authorities and Chief of Nuclear Safety/Chief of Defense Nuclear Safety DOE CTAs in NNSA and the Under Secretaries for Energy and Science provide centralized technical expertise and maintain operational awareness to ensure adequate implementation of nuclear safety policy and requirements. The CTAs are supported by the CNS/CDNS technical support organizations. The CNS/CDNS perform oversight activities at DOE organizations and nuclear facilities in support of their respective program offices and CTAs. 8 DOE G 226.1-2 6-21-12 2.2.4 Federal Training and Qualifications DOE O 226.1B requires DOE organizations to maintain sufficient technical capability and knowledge of site and contractor activities to make informed decisions about hazards, risks, and resource allocation; provide direction to contractors; and evaluate contractor performance. Additional training and qualification requirements apply to defense nuclear facilities. These include the regulations set out in DOE O 426.1, Chg. 1, Federal Technical Capability, which applies only to Federal personnel. This directive provides specific requirements for qualification programs for Facility Representatives, SSO personnel, and senior technical safety managers (STSMs). DOE O 360.1C, Federal Employee Training, establishes requirements for training Federal personnel. 2.3 Independent Oversight and Other DOE and External Reviews

In accordance with DOE O 227.1, Independent Oversight Program, the DOE independent oversight program for safety and security (including cyber security; emergency management; safeguards and security; and environment, safety, and health) programs is implemented by the HSS Office of Enforcement and Oversight. This program provides DOE and contractor managers, Congress, and other stakeholders with an independent evaluation of the adequacy of DOE policy and requirements and the effectiveness of DOE and contractor performance in safety, security, and other critical functions. As shown in Figure 1, the HSS independent oversight program is unique in that it examines site programs and the three tiers of line management oversight to provide management with independent perspectives on the overall effectiveness of DOE policies, programs, and performance in safety and security. The HSS independent oversight program is independent of DOE line management. However, HSS coordinates with DOE line management to make optimum use of resources for conducting oversight. HSS sometimes conducts independent reviews concurrent with DOE line management oversight activities and sometimes performs independent reviews at the request of DOE line management. While HSS coordinates with DOE line management, HSS recognizes that nuclear facilities contain unique hazards that warrant significant independent oversight. Other internal and external organizations, including the DOE Inspector General (IG), may perform reviews or investigations that provide perspectives on DOE’s oversight of nuclear facility safety. DOE line management should consider the results of those reviews as input to their line management oversight programs. 2.4 Overview of General and Detailed Guidance for Federal Line Management Safety Oversight of Nuclear Facilities This Guide is designed to identify the aspects of DOE O 226.1B for which guidance for safety oversight of nuclear facilities would be most useful. These aspects are grouped into three categories: oversight programs, oversight processes, and detailed guidance for evaluations. Oversight Programs. The oversight policy and order recognize that essential DOE line management oversight programs must be specific for each nuclear facility. Therefore, the order DOE G 226.1-2 9 (and 10) 6-21-12 establishes broad performance requirements, rather than detailed procedural requirements, for oversight programs for facilities. The following topics provide guidance that is useful to DOE line management in establishing oversight programs for nuclear facilities: • Scope of DOE Line Oversight Program for Safety Oversight of Nuclear Facilities (Section 3.1) • Tailoring to Facilities, Activities, and Hazards (Section 3.2) • Designing and Implementing DOE Field Element Oversight Programs (Section 3.3) • Designing and Implementing DOE Program Office Oversight Programs (Section 3.4). Oversight Processes. The oversight order identifies requirements for oversight processes. The following topics provide guidance for DOE field elements’ oversight processes: • Evaluation Processes (Section 3.5) • Issues/Corrective Action Management Program (Section 3.6) • Performance Measures and Communications (Section 3.7).

Detailed Guidance for Evaluations. Two types of detailed guidance for evaluating safety performance are provided to complement the information on programs and processes. The first includes detailed guidance for DOE line management assessments of various programs and cross cutting functions that support safe operation of nuclear facilities. This Guide groups these functions and programs into four core performance areas (safety system operability, TSR implementation, SMPs, and safety management systems) and two cross cutting performance areas (formality of operations and safety culture). The second type of detailed guidance provides information about criteria review and approach documents (CRADs), which DOE line management can use to evaluate various elements of a nuclear facility safety program. Guidance in these two areas is provided as follows: • Detailed Guidance for DOE Line Management Oversight of Core and Cross Cutting Performance Areas for Nuclear Facilities (Section 4.1) • Application of Criteria Review and Approach Documents (Section 4.2). DOE G 226.1-2 11 6-21-12 3. GUIDANCE FOR FEDERAL LINE MANAGEMENT SAFETY OVERSIGHT OF NUCLEAR FACILITIES 3.1 Scope of DOE Line Management Program for Safety Oversight of Nuclear Facilities One of the first and most critical steps in establishing and implementing an effective safety oversight program for nuclear facilities is for DOE line management to systematically identify the applicable requirements and elements of nuclear safety programs at each nuclear facility under its purview. DOE line management should also understand all of the components of these programs and their interrelationships. DOE nuclear safety requirements are the collection of the Department’s regulations and directives that establish requirements for both DOE and its contractors. Title 10 CFR Part 830, Nuclear Safety Management, is the primary rule for nuclear facilities. Specifically, Subpart B of 10 CFR 830 requires contractors and operators of hazard category 1, 2, and 3 nuclear facilities to develop and maintain a safety basis and to perform work in accordance with that safety basis, including the associated TSRs and the USQ process. Similarly, Subpart A provides contractor requirements for QA activities that affect nuclear safety at DOE nuclear facilities. DOE directives establish various requirements applicable to nuclear facilities, including requirements for nuclear facility design, construction, verification of readiness to operate, QA, maintenance, systems engineering, training, SMPs, and safety management systems. In some cases, DOE directives invoke industry consensus standards. A major role of DOE line management oversight is to monitor and ensure compliance with those safety requirements at nuclear facilities. An important method that DOE line management can use to monitor compliance with nuclear safety requirements is to evaluate the adequacy of the following types of activities: • Designing and constructing compliant facilities, • Using physical barriers (e.g., containers, gloveboxes, filtered ventilation systems, facility structures) to safely contain hazardous radioactive materials and prevent uncontrolled and unmonitored personnel exposure to radiation, • Preparing and using safety basis documentation that requires multiple layers of defense (e.g., engineered and administrative controls) to prevent and mitigate the release of hazardous radioactive materials,

• Operating the facilities according to approved specifications and abiding by strict controls on changing the design, • Designing and implementing systems and programs to minimize initiating events that could lead to an accident, • Ensuring that safety systems are maintained, operable, and sufficient to perform their intended safety function as delineated in the safety basis documents, and • Preparing for emergencies, including developing emergency response programs and plans to shelter or evacuate people in the event of an accident. 12 DOE G 226.1-2 6-21-12 In addition, the regulations and directives require contractors to establish and maintain various safety management programs and cross cutting functions that support safe operation of nuclear facilities. These include: • An integrated safety management (ISM) program to ensure that safety is an integral part of each work activity; • A QA program to ensure reliable performance of systems; • A USQ process to evaluate proposed changes and as-found discrepant conditions; • A configuration management program to prevent unauthorized changes to designs, documentation, and the facility safety program; • A nuclear maintenance program that maintains the engineered controls that are important to safety; • A planning and work control process that supports safe work activities; • A conduct-of-operations program that fosters formality of operations; • A radiological control program that maintains exposure to radiation as low as reasonably achievable; • A comprehensive fire protection program to minimize the potential for, and consequences of, a fire or fire-related event; • A criticality safety program to ensure that activities with the potential for criticality hazards provide adequate protection to the public, workers, and the environment; • A sitewide training program to ensure that personnel performing operations and maintenance affecting nuclear facilities are trained for those duties; • A program for verifying the readiness for startup and restart of operations; and • A sitewide emergency management program. Figure 3 illustrates the framework for nuclear facility oversight, which includes three components (shown in pink) – regulations and directives, core performance areas, and cross cutting performance areas – and their interdependence in ensuring nuclear facility safety. The figure also shows the elements of each component (shown in blue). A more detailed description of rules and directives applicable to nuclear facilities is provided in Appendix B (which is available at http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html). Additional guidance on evaluating the core and cross cutting performance areas is provided in Section 4.1. http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html DOE G 226.1-2 13 6-21-12 Figure 3. Framework for Nuclear Facility Oversight Notes: * A more detailed description of regulations and directives applicable to nuclear facilities is provided in Appendix B. **Emergency preparedness is included in Figure 3 for completeness. However, since comprehensive guidance for oversight of emergency management programs is provided in DOE O 151.1C, Comprehensive Emergency Management System, and its guides, the emergency preparedness core performance area is not described further in this Guide. Safety Management Program Effectiveness DOE Line Oversight Directives Technical Safety Requirement Implementation Safety System Operability

Cross Cutting Performance Areas Emergency Preparedness** Safety Management System Effectiveness 10 CFR 830 and Related Directives DOE Nuclear Facility Directives Regulations and Directives* Core Performance Areas Issue Identification and Resolution Formality of Operations Safety Culture 14 DOE G 226.1-2 6-21-12 The following is a list and description of the nuclear facility core and cross cutting performance areas shown in Figure 3 that are referred to in the remaining sections of this Guide: Core Performance Areas • Safety System Operability. This performance area includes verifying the operability of safety class and safety significant structures, systems, and components (SSCs) identified in the DSA, including design features, on a recurring basis. • TSR Implementation. This performance area includes evaluating the implementation of TSR controls – surveillance requirements, design features, specific administrative controls (SACs), and administrative controls (ACs) – on a recurring basis. • SMP Implementation. This performance area includes evaluating the overall effectiveness of the SMPs identified in the DSA, over a baseline period of time. • Safety Management System Implementation. This performance area includes evaluating the effectiveness of ISM primarily at the activity level, the effectiveness of the CAS, and the effectiveness of the QA program over a baseline period of time. • Emergency Preparedness. Comprehensive guidance for oversight of emergency management programs is provided in DOE O 151.1C, Comprehensive Emergency Management System, and its guides. Particularly relevant to oversight of emergency preparedness is DOE G 151.1-3, Programmatic Elements, Section 4. Readiness Assurance. The emergency preparedness core performance area is not described further in this Guide. Cross Cutting Performance Areas • Formality of Operations Programs. This performance area includes evaluating the effectiveness of the implementation of conduct of operations (DOE O 422.1), conduct of maintenance (DOE O 433.1B), conduct of engineering (DOE O 420.1B, Chg. 1), and conduct of training programs (DOE O 426.1, Chg. 1) over a baseline period of time. • Safety Culture. This performance area includes developing, monitoring, and periodically evaluating the nuclear facility safety culture. • Issue Identification and Resolution. This performance area includes evaluating the significance determination process and, for those issues with high significance, ensuring that a rigorous evaluation and resolution process is effectively implemented. DOE G 226.1-2 15 6-21-12 3.2 Tailoring to Facilities, Activities, and Hazards DOE O 226.1B, Section 4.b(5), requires DOE line management to tailor oversight programs according to the effectiveness of CASs, the hazards at the site/activity, and the degree of risk. The order also requires DOE line management to give additional oversight emphasis to high consequence activities, such as nuclear facilities. To meet the tailoring provision for oversight of nuclear facilities, DOE line management should systematically evaluate each nuclear facility under its purview and the associated requirements and programs to identify site-specific conditions that warrant increased oversight attention, as well as factors that could indicate that fewer oversight activities and resources would be needed, to provide assurance of adequate protection.

The information in this subsection identifies the site-specific conditions that DOE line management should consider in designing oversight processes, establishing oversight priorities, and allocating oversight resources. Types of Nuclear Facilities/Activities. DOE has various types of nuclear facilities, including nuclear reactors, stockpile production/maintenance facilities, storage facilities, research laboratories, transportation and packaging facilities, and analytical laboratories. DOE nuclear facilities are also in different stages of their lifecycle (e.g., construction, pre-operational, operational, inactive, and decommissioning). Furthermore, activities within a specific nuclear facility change from time to time (e.g., a reactor may be at a high power level at some times and in a shutdown mode at other times), and certain activities (e.g., moving items in a storage facility) may involve a unique set of hazards. DOE organizations should systematically evaluate their nuclear facilities and tailor their oversight activities to the hazards for each facility. Such evaluations should be reviewed and updated periodically since facilities and conditions change. DOE organizations should also systematically identify the activities that are performed at each nuclear facility. The DSA and TSRs for each nuclear facility provide much of the information needed to help DOE tailor oversight activities, including detailed analyses of the authorized activities and the associated safety controls, as well as information about potential accidents and events and their consequences. DOE organizations should use this information in the design of their oversight activities, including establishment of a baseline oversight program and identification of conditions that warrant increased or special oversight emphasis. Examples of the conditions that might warrant increased or special oversight attention include: • Research laboratories frequently change experiments and perform activities with new equipment, materials, or procedures. Oversight activities in the early phases of such activities could focus on verifying that the activities remain within the provisions of the safety bases and that any new conditions are properly evaluated. • During pre-operational, construction, or major modification phases, conditions at a nuclear facility change rapidly, and certain conditions can be observed best at certain points in the construction effort. For example, verification of seals, welds, concrete quality, and the 16 DOE G 226.1-2 6-21-12 associated QA provisions might be readily observable at certain phases of construction or modification. DOE organizations should consider scheduling oversight activities of contractor processes and QA measures at optimal times to verify conformance with requirements and identify deficiencies at an early stage for appropriate corrective actions. In addition to promoting safety, such timely oversight can promote success of the mission by identifying deficiencies for corrective action before they result in a need for extensive rework. • Certain facility activities are particularly important during particular phases of the lifecycle of the facility or a particular mission within the facility. For example, while always important, procurement processes are often more extensively used during construction or major modifications/upgrades. DOE oversight can effectively use its resources by targeting processes, such as procurement, for increased oversight attention at appropriate times in the lifecycle of the facility or a mission activity.

