DOE G 231.1-2, Occurrence Reporting Causal Analysis Guide

DOE G 231.1-2 Approved: 08-20-03 OCCURRENCE REPORTING CAUSAL ANALYSIS GUIDE [This Guide describes suggested nonmandatory approaches for meeting requirements. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with the parent Policy, Order, Notice, or Manual.] U.S. DEPARTMENT OF ENERGY Office of Environment, Safety and Health DISTRIBUTION: INITIATED BY: All Departmental Elements Office of Environment, Safety and Health DOE G 231.1-2 Page i 08-20-03 CONTENTS 1. PURPOSE............................................................................................................................1 2. REFERENCES ....................................................................................................................1 3. INTRODUCTION ...............................................................................................................1 4. CAUSAL ANALYSIS TREE DESCRIPTION...................................................................2 5. CAUSAL ANALYSIS PROCESS GUIDANCE.................................................................2 A. Operational Emergency (SC OE) ..................................................................................2 B. Significance Category 1 (SC 1) . ...................................................................................2 C. Significance Category R (SC R) ...................................................................................2 D. Significance Category 2 (SC 2) and Significance Category 3 (SC 3) ..........................2 E. Significance Category 4 (SC 4) ....................................................................................3 F. Evaluation of Significance Categories ..........................................................................3 G. Guidance Tables ............................................................................................................3 6. CAUSAL ANALYSIS PROCESS………………………………………………………...5 Page ii DOE G 231.1-2 08-20-03 ATTACHMENTS ATTACHMENT 1. ISM FUNCTIONS AND THE B-LEVEL CAUSAL ANALYSIS TREE BRANCHES ATTACHMENT 2. CAUSAL ANALYSIS TREE ATTACHMENT 3. CAUSAL ANALYSIS KEY TERMS AND DEFINITIONS ATTACHMENT 4. CAUSAL FACTOR IDENTIFICATION METHODOLOGIES ATTACHMENT 5. INPO ERROR PRECURSORS (SHORT LIST) VERSUS CAUSAL ANALYSIS TREE C NODES ATTACHMENT 6. CAT BRANCH A3 MATRIX ATTACHMENT 7. CAUSAL ANALYSIS NODE DESCRIPTIONS ATTACHMENT 8. REFERENCES DOE G 231.1-2 Page 1 08-20-03 1. PURPOSE This Guide is intended to assist personnel in determining the Apparent Cause(s) of specific reportable occurrences and to explain the structure and nodes of the Causal Analysis Tree for use in occurrence reporting and causal analysis. It does not introduce or impose any new requirements and is to be used in conjunction with the References listed below. 2. REFERENCES DOE O 231.1A, Environment, Safety and Health Reporting, dated 08-19-03 DOE M 231.1-2, Occurrence Reporting and Processing of Operations Information, dated 08-19-03 DOE G 231.1-1, Occurrence Reporting and Performance Analysis Guide, dated 08-20-03 3. INTRODUCTION The Department of Energy has established the requirements for identification of occurrences/events, categorization of the significance of the identified events, determination of the cause or causes of the events, and development of corrective actions designed to eliminate the events and to prevent their recurrence using a graded approach based on the significance of the event. Figure 1 illustrates the relationship between the Significance Category (SC) and the causal analysis step from the Occurrence Reporting Model in Section 11 of DOE M 231.1-2, Occurrence Reporting and Processing of Operations Information.

FIGURE 1 OE Root Cause Determined Root Cause Determined 1 Apparent Cause Determined 3 Apparent Cause Determined 2 Recurring Event Root Cause Determined R Causal Analysis per Contractor Corrective Action Program 4 SC Identified Event Identification / Documentation Page 2 DOE G 231.1-2 08-20-03 Typically, more investigation and analysis is necessary as the level of significance of the identified event increases (i.e., the SC number decreases). The scope of the corrective actions being developed also becomes more extensive as the significance level of the event increases. This Guide does not address specific Root Cause methodologies that can be used to determine the Root Cause(s) of an event. Rather, it addresses the Apparent Cause analysis and use of the Causal Analysis Tree (CAT) to determine the causes for all events. 4. CAUSAL ANALYSIS TREE DESCRIPTION The Causal Analysis Tree (CAT) has been developed to assist in the assignment of Apparent Cause(s) to identified events and for use in coding causes for all occurrences. The CAT is shown in Attachment 1 (“B”- Level) and Attachment 2 (“C”-Level) of the Guide. The CAT is a result of a benchmarking study of industry causal analysis systems. The lowest level of the CAT is typically referred to as the “C” Level of the CAT. Attachment 7 provides a detailed description of each “C”-Level node in the CAT with examples and potential corrective actions identified. In accordance with DOE M 231.1-2, guidance found in Table I of this Guide, used in conjunction with the CAT, allows for a tailored approach to developing corrective actions based on the significance category. Table I also prompts for the identification of applicable ISM Core Functions. For instance, as shown in Table I, for a SC 1 event or a recurring event (R) identified during performance analysis, root causes should be determined, and corrective actions should be identified to remedy the problem, prevent recurrence of the specific problem, and also preclude occurrence of similar problems. However, for a SC 3 event, Apparent Cause(s) are identified and the corrective actions are targeted to remedy the problem. 5. CAUSAL ANALYSIS PROCESS GUIDANCE Table I, Causal Analysis Process Guidance, and the CAT should be used to implement the causal analysis process such that appropriate corrective actions can be determined according to the significance of the event. The causal analysis guidance discussed below meets the minimum requirements; however, there may be additional causal analysis requirements imposed by individual organizations. A. Operational Emergency (SC OE) A team using any formal causal analysis method (e.g., interviews, event and causal factors charting, barrier analysis, or change analysis) should perform an analysis of SC OE events to determine Root Cause(s). Any site-specific Root Cause methodology can be used to determine Root Cause(s). In addition, all of the cause codes for entry in the occurrence reports should be selected from the CAT. At least one investigation team member should be a trained investigator per DOE M 231.1-2, Occurrence Reporting and Processing of Operations Information, should understand the CAT, and should have experience in previous investigations. Corrective actions for SC OE events are to be developed to remedy the problem, prevent its recurrence, and also preclude the occurrence of similar problems. B. Significance Category 1 (SC 1)

A team with a trained investigator, as defined in DOE M 231.1-2, should use the methods described in (A) above to analyze SC 1 events. Additionally, corrective action methods as described in (A) also apply to SC 1 events. C. Significance Category R (SC R) A trained investigator, as defined in DOE M 231.1-2, should use the methods described in (A) above to analyze SC R events. Additionally, corrective action methods as described in (A) also apply to SC R events. D. Significance Category 2 (SC 2) and Significance Category 3 (SC 3) DOE G 231.1-2 Page 3 08-20-03 For SC 2 and SC 3 events, a trained investigator should use the best available information (such as critiques, log entries, or engineering judgment) to determine Apparent Causes using the CAT. Corrective actions for SC 2 events are required to remedy the problem and prevent its recurrence. Corrective actions for SC 3 events are required only to remedy the problem. E. Significance Category 4 (SC 4) Analysis of SC 4 events is accomplished per the contractor’s specific corrective action program. F. Evaluation of Significance Categories Upon completion of the analysis of the event, the significance category should be reviewed for appropriateness based on any new information that may have been identified during the investigation. If it is determined that the significance category of the event should be higher or lower (i.e., the reporting criterion has changed), then the correct reporting criterion should be assigned, which will result in an automatic change to the significance category. The causal analysis should then be reworked to the requirements of the higher or lower significance category. In such cases, the reporting organization needs to submit an Update Report or, if the occurrence does not meet any of the reporting criteria, the existing report can be cancelled. G. Guidance Tables The guidance listed in Sections A – E is summarized in Table I. Page 4 DOE G 231.1-2 08-20-03 TABLE I CAUSAL ANALYSIS PROCESS GUIDANCE Significance Category Causal Analysis Level Analysis Requirements Corrective Action Development Requirements OE All causes of the event are determined and documented using the organization’s approved Root Cause Analysis Process. • Identify deficient ISM core functions • Perform Root Cause Analysis • Select all appropriate Cause Codes (Levels A, B, and C of the CAT) Corrective Actions are designed to remedy the problem, prevent recurrence of the specific problem, and preclude occurrence of similar problems. 1 All causes of the event are determined and documented using the organization’s approved Root Cause Analysis Process. • Identify deficient ISM core functions • Perform Root Cause Analysis • Select all appropriate Cause Codes (Levels A, B, and C of the CAT) Corrective Actions are designed to remedy the problem, prevent recurrence of the specific problem, and preclude occurrence of similar problems. R Same as SC 1 above Same as SC 1 above Same as SC 1 above 2 Apparent Cause(s) of the event is identified and documented. • Identify deficient ISM core functions • Apparent Cause Analysis (Levels A, B, and C of the CAT) Corrective Actions are designed to remedy the problem and prevent its recurrence. 3 Apparent Cause(s) of the event is identified and documented. • Identify deficient ISM core functions • Apparent Cause Analysis (Levels A, B, and C of the CAT) Corrective Actions are designed to remedy the problem.

4 Analysis and Actions per the contractor specific Corrective Action Program. DOE G 231.1-2 Page 5 08-20-03 6. CAUSAL ANALYSIS PROCESS The causal analysis process is an integral part of the Occurrence Reporting and Processing System (ORPS) model and supports the required Performance Analysis process described in the Occurrence Reporting and Performance Analysis Guide, DOE G 231.1-1. When implementing the causal analysis process, Apparent Cause(s) are identified as the most probable cause(s) of an event or condition that management has the control to fix and for which effective recommendations for corrective actions can be generated. A model for the causal analysis process is provided below. Causal Analysis Key Terms and Definitions are provided in Attachment 3. There are three basic steps in the process: 1) identifying causal factors, 2) selecting ISM Core Functions, 3) using the CAT to identify Apparent Causes/Cause Codes. 1. Identify Causal Factors. Use one of the contractor’s supported/recommended methodologies or those methodologies recommended in Attachment 4 to determine causal factors. 2. Select Applicable ISM Core Function(s). Select all of the ISM core function(s) necessary to identify any observed weakness(es) in the facility's implementation of the ISM program (Attachment 1). Deficient ISM Core Functions are considered to be Causal Factors and processed in the same manner as the Causal Factors determined above. 3. Use the CAT to Identify Apparent Causes/Cause Codes. Use the CAT (Attachment 2) to determine the appropriate cause(s) for each causal factor identified. Causal Analysis Node Descriptions are shown in Attachment 7 and can be used, as needed, to determine the appropriate cause(s). Additionally, the logic provided below for using the CAT will ensure that all possible cause(s) are considered during the analysis. A. Use the Design/Engineering (A1) Branch and the Equipment/Material (A2) Branch to codify any design/equipment related deficiencies. B. Use the Human Performance (A3) Branch to codify errors by personnel. If any Human Performance Codes are determined to be applicable, use Attachment 6 to determine applicable C level apparent cause codes in the other branches that may have caused the resultant human error. These codes coupled together describe the cause of the human error. C. Use the Management Problem (A4), Communications LTA (A5), Training Deficiency (A6), and Other Problem (A7) branches to determine other Cause Codes. D. Repeat this process with remaining causal factors until all causal factors have been addressed. DOE G 231.1-2 Attachment 1 08-20-03 Page 1 Attachment 1 INTEGRATED SAFETY MANAGEMENT FUNCTIONS AND THE B-LEVEL CAUSAL ANALYSIS TREE BRANCHES The objective of ISM is to integrate safety considerations into management and work practices at all levels to accomplish missions while protecting the public, the worker, and the environment. Identification of a breakdown or gap in an ISM core function is considered essential; the information provides additional insight into the probable cause of the occurrence. Deficient ISM Core Functions are considered to be Causal Factors and processed in the same manner as the Causal Factors determined above. B1 CALIBRATION FOR INSTRUMENTS LTA B2 PERIODIC/ CORRECTIVE MAINTENANCE LTA B3 INSPECTION/ TESTING LTA B4 MATERIAL CONTROL LTA B5 PROCUREMENT CONTROL LTA B6 DEFECTIVE, FAILED OR CONTAMINATED A2 Equipment/Material Problem