• DSAs typically identify various accident scenarios that could result in the highest consequences. Often, such accidents could occur under certain conditions (e.g., during a fuel move, while a reactor is at high power, or when a vault is open). DOE oversight processes should consider such information to focus ongoing oversight activities (e.g., Facility Representative programs) on these conditions. • Major safety-related work activities performed by subcontractors may warrant extra scrutiny. Subcontractors could be subject to organizational, contractual, or financial incentives or penalties that result in pressure to meet production/mission objectives, possibly resulting in less priority for safety objectives. The above list is intended to illustrate the many factors that DOE organizations should consider in selecting oversight activities. Systematic analysis involving subject matter experts from various disciplines should be performed to optimize oversight efforts. Status and Effectiveness of CASs. DOE should evaluate CASs as one factor in setting DOE oversight priorities. For example, DOE line oversight might focus on problem areas identified by the contractor. DOE also might analyze the results of CAS efforts, determine that the contractor is not performing enough reviews of certain areas, and target those areas for increased attention. DOE organizations are required by regulations (10 CFR 830) and certain directives (e.g., requirements that apply to Facility Representative and SSO programs) to perform a minimum set of baseline oversight activities even if the CAS is determined to be effective. In addition, the continued effectiveness of the CAS should be routinely monitored. Budget limitations, organizational changes, and shifting priorities are among the many factors that may impact the continued effectiveness of a CAS. DOE line management should remain cognizant of such influences and monitor the continued effectiveness of CASs. Other Factors Considered in Tailoring. DOE line management should be alert to factors in addition to changes in facility conditions that might affect contractor implementation of safety requirements. Such factors could include new contractors, contractor reorganizations, changes in mission scope and workforce levels, significant reassignment of contractor safety responsibilities, major revisions to safety programs (e.g., rollout of changes to ISM or work control process), and significant changes in funding levels for safety activities. These changing conditions could result in changes in how work is performed (e.g., by personnel with less DOE G 226.1-2 17 6-21-12 experience), in different management attitudes (possibly less attention to safety), and in different interfaces between contractor organizations (possibly resulting in gaps in recognized safety responsibilities). 3.3 Designing and Implementing DOE Field Element Oversight Programs DOE field elements are most familiar with site activities and hazards and perform most of the DOE oversight activities in all areas, including oversight of nuclear facilities. DOE field elements use a variety of mechanisms to perform oversight of nuclear facilities, including a wide range of operational awareness activities (e.g., review of event reports, attendance at meetings, inspection of field conditions, and observation of work), an SSO program, a Facility Representative program, a documented oversight plan containing various assessments (baseline, supplemental, reactive) and assessment techniques (field element assessments or observing contractor assessments), issues management processes, and investigations of events and accidents.

While most of the guidance in this Guide is relevant to DOE line management, this section (3.3) applies specifically to the aspects of oversight that relate primarily to DOE field elements in designing and implementing their oversight program. This subsection includes: • Field Element Oversight Objectives for Nuclear Facilities (Section 3.3.1), • Field Element Mechanisms for Oversight of Nuclear Facilities (Section 3.3.2), • Field Element Nuclear Facility Oversight Plan (Section 3.3.3), and • Integrated Oversight Plan (Section 3.3.4). 3.3.1 Field Element Oversight Objectives for Nuclear Facilities Field element line oversight programs for nuclear facilities involve two primary objectives. The first is to evaluate the adequacy of the contractor’s oversight and assurance activities in each of the core performance areas and cross cutting performance areas. This objective is accomplished through assessments of the CAS and operational awareness activities, such as observing contractor response to issues, inspecting facilities, observing contractor performance of work, observing contractor oversight activities, and evaluating contractor performance indicator data. The second objective is to independently evaluate the contractor’s performance in each of the nuclear facility core performance areas and cross cutting performance areas. This evaluation is primarily accomplished by performing a set of assessments using approved written plans that include CRADs. A set of CRADs is available in Appendix C as a starting point for developing CRADs that are tailored to the particular facility or functional area under consideration. The set of assessments should include two components: (1) the required field element assessments (typically referred to as baseline or required assessments) identified in DOE rules and directives and site- or program-specific assessment requirements; and (2) any supplemental assessments identified by field element managers to significantly reduce uncertainty about the likelihood of potential adverse consequences that would have the greatest impact on safe, secure, and efficient achievement of the DOE mission. The types of information that field element 18 DOE G 226.1-2 6-21-12 managers should evaluate to identify an appropriate set of supplemental assessments include the magnitude of the potential hazard, the adverse consequence of failures of safety systems or functions, the current level of contractor performance reflected in performance measures and indicators, the significance of previous performance issues, the maturity of the contractor’s CAS, and the maturity of their own field element line oversight processes. The field element typically develops an annual assessment plan that includes both the required assessments and any identified supplemental assessments. The annual assessment plan is a key component of the nuclear facility oversight plan described in Section 3.3.3 below. Field element managers may use the results of these assessments to: (1) adjust the focus of operational awareness activities; (2) adjust the frequency, depth, and scope of planned assessments; and (3) identify the need for any additional assessments, including any “for cause” assessments. In making such decisions, field element managers should also consider insights from analysis of hazards, the effectiveness of the CAS, and other factors, as discussed in the discussion of tailoring in Section 3.2.

A more detailed description of the field element oversight activities for each of the two primary objectives follows. Field Element Oversight Objective 1. The first objective of field element oversight activities is to evaluate the adequacy of the contractor’s assurance activities in each of the core and cross cutting performance areas. In order to provide specific guidance in this area, it is necessary to briefly describe DOE expectations for the contractor’s nuclear facility assurance program. For each of the core and cross cutting performance areas, the contractor develops performance objectives, measures, and indicators, along with a set of management and independent assessments. The set of assessments should include two components: (1) the recurring assessments explicitly required by regulations and DOE directives (typically referred to as baseline or required assessments), and (2) any supplemental assessments identified by the contractor to significantly reduce uncertainty about the likelihood of the potential adverse consequences that would have the greatest impact on safe, secure, and efficient achievement of the DOE mission. The types of information that contractor managers should evaluate to identify an appropriate set of supplemental assessments include the magnitude of the potential hazard, adverse consequences of failures of safety systems or functions, the current level of performance reflected by performance measures and indicators, the significance of previous performance issues, and the maturity of their CAS. Supplemental assessments may also be derived from other commitments or internal requirements established by contractor management and/or from DOE line management expectations identified in the contract. The contractor then develops an annual assessment plan that includes both the required assessments and any identified supplemental assessments. For each of the core and cross cutting performance areas, the responsible field element oversight lead evaluates the quality and effectiveness of CAS implementing processes and activities through operational awareness, participation in contractor-led assessments (e.g., joint assessments), observation of performance of contractor-led assessments (e.g., shadow DOE G 226.1-2 19 6-21-12 assessments3), and comparison of the results of CAS activities and field element operational awareness and formal assessments. (See Section 3.5.) Field Element Oversight Objective 2. The second objective of field element oversight is to independently evaluate the contractor’s performance in each of the nuclear facility core and cross cutting performance areas. The field element should consider performance information provided by the contractor when selecting the operational awareness activities and assessments that will be used to evaluate contractor safety performance. The number of oversight activities may be adjusted up or down based on the inherent or base risk of a particular area, the contractor’s performance in that area, and the field element’s confidence in the CAS. The proportion of oversight resources committed to assessments, operational awareness activities, and evaluation of systems and programs using CAS data may also be adjusted, using similar criteria. However, field element independent assessments of contractor performance should not be adjusted below the baseline level without adequate justification and formal approval by the appropriate level of line management. Section 4.1 provides specific guidance for developing an appropriate level of baseline assessments for each of the core and cross cutting performance areas.

3.3.2 Field Element Mechanisms for Oversight of Nuclear Facilities As shown in Figure 2 (see Section 2.2), DOE field element oversight should incorporate the following four mechanisms: • Field element information collection and analysis program (including the sources of information and analysis of performance), • Field element oversight planning, • Conduct of assessments, and • Corrective action management. The first two of these mechanisms are discussed here. The other two are discussed in Sections 3.5 and 3.6. Field Element Information Collection and Analysis Program. DOE field elements should develop and implement an information program with the following attributes: • Field element oversight and oversight-related activities should generate performance-related data and information; • This data and information should come from many sources, including the CAS, operational awareness activities, event reporting, worker feedback, issues management, lessons learned, performance measures/indicators, the DOE operating experience program, accident investigations, DOE IG findings, Defense Nuclear Facilities Safety Board (DNFSB) reports and recommendations, and employee concerns investigations; 3 “Shadow assessments” refers to the practice of DOE line management personnel participating in or observing contractor-led assessments, with the dual purpose of gathering information about the element being assessed and evaluating the effectiveness of the contractor’s assessment processes and activities. 20 DOE G 226.1-2 6-21-12 • The program should collect, analyze, categorize, and organize historical and current performance-related information; • Regular reports should be provided to field element managers summarizing conclusions and recommendations; and • Where feasible and cost-effective, multiple information systems, including systems maintained separately by DOE and contractors, should be consolidated or coordinated. Field Element Oversight Planning. Field element oversight should be planned and performed to understand the safety condition of nuclear facilities and to identify and ensure resolution of identified deficiencies. Field element oversight includes baseline, supplemental, and reactive evaluation processes, as discussed in Section 3.5.2. 3.3.3 Field Element Nuclear Facility Oversight Plan A description of the operational awareness focus areas and specific assessments to be performed by the field element in each of the nuclear facility core and cross cutting performance areas should be documented in a nuclear facility oversight plan, integrated oversight plan, or master assessment program. The plan should be updated, at least annually, and approved by the field element manager. The plan should: • Identify periodic field element-led assessments required by DOE directives or directed by the DOE program office; • Identify other needed assessments based on a documented analysis that includes evaluation of the level of risk to safety and mission delivery, contractor performance, field element oversight information, and CAS information; and • Identify significant operational awareness activities. Section 4.1, “Detailed Guidance for DOE Line Management Oversight of Core and Cross Cutting Performance Areas for Nuclear Facilities,” provides specific attributes and guidance for identifying operational awareness activities and assessment activities for each of the core and cross cutting performance areas that should be included in a nuclear facility oversight plan.