Scope of Work LTA B1 SKILL BASED ERROR B2 RULE BASED ERROR B3 KNOWLEDGE BASED ERROR B4 WORK PRACTICES LTA A3 Human Performance LTA Level A nodes are underlined. Level B nodes are in ALL CAPS. Level C nodes are in “Sentence case.” LTA = Less than Adequate A1 Design/ Engineering Problem B1 DESIGN INPUT LTA B2 DESIGN OUTPUT LTA B3 DESIGN/ DOCUMENTATION LTA B4 DESIGN/ INSTALLATION VERIFICATION LTA B5 OPERABILITY OF DESIGN/ ENVIRONMENT LTA Developed / Implemented Controls LTA Performed work within Controls LTA Feedback / Improvement LTA Determination of Deficient ISM Function Integrated Safety Management B1 WRITTEN COMMUNICATIONS METHOD OF PRESENTATION B2 WRITTEN COMMUNICATION CONTENT LTA B3 WRITTEN COMMUNICATION NOT USED B4 VERBAL COMMUNICATION LTA A5 Communications LTA A6 Training Deficiency B1 NO TRAINING PROVIDED B2 TRAINING METHODS LTA B3 TRAINING MATERIAL LTA B1 MANAGEMENT METHODS LTA B2 RESOURCE MANAGEMENT LTA A4 Management Problem B3 WORK ORGANIZATION & PLANNING LTA B4 SUPERVISORY METHODS LTA B5 CHANGE MANAGEMENT LTA A7 Other Problem B1 EXTERNAL PHENOMENA B2 RADIOLOGICAL/ HAZARDOUS MATERIAL PROBLEM Causal Analysis Tree START HERE Analyzed Hazards LTA DOE G 231.1-2 Attachment 2 08-20-03 Page 1 Attachment 2 B1 SKILL BASED ERROR C01 Check of work was LTA C02 Step was omitted due to distraction C03 Incorrect performance due to mental lapse C04 Infrequently performed steps were performed incorrectly C05 Delay in time cause d LTA actions C06 Wrong action selected based on similarity with other actions C07 Omission / repeating of steps due to assumptions for completion B2 RULE BASED ERROR C01 Strong rule incorrectly chosen over other rules C02 Signs to stop were ignored and step performed incorrectly C03 Too much activity was occurring and error made in problem solving C04 Previous success in use of rule reinforced continued use of rule C05 Situation incorrectly identified or represented result ing in wrong rule used B3 KNOWLEDGE BASED ERROR C01 Attention was given to wrong issues C02 LTA Conclusion based on sequencing of facts C03 Individual justifie d action by focusing on biased evidence C04 LTA review based on assumption that process will not change C05 Incorrect assumption that a correlation existed between two or more facts C06 Individual underestimated the problem by using past events as basis B4 WORK PRACTICES LTA C01 Individual ’s capability to perform work LTA [Examples include: Sensory / perceptual capabilities LTA, Motor / physical capabilities LTA, and Attitude / psychological profile LTA.] C02 Deliberate violation A3 Human PerformanceLTA B1 MANAGEMENT METHODS LTA C01 Management policy guidance/ expectations not well-defined, understood or enforced C02 Job performance standards not adequately defined C03 Management direction created insufficient awareness of impact of actions on safety / reliability C04 Management follow-up or monitoring of activities did not identify problems C05 Management assessment did not determine causes of previous event or known problem C06 Previous industry or in-house experience was not effectively used to prevent recurrence C07 Responsibility of personnel not well-defined or personnel not held accountable C08 Corrective action responses to a known or repetitive problem was untimely

C09 Corrective action for previously identified problem or event was not adequate to prevent recurrence B2 RESOURCE MANAGEMENT LTA C01 Too many administrative duties assigned to immediate supervisor C02 Insufficient supervisory resources to provide necessary supervision C03 Insufficient manpower to support identified goal / objective C04 Resources not provided to assure adequate training was provided / maintained C05 Needed resource changes not approved / funded C06 Means not provided to assure procedures / documents / records were of adequate quality and up -to-date C07 Means not provided for assuring adequate availability of appropriate materials / tools C08 Means not provided for assuring adequate equipment quality, reliability, or operability C09 Personnel selection did not assure match of worker motivations / job descriptions C10 Means / method not provided for assuring adequate quality of contract services A4 Management Problem Level A nodes are underlined. Level B nodes are in ALLCAPS. Level C nodes are in “sentence case.” LTA = Less than adequate A1 Design / Engineering Problem B1 DESIGN INPUT LTA C01 Design input cannot be met C02 Design input obsolete C03 Design input not correct C04 Necessary design input not available B2 DESIGN OUTPUT LTA C01 Design output scope LTA C02 Design output not clear C03 Design output not correct C04 Inconsistent design output C05 Design input not addressed in design output C06 Drawing, specification, or data error C07 Error in equipment or material selection C08 Errors not detectable C09 Errors not recoverable B3 DESIGN / DOCUMENTATION LTA C01 Design / documentation not complete C02 Design / documentation not up-to-date C03 Design / documentation not controlled B4 DESIGN / INSTALLATION VERIFICATION LTA C01 Independent review of design / documentation LTA C02 Testing of design / installation LTA C03 Independent inspection of design / installation LTA C04 Acceptance of design / installation LTA B5 OPERABILITY OF DESIGN / ENVIRONMENT LTA C01 Ergonomics LTA C02 Physical environment LTA C03 Natural environment LTA B1 CALIBRATION FOR INSTRUMENTS LTA C01 Calibration LTA C02 Equipment found outside acceptance criteria B2 PERIODIC / CORRECTIVE MAINTENANCE LTA C01 Preventive maintenance for equipment LTA C02 Predictive maintenance LTA C03 Corrective maintenance LTA C04 Equipment history LTA B3 INSPECTION / TESTING LTA C01 Start-up testing LTA C02 Inspection / testing LTA C03 Post-maintenance / Post- modification testing LTA B4 MATERIAL CONTROL LTA C01 Material handling LTA C02 Material storage LTA C03 Material packaging LTA C04 Material shipping LTA C05 Shelf life exceeded C06 Unauthorized material substitution C07 Marking / labeling LTA B5 PROCUREMENT CONTROL LTA C01 Control of changes to procurement specifications / purchase order LTA C02 Fabricated item did not meet requirements C03 Incorrect item received C04 Product acceptance requirements LTA B6 DEFECTIVE, FAILED OR CONTAMINATED C01 Defective or failed part C02 Defective or failed material C03 Defective weld, braze or soldering joint C04 End of life failure C05 Electrical or instrument noise C06 Contaminant A2 Equipment / Material Problem

B1 WRITTEN COMMUNICATIONS METHOD OF PRESENTATION LTA C01 Format deficiencies C02 Improper referencing or branching C03 Checklist LTA C04 Deficiencies in user aids (charts, etc.) C05 Recent changes not made apparent to user C06 Instruction step / information in wrong sequence C07 Unclear / complex wording or grammar B2 WRITTEN COMMUNICATION CONTENT LTA C01 Limit inaccuracies C02 Difficult to implement C03 Data / computations wrong / incomplete C04 Equipment identification LTA C05 Ambiguous instructions / requirements C06 Typographical error C07 Facts wrong / requirements not correct C08 Incomplete / situation not covered C09 Wrong revision used B3 WRITTEN COMMUNICATION NOT USED C01 Lack of written communication C02 Not available or inconvenient for use B4 VERBAL COMMUNICATION LTA C01 Communication between work groups LTA C02 Shift communications LTA C03 Correct terminology not used C04 Verification / repeat back not used C05 Information sent but not understood C06 Suspected problems not communicated to supervision C07 No communication method available A5 Communications LTA A6 Training Deficiency B1 NO TRAINING PROVIDED C01 Decision not to train C02 Training requirements not identified C03 Work incorrectly considered “skill of the craft” B2 TRAINING METHODS LTA C01 Practice or hands -on experience LTA C02 Testing LTA C03 Refresher training LTA C04 Inadequate presentation B3 TRAINING MATERIAL LTA C01 Training objectives LTA C02 Inadequate content C03 Training on new work methods LTA C04 Performance standards LTA Causal Analysis Tree Rev. 0 B3 WORK ORGANIZATION & PLANNING LTA C01 Insufficient time for worker to prepare task C02 Insufficient time allotted for task C03 Duties not well-distributed among personnel C04 Too few workers assigned to task C05 Insufficient number of trained or experienced workers assigned to task C06 Planning not coordinated with inputs from Walk downs/ task analysis C07 Job scoping did not identify potential task interruptions and / or environmental stress C08 Job scoping did not identify special circumstances and / or conditions C09 Work planning not coordinated with all departments involved in task C10 Problem performing repetitive tasks and / or subtasks C11 Inadequate work package preparation B4 SUPERVISORY METHODS LTA C01 Tasks and individual accountability not made clear to worker C02 Progress / status of task not adequately tracked C03 Appropriate level of in-task supervision not determined prior to task C04 Direct supervisory involvement in task interfered with overview role C05 Emphasis on schedule exceeded emphasis on methods / doing a good job C06 Job performance and self-checking standards not properly communicated C07 Too many concurrent tasks assigned to worker C08 Frequent job or task “shuffling” C09 Assignment did not consider worker’s need to use higher-order skills C10 Assignment did not consider worker’s previous task C11 Assignment did not consider worker’s ingrained work patterns C12 Contact with personnel too infrequent to detect work habit/attitude changes C13 Provided feedback on negative performance but not on positive performance B5 CHANGE MANAGEMENT LTA C01 Problem identification did not identify need for change C02 Change not implemented in timely manner C03 Inadequate vendor support of change

C04 Risks / consequences associated with change not adequately reviewed / assessed C05 System interactions not considered C06 Personnel / department interactions not considered C07 Effects of change on schedules not adequately addressed C08 Change-related training / retraining not performed or not adequate C09 Change-related documents not developed or revised C10 Change-related equipment not provided or not revised C11 Changes not adequately communicated C12 Change not identifiable during task C13 Accuracy / effectiveness of change not verified or not validated START HERE A7 Other Problem B1 EXTERNAL PHENOMENA C01 Weather or ambient conditions LTA C02 Power failure or transient C03 External fire or explosion C04 Other natural phenomena LTA B2 RADIOLOGICAL / HAZARDOUS MATERIAL PROBLEM C01 Legacy contamination C02 Source unknown DOE G 231.1-2 Attachment 3 08-20-03 Page 1 Attachment 3 CAUSAL ANALYSIS KEY TERMS AND DEFINITIONS Apparent Cause– the most probable cause(s) that explains why the event happened, that can reasonably be identified, that local or facility management has the control to fix, and for which effective recommendations for corrective action(s) to remedy the problem can be generated, if necessary. Causal Factor - an event or condition that either caused the occurrence under investigation or contributed to the unwanted result. If it were not for this event or condition, the unwanted result would not have occurred or would have been less severe. LTA – Less Than Adequate Root Cause-- the most basic cause(s) that explains why the event happened, that can reasonably be identified, that senior management has the control to fix, and for which effective recommendations for corrective action(s) to remedy the problem, prevent specific recurrence of the problem, and preclude occurrence of similar problems can be generated, if necessary. This is typically one level further in analysis beyond the Apparent Causes(s) (i.e., one level beyond the Level C node of the CAT). DOE G 231.1-2 Attachment 4 08-20-03 Page 1 Attachment 4 CAUSAL FACTOR IDENTIFICATION METHODOLOGIES Data Collection - It is important to begin data collection immediately following the occurrence to ensure all relevant information associated with the event is identified. The information that should be collected consists of conditions before, during, and after the occurrence; personnel involvement; environmental factors and other information having relevance to the occurrence. This information is key to determining causal factors associated with the occurrence. Methodologies - Identify causal factors immediately proceeding and surrounding the occurrence using one of the recommended methodologies (or equivalent) listed below. • Events and Causal Factor Analysis - Events and Causal Factor Analysis identifies the time sequence of a series of tasks and/or actions and the surrounding conditions leading to an event. The results are displayed in an Events and Causal Factor chart that gives a picture of the relationships of the event and causal factors. • Change Analysis - Change Analysis is used when the event is obscure. It is a systematic process that is generally used for a single occurrence and focuses on elements that have changed to identify causal factors. • Barrier Analysis - Barrier Analysis is a systematic process that can be used to identify causal factors related to physical, administrative, and procedural barriers or controls that should have prevented the event.

• Management Oversight and Risk Tree (MORT) Analysis - MORT is used to identify causal factors related to inadequacies in barriers/controls, specific barrier and support functions, and management functions. • Kepner-Tregoe Problem Solving and Decision Making - Kepner-Tregoe provides a systematic framework for gathering, organizing, and evaluating information to determine causal factors during the investigation process. DOE G 231.1-2 Attachment 5 08-20-03 Page 1 Attachment 5 INPO ERROR PRECURSORS (SHORT LIST) VERSUS CAUSAL ANALYSIS TREE LEVEL C NODES The Institute of Nuclear Power Operations has developed a list of Error Precursors that are useful in preventing events from occurring. For example, if the operator recognizes that a number of Error Precursors are present in a given situation, awareness can be increased to reduce the likelihood of Human Performance errors. Similarly, knowing that a particular precursor was evident during an event can aid the analyst in determining proper corrective action. The matrix below is provided in that vein. It also shows that the error precursors are imbedded within the Causal Analysis Tree. In some cases, the B node is listed. This is to be interpreted as all of the relevant C nodes applying to that precursor. AREA ELEMENT CAT High workload [memory requirements] A4B4C07, Too many concurrent tasks assigned to worker, A5B2C05, Ambiguous instructions / requirements, A5B2C08, Incomplete / situation not covered Time pressure [in a hurry] A4B3C02, Insufficient time allotted for task, A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress Simultaneous, multiple tasks A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B4C07, Too many concurrent tasks assigned to worker Repetitive action/monotony A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B3C10, Problem performing repetitive tasks and/or subtasks Irrecoverable actions A1B2C09, Errors not recoverable Interpretation requirements A1B5C01, Ergonomics LTA, A1B5C02, Physical environment LTA, A3B3, Knowledge based error, A4B1C01, Management policy guidance / expectation not well-defined, understood or enforced, A4B4C01, Tasks and individual accountability not made clear to worker, A5B2C05, Ambiguous instructions / requirements, A5B2C08, Incomplete / situation not covered, A5B4C03, Correct terminology not used, A5B4C04, Verification / repeat back not used, A5B4C05, Information sent but not understood Unclear goals, roles or responsibilities A4B1C07, Responsibility of personnel not well-defined or personnel not held accountable, A4B4C01, Tasks and individual accountability not made clear to worker, A5B2C02, Difficult to implement, A5B2C05, Ambiguous instructions / requirements, A5B2C07, Facts wrong / requirements not correct, A5B2C08, Incomplete / situation not covered, A5B3C02, Not available or inconvenient for use, A6B3C01, Training objectives LTA Task Demands Lack of or unclear standards A4B1C01, Management policy guidance / expectation not well-defined, understood or enforced, A5B2C08, Incomplete / situation not covered Attachment 5 DOE G 231.1-2 Page 2 08-20-03 AREA ELEMENT CAT Distractions / interruptions A1B5C02, Physical environment LTA, A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B4C07, Too many concurrent tasks assigned to worker

Changes / departures from routine A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B4C01, Tasks and individual accountability not made clear to worker, A6B3C02, Inadequate content Confusing procedure / vague guidance A4B4C01, Tasks and individual accountability not made clear to worker, A5B1C01, Format deficiencies, A5B1C07, Unclear / complex wording or grammar, A5B2C05, Ambiguous instructions / requirements, A5B2C08, Incomplete / situation not covered Confusing displays / controls A1B5C01, Ergonomics LTA, A2B4C07, Marking / labeling LTA Work-arounds; Out of Service instrumentation A1B5C01, Ergonomics LTA, A2B1C01, Calibration LTA, A2B2C01, Preventive maintenance for equipment LTA, A4B4C01, Tasks and individual accountability not made clear to worker, A5B2C08, Incomplete / situation not covered, A6B3C02, Inadequate content Hidden system response A1B2C08, Errors not detectable, Unexpected equipment conditions A1B5C01, Ergonomics LTA, A2B1C01, Calibration LTA, A2B2C01, Preventive maintenance for equipment LTA, A2B2C04, Equipment history LTA, A2B3C02, Inspection / testing LTA, A2B4C04, Material shipping LTA, A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B3C08, Job scoping did not identify special circumstances and/or conditions, A4B3C11, Inadequate work package preparation Work Environment Lack of alternative indication A1B2C01, Design output scope LTA, DOE G 231.1-2 Attachment 5 08-20-03 Page 3 AREA ELEMENT CAT Unfamiliar with task/first time A4B2C01, Too many administrative duties assigned to immediate supervisor, A4B2C02, Insufficient supervisory resources to provide necessary supervision, A4B4, Supervisory methods LTA, A6B1C01, Decision not to train, A6B1C02, Training requirements not identified, A6B1C03, Work incorrectly considered skill of the craft, A6B2C01, Practice or hands-on experience LTA Lack of knowledge [mental model] A3B3, Knowledge based error, A6B1C01, Decision not to train, A6B1C02, Training requirements not identified, A6B3C02, Inadequate content Imprecise communication habits A5B4C03, Correct terminology not used, A5B4C04, Verification / repeat back not used, A5B4C05, Information sent but not understood Lack of proficiency / inexperience A6B2C01, Practice or hands-on experience LTA New technique not used before A4B2C01, Too many administrative duties assigned to immediate supervisor, A4B2C02, Insufficient supervisory resources to provide necessary supervision, A4B4, Supervisory methods LTA, A6B1C01, Decision not to train, A6B1C02, Training requirements not identified, A6B3C03, Training on new work methods LTA Unsystematic problem-solving skills A3B4C01, Individual’s capability to perform work LTA, ‘Can do’ attitude for crucial task A3B3C01, Attention was given to wrong issues, A4B4C01, Tasks and individual accountability not made clear to worker Individual capabilities Illness or fatigue A3B4C01, Individual’s capability to perform work LTA, A4B1C01, Management policy guidance / expectation not well-defined, understood or enforced, A4B2C03, Insufficient manpower to support identified goal / objective, A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress Attachment 5 DOE G 231.1-2 Page 4 08-20-03 AREA ELEMENT CAT Stress A3B4C01, Individual capabilities to perform work LTA,

A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B4C11, Assignment did not consider worker’s ingrained work patterns Habit patterns A4B4C11, Assignment did not consider worker’s ingrained work patterns, A5B1C03, Checklist LTA, A5B3C01, Lack of written communication Assumptions A3B3, Knowledge based error Complacency / overconfidence A3B1, Skill based error, Mind set [intention] A4B3C01, Insufficient time for worker to prepare task, A3B4C02, Deliberate violation, A4B4C01, Tasks and individual accountability not made clear to worker, A6B1C01, Decision not to train, A6B1C02, Training requirements not identified Inaccurate risk perception A4B1C03, Management direction created insufficient awareness of impact of actions on safety / reliability, A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B5C04, Risks / consequences associated with change not adequately reviewed / assessed, A6B1C01, Decision not to train, A6B1C02, Training requirements not identified Mental shortcuts [biases] A3B3C03, Individual justified action by focusing on biased evidence, A3B3C04, LTA review based on assumption that process will not change, A3B3C05, Incorrect assumption that a correlation existed between two or more facts, A3B3C06, Individual underestimated the problem by using past events as basis Human nature Limited short term memory A3B4C01, Individual’s capability to perform work LTA, A4B4C07, Too many concurrent tasks assigned to worker DOE G 231.1-2 Attachment 6 08-20-03 Page 1 Attachment 6: CAT BRANCH A3 MATRIX Potential Associated Level C Nodes from Different CAT Branches*** Human Performance A3 Level C Nodes Level C nodes applicable to the particular A3 Level C Node Additional Level C Nodes applicable to the associated A3 Level B Node A3B1C01 Check of work was LTA A1B5C02, Physical environment LTA, A5B1C03, Checklist LTA A3B1C02 Step was omitted due to distraction A4B4C08, Frequent job or task “shuffling” A3B1C03 Incorrect performance due to mental lapse A4B4C07, Too many concurrent tasks assigned to worker, A4B4C08, Frequent job or task “shuffling” A3B1C04 Infrequently performed steps were performed incorrectly A3B1C05 Delay in time caused LTA actions A4B4C07, Too many concurrent tasks assigned to worker, A4B4C08, Frequent job or task “shuffling” A3B1C06 Wrong action selected based on similarity with other actions A5B1C07, Unclear / complex wording or grammar, A5B2C05, Ambiguous instructions / requirements A3B1C07 Omission/repeating of steps due to assumptions for completion A5B1C03, Checklist LTA A1B1C03, Design input not correct, A1B5C01, Ergonomics LTA, A4B1C03, Management direction created insufficient awareness of impact of actions on safety / reliability, A4B2C04, Resources not provided to assure adequate training was provided / maintained, A4B3C02, Insufficient time allotted for task, A4B3C05, Insufficient number of trained or experienced workers assigned to task, A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B4C03, Appropriate level of in-task supervision not determined prior to task, A4B4C06, Job performance and self- checking standards not properly communicated, A4B4C10, Assignment did not consider worker’s previous task, A5B1C01, Format deficiencies, A6B1C03, Work incorrectly considered skill of the craft A3B2C01 Strong rule incorrectly chosen over other rules

A3B2C02 Signs to stop were ignored and step performed incorrectly A4B4C06, Job performance and self- checking standards not properly communicated A3B2C03 Too much activity was occurring and error made in problem solving A1B5C02, Physical environment LTA, A4B3C04, Too few workers assigned to task, A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B4C07, Too many concurrent tasks assigned to worker, A4B4C08, Frequent job or task “shuffling” A3B2C04 Previous success in use of rule reinforced continued use of rule A4B3C10, Problem performing repetitive tasks and/or subtasks A3B2C05 Situation incorrectly identified or represented resulting in wrong rule used A5B1C07, Unclear / complex wording or grammar A1B2C06, Drawing, specification, or data error, A1B5C01, Ergonomics LTA, A4B1C03, Management direction created insufficient awareness of impact of actions on safety / reliability, A4B1C09, Corrective action for previously identified problem or event was not adequate to prevent recurrence, A4B2C06, Means not provided to assure procedures / documents / records were of adequate quality and up-to-date, A5B1C01, Format deficiencies, A5B2C05, Ambiguous instructions / requirements, A6B1C03, Work incorrectly considered “skill of the craft”, A6B2C01, Practice or hands-on experience LTA Attachment 6 DOE G 231.1-2 Page 2 08-20-03 Attachment 6: CAT BRANCH A3 MATRIX Potential Associated Level C Nodes from Different CAT Branches*** Human Performance Level C Nodes Level C nodes applicable to the particular A3 Level C Node Additional Level C Nodes applicable to the associated A3 Level B Node A3B3C01 Attention was given to wrong issues A3B3C02 LTA conclusion based on sequencing of facts A5B1C06, Instruction step / information in wrong sequence A3B3C03 Individual justified action by focusing on biased evidence A3B3C04 LTA review based on assumption that process will not change A4B3C10, Problem performing repetitive tasks and/or subtasks, A4B5C12, Change not identifiable during task, A5B1C05, Recent changes not made apparent to user A3B3C05 Incorrect assumption that a correlation existed between two or more facts A3B3C06 Individual underestimated the problem by using past events as basis A4B3C10, Problem performing repetitive tasks and/or subtasks A1B5C01, Ergonomics LTA, A4B1C09, Corrective action for previously identified problem or event was not adequate to prevent recurrence, A4B2C04, Resources not provided to assure adequate training was provided / maintained, A4B3C08, Job scoping did not identify special circumstances and / or conditions, A4B4C06, Job performance and self- checking standards not properly communicated, A5B4C03, Correct terminology not used, A5B4C04, Verification / repeat back not used, A5B4C05, Information sent but not understood, A6B1C02, Training requirements not identified, A6B2C01, Practice or hands-on experience LTA, A6B3C02, Inadequate content A3B4C01 Individual’s capability to perform work LTA A1B5C01, Ergonomics LTA, A1B5C02, Physical environment LTA, A4B3C07, Job scoping did not identify potential task interruptions and/or environmental stress, A4B4C09, Assignment did not consider worker’s need to use higher- order skills, A4B4C10, Assignment did not consider worker’s previous task, A4B4C11, Assignment did not consider worker’s ingrained work patterns A3B4C02 Deliberate violation

A4B2C02, Insufficient supervisory resources to provide necessary supervision, A4B4C03, Appropriate level of in-task supervision not determined prior to task, A4B4C05, Emphasis on schedule exceeded emphasis on methods / doing a good job, A4B4C12, Contact with personnel too infrequent to detect work habit / attitude change A4B1C04, Management follow-up or monitoring of activities did not identify problems, A4B1C09, Corrective action for previously identified problem or event was not adequate to prevent recurrence, A4B2C09, Personnel selection did not assure match of worker motivations / job descriptions, A4B4C04, Direct supervisory involvement in task interfered with overview role *** The left column contains each A3 Level C node. The center column contains nodes from the other branches that can be coupled with the associated A3 Level C nodes. The right column contains Level C nodes that can be coupled with the any of the A3 Level C nodes that are associated with the B level node. This list shows recommendations only and is not all-inclusive. DOE G 231.1-2 Attachment 7 08-20-03 Page 1 Attachment 7 CAUSAL ANALYSIS NODE DESCRIPTION A1 Design / Engineering Problem – An event or condition that can be traced to a defect in design or other factors related to configuration, engineering, layout, tolerances, calculations, etc. Note: even though Engineering is explicitly only in the branch title, its use throughout this branch is implicit. Also, it is Engineering as a function or process, not as a job title. • B1 Design Input Less Than Adequate (LTA) – Input to a design that was lacking adequate information that was necessary for the design. • B2 Design Output LTA – Inadequate design output that did not meet the customer’s expectations or design requirements. • B3 Design / Documentation LTA – Design or documentation that did not include all of the required information and did not comply with document control and record requirements. • B4 Design Verification / Installation Verification LTA – Design reviews, testing, independent inspections, and acceptance were not in compliance with customer expectations and/or site requirements. • B5 Operability of Design / Environment LTA – Personnel or environmental factors were not considered as part of the design. A1B1C01 - Design input cannot be met Definition: The criteria and other requirements were so stringent that they could not be met. There were conflicting criteria. Not all of the necessary references were included. Examples: A flow controller could not adequately control flow during an infrequent operation. The flow requirements for normal, emergency and infrequent operation covered too wide a range for a controller to operate properly under all conditions. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Determine which mode of operations is causing the range to be too wide. Install a separate controller for that mode. A1B1C02 - Design input obsolete Definition: The criteria were out-of-date. An old version of a requirement or specification was used. Process requirements/conditions changed and the changes were omitted from the input. Examples: A valve failed because it was designed to operate under the original operating requirements of the plant rather than to the revised operating requirements. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace valve with one designed for current operating requirements.