3.3.4 Integrated Oversight Plan DOE field elements, in concert with program offices, should develop an integrated oversight plan (IOP) that identifies planned assessments and other significant oversight activities by various organizations (including program offices and field elements, as well as external organizations to the extent known). Such a plan enables better coordination of assessments and oversight activities and minimizes schedule conflicts. A nuclear facility oversight plan (briefly described in the previous section) that includes specific field element oversight activities for each nuclear facility at a site should be included or referenced in the IOP. The following are attributes of an effective IOP: • DOE IOPs should address:  The required baseline assessments conducted using oversight CRADs; DOE G 226.1-2 21 6-21-12  Contractual/legal requirements;  Any supplemental assessments or other oversight activities that should be conducted based on established criteria or conditions, such as: - Significant changes in a system, program, facility, or activity (for example, change of site/facility managing contractor, transfer of site/facility ownership from one program office or field element to another, or permanent cessation of operations); - Individual and systemic problem areas identified by DOE or contractor oversight activities and determined by the analysis of information to warrant additional oversight; - Inadequate identification or implementation of corrective actions to address significant or repetitive DOE- or contractor-identified safety issues that warrant additional follow-up; - Areas for which little information is documented; and - Areas of special DOE management interest or priority. • DOE IOPs should be formally documented, coordinated with the program office and CTAs and respective technical support organization (e.g., CDNS), and approved for use by the DOE field element; • The field element should maintain the IOPs and manage the information; • The IOP process should include input from craft employees, field safety specialists, Facility Representatives, safety engineers, program managers, maintenance personnel, and others as needed; • The DOE IOP should be coordinated with the contractor’s oversight activities to identify opportunities for more efficiency through collaboration; • Changes to scheduled assessments (date change, deferral to next cycle, change in scope, cancellation, etc.) should be expected in response to changing circumstances, but these changes should be reviewed and approved by responsible DOE line management in accordance with a defined change control process; and • DOE IOPs should be updated and published annually. The IOP is the opportunity for establishing an effectiveness interface between program offices and field elements and should ensure that: • The field element oversight program provides a balance between reviews of documentation (e.g., plans, procedures, and records) and reviews of the adequacy of implementation through performance tests and observation of actual work activities at the facilities. Oversight program activities provide for a similar balance between evaluations of systems (such as the DOE ISM system), programs (e.g., radiation protection), facility conditions, and implementation of individual elements of those systems (e.g., specific work activities);

• DOE line management oversight coordinates assessment activities with CAS activities to promote efficient use of resources. DOE line management may conduct some assessments jointly with contractors, but DOE directives also require DOE line management to maintain an adequate baseline oversight program that includes sufficient DOE-led assessments of contractor management systems and site programs; 22 DOE G 226.1-2 6-21-12 • DOE line management (primarily through field organizations) implements a baseline line management oversight program that focuses resources on selected assessments, operational awareness activities, performance measure monitoring, and assessment of assurance systems; • For sites that need improvement in site programs, management systems, or assurance systems (e.g., insufficient rigor or comprehensiveness in existing systems), DOE line management should conduct more frequent assessments focusing on areas needing improvement; • DOE oversight programs and CASs evaluate performance against requirements and performance objectives from such sources as regulations, national standards, DOE directives, DOE-approved plans and program documents (e.g., radiation protection program and QA program, authorization basis documents), site-specific procedures/manuals, CRADs, other contractually mandated requirements, and contractual performance objectives; • Requirements and performance objectives are established and interpreted through approved processes so that they are relevant to the site and mission, and continuous improvement opportunities are identified and pursued; and • DOE line management should verify that plans submitted by contractors clearly delineate actions to be taken and describe programs that meet DOE requirements and expectations. 3.4 Designing and Implementing DOE Program Office Oversight Programs DOE O 226.1B requires program offices to conduct oversight of nuclear facility safety to ensure that all of the nuclear facility oversight systems are working effectively. Program office oversight includes two components: program office oversight and CTA oversight functions. 3.4.1 Program Office Oversight Program office oversight processes focus primarily on oversight of their subordinate field elements. However, program offices and their support staff may conduct oversight of contractors during reviews pursuant to oversight requirements in DOE rules and directives or program office priorities, or they may provide support to field elements’ oversight activities and when the need for a “for cause” review is identified. Program office oversight should incorporate the following mechanisms and attributes: • Program/field level information collection and analysis: DOE program office personnel should develop a good understanding of the nuclear facilities within their area of responsibility by regularly reviewing the results of field element oversight, contractual expectations, operating experience information, external organization inputs (such as DNFSB staff observations), and other relevant information. Analysis of this information helps maintain awareness of conditions and trends in their nuclear facilities and helps determine the effectiveness of field element oversight processes. • Planning baseline oversight: Based on the information collected, program offices should establish appropriate baseline oversight activities and schedules that focus primarily on field elements but may also include contractor activities.

• Conducting/participating in oversight activities: DOE program offices should assess or participate in assessments led by field elements or contractors to determine independently the adequacy of the scope and implementation of field element self-assessment activities, DOE G 226.1-2 23 6-21-12 oversight activities, technical capabilities, and CASs. Program offices should have a formal process for identifying, planning, and performing assessments that includes expectations for using CRADs when performing assessments. • Feedback and improvement: Program offices and CTA support organizations should establish effective communications with their field elements and provide meaningful feedback to improve field elements’ nuclear facility safety programs, processes, and procedures. In addition, program offices should clearly identify the sources of information used to monitor and analyze performance and should ensure that the information developed is of appropriate quality and is useful for performing analyses and for decision-making. Based on an evaluation of the various sources of information available from field element oversight programs and CASs, program offices may identify the need to perform additional oversight activities, which may include supplemental assessments of areas of increased vulnerability and reactive assessments in response to significant events. 3.4.2 CTA Oversight Functions Oversight of nuclear facility operations warrants additional and focused program office oversight. Accordingly, DOE has established CTAs and their technical support organizations to ensure that essential nuclear safety functions are appropriately established and implemented. For high-consequence nuclear operations, the CTAs should maintain awareness of the content of applicable DOE line oversight programs, plans, and processes, as well as the maturity and effectiveness of the CASs, by monitoring and evaluating the oversight programs, performing trend analyses, monitoring associated assessment reports, and participating in oversight activities. The CTAs and their technical support organization staffs also should conduct and participate in various program office oversight review activities, as defined in the associated oversight programs. Based on these activities, the CTA should communicate identified issues and trends to line management, provide advice concerning technical solutions or options, and follow up to ensure proper closure of issues and/or implementation of corrective actions. Each of the CTAs and their technical support organizations should define their own approaches and strategies for selecting, prioritizing, and performing oversight activities. 3.5 Evaluation Processes DOE O 226.1B, Section 4.b(1), requires DOE organizations to evaluate performance based on the results of: (1) operational awareness activities; (2) assessments of facilities, operations, and programs; and (3) assessments of the CAS. This section provides guidance for these three evaluation methods. DOE O 226.1B and DOE 414.1D also require DOE organizations to evaluate the performance of their own organizations (i.e., self-assessments), and this section also provides guidance for self-assessments. 24 DOE G 226.1-2 6-21-12 3.5.1 Operational Awareness Activities Operational awareness refers to the activities performed by DOE line personnel to maintain cognizance of overall facility or activity status, major changes planned, and overall safety posture. Attributes of effective operational awareness include:

• DOE line management rigorously reviews and critiques contractor processes and performance in identifying, evaluating, and reporting events and safety issues that are required to be reported by rules or directives to determine whether issues are properly screened, evaluated, and reported; • DOE line management evaluates and monitors contractor evaluations and corrective actions for events and issues and assesses whether effective corrective actions have been identified and implemented to address the issues and prevent recurrence of events; • Operational awareness activities and results of Facility Representative and SSO activities are documented either individually or in periodic (e.g., weekly or monthly) summaries; and • Deficiencies in programs or performance identified during operational awareness activities are communicated to the contractor for resolution through a structured issues management process, which can be managed by the field element or the contractor. Examples of these operational awareness activities include: • Attending event critiques; • Reviewing the contractor’s issue response and corrective action follow-up; • Reviewing contractor performance indicator data; • Reviewing assessment review plans and reports; • Reviewing contractor analysis and trending performance reports; • Attending the contractor’s issues management boards, plan-of-the-day meetings, and other safety-related management meetings; • Participating in contractor facility condition inspections and work activity observations; • Participating in contractor management walk-around program activities; and • Reviewing parent company and/or peer review reports. Operational awareness can be enhanced through shadow assessments of contractor-led assessment activities, which could include: • Shadowing contractor-led assessments to assess the quality and rigor of assessments and the area that is being assessed by the contractor; • Shadowing parent company oversight activities; and • Shadowing elements of contractor-led assurance system validations. DOE G 226.1-2 25 6-21-12 3.5.2 Assessments of Facilities, Operations, and Programs DOE G 414.1-1B provides detailed guidance on how to perform management and independent assessments. This section provides guidance on how to select the type of assessments to be performed that complement the guidance in DOE G 414.1-1B. DOE line management should rely on a robust information collection and analysis program (see Section 3.3.2) to identify the optimum level and balance of baseline oversight and supplemental oversight to be performed, and should perform reactive oversight when circumstances warrant. Baseline Oversight. Baseline oversight is defined as the minimum level of oversight to be conducted, regardless of the contractor’s performance. Baseline oversight should ensure the adequacy and effectiveness of contractor and field element performance with respect to safe operation and adherence to DOE requirements and contract provisions. Baseline oversight should make use of established CRADs (see Section 4.2) and should consider the following attributes: • Baseline oversight should be planned, systematic, and scheduled as repetitive cyclic oversight activities; • Baseline oversight should be conducted in specified functional areas and at specified frequencies, even when performance meets requirements; • The oversight CRADs should be tailored to reflect the appropriate breadth, depth, and scope with which baseline oversight needs to be conducted for a particular facility or functional area; and

• Baseline oversight should ensure compliance with requirements applicable to the field element. Field element organizations should establish and implement oversight processes for monitoring their internal operations and completing required activities, such as review and approval of important process and procedure documents. Supplemental Oversight. Supplemental oversight should be conducted in response to declining performance and should focus on topics of safety significance, as supported by data from the contractor’s and DOE’s assessment activities. As the need is identified, supplemental oversight should be added to the integrated schedule during its periodic update. Supplemental oversight should make use of established CRADs in conjunction with other, more specialized, in-depth criteria developed on a site-by-site or program-by-program basis. Reactive Oversight. Reactive oversight should be performed in response to a specific event, condition, special request, or emerging safety performance issue resulting from analysis of information. Examples of reactive safety oversight activities include follow-up on significant employee concerns; response to incidents, accidents, or any unusual event impacting safety; special follow-up on corrective actions not covered by the baseline or supplemental oversight program; and technical assistance (in response to a particular event, condition, or request) by a subject matter expert or group of subject matter experts. Standardized written guidance (e.g., CRADs) for conducting reactive safety oversight is limited and may warrant development of one-of-a-kind plans and procedures based on the specific issue at hand. Consequently, and given the highly focused, technical nature and short response time for 26 DOE G 226.1-2 6-21-12 reactive oversight activities, reactive oversight should rely heavily on the competence and expertise of the staff that performs the oversight. 3.5.3 Assessments of the Contractor Assurance System Since the CAS is the baseline tier of oversight and provides the most comprehensive coverage, it is critically important that the CAS describes comprehensive, detailed, and specific processes and mechanisms that provide an adequate basis for assuring DOE of safe operations. Therefore, DOE line management review of the CAS is a critical element of DOE field element oversight. DOE field elements assess the effectiveness of the CAS and can increase the depth and breadth of oversight activities relative to the results of the assessments. DOE should devote considerable rigor and resources to: (1) reviewing the contractor CAS submittals, including updates; (2) reevaluating the CAS submittal periodically or as needed to ensure that it remains adequate for evolving site conditions; and (3) evaluating the effectiveness of the contractor CAS and implementation of the CAS processes and mechanisms. Attributes of effective oversight of a CAS include: • DOE line management assesses the implementation and effectiveness of CASs for nuclear facility safety and supporting sub-elements (e.g., criticality safety, conduct of operations) by examining:  Assessment methods (e.g., whether sufficient emphasis is placed on observation of work activities);  Whether the process used for selecting assessment topics is structured and appropriately implemented (i.e., is the contractor selecting the right assessment subjects based on appropriate analysis?);

 The frequency, breadth, and depth of self-assessments;  Line management involvement in self-assessments;  Evaluators’ technical expertise and qualifications;  The number and nature of findings identified;  The degree of rigor applied to self-assessment;  The application of the CAS by subcontractors and prime contractor oversight of subcontractor safety programs and processes, including self-assessments and issues management processes; • DOE line management regularly assesses the adequacy and effectiveness of contractor issues management and corrective action processes (e.g., categorization, analysis of causes and extent of condition, and application of controls to prevent recurrence), lessons-learned processes, and other feedback mechanisms (e.g., worker feedback). DOE line management also evaluates contractor processes for communicating information, including safety concerns and dissenting technical opinions, up the management chain. DOE line management validates that contractor corrective actions have been implemented and are effective in resolving deficiencies and preventing recurrence; • DOE line management regularly assesses the contractor’s reporting processes and performance to determine whether contractors meet reporting requirements for events and DOE G 226.1-2 27 6-21-12 incidents relevant to nuclear facility safety and takes effective actions to prevent their recurrence; and • For sites where contractors report the results of performance measures to DOE (e.g., as part of a contractual provision), DOE regularly assesses the effectiveness of processes for collecting, evaluating, and reporting performance data to ascertain the accuracy, completeness, and validity of the performance measures. 3.5.4 Self-Assessment Program offices and field elements should have a structured, documented program for self- assessment of DOE line management nuclear safety functions and oversight to ensure compliance with applicable requirements and verify effective performance. DOE organizations should perform self-assessments of programmatic and line management oversight processes and activities (e.g., Facility Representative programs, SSO, issues management, technical qualification programs, and training programs) to determine whether requirements and management expectations are met. The frequency of assessments of these functions should be commensurate with the hazards and risks and should comply with applicable directives. Continuous improvement mechanisms (e.g., corrective action processes) should be in place to improve the effectiveness and efficiency of DOE line management self-assessment programs. 3.6 Issues/Corrective Action Management Program DOE line management should implement documented processes for ensuring that corrective actions are appropriate, complete, and performed in accordance with requirements before issues4 identified by DOE assessments or reviews are closed. Issues should be analyzed both individually and collectively to identify causes and prevent recurrences. To avoid unnecessary duplication of effort, program offices may choose to utilize field element issues management processes, and field elements may choose to utilize contractor issues management processes, to track some findings. However, program offices and field elements may need to use their own issues management systems for certain issues.