A1B1C03 - Design input not correct Definition: The wrong standards or requirements were used. The requirements were transcribed in error. Examples: A valve failed because the design input had incorrect information concerning the chemical concentrations in the system in which the valve would be used. An o-ring failed because the design input defined incorrect temperatures for the system in which the o- ring was to be used. The actual temperature extremes were much greater than those stated in the Design Input. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace with equipment/material designed for operating environment. Attachment 7 DOE G 231.1-2 Page 2 08-20-03 A1B1C04 - Necessary design input not available Definition: The necessary requirements, codes, standards, etc. were not available to the designer. Examples: A valve failed because the design input [performance requirements of the system] had been changed, but the revised requirements had not been given to the designer. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace with valve designed for current requirements. A1B2C01 - Design output scope LTA Definition: The design did not consider all the possible scenarios. All the operating conditions, [normal and emergency] were not included in the design. Examples: A line ruptured because a flange failed. The flange was constructed of the wrong material because the design did not consider all the possible chemicals that would be in the line during different operating conditions. One that was not considered caused the flange to fail. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace with flange designed for current environment. A1B2C02 - Design output not clear Definition: The drawings were difficult to read. The specifications were difficult to understand. The specification could be interpreted in more than one way. Examples: A pump did not provide the necessary cooling water during an emergency. The pump was sized wrong because the drawings were difficult to read and the wrong pump was ordered and installed. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Provide clearer copy of drawing and replace pump. A1B2C03 - Design output not correct Definition: The drawings and other specifications were incorrect. The final design output did not include all changes. Examples: A pump did not provide the necessary cooling water during an emergency. The pump was sized wrong because the final design did not include changes identified in the safety analysis. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Install pump designed to new criteria. A1B2C04 - Inconsistent design output Definition: There were differences between different output documents. The drawings and other design documents did not agree. Examples: A pump did not provide the necessary cooling water during an emergency. The procurement specifications were not updated to reflect final changes to the drawings. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace with pump designed to new criteria. DOE G 231.1-2 Attachment 7 08-20-03 Page 3 A1B2C05 - Design input not addressed in design output Definition: The specifications did not include all the requirements. Some criteria were left out of the design

output. Examples: A line ruptured due to a failed flange. The flange failed because it was constructed of the wrong materials. Some potential process upsets were not identified in the input and were not addressed in the output. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace with flange designed to all applicable criteria. A1B2C06 – Drawing, specification or data error Definition: The latest drawing revision was not referenced. The latest vendor information was not included in the design documentation. The correct data was not noted on the design documentation request. Examples: A recent print revision reflected that a modification was made to a steam supplied transfer pit. The print reflected that a common header, instead of a dedicated header to each system supplied steam. The as-found field condition reflected that each system still had a dedicated supply header. Investigation found out that funds had run out when approximately 50% of the work had been completed. The system had to be modified for continued operation. The prints were never revised to reflect the modifications that were made. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Revise the design documentation and perform better checks of process system configuration. A1B2C07 - Error in equipment or material selection Definition: The correct vendor identification number was not used for procurement of equipment. The correct grade of stainless steel was not specified for the material. Examples: The wrong grade of piping was specified and installed in a caustic piping system. Grade 304L Stainless Steel piping was mistakenly specified and installed in a system that contained a highly caustic solution. The use of this incorrect piping code resulted in premature failure of the newly installed system. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace piping with the proper piping per applicable codes. A1B2C08 - Errors not detectable Definition: Personnel were unable to detect errors [by way of alarms or instrument readings] during or after the occurrence. A serious error went unnoticed because there was no way to monitor system status. Note: It is unreasonable to expect all systems and equipment to have alarms; however, important safety- related equipment should have reliable error detection systems. Examples: A tank fill was in progress. Initial tank level had been determined using the dipstick. There was no level alarm on the tank to indicate that overflow was imminent. The standard practice was to mentally time the closure of the inlet valve knowing the flowrate of the centrifugal pump. The inlet valve was on the opposite side of the tank from the dipstick. Thus, the tank overflowed. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Consider installation of tank level alarm. Attachment 7 DOE G 231.1-2 Page 4 08-20-03 A1B2C09 – Errors not recoverable Definition: The system was designed such that personnel were unable to recover from error discovered before a failure occurred. Note: Important safety-related equipment should be designed so that detected errors can be alleviated before system failure occurs. Examples: A computer operator started an automatic operating sequence, controlled by a distributed control

system, before the valving lineups in the process area had been completed. Even though operators in the field called in to tell the operator to stop the operation, the computer was not programmed to allow interruption of the sequence. As a result, process flow was routed to waste. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Reprogram operating sequence to allow abort. A1B3C01 – Design / documentation not complete Definition: The designs and other documentation for equipment were incomplete. Items were missing from the documentation. A complete baseline did not exist. Examples: A waste tank overheated because incompatible materials were mixed. The baseline documentation was not complete. It failed to show a line that emptied into the tank. The line apparently was installed during original construction, but the drawings did not show it. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Update drawing. A1B3C02 – Design / documentation not up-to-date Definition: Drawings and documents were not updated when changes were made. Documents/drawings did not reflect the current status. Note: Problems with this node will often be multiple coded. The system for controlling documents may not be adequate. Another problem could be that changes are being made without proper authorization and are, therefore, not being entered into the system. Examples: An acid spill occurred during a line break. Lockouts had been performed based on current drawings. The drawings were not up-to-date and did not show an acid stream that had been tied into the line. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Update drawings. A1B3C03 – Design / documentation not controlled Definition: The design documentation was not controlled per site requirements for document control and records. Examples: During a recent assessment, an individual preparing some design documentation was noted using “Uncontrolled” and “Information Only” design documentation to complete a Design Change Form. When questioned he responded that he did not have to contact document control because he was the only person responsible for the system and no other changes had been made to the system since the last modifications he had completed. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Contact site document control and verify the latest revision status of necessary design documentation. DOE G 231.1-2 Attachment 7 08-20-03 Page 5 A1B4C01 - Independent review of design / documentation LTA Definition: A required review was not performed on the design. The review was not performed by an independent reviewer. The design had problems passing the functional testing. Examples: A tank failed because it was not constructed of materials suitable for the environment in which it was installed. The designer was not familiar with the area where the tank was to be used and did not know that it was a corrosive environment. An independent review by a knowledgeable reviewer was not conducted. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Change affected procedure[s] to insert independent verification step. Note this would imply that another Apparent Cause was under Written Communication Content LTA [A5B2]. • Assign additional independent reviewer[s] to design function. Note this would imply that another Apparent Cause

was under Work Organization & Planning LTA [A4B3]. A1B4C02 - Testing of design / installation LTA Definition: Testing was not included as part of the design acceptance process. The testing did not verify the operability of the design. Design parameters did not successfully pass all testing criteria. Examples: A Flow Indicator failed testing because the test plan was not reviewed and approved by the Design Agency. The test engineer requested a pressure rating that when applied to the system over pressurized the flow indicator, which caused the test to fail. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Have the Design Agency review and approve the test plan. Examine the flow indicator, replace if necessary, and perform the test using the correct pressure rating. A1B4C03 - Independent inspection of design / installation LTA Definition: Independent Inspection attributes were not included in the design installation. Required Hold/Witness points were not verified by Quality Assurance (QA). Hold/Witness points did not pass the acceptance criteria. Commercial Grade Material was not adequately dedicated and documented. Examples: A Safety Class designed system required QA Independent Inspections. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Disassemble the system and have the Owner Examiner perform the required examinations. A1B4C04 - Acceptance of design / installation LTA Definition: The customer had problems with acceptance of the design, testing, and/or verification. Example: During the Operations Acceptance it was noted that the required design change documentation was not included in the completed document package. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Obtain the required design change documentation and include it as part of the completed work package. A1B5C01 - Ergonomics LTA Note: Ergonomics is defined as the science that seeks to adapt work or working conditions to suit the worker. The design should include provisions for eliminating problems encountered by personnel performing tasks. This may also include problems resulting from Physical or Environmental factors. Attachment 7 DOE G 231.1-2 Page 6 08-20-03 Definition: Inadequate ergonomic design contributed to the occurrence. The operator was physically incapable of performing the required task. The operator had to go too far to respond to the alarm. Personnel mobility or vision was restricted. An individual had difficulty reaching the equipment or assumed an awkward position to complete a task. The event was caused because illumination levels were not sufficient for task performance. Examples: A Balance of Plant (BOP) Operator was making rounds when a response alarm activated. The control room operator requested the BOP Operator to go to the alarm location. When arriving at the newly installed panel the Operator could not gain access from the direction or see the panel from where they were standing. The Operator had to go around the building to gain access to the area to be in a position to provide the information requested by the Control Room Operator. This resulted in loss of valuable time necessary to take the necessary compensatory actions. A control room operator made a mistake in reading a meter that was placed at ceiling level. The position of the meter did not allow the operators to take readings from floor level. It was necessary to use a stepladder to take the reading.

A serious incident occurred when glare caused by improper overhead lighting prevented an operator from detecting that an important annunciator tile was illuminated. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Assure design includes ease of access to area and takes into consideration time and distance that a worker has to travel to perform tasks due to response requirements. • Reduce lighting in area. • Replace with glare resistant glass. A1B5C02 - Physical environment LTA Definition: Inadequate equipment controls or control systems [e.g., push-buttons, rotary controls, J-handles, key- operated controls, thumb-wheels, multiple switches, joysticks] contributed to the occurrence. The control failed to provide an adequate range of control for the function it performs. The control was inadequately protected from accidental activation. Similar controls were indistinguishable from one another. Controls were in too close proximity of each other. Operating conditions [e.g. room temperature, work location, physical location, restricted vision, personal protective equipment, excessive noise, arrangement or placement of equipment] affected performance of the task. Lighting was inadequate. Noise was a factor. Examples: An operator made an error in reading a meter because of the unusual scale progression. Instead of a scale with major markings divided by units of five [i.e., 5, 10, 15, 20], the scale was divided into units of six [i.e., 6, 12, 18, 24]. Two computer systems, located side-by-side in the facility, were programmed using different color schemes. On the first system, the color red indicated flow to the process. On the second system, red indicated the lack of flow. Because of the inconsistency in color coding between the two systems, an operator who normally worked on the second system allowed a tank to overflow when he was temporarily assigned to the first system. His mindset was that red indicated lack of flow. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace with a meter with standard scale progression. • Install a warning as to nonstandard scale progression. • Select one of the two color schemes as standard. Reprogram the other unit. Retrain affected system operators. A1B5C03 - Natural environment LTA Definition: Exposure to heat, cold, wind, and rain was not included in the design. Earthquake tested devices were not included in the design. System was not designed to withstand flooding, freezing, or high wind conditions. Lightning suppressing devices were not included in the design. The event was caused by excessive exposure of personnel to a hot or cold environment. DOE G 231.1-2 Attachment 7 08-20-03 Page 7 Examples: During an extreme cold spell, a mechanic damaged an expensive piece of equipment by dropping a tool into its moving parts. Even though the mechanic was wearing gloves, his hands were so cold that he was unable to get a firm grip on the tool. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Provide portable space heaters. Note: this will not be acceptable in certain environments. A2 Equipment / Material Problem Is defined as an event or condition resulting from the failure, malfunction, or deterioration of equipment or parts, including instruments or material. • B1 Calibration for Instruments Less Than Adequate (LTA) - Calibrations did not include all the essential elements.

Equipment as-found condition was less than adequate. • B2 Periodic / Corrective Maintenance LTA - Periodic maintenance was not established for the equipment, instrument or component. The periodic maintenance was inadequate. Corrective maintenance was inadequate to correct the problem. Equipment history did not exist for the instrument or component. The equipment history was incomplete. • B3 Inspection / Testing LTA - Scheduled inspection/testing did not exist for the instrument or equipment. The inspection/testing was inadequate or not performed as required. The inspection/testing did not include all the essential elements. Note: A1B4 should be used for Design Testing. • B4 Material Control LTA - The problem was due to the inadequate handling, storage, packaging or shipping of materials or equipment. The shelf life for material was exceeded. An unauthorized material or equipment substitution was made. Spare parts were inadequately stored. There was an error made in the labeling or marking. • B5 Procurement Control LTA - The error was due to inadequate control of changes to procurement specifications or purchase orders. A fabricated item failed to meet requirements or an incorrect item was received. Product acceptance requirements failed to match design requirements or were otherwise unacceptable. Note: This is only for equipment and materials, procured services are addressed in A4B2C10. • B6 Defective, Failed or Contaminated - An event was caused by a failed or defective part. The material used was defective or flawed. The weld, braze or soldered joint was defective. The component reached the end of its expected service life. There was electrical or instrument noise interference or interaction. Foreign material or contaminant caused the equipment or component to fail. A2B1C01 - Calibration LTA Definition: The equipment involved in the incident was not included in a routine calibration program. Calibrations were performed too infrequently. The calibration did not include all the essential elements. Examples: A tank overflowed because the level indicator was out of calibration. The instrumentation was not included in a calibration program. A tank overflowed because of faulty liquid level instrumentation. The instrument calibration was not performed in accordance with the manufacturer’s recommended frequency for calibrations. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Calibrate instrument. • Incorporate manufacturer’s recommended frequency into the calibration program. A2B1C02 - Equipment found outside acceptance criteria Definition: An event occurred as a result of equipment that was found outside of the specified acceptance criteria. The instrument calibration drift was outside of the acceptable range. Process instrumentation was outside of acceptable range criteria due to a standard that was out of calibration. Attachment 7 DOE G 231.1-2 Page 8 08-20-03 Examples: A pressure switch is required to activate when vessel coil pressure is at a high pressure of 5.83 to 5.95 pounds per square inch (psi). During a functional check, the pressure switch activated at 5.98 psi. The pressure switch had drifted outside of the acceptable calibration criteria. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Adjust the pressure switch back into calibration and re-perform the functional test. • Replace pressure switch if warranted by adverse trend or decreased performance. • Increase pressure switch calibration frequency to improve instrument reliability.