Criteria should be established to categorize the significance of issues. The highest level of rigor should be applied to issues categorized as high significance in the implementation of the overall corrective action management process. Section 3.6.1 includes additional guidance for determining the significance of issues. Attributes of effective DOE line management processes for managing and tracking nuclear safety-related issues and corrective actions at hazard category 1, 2, and 3 nuclear facilities include: 4 The term “issues” in this discussion of corrective actions management includes deficiencies, findings, or other types of assessment results that indicate performance that does not fully meet expectations. 28 DOE G 226.1-2 6-21-12 • Categorization of issues in a manner that supports prioritization of corrective actions (described in Section 3.6.1); • Processes for ensuring that issues are evaluated and corrected on a timely basis; • Accurate communication of DOE-identified issues to the contractor; • Effective processes for communicating line oversight issues within the DOE line management organizations, and provisions for communicating and documenting dissenting opinions; • Accurate communication of expectations for an effective response (e.g., timeliness, completion of corrective actions, suspension of activities, contractor investigations and/or assessments) for significant and/or repeated issues; • Provisions for independent technical reviews of significant issues; • Corrective action plans (CAPs):  CAPs are a useful tool for implementing an issues management system;  CAPs should describe the analysis (causes and extent of condition); linkages between issues, causes, and recurrence controls; and actions to be taken to manage the issues, including timely milestones for corrective actions, verification of closure, and validation of effectiveness as appropriate;  For external reviews or joint DOE/contractor assessments, DOE-identified oversight issues and associated corrective actions should be coordinated and may be integrated with contractor-identified issues and corrective actions to create a sitewide CAP;  As appropriate for each DOE-identified oversight issue, the organization responsible for correcting the issue should develop a written plan to resolve it. The following actions should be considered in the written plan: o Investigate, to the extent necessary, to determine a complete understanding of the issue, including whether the issue is isolated or represents a systemic program- related or cross cutting issue; o Identify apparent causes or root cause and associated causal factors for each issue; o Develop corrective actions that are clear, concise, and executable; have a measure of performance to demonstrate the outcome; can be verified and validated as complete; and address the identified cause(s); o Identify the organizations and managers responsible for carrying out each corrective action; o Ensure that timely completion dates are established for each corrective action; o Explain how corrective actions will be tracked to closure; and o Identify mechanisms to verify and validate closure of issues; • Document the closure of issues:  Closure packages should be generated that specify what measures were completed to resolve the issue;  The closure package should include objective evidence that the actions taken to resolve the issue have been completed. The person or persons validating

DOE G 226.1-2 29 6-21-12 implementation should consider the need to perform field inspections to validate that corrective actions were completed as specified;  All documentation should be included with the final documentation package that closes the issue; and  Closure of issues should not be approved if corrective actions are found to be inadequate in any way (e.g., the causal analysis was insufficient, the proposed actions do not address identified causes or after implementation did not prevent recurrence of the issue), and the issue of inadequate corrective action should be identified as a new issue; • Corrective actions review and verification:  Corrective actions for significant issues should be reviewed and approved by the appropriate line manager, who should be designated based on the significance of the issue, before they are implemented;  The review and approval process should involve verifying the completeness of the proposed actions to gauge whether their implementation will likely correct the identified issues and prevent their recurrence; and  Verification should typically be performed by some combination of individuals representing the applicable DOE program secretarial officer (PSO), head of the field organization, and the organization that identified the deficiency; and • Validation (effectiveness review):  Corrective actions taken to resolve significant issues should be validated. Validation involves making sure that corrective actions are completed as planned, and that the actions resolved the issue and will prevent its recurrence;  Validation should be performed by the appropriate organization (which should be designated in the CAP, considering such factors as the significance of the issue, knowledge of the corrective action, and appropriate degree of independence) and should be confirmed by a representative from the applicable field element; and  Depending on the significance of the issue, the person or persons validating CAP implementation may choose to sample the completed actions. The sample size depends on the number of corrective actions and the significance of the issue. 3.6.1 Issue Identification and Resolution The objective of oversight in this area is to evaluate the effectiveness of the contractor’s issues management program, with emphasis on the issue significance determination process, and, for issues with high significance, to ensure that a rigorous evaluation and resolution process is effectively implemented. Methods for evaluation include operational awareness and reviews and assessments by the field element including the responsible STSM, with input from Facility Representatives, SSO personnel, and functional area leads. An essential element of issue identification and resolution is an issues management process that is capable of accurately categorizing findings in a manner that supports prioritization of 30 DOE G 226.1-2 6-21-12 corrective actions; ensuring that DOE identified findings are effectively communicated to the contractors; and ensuring that problems are evaluated and corrected on a timely basis. DOE O 226.1B, Section 4.b(4), requires that the following actions be taken for issues categorized as high significance findings: • A thorough analysis of the underlying causal factors is completed; • Corrective actions that will address the cause(s) of the findings and prevent recurrence are identified and implemented; • After completion of a corrective action or a set of corrective actions, an effectiveness review

is conducted, using trained and qualified personnel, to verify that the corrective action/CAP has been effectively implemented to prevent recurrence; • The causal analysis process and results are documented, and plans and schedules for the corrective actions and effectiveness reviews are tracked to completion in a readily accessible system; and • When findings and/or corrective actions apply to more than one secretarial office, a lead office is appointed by mutual agreement between the affected secretarial officers. The field element should identify site-specific criteria for categorizing a finding or issue as a high significance finding, which is subject to all the elements of a rigorous corrective action management process. The following definitions and guidance are excerpted from the Nuclear Quality Assurance Standard, NQA-1, 2008, Quality Assurance Requirements for Nuclear Facility Operations, to assist with developing issue significance determination criteria. NQA-1, Part 1, Introduction, Definition section, defines Conditions Adverse to Quality as “An all inclusive term used in reference to any of the following: Failures, malfunctions, deficiencies, defective items, and non conformances. Significant Conditions Adverse to Quality is one that, if uncorrected, could have a serious effect on safety or operability.” In the context of oversight, a condition adverse the quality is synonymous with a finding or issue, and a significant condition adverse to quality is synonymous with a high significance finding. Additionally, NQA-1, Appendix 16A-1, Non Mandatory Guidance on Corrective Action, includes guidance for classifying conditions adverse to quality. Section 302 of this appendix states that criteria for classifying conditions adverse to quality (e.g., findings/issues) as to significance should be established and, as a minimum, should consider the following aspects: • Impact on health and safety of the public or environment; • Impact on reliability, availability, or maintainability of the equipment or facility; • Importance in meeting regulatory requirements; • Consequence of recurrence; and • The extent to which the adverse condition (finding/issue) may apply to other items or activities beyond the specific occurrence where it may have greater impact. Examples of conditions that may be considered significant under certain conditions include: • Repeated failure to implement a specific portion of a procedure; • Adverse trend of near misses; DOE G 226.1-2 31 6-21-12 • Adverse trend in formality of operations issues or findings; • Widespread training weakness or operator knowledge gaps; and • External findings from the DOE IG or HSS. Additionally, DOE directives require rigorous corrective action management for significant reportable events defined in the Occurrence Reporting and Processing System (see DOE O 232.2, Occurrence Reporting and Processing of Operations Information) and for events meeting criteria for accident investigations. The field element should also consider developing an action matrix to outline the expected field element response to identified issues and contractor demonstrated performance through CAS. The action matrix should provide for a more predictable and consistent field element response to deficiencies based on the associated safety impact. The action matrix should identify the attributes that define a performance level of concern, the appropriate response to be taken by the field element (e.g., level of management interaction, expected contractor action, change in oversight above baseline), and the required documentation to be generated.

3.6.2 Feedback The feedback and improvement function closes the ISM system loop by connecting the practical experiences of work to the planning for future work. Following are criteria for assessing feedback mechanisms: • Individuals or groups are responsible for identifying feedback information, • Assessments and other data sources are established to identify feedback issues, • Feedback requiring evaluation is clearly identified and described, • Factual accuracy of feedback is assured, • Line management evaluates feedback to identify safety issues and significance and to determine causes, and • The individual or group originally identifying the feedback issues is given an opportunity to review the improvement plans and CAPs and provide comments for line disposition. In addition, DOE G 450.4-1C, Integrated Safety Management System Guide, includes Attachment 2, Section 5, Core Function 5, Provide Feedback and Continuous Improvement, which assessors can use as background information when planning an assessment that addresses feedback and improvement mechanisms. This section of DOE G 450.4-1C includes a detailed list of attributes of effective feedback and continuous improvement mechanisms. DOE G 450.4-1C, Attachment 9 Continuing Core Expectations, CCE-6, describes the characteristics of an effective feedback and improvement process, and assessors can use it as background information when planning an assessment that addresses feedback and improvement mechanisms. In addition, the Energy Facility Contractors Group (EFCOG) Work Management Subgroup5 has developed CRADs for performing assessments of activity level work planning and control programs and CRADs for assessing the effectiveness of the implementation of these programs. Both sets of 5 DOE supports EFCOG activities, but EFCOG-developed guidance is not official DOE guidance. 32 DOE G 226.1-2 6-21-12 these CRADs are included by hyperlink in Appendix C and include a CRAD for assessing feedback and improvement. 3.7 Performance Measures and Communications DOE O 226.1B, Section 4.c. requires that DOE line management establish and communicate performance expectations to contractors through formal contract mechanisms and that these expectations (e.g., safety performance measures and commitments) must be established on an annual basis, or as otherwise required or determined appropriate by the field element. The following attributes should be considered in designing site-specific performance measures and processes as applied to safety oversight of nuclear facilities: • Particular attention should be devoted to ensuring that requirements and expectations are established in contractual documents, including performance indicators, measures, objectives, and criteria; • Performance expectations should be established through the development and approval of program documents that are required by regulations, directives, or contracts; • DOE line management should verify that plans submitted by contractors clearly delineate actions to be taken and describe programs that meet DOE requirements and expectations; • DOE line management should work with contractors to ensure the development and monitoring of performance indicators and measures that use objective data and evaluation results that correspond to the requirements, core performance areas, cross cutting performance areas, and program elements of an effective nuclear safety program, such as those shown in Figure 3 (see Section 3.1) or a site-specific version that shows a similar set of nuclear safety program elements;

• Indicators and performance measures should be established and periodically reviewed by DOE line management and communicated to contractors to provide tools for monitoring performance in meeting expectations; • DOE line management should devote attention to verifying the accuracy of the data and information reported via performance measures. Verification could include sampling performance measures to verify that operating experience was appropriately considered, data was appropriately entered, reporting thresholds were clearly established and followed, and action levels/thresholds produced acceptable results; • Contractor-specific performance objectives and criteria and appropriate incentives should be identified and specified in contract documents. Objectives and criteria should be challenging, meaningful, measurable, and focused on improving performance in known areas of weakness. DOE should encourage the use of both leading and lagging performance indicators; and • If the CAS is not adequate for nuclear facilities and nuclear safety programs, DOE line management should provide direction to the contractor through such measures as contractual provisions and direction to improve required program documents (e.g., ISM, CAS, QA program documents). DOE line management should have effective processes for communicating line oversight results and other issues up the DOE line management chain, using a graded approach based on DOE G 226.1-2 33 (and 34) 6-21-12 the hazards and risks. The results of DOE line management oversight activities should be subject to a process that determines significance. The process should consider various factors (e.g., the type of hazards, whether a deficiency was isolated or systemic, the extent of condition, and past process or performance deficiencies in the same area). DOE line management expectations for a response should be clearly communicated to contractors, including expectations for a prompt and effective response (e.g., completion of corrective actions, suspension of activities, contractor investigations/assessments) for significant and/or repeated deficiencies. The processes should provide a sufficient technical basis to allow senior DOE managers to make informed decisions and should include provisions for communicating and documenting dissenting opinions. Processes for resolving disputes about oversight findings and other significant issues should also be implemented and should include provisions for independent technical reviews of significant issues. DOE G 226.1-2 35 6-21-12 4. DETAILED GUIDANCE FOR FEDERAL LINE MANAGEMENT SAFETY OVERSIGHT OF NUCLEAR FACILITIES 4.1 Detailed Guidance for DOE Line Management Oversight of Core and Cross Cutting Performance Areas for Nuclear Facilities DOE line management oversight of nuclear facilities should include all components of the nuclear facility oversight framework (see Figure 3 in Section 3.1) with a particular focus on implementation of the safety basis, which includes the DSA and TSRs. Oversight of the nuclear facility safety basis can be achieved through a rigorous and continuous evaluation of the core and cross cutting performance areas discussed below. A field element nuclear safety oversight program should include a comprehensive set of operational awareness activities and formal assessments to determine the effectiveness of implementation of the CAS and to independently evaluate the contractor’s performance in each of the nuclear facility core and cross cutting performance areas.

This section focuses on detailed guidance for establishing an appropriate baseline oversight program to independently evaluate the contractor’s performance in each of the core and cross cutting performance areas. 4.1.1 Operability of Safety Systems Oversight of the operability of safety systems is primarily performed by DOE personnel assigned to a particular system or multiple systems. The assigned Facility Representative for the nuclear facility also conducts oversight to support the field element’s independent evaluation of safety system operability. Depending on the complexity of the individual systems and the range and number of systems, other field element functional leads (e.g., pressure safety, explosive safety, electrical safety, nuclear criticality safety, fire protection) may also conduct oversight to support the overall evaluation of operability. The information gained from the oversight conducted by all these personnel is periodically analyzed, and the baseline oversight plan is adjusted if necessary. The responsible field element nuclear facility oversight personnel should identify specific criteria, such as an adverse trend or a potential vulnerability, that will lead to an increase in oversight activities from the baseline, as well as action levels for providing technical direction to the contractor. Field element oversight of safety SSC operability should include the following attributes: 1. A comprehensive set of routine operational awareness activities is identified and documented. The following should be considered when developing the set of operational awareness activities: - Review system health reports; - Participate in contractor system walkdowns; - Observe system maintenance activities; 36 DOE G 226.1-2 6-21-12 - Observe surveillance activities; - Observe operability determinations; - Observe causal analysis and extent-of-condition reviews; - Review corrective action status; and - Observe resolution of as-found discrepant conditions. 2. A method for selecting the type, amount, and frequency of routine operational awareness activities is established and documented. Expectations for conducting operational awareness activities on a routine basis are established, and the results of these activities are documented. The expectations should include identifying activities that are conducted daily, weekly, monthly, quarterly, and “as needed.” For example, daily activities could include attending plan-of-the-day meetings and listening to daily operations calls, weekly activities could include reviewing performance metrics and other sources of contractor data, monthly activities could be observing system maintenance or surveillance activities, and quarterly activities could be observing or conducting system walkdowns and shadowing contractor system assessment activities. “As needed” activities could be observing event causal analysis, observing operability determinations, observing safety system modifications, reviewing configuration management activities, reviewing occurrence reports, and evaluating the adequacy of system compensatory measures resulting from an as-found discrepant condition. Operational awareness activities should be broad enough and include a sufficient scope of safety systems that a periodic analysis of oversight information, including information from the CAS, can be used to: - Identify the need for any additional assessments, beyond the baseline set of recurring

safety system assessments; - Identify the need for a “for cause” assessment; - Adjust the focus of upcoming operational awareness activities; - Provide feedback on contractor performance based on performance measures; - Identify new performance targets; and - Identify the need for any directed contractor actions. 3. The set of safety systems that require baseline recurring SSO assessments is identified and documented. Comprehensive assessments, using CRADs, should be conducted for all active and passive safety systems and design features that are identified in the facility DSA and TSRs. The set of safety systems requiring periodic assessments may be adjusted based on the results of field element operational awareness and assessments and contractor oversight information when there is a reasonable level of confidence in the outputs of the CAS. However, safety class SSCs should always be included in the set of safety systems requiring baseline recurring SSO assessments. DOE G 226.1-2 37 6-21-12 4. A minimum periodicity for conducting SSO assessments for the scope of safety systems identified as needing periodic reviews is established and documented. For safety class SSCs, an assessment using a system-specific CRAD using the DSA and the System Description Document as primary inputs should be conducted at least once every three years, unless the safety SSC has been significantly modified or changed status to affect the baseline during this period. For safety significant SSCs identified as needing baseline recurring SSO assessments, an assessment using system-specific CRADs should be conducted at least once every five years for SSCs that have not been modified or changed status significantly. The scope and depth of assessment may be adjusted based on the types and results of field element operational awareness activities and contractor assurance activities. However, the scope of the assessments should include, as a minimum, equipment configuration, material condition, operational reliability, and maintenance of the safety system. Assessments of a representative sample of a similar system in another nuclear facility may be used to meet the baseline periodicity if the systems are of similar age and condition, design, and safety classification and are located in similar environments that impact the systems in similar ways (e.g., in terms of water quality and rates of corrosion of piping). For example, if three nuclear facilities each have a safety class fire suppression system with the same design, operation, and maintenance requirements, an assessment may be performed on the fire suppression system in only one of the nuclear facilities every three years. However, if significant findings were previously identified for a safety system in one such facility, a follow-up assessment may be warranted on that particular system in addition to the baseline review of the same system in another nuclear facility. Based on operational awareness activities and evaluation of contractor assurance information, other systems important to safety may be included on a one-time or periodic basis. However, such systems do not need assessments at a recurring frequency. 5. Activities should be documented in oversight plans, with formal change control.

The written oversight plan should identify and schedule key operational awareness activities conducted on a monthly and quarterly basis, such as system walkdowns and shadow assessments, and the safety system assessments for each annual assessment cycle. The results of routine and scheduled operational awareness activities, formal assessments, and the CAS should be comprehensive enough to allow the following to be periodically conducted, typically on a quarterly and annual basis: - Identify the need for any additional assessments, beyond the baseline set of recurring safety system assessments, for the next quarterly or annual cycle; - Identify the need for a “for cause” assessment; - Adjust the focus of the upcoming quarter’s operational awareness activities; - Provide feedback on contractor performance, based on performance measures; - Identify new performance targets; - Identify directed contractor actions; and - Validate the contractor’s evaluation of continued system operability. 38 DOE G 226.1-2 6-21-12 4.1.2 Technical Safety Requirements Implementation The proper implementation of safety basis controls is important for assuring the protection of workers and the public. Current requirements promote the use of a graded approach that emphasizes the controls that are most important for protecting the public and workers. These controls are identified as TSRs and include safety limits, operating limits, surveillance requirements, administrative (including specific administrative) and management controls, use and application provisions, and design features. DOE requirements for implementing safety basis controls set out in 10 CFR Part 830, Nuclear Safety Management, and associated DOE directives focus on holding contractors responsible for proper implementation of controls as part of their QA program. Contractors conduct implementation verification reviews (IVRs) for new or revised safety basis controls and periodically conduct IVRs to reconfirm proper implementation of existing safety basis controls in accordance with DOE G 423.1-1A, Implementation Guide for Use in Developing Technical Safety Requirements. Such reviews are geared toward meeting the requirements of 10 CFR Part 830 and several DOE orders, including DOE O 414.1D, Quality Assurance; DOE O 226.1B Implementation of Department of Energy Oversight Policy; DOE O 420.1B, Facility Safety; and DOE O 426.1, Chg. 1, Federal Technical Capability. Independent validations of safety basis controls occur at several levels to various degrees. While contractors perform independent assessments in accordance with 10 CFR 830 and DOE O 414.1D, field elements provide for reviews by SSO, Facility Representative, and safety basis personnel during operational readiness reviews, safety basis approvals, and independent assessments. DOE Headquarters program offices, the CTAs (through their technical support organizations), and HSS’s Office of Enforcement and Oversight also perform reviews of TSR implementation. DOE line management may also choose to perform periodic re-verification of existing safety basis controls similar to a contractor periodic IVR. Guidance for selecting the scope, sample size, and periodicity for conducting field element IVRs of existing safety basis controls is provided in this section.

For startup of new (or restart of existing) facilities, activities, or operations, the primary means for DOE's validation of the initial implementation of safety basis controls are readiness reviews. The readiness review process includes requirements for evaluating whether the contractor’s processes for ensuring that safety basis controls have been properly implemented are effective. The readiness review process also includes requirements for DOE to determine whether the safety basis controls have been appropriately implemented. This determination occurs prior to the readiness review final report’s conclusion as to whether startup or restart of the nuclear facility, activity, or operation can proceed safely. A good source of information for identifying opportunities for DOE oversight of TSR implementation is the startup notification reports required by DOE Order 425.1D, Verification of Readiness to Start Up or Restart Nuclear Facilities. The resulting plan of action for the readiness activity, along with supporting information, provides insight into changes in the safety basis that require implementation of new safety basis controls, or changes to existing safety basis controls. DOE G 226.1-2 39 6-21-12 Field element oversight of the ongoing implementation of TSR controls is a shared responsibility among the Facility Representative, SSO personnel, and other functional oversight leads. The Facility Representative is typically responsible for oversight of operational controls, such as daily, weekly, and monthly surveillances that verify system operational parameters and SACs. SSO personnel are typically responsible for oversight of less-frequent surveillances, such as quarterly and annual maintenance activities, integrated system testing, and passive design feature inspections. Depending on the complexity of the individual systems and the range and number of systems, other field element functional leads may conduct oversight of specific TSR surveillances or SACs in their area of expertise. Also, the SMPs in the TSRs may have elements of the program credited as ACs or, in some cases, SACs. For the purposes of this Guide, the ACs or SACs associated with an SMP are considered part of TSR implementation. Evaluating the overall adequacy of SMPs is addressed in Section 4.1.3. DOE line management should ensure that expectations for the scope, breadth, depth, and periodicity of these SSO and Facility Representative reviews are defined in guidance and site procedures. The following sections provided attributes that should be considered when developing and periodically updating such expectations and guidance. Field element oversight of TSR controls should include the following attributes: 1. A comprehensive set of routine operational awareness activities is identified and documented. The following should be considered when developing the set of operational awareness activities: - Monitor TSR surveillance completion status board or other tracking tool; - Review logs and other information to maintain awareness of the results of TSR surveillances; - Monitor actions in response to discovered TSR violations and out-of-tolerance surveillance results; - Observe contractor implementation of ACs and SACs; - Observe contractor performance of required surveillance requirements; - Review contractor performance measures and indicators; - Observe causal analysis and extent-of-condition reviews; and - Review corrective action status.

2. A method for selecting the type, number, and frequency of routine operational awareness activities is established and documented. Expectations for conducting operational awareness activities on a routine basis are established, and the results of these activities are documented. The expectations should include identifying routine activities that are conducted daily, weekly, monthly, quarterly, and “as needed.” For example, daily activities could include reviewing the operations status board and listening to daily operations calls, weekly activities could include observing ACs (such as verification of material-at-risk inventories) and reviewing performance metrics and 40 DOE G 226.1-2 6-21-12 other sources of contractor data, monthly activities could be observing system maintenance or surveillance activities, and quarterly activities could be observing or conducting system walkdowns and shadowing contractor system assessment activities, including contractor IVRs of TSR controls. “As needed” activities could be observing responses to TSR non- compliances, reviewing occurrence reports, and evaluating the adequacy of the implementation of compensatory measures resulting from an as-found discrepant condition. Operational awareness activities should include a representative sample of the full set of TSR controls so that a periodic analysis of oversight information, including information from the CAS, can be used to: - Identify areas that warrant an independent assessment of the implementation of a specific set of controls or new controls; - Identify the need for a “for cause” assessment; - Adjust the focus of upcoming operational awareness activities; - Provide feedback on contractor performance based on performance measures; - Identify new performance targets; and - Identify the need for any contractor-directed actions. 3. The method for selecting the scope of safety basis controls credited and included in the TSR that require an initial and/or a periodic formal assessment (i.e., an IVR) is identified and documented, along with the periodicity for conducting the IVRs. Scope and Periodicity of Contractor Safety Basis Control IVRs. Section 3.3 of Appendix D, Performance of IVRs of Safety Basis Controls, of DOE G 423.1-1A, Implementation Guide for Use in Developing Technical Safety Requirements, provides guidance for the re- verification of safety basis controls by nuclear facility contractors. The following is an excerpt of that guidance to provide context for the additional guidance for conducting DOE field element IVRs of safety basis controls: The re-verification of Safety Basis controls is an important tool for contractors to ensure that they continue to operate the facility in accordance with the Safety Basis. Many of the hardware controls will have surveillance requirements that periodically ensure they are operable to perform as documented in the Safety Basis. In general, re-verification of Safety Basis controls should be performed every 3 to 5 years as part of the contractor’s ongoing assessment process. Safety controls that are susceptible to the effects of the degradation of human knowledge (e.g., procedural controls) typically should be re- verified at least every 3 years, and controls dependent upon hardware functionality typically should be re-verified at least every 5 years. The following factors should be considered in determining the specific frequency, scope, and depth of re-verification of a Safety Basis control.