A2B2C01 - Preventive maintenance for equipment LTA Definition: An equipment malfunction was caused by a failure to carry out scheduled preventive maintenance. Preventive maintenance was not established for the equipment or component that failed. Preventive maintenance was scheduled too infrequently. The preventive maintenance was incomplete. Preventive maintenance was performed on some of the components but not on others. Examples: A motor failed due to a lack of lubrication. Routine maintenance had not been performed on the equipment. A motor failed due to a lack of lubrication. Preventive maintenance had been performed on the equipment but on a longer frequency than that recommended by the manufacturer. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Repair/replace motor. • Establish routine maintenance frequencies for failed equipment. • Adjust preventive maintenance frequencies to correspond to manufacturer’s recommendations. A2B2C02 - Predictive maintenance LTA Definition: Predictive maintenance was not established for the equipment. The established frequency was inadequate to prevent or detect equipment degradation. The established method used to prevent or detect equipment degradation was inadequate. Examples: A bent fan shaft went undetected and generated high vibrations that caused the catastrophic failure of a building supply fan. Predictive maintenance was not used to manage and assess equipment performance / condition. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Repair/replace fan components as necessary. • Establish predictive maintenance for the failed equipment to help detect the onset of equipment problems. • Identify the appropriate predictive maintenance strategy to better evaluate machinery condition. A2B2C03 - Corrective maintenance LTA Definition: Corrective maintenance was performed but failed to correct the originating problem. The equipment or component was reassembled improperly during corrective maintenance. Other problems were noted during maintenance activities that were not corrected. The actual job of performing a maintenance activity was complete, but was not performed correctly. Examples: Corrective maintenance was performed to replace a malfunctioning time delay relay to address problems associated with the building exhaust fans. After replacement of the relay, it was discovered that the problem still existed with the building exhaust fans. Corrective maintenance was performed to replace a malfunctioning time delay relay to address problems associated with the building exhaust fans. After installation of the relay, it was discovered that the relay contacts were positioned incorrectly. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] DOE G 231.1-2 Attachment 7 08-20-03 Page 9 • Replace the time delay relay per approved work instructions. • Assure work instructions specify correct setting/position for relay contacts prior to installation. A2B2C04 – Equipment history LTA Definition: Equipment history / records did not exist for the equipment that malfunctioned. The history for the equipment that malfunctioned was incomplete / inadequate. The history did not contain all the information necessary to assure equipment reliability. Knowledge of equipment history would have prevented the incident or lessened its severity.

Examples: A tank overflowed because of faulty liquid level instrumentation. Previous problems had occurred with the instrumentation. This was not known by Maintenance personnel because there was no equipment history available. A tank overflowed because of faulty liquid level instrumentation. The problem had occurred on similar equipment in other facilities. This was unknown to facility personnel since the equipment history did not contain information on similar equipment. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Expand the maintenance inspection / activity to include equipment history files to collect and use historical data for Structures, Systems, and Components (SSCs). • Establish provisions for similar equipment within equipment history program. Note: this may also indicate a weakness in the implementation of lessons learned [A4B1C06]. A2B3C01 – Start-up testing LTA Definition: Functional testing did not exist for the equipment or system prior to placing them in service. Start-up testing was inadequate for the equipment or system being placed into service. Examples: A fire alarm system failed to activate during a fire in a process room. The system had not been functionally tested prior to being placed in service. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Functionally test fire alarm system for process room. • Assure systems are functionally tested prior to being placed in service. Note: this may also imply an inadequate written communication [A5] or work organization / planning deficiency [A4B3] as an Apparent Cause. A2B3C02 – Inspection / testing LTA Definition: Required testing / inspection was not established or performed for the equipment involved in the incident. The required testing / inspection was performed at an incorrect frequency. The acceptance criteria for the required testing / inspection were inadequately defined. All essential components were not included in the required testing / inspection. Examples: An emergency generator failed to start during a power outage. The generator had not been included in the routine functional testing program. An environmental release occurred because of a slow leak from a chemical tank. Thorough quarterly inspections were specified for the tank, but more frequent inspections were not required to identify leaks. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Establish routine functional testing for the generator. • Review routine functional testing program to assure applicable equipment is included. Note: this corrective action strongly implies that there is at least one programmatic weakness • Revise the required inspection program for the tank to include more frequent leak inspections. Note: this may also imply inadequate written communication [A5] as an Apparent Cause. Attachment 7 DOE G 231.1-2 Page 10 08-20-03 A2B3C03 – Post-maintenance / post-modification testing LTA Definition: The post-maintenance or post-modification testing specified was not performed or was performed incorrectly. The post-maintenance or post-modification testing was completed, but the testing requirements were less than adequate. The post-maintenance or post-modification testing was not performed in accordance with the schedule for testing. Examples: A high-pressure steam flow interlock failed to actuate when the high coil pressure limit was reached

inside a process vessel. Post-maintenance testing was not completed for the system prior to its being placed in service. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Establish and perform post-maintenance testing for the interlock. A2B4C01 – Material handling LTA Definition: Material / equipment was damaged during handling. Material / equipment was “mixed up” during handling. Note: This code is for handling occurring onsite. Problems with handling occurring offsite would be coded under Procurement control LTA [A2B5], Management Methods LTA [A4B1], Means not provided for assuring adequate equipment quality, reliability, or operability [A4B2C08], or Written communication content LTA [A5B2]. Examples: The wrong pump was installed in a line. The mechanics were installing several pumps and had them all on a cart. They were “mixed up” and installed in the wrong locations. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Install pumps in correct line. Provide separation between distinct work packages and materials. Note: this may also imply a work organization / planning deficiency [A4B3] as an Apparent Cause. A2B4C02 – Material storage LTA Definition: The material, equipment or part was stored improperly. The material, equipment, or part was damaged in storage. The material, equipment, or part had weather damage. The material, equipment, or part was stored in an environment [heat, cold, acid fumes, etc.] that damaged it. Inadequate preventive maintenance [cleaning, lubrication, etc.] was performed on spare parts. Examples: An absorption column installed to remove contaminants from solvent did not operate as designed. Investigation revealed that the absorbent material used to pack the column had been stored outside and uncovered. The damaged material reduced the efficiency of the column. A pump failed shortly after installation, much earlier than anticipated given the life expectancy of the pump. Investigation revealed that the pump had been stored in spare parts for a long time. During the storage, no preventive maintenance, such as cleaning and lubrication, had been performed as specified in the manufacturer’s instructions for storage. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Refill absorption column after verifying that absorbent packing material is acceptable. • Verify remaining stock of absorbent material is stored under cover. • Review spare parts inventories to identify and address preventive maintenance concerns, which will be included in a preventive maintenance program. Note: this may also imply that preventive maintenance was LTA [A2B2C01] as an Apparent Cause. DOE G 231.1-2 Attachment 7 08-20-03 Page 11 A2B4C03 – Material packaging LTA Definition: Material or equipment was packaged improperly. The material or equipment was damaged because of improper packaging. Material or equipment was exposed to adverse conditions because the packaging had been damaged. Note: This code is for packing occurring onsite. Problems with packing occurring offsite would be coded under Procurement control LTA [A2B5], Management Methods LTA [A4B1], Means not provided for assuring adequate equipment quality, reliability, or operability [A4B2C08], or Written communication content LTA [A5B2]. Examples: An electronic system received water damage because it was not packaged in waterproof packaging as

specified in the packaging requirements. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Repair/replace the damaged material or equipment. • If reusable, restore material packaging to design specifications. A2B4C04 – Material shipping LTA Definition: The material / equipment was transported improperly. The material / equipment was damaged during shipping. Note: This code is for shipping originating within the local organization. Problems with shipping originating at another organization would be coded under Procurement control LTA [A2B5], Management Methods LTA [A4B1], Means not provided for assuring adequate equipment quality, reliability, or operability [A4B2C08], or Written communication content LTA [A5B2]. Examples: A technical limit was exceeded because several containers of nuclear material were not shipped in approved shipping containers. Sensitive electronic equipment transported by rail was damaged. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Revise shipping procedure to include caution for using approved containers. Note: this may also imply inadequate written communication [A5] or a work organization / planning deficiency [A4B3] as an Apparent Cause. • Repair/replace damaged equipment. Assure replacement equipment is shipped under more favorable conditions. A2B4C05 – Shelf life exceeded Definition: Material, equipment, or parts that had exceeded the shelf life were installed. Materials continued in use after the shelf life was exceeded. Note: Shelf life can be highly dependent on storage environment, i.e., this could be a storage issue [A2B4C02] instead or as well. Examples: A technical limit was violated because resin that had exceeded its shelf life was used for a separation process. When old resin is used, separation efficiency of different elements is greatly reduced. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace affected resin with material within its shelf life. • Assure remaining resin stock is within its shelf life. A2B4C06 – Unauthorized material substitution Definition: Incorrect materials or parts were substituted. Material or parts were substituted without authorization. The requirements specified no substitution. Attachment 7 DOE G 231.1-2 Page 12 08-20-03 Note: This code is for material substitution occurring onsite. Problem with material substitution occurring offsite would be coded under Procurement control LTA [A2B5], Management Methods LTA [A4B1], Means not provided for assuring adequate equipment quality, reliability, or operability [A4B2C08], or Written communication content LTA [A5B2]. Examples: A valve failed, causing a spill to the environment. The valve was not the one specified in the requirements. Since the specified one was not available, a substitute valve had been installed without the proper review and authorization. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Install correct valve or get proper approval for the substitute. • Determine why unapproved substitution was made and correct that cause. A2B4C07 – Marking / labeling LTA Definition: There was an error made in the labeling or marking. Equipment identification, labeling, or marking was less than adequate. Examples: Procurement specification required that parts be stamped 304 SS for use in a critical safety significant

system. A facility was shutdown because the parts did not meet marking specification. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace parts with proper marking specification to bring system into compliance. • Evaluate procurement specification to provide additional controls for assurance and validation of parts and material used in safety related systems. • Determine the necessary controls to assure proper procurement and selection of materials/parts. A2B5C01 – Control of changes to procurement specification / purchase order LTA Definition: Changes were made to purchase orders or procurement specifications without the proper review and approvals. The changes resulted in purchase of the wrong material, equipment, or parts. Examples: A process upset occurred because the acid used was out of specifications. Investigation revealed that the purchase order had been changed without the proper review and approval. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace affected acid. • Determine if affected acid could be used somewhere else [excess chemicals program]. If not, dispose of acid in accordance with applicable regulations. A2B5C02 – Fabricated item did not meet requirements Definition: The item of concern was not fabricated according to the requirements specified in the procurement specifications/purchase requisition. Examples: A pump failed because it was not fabricated with materials specified in the procurement specifications. As a result, it did not withstand the corrosive environment where it was installed. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Contact manufacturer for replacement pump made of correct materials. A2B5C03 – Incorrect item received Definition: An item received was not the one ordered. The inconsistency was not recognized. The item was accepted rather than returned. DOE G 231.1-2 Attachment 7 08-20-03 Page 13 Examples: A process upset occurred because the acid used was out of specifications. When the acid was received, personnel in material receiving did not recognize that it was not what was ordered. It was accepted and sent to the operating facility for use. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace affected acid. • Provide additional instructions to receiving inspectors on recognizing chemicals. • Determine if affected acid could be used somewhere else [excess chemicals program]. If not, dispose of acid in accordance with applicable regulations. A2B5C04 – Product acceptance requirements LTA Definition: The product acceptance requirements were incomplete. The product acceptance requirements did not address all the safety concerns for the item. The requirements did not address all the concerns for efficiency. The product acceptance requirements did not address all the safety concerns for the items. Examples: A pump failed shortly after installation because it was constructed of material incompatible with the environment in which it was used. The acceptance requirements correctly addressed the size of the pump but did not address specifications for the corrosive environment in which the pump would be installed. A pump of the wrong size was installed in the process. Investigation revealed that the acceptance requirements used when the pump was received were not the same as the design requirements.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Repair/replace the failed pump. • Assure procedure for acceptance requirement development has sufficient cautions on incorporation of all applicable criteria. Note: this may also imply inadequate written communication [A5] as an Apparent Cause. A2B6C01 – Defective or failed part Definition: A part/instrument that lacked something essential to perform its intended function. The degraded performance of a part or a component contributed to the failure of the component, equipment, or system. Note: this does not to explain why the object failed or was defective. Therefore, this node should be multiple coded. Examples: A motor on a pump that had only been in operation for six months failed due to defective windings. A large turbine/generator bearing failed during normal equipment operation. Follow-up investigation determined that an internal oil pump contributed to the premature failure of the turbine bearing. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace the failed components (i.e., windings, oil pump, bearings, etc.) and return the system to normal operation. A2B6C02 – Defective or failed material Definition: A component failed because the material used was not adequate for the application. The material used was found to be defective, flawed, or damaged. Note: this does not explain why the object failed or was defective. Therefore, this node should be multiple coded. Examples: A steel plate on a waste storage tank leaked due to failed material. The steel from which the plate was fabricated exhibited laminations that formed during the extrusion process when the steel was rolled at the manufacturer’s plant. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace the steel plate with a replacement suitable for the harsh chemical environment. Attachment 7 DOE G 231.1-2 Page 14 08-20-03 A2B6C03 – Defective weld, braze or soldering joint Definition: A specific weld/joint defect or failure. Note: this does not explain why the object failed or was defective. Therefore, this node should be multiple coded. Examples: A leak occurred due to cracks in weld at the bottom of a tank. The weld cracked due to inadequate length of time allowed for pre-heating of surface prior to making the weld. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Repair the weld using correct surface pre-heat procedures. • Assure pre-heat and interpass temperatures for weldments are conducted and controlled in accordance with procedures. A2B6C04 – End of life failure Definition: The failure resulted from equipment or material having reached the end of its expected / normal service life. The failure was a result of the normal aging process for this component. Examples: A facility had determined that it was more cost effective to run a certain pump to failure rather than provide preventive maintenance that only yielded minimal life extension. Note: if the facility has not made this determination, then it is under A2B2. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Replace the failed pump. A2B6C05 – Electrical or instrument noise Definition: An unwanted signal or disturbance that interfered with the operation of equipment. Examples: Actuation of a radio in close proximity to instrumentation caused indication fluctuations.

The Distributed Control System (DCS) installed in the facility received erroneous alarms due to excess instrumentation noise on the system. The noise was a result of not having an adequate building grounding system installed. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Consider posting location to eliminate radio use. • Evaluate the use of shielding for affected components. A2B6C06 – Contaminant Definition: Failure or degradation of a system or component due to foreign material (i.e., dirt, crud, impurities, trash in river intake, etc.) or radiation damage due to excessive radiation exposure. Note: can be related to any material in an unwanted location. Examples: During post-maintenance testing, flowrate from a centrifugal pump was less than specification. Upon subsequent disassembly, it was determined that a rag had been left in the pump, partially blocking the intake. A valve actuator coupling was leaking. The coupling o-ring had become embrittled due to radiation exposure. During facility surveillance of diversion valve timers for the Segregated Cooling Water System, a diversion valve failed to operate completely. Dirt and crud inside the valve mechanism caused the valve to bind. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] DOE G 231.1-2 Attachment 7 08-20-03 Page 15 • Remove the rag and reassemble the pump. Note: this also implies administrative controls [A4B1 or A5] for foreign material exclusion are less than adequate. • Replace the o-ring. Note: this may also imply that preventive maintenance was LTA [A2B2C01], since radiation embrittlement can be predicted, therefore, the o-ring could have been replaced prior to failure. • Establish a means to filter the water prior to entering the diversion valve. Note: this could imply that preventive maintenance was LTA [A2B2C01], since more frequent refurbishment of the valve could have reduced the binding. The life cycle costs of the preventive maintenance could be less expensive than the modification cost to install the filter. A3 Human Performance Less Than Adequate (LTA) – An event or condition resulting from the failure, malfunction, or deterioration of the human performance associated with the process. Note: Strictly speaking, A3B1, A3B2, & A3B3 nodes are only applicable when “problem-solving,” although this does not have to be conscious. These are not the intended coding when not engaged in solving a problem, e.g., falling asleep because of prescription medication [which might be A3B4C01 or A5B4C06]. Further, these codes are for individual actions or lack thereof. If an event has multiple occurrences of the same A3 C node[s], it is time to look for other rationale behind the behavior. Yes, there are single examples of group performance that is LTA. However, when it is multiple examples, there is usually another explanation. For example, the control room operators at Three Mile Island mutually incorrectly diagnosed several of the accident indications and also mutually avoided application of several potential recovery paths. These errors were eventually traced to how their training had treated these potentialities. • B1 Skill Based Errors – Inattention or over-attention to performance of work affected the event. • B2 Rule Based Error – A misapplication of a good rule for behavior or application of a bad rule applied for behavior

during the work process impacted the event. Note: application of this node is not limited to misapplication of procedures. Rules are often mental rather than written. • B3 Knowledge Based Error – The problem was solved without using stored rules for behavior. The involved personnel were in a problem solving/troubleshooting mode. Note: Some people find it easier to think of this node as “Lack of Knowledge Based Error” since the essential gap is experiential. • B4 Work Practices LTA – The capacity to perform work was impaired. The act to incorrectly perform work was deliberate. People create all non-natural systems. There is no such thing as a perfect [error-free] system. All people who come into contact with any given system both affect the system and are affected by it. This applies to the designers, builders, operators and management. Although the degree/amount of affect may vary, there is an affect. Further, the vast majority of people [>95%] do not intend to commit an error. When a human performance error occurs, it is the individual that acted incorrectly, however, the real question is what in the system[s] failed to allow that action? In this context, a “system” can be hardware, administrative, or mental*. We essentially never deal with a single system in isolation. Similarly, the permutation or combination of impacted systems is constantly changing. This means that before the fact analysis of all potential system interactions is basically impossible. Thus, the intent is for A3 cause codes to be “coupled” (Refer to Attachment 6 of the Guide) with cause codes somewhere else on the CAT for each applicable causal factor. The A3 node needs to be captured to allow future root cause analysis on the human performance clusters. The other nodes are to fix the system(s) and annotate clusters other than human performance. You cannot permanently fix the individual [thereby preventing recurrence]. There are a few cases where it may be acceptable not to determine couplets: • Deliberate violations [<3%]. These are limited to those cases where the individual, with conscious forethought, violates the accepted norms. • Where the individual is at >2 standard deviations (σ)**, i.e., is an outlier in human performance. There is no intentional error or violation in this case. For example, the individual has been repeatedly trained [for a rule or knowledge based error] and the error still recurs with that person. By definition, this is an isolated case. These are not limited to training issues. Even here, there are ancillary issues that need to be addressed. Why didn’t the supervisor know about [take action on] this individual previously? What in the system broke down to allow this individual to get into this position [both in terms of where there were untoward challenges to his/her physical capabilities or uncompensated degradation of psychological environment that challenged mental capabilities]? If the total of these exceptions starts running at more Attachment 7 DOE G 231.1-2 Page 16 08-20-03 than 5% of the facility’s total evaluations, it is time to investigate why, i.e., the facility’s application of causal analysis is faulty.

In summary, A3, typically, is coupled with other coding from other branches. It is recognized that the number of links and number of impacted systems will vary with the event significance category. However, this is not to be used as a rationale for single-coding a particular event. The Attachment 6 matrix provides suggested links between the A3 nodes and the rest of the CAT. It is reiterated that while there is reason to believe that the nodes listed are more likely than others, there is no constraint that these are the only potential links. Similarly, while it is possible that there is no link for a particular situation, overuse of this extreme exception is indicative of other issues. * Mental systems are tricky because there is no requirement for them to be conscious. For example, most people are not aware of the influence of “culture” on their actions. The converse is also true, i.e., people are typically not aware of their influence on various systems. ** All intentionally designed systems are statistical in concept [nothing works perfectly every time]. They are designed for normative behavior/capabilities on the part of the “operator.” If the “operator” falls outside of these norms [>2σ], he/she cannot be expected to perform error free [be solely culpable for the event]. A3B1C01 - Check of work was LTA Note: All corrective actions defined for this C node can be used in any combination to mitigate or prevent the any “Skill” error from recurring. Suggested corrective actions are: A. Install blocking devices between similar controls. B. Identify critical steps of a task to increase attention. C. Increase supervision or include additional personnel to peer check critical steps of a task. D. Avoid multi-mode switches or controls. E. Implement practice of rereading previous two/three steps of a procedure before proceeding with task, if distracted or interrupted. F. Improve planning to reduce distractions or interruptions. G. Eliminate unnecessary time pressure through scheduling. H. Rotate individuals through various jobs. I. Practice using skill to maintain proficiency. J. Simplify and standardize manual checks (skill of the craft). K. Automate some tasks less suited for human beings. Definition: An individual made an error that would have been detectable and correctable if a check of the completed, or partially completed, work was performed. Examples: A transcription error was made when entering process data into a procedure. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Identify critical steps of the task. Include peer checking for critical steps. A3B1C02 - Step was omitted due to distraction Definition: Attention was diverted to another issue during performance of the task and the individual committed an error in performance due to the distraction. Examples: Procedure steps were not properly completed because the performer was distracted and skipped a step in the procedure. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Implement practice of rereading previous two or three steps in the procedure before proceeding with task for affected individual. • See note for A3B1C01. A3B1C03 - Incorrect performance due to mental lapse DOE G 231.1-2 Attachment 7 08-20-03 Page 17 Definition: The individual knew appropriate action(s) to take, but failed to initiate the correct action(s) based on inattention/over-attention.

Examples: A routine task was incorrectly performed when an individual forgot the correct action to take. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Improve planning to reduce distractions or interruptions. • Review the work flow to see if checks can be put into place that would catch similar mental lapses. • See note for A3B1C01. A3B1C04 - Infrequently performed steps were performed incorrectly Definition: An individual was not completely familiar with the tasks required based on not frequently performing the tasks and not operating at a fluency level. Examples: A particular method for reaching valving was used to install a lockout. Based on the Lockout Installer infrequently installing a lockout on the particular system, an incorrect method was chosen for reaching the valving and the installer was injured in the process. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Increase supervision or include additional personnel to peer check critical steps of the task. • See note for A3B1C01. A3B1C05 – Delay in time caused LTA actions Definition: An individual performed the wrong actions based on an extended length of time expiring between the time the task was defined and the time the task was completed. Examples: A motor failed due to a lack of lubrication. Routine maintenance had not been performed on the equipment. After an extended period of time, repair was made to the motor, but the Preventive Maintenance was not reviewed for adequacy to assure lubrication performance. This was based on the individual not recalling the cause for motor failure. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Improve planning to reduce distractions or interruptions. • Assure inclusion of failure cause in equipment history. Note: this would be multiple coded as Equipment history LTA [A2B2C04]. • See note for A3B1C01. A3B1C06 - Wrong action selected based on similarity with other actions Definition: An individual selected a wrong action out of a series of actions that appeared to be the same, but are not. Examples: Multiple procedure steps were similarly written that required addition of the same chemical, but each step varied in timing and quantity of chemical. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Install blocking devices between similar controls. • Place an explanatory note in the procedure just before, or in, the steps to notify the user that differences exist. • See note for A3B1C01. A3B1C07 – Omission / repeating of steps based on assumptions for completion Definition: Individual, based on assumptions, concluded that activity steps were not completed or completed. Based on the perceptions, an error occurred because the incorrect decision or assumption was made. Attachment 7 DOE G 231.1-2 Page 18 08-20-03 Examples: Multiple steps that were similar and sequential in a procedure required completion. A shift change occurred and no turnover was performed. Individual did not have enough knowledge of where the previous shift left off, and assumed specific steps had been completed, but were not documented. The individual proceeded with the procedure, but did not complete required steps in the procedure. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Implement practice of rereading previous two or three steps in the procedure before proceeding with task for