- Safety significance of Safety Basis control - Type of Safety Basis control and susceptibility to degradation - Extent of Safety Basis control changes that have accumulated since the last IVR. DOE G 226.1-2 41 6-21-12 The following guidance is intended to supplement the above general guidance for Federal oversight of contractor IVRs conducted consistent with DOE G 423.1-1A and to aid in determining a reasonable basis for assessing the periodicity, breadth, and depth of periodic contractor IVRs. This additional guidance may be used in the developing site specific implementing procedures. The field element should establish, through appropriate contract mechanisms, site-specific expectations for both initial and periodic contractor IVRs, the frequency of the periodic reviews, and an approach for establishing the sample size for verifying a single control in facilities with redundant safety systems and systems with redundant controls and multiple components. A graded approach for conducting re-verification IVRs should ensure a higher priority, both in the sample size of the controls to be reviewed and the periodicity of the review, for safety class controls and controls that are more reliant on human performance, such as SACs. The sample size for each IVR selected to be performed should be based on the risk significance of the safety system, past operational performance, and the number of safety systems and their associated complexity of operation. Greater numbers of safety systems and their associated complexity will normally result in the need to devote more time to preparing and conducting an assessment. The following examples illustrate some ways to apply the graded approach to determine the periodicity, scope, and depth of periodic IVRs. (These examples are for illustrative purposes only.) Example 1 A nuclear facility has one safety class system, with one daily surveillance requirement (SR), two monthly SRs, and one annual SR. The daily SR specifies a check of ten similar components around the facility, the monthly surveillances specifies a check of two redundant systems with multiple components, and the annual surveillance specifies a comprehensive evaluation of the entire system. Since there is only one safety class system, and it has a relatively small number of surveillances and components, the scope of the IVR would be expected to include all the individual surveillances and most of the components within the depth or sample size of the IVR. Example 2 A nuclear facility has 5 safety class systems with a total of 20 SRs and 10 safety significant systems with over 50 SRs and over 200 individual components that are checked during all the SRs. Since there is a large number of individual SRs and overall components, the scope and sample size of the IVRs need to be carefully evaluated and determined. For example, one approach could be to evaluate one-third of the safety class SRs each year so that all are covered in three years, with 50% of individual components covered each three-year cycle. With sustained performance, and based on an analysis of the results of the baseline 42 DOE G 226.1-2 6-21-12 cycle, the sample size for subsequent cycles may be reduced. The overall objective is to ensure sufficient breadth and depth in the periodic reviews to provide a reasonable level of confidence that the safety basis controls continue to be effectively implemented over an established period of time. Example 3

This example illustrates an approach for determining the sample size of individual components that are tested as part of a single TSR SR. The safety class Quarterly Fire Alarm System Surveillance requires a physical test of each of 20 alarm panels the nuclear facility. Since this is a safety class control, an IVR should be considered every three years, with enough of the individual components evaluated to reach a conclusion about overall effectiveness. For 20 components, 5 to 10 components may be tested. For a system with only five individual components, the sample size may be need to initially be all five, and then the sample size may be reduced for the following three-year cycle based on sustained performance. Scope and Periodicity of Field Element IVRs. As stated in Section 3.3 of Appendix D of DOE G 423.1-1A, DOE may also choose to perform periodic re-verification of Safety Basis controls. This can be performed as part of DOE’s normal oversight efforts (e.g., reviews conducted by the SSO staff or Facility Representatives, or through DOE shadowing of contractor IVR activities) and may not be as formal or detailed as the contractor re- verification. The appropriate reviewers and level of formality should be determined as part of the DOE’s integrated oversight planning. The following section provides guidance for selecting the scope, sample size, and periodicity for conducting field element IVRs of existing safety basis controls. The field element should document an approach for selecting the scope, sample size, and periodicity for conducting IVRs. The primary emphasis should be on observing or shadowing contractor-led IVRs. The type and number of IVRs shadowed by the field element should be based on the significance of the control, the results of contractor assessments, and the results of field element operational awareness activities. As previously described in this section, the routine operational awareness activities of TSR control implementation, such as observing valve lineup verifications, conducting log reviews, and observing TSR surveillance and maintenance activities, should be documented so the results can support the selection of which contractor IVR to shadow. For facilities that have a relatively small number of safety class SSCs (fewer than 5), with a relatively small number of total combined surveillances for these systems (fewer than 20 a year), the field element should only need to shadow contractor IVRs on a small subset of these controls. For example, with a total of 20 safety class controls, using the guidance in DOE G 423.1-1A outlined above, the contractor should conduct IVRs on a sample of these controls each year and should cover a majority of them every three years. The field element should shadow a subset of the contractor IVRs and, based on the results of the contractor IVRs and their operational awareness activities, may also decide to lead an IVR on a TSR DOE G 226.1-2 43 6-21-12 control not included in the scope of a contractor IVR. If performance is good and there is high confidence in the CAS and the quality of the contractor IVRs, the field element should not need to lead a separate IVR in a given assessment cycle. However, for safety class SSCs, the field element should establish a baseline assessment program that includes shadowing at least one contractor IVR each year and leading an IVR at least once every three years.

For facilities that have a greater number of safety class SSCs (e.g., more than 5) and total combined controls for these systems (e.g., more than 50), the contractor is not expected to perform IVRs on all the combined controls over a three-year period. To provide confidence in the overall performance and operability of the greater number of systems, the contractor should sample enough of the various controls to provide reasonable assurance of continued system operability and compliance with the TSRs each year. This may mean that only 20- 30% of the individual controls will have an IVR over a three-year period. Likewise, with a significantly greater number of safety class systems and total controls, the field element should consider conducting more than one shadow assessment of contractor-led IVRs and leading at least one IVR each year. For facilities with only safety significant systems and related surveillances, a similar approach should be used for selecting the type, number, and scope of shadow assessments of contractor IVRs and field element-led IVRs. However, the periodicity may be extended so that at least one shadow assessment is performed every three years and at least one field element-led IVR is conducted every five years. The program office for each site should establish specific expectations for the number of field element IVRs that are expected to be performed on a periodic basis. The periodicity should be based on the relative number of safety class and safety significant controls, confidence in the CAS and line oversight, and other relevant factors. Specific Administrative Controls. Specific expectations for the development and oversight of SACs are included in DOE-STD-1186-2004, Specific Administrative Controls. Since the effectiveness of these controls relies more on human performance than on engineered controls, an appropriate priority should be placed on including the SACs in the scope of periodic recurring IVRs, both for the contractor and the field element. Administrative Controls. The DSA may credit elements of SMPs and include them in the facility TSRs as ACs. These controls should be explicitly evaluated as part of the oversight of the SMPs. Periodic evaluation of the ACs may be included in the scope of IVRs, both contractor and field element, if appropriate. 4. A written oversight plan is developed and documented, with formal change control. The written oversight plan should identify and schedule the significant operational awareness activities conducted on a monthly and quarterly basis, such as observations of TSR control performance, selected shadow assessments of contractor assessments and IVRs, and field element IVRs selected for each annual assessment cycle. The breadth and depth of the routine and scheduled operational awareness activities and shadow and independent field 44 DOE G 226.1-2 6-21-12 element assessments should be sufficient to allow meaningful conclusions on a recurring basis, typically quarterly and annually, in the following areas: - Identify the need for any additional field element assessments and/or IVRs for the next quarterly or annual cycle; - Identify the need to conduct a “for cause” assessment; - Adjust the focus of the upcoming quarter’s operational awareness activities; - Provide feedback on contractor performance based on performance measures; - Identify new performance targets; - Identify directed contractor actions; and - Independently evaluate the status and overall health of the implementation of TSR

controls. 4.1.3 Safety Management Program Implementation The field element should routinely monitor and formally assess, on a periodic basis, each SMP defined in the facility DSA. The field element should identify an oversight lead for each credited SMP. The following are examples of typical SMPs identified in a nuclear facility DSA: • Fire protection program; • Criticality safety program; • Radiation protection program; • Radioactive waste management program; • Nuclear material packaging and storage; • Nuclear explosive safety program; • Emergency management; • Safety basis program:  USQ, and  DSA/TSR updates; and • Other specific safety programs credited in the DSA – for example, the pressure safety program. Field element oversight of SMPs should include the following attributes: 1. A comprehensive set of routine operational awareness activities that focuses on SMPs is identified and documented. The following should be considered when developing the set of operational awareness activities to oversee SMPs: - Review contractor SMP performance metrics; - Review status of issues and corrective action status; - Review related occurrence reports; - Review status and results of contractor assessments; DOE G 226.1-2 45 6-21-12 - Observe performance of credited SMPs and ACs; - Review implementing procedure updates; and - Attend/review related SMP training classes. 2. A method for selecting the type, amount, and frequency of routine operational awareness activities to oversee SMPs is established and documented. Expectations for conducting operational awareness activities to oversee SMPs on a routine basis are established, and the results of these activities are documented. In general, these activities are performed less often than for safety systems and TSRs. Emphasis should be placed on monitoring the performance of any credited ACs and monitoring program performance measures. Some activities should be conducted on a recurring basis, such as monthly and quarterly. The overall breadth of operational awareness activities to oversee SMPs should be sufficient to provide for a periodic analysis of oversight information, including information from the CAS, that can be used to: - Identify focus areas for any shadowing of contractor periodic assessments of the SMP; - Identify focus areas for field element independent periodic assessments of the SMP; - Provide feedback on contractor performance based on performance measures; - Identify new performance targets; and - Identify actions directed by the contractor, such as requiring a special assessment of an SMP element or the entire SMP. 3. The expectations for periodic assessments of credited SMPs are identified. A baseline frequency for conducting formal assessments of credited SMPs for nuclear facilities should be established. Some DOE regulations and directives require field element reviews of specific contractor programs over a certain period of time. For example, the field element is required to perform a comprehensive assessment of the conduct-of-operations program every three years. If the SMP has specific requirements for conducting assessments on a certain periodicity, those requirements should be followed. If a longer periodicity is warranted based on sustained good performance and a mature CAS, the field element manager may request an exemption from the requirement using the process in DOE O 251.1C, Departmental Directives Program. However, regardless of performance, the field element should perform an assessment of all credited SMPs at least once every five years. Where a sitewide SMP covers a number of nuclear facilities, it is appropriate to sample the implementation in a subset of facilities, if at least one SMP in each nuclear facility is assessed in a specific five-year period. The breadth and depth of the formal assessments should be adjusted based on the results of operational awareness activities, contractor performance, the relative importance of any credited ACs in the SMP, and confidence in contractor assurance information.

46 DOE G 226.1-2 6-21-12 4.1.4 Safety Management System Implementation The objective of oversight in this area is to evaluate the effectiveness of ISM systems implementation, primarily at the facility and activity level; the effectiveness of the CAS; and QA programs. A field element lead should be identified to evaluate the broad safety management systems listed below, as they apply to nuclear facilities. These broad safety management systems are normally applied on a sitewide basis but are relied upon as a safety management program supporting implementation of the safety basis. Thus, an oversight program focused on nuclear facilities should assess whether the sitewide program provides effective implementation of the program at the nuclear facilities. 1. Integrated Safety Management Effectiveness Reviews. DOE field offices are responsible for performing ISM system effectiveness reviews and using the results of these reviews to prepare ISM declarations of the status of both field office and contractor ISM system implementation and submit the declarations to their respective program office. Effectiveness reviews should consider both ISM process and outcome measures. Examples of ISM process measures include how well the organization addresses: (1) implementation of each ISM core function and principle; (2) integration of ISM with other management systems, such as QA; and (3) the effectiveness of the identification of weaknesses and the effectiveness of improvement activities. Additional examples of ISM process measures include: (1) performance on process-based performance measures, and (2) results of oversight reviews. The ISM outcome measures can be obtained from the results of the field office’s achievement of their safety goals and objectives and the results of the contractor meeting DOE’s expectations described in the contractor’s safety performance objectives, measures, and commitments. DOE O 450.2, Section 5.c. requires “the establishment of the annual Field Element safety goals and objectives and contractor safety performance objectives, measures, and commitments.” DOE’s acquisition regulations (DEAR), 48 CFR 970.5223-1, Integration of environment, safety, and health into work planning and execution, requires “On an annual basis, the Contractor shall review and update, for DOE approval, its safety performance objectives, performance measures, and commitments consistent with and in response to DOE's program and budget execution guidance and direction.” ISM system effectiveness reviews serve to: (1) determine the effectiveness of the ISM system in supporting the conduct of work, (2) identify weaknesses to focus attention on corrective and improvement actions, (3) identify opportunities for improvement in the efficiency or effectiveness of the ISM system and its implementation, and (4) identify actions for continuous improvement both at the site and for sharing with other DOE elements to aid in improvements at other locations. DOE field offices should identify and provide the criteria that will be used to assess contractor ISM effectiveness. These criteria should be conveyed to their contractors as early as possible DOE G 226.1-2 47 6-21-12

(preferably one year in advance of planned effectiveness reviews) so that contractors’ efforts and resources are appropriately applied to meeting DOE's expectations. Similarly, DOE field offices would benefit from receiving from their program office early identification of effectiveness criteria in order to plan the field office self-assessments and prepare for program office line oversight reviews of the field office. The criteria for determining effectiveness should be included in ISM system descriptions and updated periodically and when changes are made to the ISM system description. ISM system re-assessments should be scheduled as part of the site’s IOP once the need, scope, and frequency of re-assessments are determined. All DOE and contractor organizations are required to ensure that their ISM system descriptions are complete, accurate, and up to date. The timing of this process should be coordinated with the DOE budget planning and formulation cycle so that safety and quality issues and considerations are an integral part of the budget process. ISM system description updates should be reflected in ISM declarations, if necessary. Facility and Activity Level Work Planning and Control. DOE G 450.4-1C, Integrated Safety Management System Guide, includes guidance that is useful for activity level work planning and control. DOE G 450.4-1C, Attachment 4, Work Planning and Execution, describes a facility and activity level work planning and control process, and Phase II Core Expectations in Attachment 8, ISM Effectiveness Reviews, Declarations, and Verifications, provides eight core expectations that sites can use for effectiveness reviews of facility and activity level work planning and control. CRADs are useful tools for performing effectiveness reviews. Appendix C of this Guide (DOE G 226.1-2) provides links to both DOE and EFCOG5 CRADs that can be used to develop local CRADs for effectiveness reviews of facility and activity level work planning and control. The DOE CRADs are contained in DOE-HDBK-3027-99, Integrated Safety Management Systems (ISMS) Verification Team Leader's Handbook, which includes CRADs for verifying how well the procedures, policies, and manuals of practice for facility and activity level work planning and control have been implemented. The EFCOG CRADs include CRADs for performing assessments of activity level work planning and control programs and CRADs for assessing the effectiveness of the implementation of these programs. Results of effectiveness reviews of facility and activity level work planning and control, using local CRADs derived from these published CRADs, should be included in ISM system declarations. ISM Declarations. The ISM declaration process is essential for promoting continuous improvement of ISM systems. It provides an opportunity to review, analyze, and evaluate safety performance. The need for, and frequency of, declarations must be based on performance history (DOE O 450.2, Section 4.c.) and should be supported by objective evidence. Performance history can be determined from multiple indicators of safety performance, including: results of self- assessments; results of oversight reviews; results of integrated reviews across multiple reporting elements; performance results for established field office goals and objectives and contractor performance objectives, measures, and commitments; conclusions of operating experience programs; and other performance information. Examples of objective evidence include: safety

48 DOE G 226.1-2 6-21-12 and quality performance measures data; results of assessments, surveillances, management walkthroughs, and event and accident investigations; and documented effectiveness of actions taken to correct safety deficiencies and poor safety and quality performance. The objective evidence should include results of both DOE and contractor oversight activities. The recommended process for preparing ISM system declarations consists of the following steps: (1) perform effectiveness reviews of the contractor's ISM system (this step may be conducted continuously and the review results summarized when a declaration is prepared); (2) perform self-assessment of the field office ISM system; (3) update the ISM system goals and objectives, performance objectives, measures, and commitments; (4) update the ISM system descriptions as necessary; and (5) prepare the ISM system declaration addressing the specific criteria provided by the field office and respective program office. In addition, DOE G 450.4-1C, Integrated Safety Management System Guide, includes Attachment 8, ISM Effectiveness Reviews, Declarations, and Verifications, which provides guidelines for ISM declarations that assessors can use as background information when planning an assessment that addresses ISM declarations. ISM System Verification. ISM verification reviews typically are performed when DOE determines a need to perform a comprehensive and in-depth review of ISM system implementation (e.g., after a new contractor assumes responsibility for a site). Field offices should consider the scope and periodicity of assessment activities by outside groups in determining whether a full verification is needed and should tailor the scope of the verification to focus on areas that have not received recent attention or are known to need verification of improvement actions. Program offices should plan and conduct full ISMS verifications on a fixed periodicity, such as once every three to five years, to promote organizational learning and continuous improvement. Appendix C of this Guide (DOE G 226.1-2) includes a link to DOE-HDBK-3027-99, Integrated Safety Management Systems (ISMS) Verification Team Leader's Handbook, which includes two sets of CRADs for use in verifying the adequacy of ISM programs. One set is for verifying the adequacy of the documentation of the procedures, policies, and manuals of practice used to implement safety management and focuses on the management level. The other set is for verifying the adequacy of how these procedures, policies, and manuals of practice have been implemented at the facility or activity level. 2. Quality Assurance DOE Federal organizations should conduct line management oversight and self-assessments to evaluate whether they are effective in overseeing the contractor’s, as well as their own organizations’, QA programs. An effective contractor QA program is essential for effective implementation of the safety basis (e.g., procurement processes ensure fidelity of components that provide a nuclear safety function). Adequate oversight of the contractor’s QA program is therefore an essential element of an effective oversight program for nuclear facilities. DOE Order 414.1D, Quality Assurance, DOE G 226.1-2 49 6-21-12 requires the use of NQA-1, Quality Assurance Requirements for Nuclear Facility Operations, as the default QA standard (others can be used if approved by the secretarial officer).

Oversight of the approved contractor QA program at nuclear facilities should focus on the implementation of QA processes for nuclear applications as detailed in the QA program and the implementing standard (normally NQA-1). Oversight of the contractor QA program should be integrated with SSO oversight (see Section 4.1.1), since SSO oversight activities necessarily include a large degree of QA oversight. Oversight of the contractor QA program at nuclear facilities should have a particular emphasis on safety systems and should include (but not be limited to) assessments of the effective implementation of: • Design control processes; • Procurement processes, including commercial grade dedication (as described in NQA-1); • Work control processes; • Corrective action processes; • Flowdown of applicable requirements and expectations to subcontractors, vendors, and suppliers; • Safety software, as defined by DOE O 414.1D; and • Suspect/counterfeit items (see DOE O 414.1D, Attachment 3, Suspect/Counterfeit Items Prevention). 3. Contractor Assurance System Section 3.5.3 provides information on reviewing a CAS. A published CRAD that can be used for developing a local CRAD for evaluating the implementation and effectiveness of a CAS is provided in Appendix C. Corrective action management is described in Section 3.6, and issue identification is addressed specifically in Section 3.6.1. 4.1.5 Formality of Operations Programs Formality of operations usually refers the following four programs that are implemented with a high degree of rigor in a DOE nuclear facility: • Conduct of Operations (Corresponding Field Element Oversight Lead - Facility Representative); • Conduct of Engineering (Corresponding Field Element Oversight Lead - Engineering Lead with SSO personnel support); • Conduct of Maintenance (Corresponding Field Element Oversight Lead - Maintenance Functional Area Lead); and • Conduct of Training (Corresponding Field Element Oversight Lead - Contractor Training and Qualification Functional Area Lead). The responsible field element oversight leads for each of the components of the formality of operations program should conduct a mix of oversight activities to provide a reasonable level of 50 DOE G 226.1-2 6-21-12 assurance that the formality of operations program supports safe operation of the nuclear facility. This mix of activities would include operational awareness, shadow assessments, and independent Federal assessments required by DOE directives. For areas where an independent Federal assessment is not required by a DOE directive, Federal oversight should focus on shadowing contractor assessments and conducting operational awareness activities to provide an adequate level of confidence in the maturity of each of the core components of the formality of operations program. Credited elements of the components of the formality of operations program, such as conduct of operations, are evaluated as part of that SMP. Also, some TSR surveillances require meeting specific requirements of components of the overall formality of operations program. For example, a TSR that requires independent verification (IV) should meet the requirements for IV in the contractor’s conduct of operations program. Another example is maintenance-related surveillance requirements and tests that would need to meet the applicable requirements of the nuclear facility maintenance program. The results of these types of TSR implementation oversight should be reviewed to identify information that also provides insight into the performance of the individual components of the formality of operations program.

Implementation of the components of the formality of operations program is highly interrelated. For example, the conduct of engineering program may include requirements for identifying predictive and preventive maintenance requirements. The maintenance program defines expectations for developing implementing procedures, conducting the preventive and predictive surveillance requirements, and conducting post-maintenance testing. The conduct of operations program identifies requirements for maintaining system status during the maintenance activity, communicating results, and if necessary reporting significant issues. The conduct-of-engineering program establishes expectations for maintaining the technical baseline and evaluating system deviations as a result of post-maintenance testing. Finally, the training program identifies training requirements for operations, maintenance, and engineering activities. As a result, the field element leads for each component of formality of operations should routinely discuss the results of their oversight activities in order to identify common issues and weaknesses that may need to be addressed. Operational Awareness Activities. Due to the highly interrelated aspects of the each component of formality of operations, specific observations of an activity should be conducted from start to finish, including the interfaces with other components of formality of operations. Each of the oversight leads may conduct these observations of work in process separately, or collectively as a group. If they are conducted separately, the oversight lead should document any issues that other leads might factor into their oversight activities. Additionally, field observations of activity-level work control should include applicable evaluations of elements of formality of operations. Formal Assessments. The contractor should periodically assess several key aspects of the overall formality of operations program over a baseline period. The contractor should establish the scope and periodicity for these baseline assessments. Some assessments are identified in the TSRs as ACs with a defined scope and periodicity of review. Another approach is for the contractor to conduct what are sometimes called “facility centered assessments,” which consist DOE G 226.1-2 51 6-21-12 of vertical reviews of the interfaces of programs within a facility, system, and activity and horizontal reviews looking at a single program across a facility, system, and activity. These are typically conducted on a recurring basis, such as every three or five years. The field element should encourage contractors to perform integrated facility centered assessments (or similar approaches) at defined periodicities. The field element should use the results of operational awareness activities to select focus areas to shadow during these assessments. Additionally, the field element needs to identify the set of DOE directive or Headquarters line/PSO requirements for assessments of the key components of formality of operations on a recurring basis. Where the formality of operations program covers a number of nuclear facilities, it is appropriate to sample its implementation in a subset of facilities, if the overall program is evaluated across all the nuclear facilities within the required timeframe. The breadth and depth of the formal assessments should be adjusted based on the results of operational awareness activities, contractor performance, the relative importance of any credited ACs in any of the components of formality of operations, and confidence in contractor assurance information.

Another recommended approach is to conduct an in-depth integrated assessment of a facility safety system, process, or specific control, or review the results of a detailed vertical slice of a safety system, process, or control, with an emphasis on aspects of formality of operations. 4.1.6 Safety Culture Policy and Requirements Related to Safety Culture. The ISM policy and order emphasize that a healthy safety culture is an inherent element of ISM, and the ISM Guide (DOE G 450.4-1C) provides guidance related to safety culture. Among other things, the ISM Guide discusses three key safety culture focus areas (leadership, employee/worker engagement, and organizational learning) that are consistent with the overarching DOE ISM framework. In addition, DOE and the EFCOG collaborated to publish information and resource documents related to safety culture. The EFCOG website (http://efcog.org/wg/ism_pmi/index.htm) identifies a wide range of resources that can be useful to DOE line managers and site operating contractors in establishing and sustaining a healthy safety culture. DOE contractors may adopt guidance from DOE G 450.4-1C or the EFCOG documents, or they may use various other models for establishing and sustaining a healthy safety culture. As examples, the Nuclear Regulatory Commission (NRC) has developed policies and guidance related to safety culture including a safety conscious work environment6 (SCWE). A December 5, 2011, memorandum on nuclear safety, signed by the Secretary of Energy and Deputy Secretary of Energy, identifies nuclear safety as a core value of DOE and further emphasizes DOE’s commitment to a strong and sustained safety culture as an essential element of nuclear safety (http://www.hss.energy.gov/deprep/2012/TB12J24A.PDF). That memorandum 6 The NRC final guidance for SCWE defines this term as the employee’s willingness to identify safety concerns, an important, but distinct attribute of a strong safety culture (which includes other attributes, such as safety-over- production principle, procedural adherence, and conservative decision-making). http://efcog.org/wg/ism_pmi/index.htm http://www.hss.energy.gov/deprep/2012/TB12J24A.PDF 52 DOE G 226.1-2 6-21-12 indicates that DOE will be performing a broad assessment of safety culture across DOE that will identify areas for improvement. In addition, the DOE Implementation Plan for DNFSB Recommendation 2011-1, Safety Culture at the Waste Treatment and Immobilization Plant, identifies plans for assessments that will lead to needed improvements in several aspects of safety culture expectations, including guidance and tools for contractor self-assessment and DOE oversight of a site’s safety culture. Because DOE’s response to DNFSB Recommendation 2011- 1 is expected to result in revisions to DOE guidance on safety culture, DOE plans to monitor these efforts and will incorporate the additional guidance and lessons learned into subsequent revisions to this Guide or through other appropriate mechanisms. In the interim, this version of this Guide (DOE G 226.1-2) provides information and references that may be useful to DOE organizations as they prepare to strengthen their capabilities in the oversight of the safety culture at nuclear facilities.