affected individual. • Implement policy to initial, date and time wherever a procedure is stopped prior to shift change. • See note for A3B1C01. A3B2C01 - Strong rule incorrectly chosen over other rules Note: All corrective actions defined for this C node can be used in any combination to mitigate or prevent the any “Rule” error from recurring. Suggested corrective actions are: A. Clearly delineate key decision points in a procedure. B. Eliminate procedure inconsistencies. C. Simplify procedures. D. Train individuals to Skill-Based mode (fluency). E. Add “Forcing Functions” (fail safe mechanisms that allow performance only one way, the right way). F. Eliminate drawing and technical manual errors. G. Improve knowledge of procedure bases. H. Practice using multiple, alternative indications. I. Promote practice of verbalizing intentions. J. Practice on transition between procedures. K. Eliminate unwise use of “Rule of Thumb”. L. Specialize on specific, safety critical tasks (resident expert). M. Improve human factors identification and layout of displays. Definition: Individual chose behavior rules based on the number of times the rule(s) had been used successfully in the past. The more times the rule(s) have been used successfully, the stronger the desire to apply the rule(s) become. Examples: An individual who did not use seat belts when driving vehicles was consistently applying a strong rule to not use them, but was incorrectly choosing to use that rule over another rule that, if applied would have guided the individual(s) to use seat belts. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Train individual(s) to a Skill Based performance mode (fluency). A3B2C02 - Signs to stop were ignored and step performed incorrectly Definition: Most activities generate indication of status [both positive and negative]. The human tendency is to focus on the indications of success rather than all the indicators. The negative indicators are the “signs to stop.” “Signs” are not necessarily physical. Note: “Signs to stop” are not limited to any standardized list of error precursors. Yes, those can, and do, have an effect. The Institute of Nuclear Power Operations short list of error precursors is built into the Causal Analysis Tree [see Attachment 5 of this guide]. Examples: Time pressure (in a hurry) is a common sign to stop for an event. When an individual(s) is in a hurry to complete tasks and move on to additional tasks, errors can occur during the effort in completing the tasks. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Add “Forcing Functions” (fail safe mechanisms that allow performance only one way) • See note for A3B2C01. DOE G 231.1-2 Attachment 7 08-20-03 Page 19 A3B2C03 - Too much activity was occurring and error made in problem solving Definition: This error was initiated when the individuals committing the error experience information overload. The right set of decisions was not made based on too many details to process mentally. Examples: Multiple activities were taking place in the control room. The control room was required to take readings, set up transfer paths, and fill out log sheets documenting activities. In addition, a number of people were in the control room creating distraction. When taking a reading and recording the result, the operator skipped a required step in the procedure by not focusing on the procedure completion due to other activities and distractions in the control room.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Train individual(s) to a Skill Based performance mode (fluency). • Establish a policy to allow only essential personnel into the control room during select evolutions. • See note for A3B2C01. A3B2C04 - Previous successes in use of rule reinforced continued use of rule Definition: If a rule for behavior has been used successfully in the past, there is an overwhelming tendency to apply the rule again, even though circumstances no longer warrant the use of the rule. Examples: In the past, chains had been used to prevent ball valves from manipulation. The recent facility practice had been to use alternative valve locking devices for the valves that had been proven to be more effective in preventing the valve from being manipulated. However, the facility did not prevent the use of chains. Lockout Installers were comfortable using chains and continued to use the chains instead of the alternative locking devices. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Add “Forcing Functions” (fail safe mechanisms that allow performance only one way) • Develop a list of ball valves and state their best lockout device. Provide list to Installers. • See note for A3B2C01 A3B2C05 - Situation incorrectly identified or represented resulting in wrong rule used Definition: Individual interpreted facts based on training and experience that helped form stored mental knowledge from which the individual interpreted the facts. When the individual used the stored knowledge, the right set of training and experience was sometimes not selected based on the existing facts. A broader search of the stored knowledge would have been necessary to explain the existing facts. Examples: A transfer of solutions was being made and the receipt vessel liquid levels were increasing. The situation appeared normal when an alarm was received that indicated the vessel was overflowing. A review of the situation revealed that the liquid level indicator installed in the vessel had been elevated [a different, higher position] in the vessel in the past. Although the individual taking the liquid level readings had known about the elevation change to the liquid level indicator, the information was not recalled when the transfer was being performed. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Practice using multiple alternative indications. • See note for A3B2C01. A3B3C01 – Attention was given to wrong issues Note: All corrective actions defined for this C node can be used in any combination to mitigate or prevent the any “Knowledge” error from recurring. Suggested corrective actions are: Attachment 7 DOE G 231.1-2 Page 20 08-20-03 A. Practice, practice, practice using methodical problem solving techniques with novel unfamiliar situations. B. Design displays to enhance use without keyboarding. C. Practice using team and communication skills. D. Assign the role of devil’s advocate. E. Develop and practice lateral thinking skills. F. Use system component knowledge and fundamental principles of physical sciences associated with plant systems and components in unfamiliar problem situations. G. Train on and verify accuracy of system and social mental models. Definition: Selective mental processing of information was targeted at the wrong issues and was not focused on

the right issues. Often the individual focus was centered around what was psychologically important instead of targeted on what was logically important. Examples: Maintenance was being performed on a pump. A flex nylobraid line was to be disconnected and replaced. This line was connected to the pump and was connected by a slip-on fit onto a barbed fitting and secured with an aviation clamp. In order to remove the line, the individual placed his foot on the pump to apply backward leverage for the purpose of pulling the line off the barbed fitting. In doing this action, the individual was focused on getting the job done instead of hazards associated with falling down if the line suddenly released from the fitting under extreme force. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Develop and practice lateral thinking skills. For this specific example, develop and practice of the thinking skills could be applied through the use of ‘Field non-punitive observation/mentoring program’ intervention concepts and practices. • Develop a standard method for removing the line and place it in the maintenance procedure. A3B3C02 - LTA conclusion based on sequencing of facts Definition: An individual, when establishing a timeline or recalling step-by-step compilation of facts as they occurred in an event, sometimes reordered the sequence which affected the conclusion based on the facts. Examples: Chemicals added to a process vessel that had to be added in a specific sequence to prevent a reaction of the chemicals. After a reaction had occurred, the individual(s) investigating the event inadvertently failed to recall the actual sequence of chemical additions, believed the sequence to be correct when it was not correct, and overlooked the cause for a chemical reaction in the vessel. An individual was in a problem solving performance mode, he/she incorrectly recalled the sequence of steps that were performed to disassemble a piece of equipment. During the re-assembly, the sequence that was recalled for disassembly was applied and the equipment could not properly be reassembled. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Train on and verify accuracy of system mental models. • See note for A3B3C01. A3B3C03 - Individual justified action by focusing on biased evidence Definition: An individual was overconfident in evaluating the correctness of his/her knowledge. The chosen course of action was selected based on evidence that favored it and contradictory evidence was overlooked. Examples: Often, the statement is used: “this is the way we did it where I used to work”. The problem with this mindset is that existing conditions, parameters, controls, etc. may be different enough to the individual(s) past experiences to require a different set of actions than what was required in the past. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Practice, Practice, Practice using methodical problem solving techniques with novel unfamiliar situations. DOE G 231.1-2 Attachment 7 08-20-03 Page 21 • Practice using team and communication skills. • See note for A3B3C01. A3B3C04 - LTA review based on assumption that process will not change Definition: Individual believed that no variability existed in the process and overlooked the fact that a change has occurred leading to differing results than normally realized.

Examples: Vessel concentrations of material were calculated based on a heel of material (solution left in bottom of vessel after flushing) believed to be present in the vessel. The normal flushing method provided for a specific amount of solution to be flushed through the vessel. However, during a flushing of the vessel, the amount of solution was less than specified for required flushing. The result was a larger heel containing more concentration of material than had been calculated. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Develop and practice lateral thinking skills. • See note for A3B3C01. A3B3C05 - Incorrect assumption that a correlation existed between two or more facts Definition: Wrong assumptions were made based on the belief that two or more facts are related to each other and incorrect actions were taken based on the assumption. Note: This also covers the case where there is an incorrect assumption that two or more facts do not correlate when they do. Examples: During a transfer of solutions from one vessel to the next, it was recognized that liquid levels on the chart recorder were increasing and the transfer had been initiated. However, further investigation revealed that a valve was incorrectly positioned allowing solution from another source to flow into the receipt vessel and the sending vessel was set-up for the wrong transfer path. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Use system component knowledge and fundamental principles of physical sciences associated with plant systems and components in unfamiliar problem situations. • See note for A3B3C01. A3B3C06 - Individual underestimated the problem by using past events as basis Definition: Individuals tend to oversimplify events. Based on stored knowledge of past events, the individual underestimated problems with the existing event and plans for fewer contingencies than will actually be needed. Examples: Contamination incidents had been a regular occurrence in the past for the facility. The source of these contamination incidents had usually not been determined. The current contamination occurrence had an identifiable source, but extensive surveys were required to locate it. The individual performing the surveys believed the current event was like the past events and did not perform an extended set of surveys in the facility to locate the source. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Practice skills using methodical problem solving techniques with novel unfamiliar situations. • See note for A3B3C01. A3B4C01 – Individual’s capability to perform work LTA Definition: Attachment 7 DOE G 231.1-2 Page 22 08-20-03 • Sensory/Perceptual Capabilities LTA - The problem was due to less than adequate vision [e.g., poor visual acuity, color blindness, tunnel vision]. The problem was caused by some defect in hearing [e.g., hearing loss, tone deafness]. There was a problem due to some sensory defect [e.g., poor sense of touch or smell]. • Motor/Physical Capabilities LTA - The causal factor was attributable to trouble with inadequate coordination or inadequate strength. The problem was due to inadequate size or stature of the individual involved. Other physical limitations [e.g., shaking, poor reaction time] contributed to the problem.

• Attitude/Psychological Profile LTA - The problem was due to a poor attitude on the part of an individual. The individual involved showed signs of emotional illness. Note: Symptoms like the following are often warning signs of poor attitude or mental illness: 1. Horseplay 2. Absence from work location 3. Failure to perform expected work 4. Maliciousness 5. Poor performance under stress 6. Poor psychological health 7. Use of drugs or alcohol 8. Insubordination 9. Failure to work well or communicate with others 10. Disregard for safety rules Note: These capabilities refer to physical and mental attributes [over which the employee has no control] and/or disease related symptoms [which may or may not be under the control of the individual]. It may take professional diagnosis to determine if this code is applicable. Related codes are Ergonomics LTA [A1B5C01] and Job scoping did not identify potential task interruptions and/or environmental stress [A4B3C07]. Intentional non-compliance is A3B4C02. Also, this code relates only to a single individual, group behavior is entirely different. Examples: • Sensory/Perceptual Capabilities LTA - An operator read the wrong temperature on a chart that recorded temperature for several tanks. The chart was color coded. The operator was partially color blind and confused the readings. He recorded a temperature as being in range when the actual temperature was out of range. • Motor/Physical Capabilities LTA - A tank overflowed because the operator could not close the valve. The valve was large and difficult to close. The operator did not have the strength to close the valve. By the time he obtained help in closing it, the tank had overflowed. • Attitude/Psychological Profile LTA - An operator failed to close a valve after filling a tank, resulting in a process upset. The operator showed symptoms of alcohol abuse and absence from his work location. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Sensory/Perceptual Capabilities LTA - Confirm diagnosis and reassign to duties that do not utilize affected capabilities. • Motor/Physical Capabilities LTA - Determine if the valve can be made easier to close [i.e., repair, replace or increased preventive maintenance]. If not, consider [non-punitive] reassignment of operator. • Attitude/Psychological Profile LTA - Process through Employee Assistance Program. A3B4C02 - Deliberate violation Definition: The action on the part of the individual was a deliberate action to commit human error. Note: Be very careful in the application of this code. It may take professional diagnosis to determine if the action was intentional or the result of something beyond the control of the individual [A3B3C01]. There is usually some form of personal gain associated with this code. Also, this code relates only to a single individual; group behavior is entirely different. If this code is cited in more than ~5% of the incidents for a given facility, there is most likely some other underlying cause. Examples: An individual cut the lock on a defined lockout point for a Lockout/Tagout on a system to bypass the lockout. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] DOE G 231.1-2 Attachment 7 08-20-03 Page 23 • Apply the Constructive Discipline program. A4 Management Problem –

An event or condition that could be directly traced to managerial actions, or methodology (or lack thereof). A “management” problem attributed to management methods (directions, monitoring, assessment, accountability, and corrective action), inadequate resource allocation, work organization and planning, supervisory methods and/or change management practices. Note: Apparent Cause Corrective Actions for this branch in particular easily slip into correcting the program as opposed to the implementation. Fixing the program is the realm of Root Cause[s]. The analyst is cautioned to gauge Corrective Actions appropriately. • B1 Management Methods Less Than Adequate (LTA) - The processes used to control or direct work-related plant activities, including how manpower and material was allocated for a particular objective. Note: This cause section addresses management-controlled practices and policies and requires that the investigator gain familiarity with the standards or expectations that exist for performing work. [See note for A4B4.] • B2 Resource Management LTA - Evaluation of the processes whereby manpower and material were allocated to successfully perform assigned tasks. Note: B2 serves as an expansion to B1, Management Methods, since both B1 and B2 are important inter-related factors. B2 provides more in-depth causal nodes for evaluating manpower and material issues impacting performance of work-related activities. • B3 Work Organization & Planning LTA – Problems in how the work to be performed was organized. This would include work scope, planning, assignment and scheduling of a task to be performed. Note: While B3 addresses the organization and planning of work, failures in this node usually imply related failures in Supervisory Methods addressed in B4. • B4 Supervisory Methods LTA - Causes that can be traced back to the immediate supervision and evaluated techniques that were used to monitor, direct and control work assignments. Note: this is supervision as a function not as a title. A manager can be the supervisor of another manager or a non-supervisor [by title] can be functioning as a supervisor. Problems with other than immediate supervision are coded under B1, B2 or B5 [which does not say that immediate supervision problems cannot be multiple coded under those B nodes]. • B5 Change Management LTA – Problems caused by the process by which changes were controlled and implemented by management as organizational needs change to accommodate new business needs. A4B1C01 - Management policy guidance / expectations not well-defined, understood or enforced Definition: Personnel exhibited a lack of understanding of existing policy and/or expectations, or policy/expectations were not well-defined or policy/expectation is not enforced. Example: A key piece of equipment in a process safety system failed. The policy stated that the required maintenance and inspections were to be performed annually. Because of the difficulty of the work and the amount of work involved, maintenance was performed the last two weeks of odd numbered years and the first two weeks of even numbered years. This allowed nearly two years between the required maintenance and inspections. The policy was confusing and not well defined, leaving room to interpret a 24 month gap between maintenance and inspections when it was intended to have not more than a 12 month gap between maintenance and inspections.