Role of Federal Line Management Oversight. In accordance with the ISM policy, DOE Federal line managers have a responsibility to ensure a healthy safety culture at all levels of their organizations. In addition, DOE line management has an important role in overseeing the effectiveness of the contractor’s nuclear facility safety culture, including determining whether contractors have established a SCWE in which employees can raise safety questions without fear of retribution and overseeing the effectiveness of implementing DOE O 442.2, Differing Professional Opinions for Technical Issues Involving Environment, Safety and Health, for both DOE and contractor employees. The DOE responsibilities for oversight of the nuclear safety culture encompass two main areas: • Assess the adequacy of contractor management and self-assessment of safety culture through routine monitoring and evaluation; and • Perform independent and in-depth assessment of the safety culture of DOE and contractor organizations as circumstances require. Traditional assessments focus on technical and process issues using established regulations, codes, standards, and quality assessment tools. In contrast, safety culture assessments are characterized by a focus on human and organizational issues, using general agreement of the results of multiple methods to validate those results, and an emphasis on the influence of perceptions on safety performance. DOE recognizes that various models may be used to assess safety culture. However, all models should be determined to be appropriate for the organization under review and used by individuals who have received training on the use of the model. Fundamental to the capability to assess safety culture is knowledge of the elements of an effective safety culture, including SCWE. DOE will conduct safety culture training for multiple layers of employees as part of the 2011-1 Implementation Plan. DOE and contractor organizations should ensure that appropriate safety culture training is institutionalized to support implementation and assessment of safety culture. DOE G 226.1-2 53 6-21-12 DOE assessment of safety culture should be incorporated into routine monitoring processes because safety culture influences all aspects of nuclear safety. Issues related to safety culture often contribute to performance deficiencies. Oversight activities that focus on safety culture often inform management about the reasons for the deficiencies. In implementing their oversight role, DOE organizations should be aware of factors that challenge safety culture (e.g., budget reductions, reductions in force, and schedule pressures) and issues that may be particularly important to facilities in the design and engineering stages of a facility’s lifecycle. DOE should also include reviews of DOE programs and processes that are particularly important to safety culture, such as DOE O 442.1, Department of Energy Employee Concerns Program, and DOE O 442.2, Differing Professional Opinions for Technical Issues Involving Environment, Safety and Health. Routine Monitoring of Safety Culture. For routine monitoring, DOE oversight elements should use an analytical framework that includes key organizational behaviors in order to characterize the organization’s safety culture. For example, the NRC oversight framework (Table 1) includes 13 behaviors grouped into four cross-cutting areas. Table 1. NRC Oversight Framework Cross- Cutting Areas Human Performance

Problem Identification and Resolution Safety Conscious Work Environment Other Safety Culture Components Behaviors Decision Making Resources Work Control Work Practices Corrective Action Program Operating Experience Self/Independent Assessments Environment for Raising Concerns Preventing, Detecting, Mitigating Perceptions of Retaliation Accountability Continuous Learning Environment Organizational Change Management Safety Policies Recurring concerns in two or more of the cross cutting areas may be an indicator that more in- depth assessment of safety culture by the contractor or DOE is necessary. In-depth Safety Culture Assessments. DOE in-depth safety culture oversight activities should use an analytic framework that systematically addresses a defined set of key, observable, organizational behaviors. DOE organizations could use or adapt information and methods 54 DOE G 226.1-2 6-21-12 developed by the NRC as a starting point for identifying the behaviors that are relevant for their organization.7 Recommended methods for assessing nuclear safety culture employ multiple tools that provide quantitative and qualitative data to assess each organizational behavior systematically and objectively. The safety culture assessment team collectively should have received appropriate training that ensures it can perform an effective assessment of safety culture. Sources of Additional Information. DOE organizations may benefit from considering frameworks, methods, tools, and lessons learned from other organizations and adapting them to their needs. The following provides information about safety culture assessments that may be particularly useful to DOE organizations, including links to specific sources. This EFCOG website includes a document that describes methods for evaluating safety culture and is particularly pertinent to DOE line management organizations that perform oversight of SCWE at nuclear facilities The document can be found at: http://efcog.org/wg/ism_sctt/docs/safety_culture_assessment_012309_final.pdf. NRC has a well established framework for oversight of safety culture that identifies relevant behaviors. The approach is defined in the NRC Inspection Manual and associated inspection procedures, which can be found at: http://www.nrc.gov/reading-rm/doc-collections/insp-manual/. Within the NRC Inspection Manual, the following chapters and inspection procedures are most relevant for assessing safety culture: • NRC Inspection Manual Chapter 0310, Components within the Cross-Cutting Areas; • NRC Inspection Manual Chapter 1245 Appendix C12, Safety Culture Assessor Training and Qualification Journal; • U.S. NRC Inspection Procedure IP 40100, which provides inspector guidance for evaluating an independent safety culture assessment; and • U.S. NRC Inspection Procedures IP 95001, 95002, and 95003 and their enclosures (particular attention to Attachment 95003.02), which provide inspector guidance for evaluating a third-party safety culture assessment and detailed information on methods and tools. 4.2 Application of Criteria Review and Approach Documents DOE oversight encompasses activities performed by DOE organizations to determine whether Federal and contractor programs and management systems, including assurance and oversight systems, are performing effectively and complying with DOE requirements. Oversight programs include operational awareness activities, onsite reviews, assessments, self-assessments, performance evaluations, and other activities that involve evaluation of contractor organizations and Federal organizations that manage or operate DOE sites, facilities, or operations.

7 More details on these behaviors and assessment methods may be found in the NRC references in the following paragraphs. http://efcog.org/wg/ism_sctt/docs/safety_culture_assessment_012309_final.pdf http://www.nrc.gov/reading-rm/doc-collections/insp-manual/ DOE G 226.1-2 55 6-21-12 CRADs are used to establish the depth and detail of an assessment and to provide clarity and consistent guidance to the assessment team, as well as to the organization being assessed. The quality of these documents significantly impacts the overall quality of the assessment. The criteria delineated within the CRADs should be specific and as objective as possible. The graded approach is applied to the scope of the assessment through the CRADs. Areas that include significant hazards, such as nuclear operations, should be assessed to a greater extent than other areas. 4.2.1 Description of a CRAD In general, a CRAD consists of the following elements: • Performance Objective: Identification of the expectation(s) or requirement(s) to be verified, which reflect the complete scope of the assessment. • Criteria: The specifics by which the performance objectives are measured, including regulatory and/or site-specific requirements. • Review Approach: A statement of the documents, interviews, and observations (e.g., work or shift evolutions) that are used to obtain objective evidence in order to determine whether a criterion is met or not. Creating the Performance Objective. The objective in each CRAD includes all, or portions, of one or more requirements or performance attributes being assessed. To write the objectives, use the following as a guide: • Begin with requirements; • Use performance goals; • Use performance expectations; and • Treat functional areas broadly, allowing criteria to address specifics. Example: OBJECTIVE: Line management has established and implemented a fire protection program to ensure adequate protection of operations and activities. Criteria. The criteria in the CRAD are developed to reflect the objective and address all requirements/performance attributes, regardless of the approach used in developing the criteria. The criteria should follow, and be clearly related to, the requirements. It is important to remember that the sum of the criteria should provide an adequate basis for determining whether the objective has been met. Each criterion is a statement of the specific actions or attributes the team members use to make a judgment that Federal and/or contractor programs and management systems, including assurance and oversight systems, are performing effectively and complying with DOE requirements. The criteria should be specific statements that are: • Measurable (e.g., the “program will have ten working elements”); and • Assessable (e.g., “there is documented evidence of meeting the working elements”). 56 DOE G 226.1-2 6-21-12 Criterion statements may also be derived from guides, standards, and good practices that are associated with requirements.

Review Approach. The Review Approach section of the CRAD describes the documents to be reviewed, the personnel to be interviewed, and the field activities, including tours and walk- downs, to be observed to allow the team to reach a conclusion as to whether the criteria have been met. Any documents expected to be reviewed (e.g., procedures, drawings, logs, reports, correspondence, other evaluations) should be cited in the CRAD. It is important to research and determine how documents that control work (e.g., procedures) are promulgated. There are two ways to determine whether documents are being followed or understood: interviews, and observations of work or shift evolutions. The titles of the personnel to be interviewed, along with the shift evolutions to be observed, should be recorded in the CRAD. The CRAD should also list any other references (e.g., DOE orders, mandatory standards, or site-specific requirements) against which the criteria are to be assessed. For the interview portion of the CRAD, assessors should develop lines of inquiry (LOIs). LOIs are sets of questions that are directly related to the criteria and are used to determine whether an objective or criterion is met or not. Questions are tailored for various levels of management and workers. Each LOI should be designed to ensure the answers from each interview are complete, unambiguous, and sufficiently comprehensive. Questions that can be answered with a “yes” or “no” may be used but should be followed with an open-ended question that would provide insight and details supporting the one-word answer. For example: • Does the contractor perform periodic assessments of the fire protection program? • If yes, what mechanisms does line management use to ensure that assessments are performed and that the contractor’s fire protection program is effective? • If no, why doesn’t the contractor perform periodic assessments? The review approach links back to each of the criteria and is tailored to the organization, facility, staff, and procedures being assessed. If the review approach is conducted correctly, the documented review becomes a major part of the final writeup. 4.2.2 Available Sets of CRADs Various DOE organizations have developed CRADs for their evaluations. As examples: • CRADs have been developed to support Facility Representative Program activities and reviews. These have been developed by various field elements and groups and are collected and maintained on the HSS Facility Representative web page. http://www.hss.energy.gov/nuclearsafety/nfsp/facrep/, which also provides surveillance guides and other information useful to oversight personnel. These CRADs also are accessible from Facility Representative Program (HSS) (see Appendix C of this Guide). • The HSS independent oversight organization has developed a detailed set of CRADs for performing assessments of various safety topical areas. This organization has also developed information and CRADs for evaluating emergency management areas, which are relevant to http://www.hss.energy.gov/nuclearsafety/nfsp/facrep/ DOE G 226.1-2 57 (and 58) 6-21-12 nuclear safety. These CRADs are accessible from Independent Oversight (HSS) (see Appendix C of this Guide). • The NNSA CDNS oversight organization has developed a detailed set of CRADs for performing assessments of various safety topical areas. These CRADs are accessible from Various (NNSA) (see Appendix C of this Guide).

• The EFCOG Work Management Subgroup is developing a work planning and control program guideline that includes sets of CRADs, one set for assessing the activity-level work planning and control program and the other for assessing activity level work planning and control implementation activities. These CRADs are accessible from Appendix C of this Guide. • CRADs have been developed to support validation of the adequacy of an ISM program and the implementation of the program in DOE-HDBK-3027-99, Integrated Safety Management Systems (ISMS) Verification Team Leader's Handbook. These CRADs are accessible from ISMS Verification CRADs from DOE Handbook (HSS) (see Appendix C of this Guide). These existing CRADs provide guidance for reviewing topics; DOE Headquarters and field elements may adapt them to provide for consistent implementation and effectiveness of periodic safety oversight assessments. The DOE CRADs can be used for all nuclear facilities, but they are intended to be tailored as appropriate, based on the specific scope of the review, site-specific hazards and conditions, the applicability to the site/office, and any specific contractual requirements. Appendix C (which is available at http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html) presents a core set of CRADs selected from the sources listed above. HSS will maintain this web site of available CRADs to make them available for use as a starting point to develop facility-specific CRADs. Although efforts will be taken to keep the CRADs on the website accurate and up to date, the user of any CRAD should verify that the CRAD is appropriate for use. Under no circumstances should these CRADs be considered mandatory or unalterable for use. Quite the opposite is true: DOE line management should tailor CRADs to the DOE organization’s needs and site conditions when establishing an oversight plan. The CRADs that relate directly to nuclear safety program elements are expected to be most useful for oversight of nuclear facilities. However, because nuclear facility safety could be affected by non-nuclear aspects of operations (e.g., accidents involving chemicals), some CRADs for other aspects of safety (e.g., chemical safety, electrical safety) and emergency management are included in the set of CRADs. http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html DOE G 226.1-2 A-1 (and A-2) 6-21-12 Appendix A List of Hazard Category 1, 2, and 3 Nuclear Facilities Available at http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html DOE G 226.1-2 B-1 (and B-2) 6-21-12 Appendix B Rules and Directives Applicable to Nuclear Facilities Line Management Oversight Available at http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html DOE G 226.1-2 C-1 (and C-2) 6-21-12 Appendix C Criteria Review and Approach Documents Available at http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html http://www.hss.energy.gov/healthsafety/flmo/appendices/index.html