During a routine inspection, containers of controlled material were found to be in violation of a safety policy regarding required information on container labels. In order to comply with the security policy concerning controlled material access, the safety policy was violated. The two policies were contradictory regarding labeling of controlled material. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Modify administrative control to stipulate maximum period of 12 months. • Modify safety and security policies to balance concerns and still meet operational mission. Attachment 7 DOE G 231.1-2 Page 24 08-20-03 A4B1C02 - Job performance standards not adequately defined Definition: Measurement of effectiveness could not be performed for a specific job function due to lack of defined standards. Example: During an extended facility outage, routine surveillance of process alarm panels was not performed. As a result, a chemical leak went undetected for two days. Facility management had not clearly defined normal surveillance standards during the extended outage. An operator made a mistake operating a process that was color-coded on the distributed control system. The operator was color-blind. There were no job performance standards or requirements concerning color blindness for this job even though being able to discriminate among colors was necessary to operate the process. Note: this [or similar] example should be multiple coded under A3B4C01. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Assure job performance standards for surveillance requirements during extended outages are adequately defined. • Reassign affected individual to position that does not require color discrimination. • Assure medical review of job performance standards where the ability to discern colors is essential to adequate performance of this assigned task and modify task requirements accordingly. A4B1C03 – Management direction created insufficient awareness of the impact of actions on safety / reliability Definition: Management failed to provide direction regarding safeguards against non-conservative actions by personnel concerning quality, safety or reliability. Example: An event occurred in a waste tank because incompatible materials were mixed. The Process Hazards Review (PHR) had been performed, but it failed to consider the possible sources of material that could be added to the tank. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Reexamine the baseline for the PHR to assure the specific incompatible materials have been documented and appropriate safeguards are integrated into management expectations, organizational programs and system designs such that employees are trained and skilled in knowing operational limitations and safety parameters. A4B1C04 - Management follow-up or monitoring of activities did not identify problems Definition: Management's methods for monitoring the success of initiatives were ineffective in identifying shortcomings in the implementation. Example: Job-specific bioassay sampling program for tritium requires personnel to leave a sample at the end of

the workshift as required in the Radiation Work Permit. If the sample is not left prior to leaving work, the employee is in noncompliance with regulatory requirements and places the company at risk for Price Anderson Amendments Act enforcement liability. The first formal opportunity to detect noncompliance was during weekly employee logsheet sign-ins and sampling label checks by the Radiological Controls Organization supervisor. Multiple noncompliance events had occurred over time with related corrective actions tracked and closed; however, corrective actions were ineffective in preventing the problem from recurring. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Develop bioassay sampling interventions that detect noncompliance at the point of failure. A4B1C05 - Management assessment did not determine causes of previous event or known problem Definition: Analysis methods failed to uncover the causal factors of consequential or non-consequential events. Example: Over a period of time, several related ORPS events involving noncompliance with operational requirements had been reported to DOE. With each similar event being reported, the significant DOE G 231.1-2 Attachment 7 08-20-03 Page 25 category progressed from low-level performance monitoring and trending to Significant Category 1. Price Anderson Amendments Act fines for violations were assessed against the company. The respective program office conducted two formal root causes. Corrective actions were tracked to closure with corrective action effectiveness reviews performed to prevent recurrence. Recommended solutions from the first reported event to the most recent event have basically been the same; however, noncompliance is still problematic for the company where risk is high for a potential repeat violation. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Determine why causal analysis was not implemented in former cases. Implement appropriate corrective actions. A4B1C06 - Previous industry or in-house experience was not effectively used to prevent recurrence Definition: Industry or in-house experience relating to a current problem that existed prior to the event, but was not assimilated by the organization. Note: This code is not necessarily limited to the site’s formal lessons learned program. It can apply to any event of which the facility had been made aware. Example: The DOE customer shared problematic issues from another DOE site concerning radiation protection issues. The site had obtained the information and discussed several corrective actions but did not take any action [or only implemented a single action]. A similar problem occurred several months later. It was evident that the department organization had not fully assimilated the significance of the prior issue. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Re-review the information provided particularly actions taken at other site, determine if actions taken were effective and implement appropriate corrective actions. • Assure work is prioritized that allows appropriate level analysis to be performed on lower level trending information as an investment in prevention. • Assure analysis of performance trending data is comprehensive enough based on the severity of the event to employees and the business and potential consequences if the event is not corrected in a manner to prevent recurrence.

A4B1C07 - Responsibility of personnel not well defined or personnel not held accountable Definition: Responsibility for process elements (procedures, engineering, training, etc.) was not placed with individuals or accountability for failures of those process elements was not placed with individuals. Example: A technical limit for the length of time allowed between airflow checks on a stack exhaust system was violated. The Operations Department considered the checks to be maintenance items. The Maintenance Department considered them to be an operations item. Responsibility for the checks was not defined. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Develop memorandum of understanding to establish responsibility. A4B1C08 - Corrective action responses to a known or repetitive problem was untimely Definition: Corrective action for known or recurring problem was not performed at or within the proper time. Example: A tank overflowed because the liquid level instrumentation was out of calibration. Corrective measures had been identified during a previous overflow of the tank but had not been implemented when the second overflow occurred. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Calibrate liquid level instrumentation. Note: this should be multiple coded under Calibration for instruments LTA [A2B1]. Attachment 7 DOE G 231.1-2 Page 26 08-20-03 • Either promptly implement corrective actions from previous event or implement compensatory measures or justify delay. A4B1C09 - Corrective action for previously identified problem or event was not adequate to prevent recurrence Definition: Management failed to take meaningful corrective action for consequential or non-consequential events. Example: Over a period of time, several related ORPS events involving noncompliance with operational requirements for had been reported to DOE. With each similar event being reported, the significance category progressed from low-level performance monitoring and trending to Significance Category 2. Recommended solutions from the first reported event to the most recent event were basically the same with procedural changes and employee training. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of causal analysis technology and frequency of analyses. • Develop new corrective actions that do not rely on procedural changes or employee training. A4B2C01 - Too many administrative duties assigned to immediate supervisors Definition: The administrative load on immediate supervisors adversely affected their ability to supervise ongoing activities. Note: This is a problem with the management of the supervisor not his/her supervisory methods [A4B4]. This is non-task activities [not actively supervising employees]. Task overload is A4B2C02. Example: A first line supervisor and his experienced crew were assigned a work package to repair a leaking tank containing a hazardous chemical. The supervisor was also involved with other important activities supporting the First Line Managers’ (FLM) Council, safety program initiatives within his department, and the division golfing event for the United Way Campaign. During the maintenance repair, the crew failed to execute a critical step in the repair process that resulted in further damage to the tank. At the time of the event, the supervisor was making a formal presentation to the FLM Council on issues impacting the work environment.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Reduce non-task items assigned to affected supervisor. • Examine work planning, scheduling and work prioritization processes and the adequacy of communications channels (oral and written) among the supervisor, the maintenance crew and the management team to accommodate duties beyond direct supervisory responsibilities. A4B2C02 - Insufficient supervisory resources to provide necessary supervision Definition: Supervision resource is less than that required by task analysis considering the balance of procedures, supervision and training. Note: This is a problem with the management of the supervisor not the supervisory methods [A4B4]. This is too many jobs to be actively supervised at once. Non-task [not actively supervising employees] overload is A4B2C01. Example: The Operations Department recently restructured to new performance management contract initiatives and other company conditions. Several experienced employees retired and/or left the organization and replacements were part of a new multi-skilled job ladder. Job responsibilities and duties were being redistributed to accommodate the reduced staffing and organizational consolidation. Although many job titles had remained the same during the last several years, most of the job functions had revised duties and tasks. Formal position descriptions and related job task analyses had not been reviewed for several years. Regulatory requirements had gradually become more stringent over the years, reducing the amount of time supervisors had available. Previous jobs that took an hour for the supervisor to complete now took 4 hours to accomplish. Therefore, even less time was spent on important job tasks DOE G 231.1-2 Attachment 7 08-20-03 Page 27 where supervision was needed. Considering tasks involving procedures, training and supervisory responsibilities, supervisory resources were not adequate to meet the need. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Update position descriptions and job task analyses based on company initiatives and regulatory changes. Modify assignments based on updated documentation. • Review department’s ability to adequately plan, prioritize and staff for human resources based on changes in scope driven by changing business conditions. A4B2C03 - Insufficient manpower to support identified goal / objective Definition: Personnel were not available as required by task analysis of goal/objective. Example: Changes in the site’s waste generation program required increased characterization of waste streams to accommodate storage in metal storage vaults versus direct ground burial. With multiple waste streams in laboratory operations and the unpredictability of those streams, Generator Certification Official (GCO) manpower was added to staff the certification function. Other job skills impacted by the program change included radiological control technicians (increased survey calculations and shipment preparation) and technical lab personnel (increased GCO training, slow downs in performing lab- specific functions resulting from characterizing, bagging and preparing waste products for shipment). Waste storage locations for staging characterized waste impacted facility housekeeping programs and generated additional ALARA concerns. Appropriate task analysis had not been conducted on the manpower needed to adequately support the overall waste management program for lab operations.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review adequacy of job/task assignment, modify task analysis or manpower loading as necessary to meet program changes. • Reduce workload in related area to provide necessary personnel in the critical area. A4B2C04 - Resources not provided to assure adequate training was provided / maintained Definition: Training resources were not available as required by task analysis. Example: Recent site restructuring efforts reduced some program manpower resources based on the percentage of budget the organization contributed to the overall program. Additionally as part of restructuring, early retirement and voluntary separation incentives were offered to qualified personnel to meet corporate budget targets by the end of the Fiscal Year. A new Multi-skilled Technician job ladder was introduced to accommodate certain organizational shifts in manpower and to fill some essential job functions. All the changes created movement within the workforce that required additional training to meet various mission essential tasking. New task analysis of job functions revealed that there were not enough resources to provide adequate training for the newly restructured organization. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Provide additional training resources, rotate existing training personnel from less important tasks, or implement compensatory actions and justify delay in resource allocation. A4B2C05 - Needed resource changes not approved / funded Definition: Corrective actions for existing deficiencies that were previously identified were not approved or funded. Example: A small project experienced problems in costs and schedule. Issues and performance deficiencies with related corrective actions were being tracked by project management, but due to emphasis on schedule delays and cost overruns, some of the corrective actions were not approved or funded. It was determined through independent management evaluation that had some of the corrective actions been Attachment 7 DOE G 231.1-2 Page 28 08-20-03 funded and approved, the project would have been able to detect its downward trend earlier and prevented further project performance degradation and reduction of scope. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of performance monitoring and trending program to assure project scope stays within acceptable parameters of performance (quality, production, schedule costs) using leading, real-time and lagging indicators. • Assure acceptance criteria for deviations between performance and expectations are known prior to restarting the project. • Re-examine original baseline planning documents to assure plan is sensitive to unexpected business changes. A4B2C06 - Means not provided to assure procedures / documents / records were of adequate quality and up-to- date Definition: A process for changing procedures or other work documents to assure quality and timeliness was nonexistent or inadequate. Example: A Lockout/Tagout (L/T) to perform Diesel Generator (D/G) maintenance was ready for review and

approval. The First Line Manager (FLM) for Maintenance was unable to locate electrical prints for the L/T. The FLM walked down the lockout plan and checked adjacent electrical panels for other feeds that may have been associated with the D/G. No other electrical feeds were identified other than those already listed on the L/T. In addition to the Subject Matter Expert, Utilities, Engineering and Operations had approved the L/T. The FLM signed the approval block on the L/T. The next day the mechanic was performing determination and voltage checks on the D/G and discovered 120 volts. The process for assuring appropriate documentation was available to verify and validate the L/T was inadequate. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Provide electrical prints [or equivalent compensatory measure] for D/G L/T. A4B2C07 - Means not provided for assuring adequate availability of appropriate materials / tools Definition: A process for supplying personnel with appropriate materials or tools did not exist. Example: A employee was cutting plastic with a table saw when several teeth broke off the blade, causing material to kick back and rip off the employee’s fingernail. The manufacturer produced the blade as part of their “woodworking line.” The carbide-tipped, 12-inch blade with 60 teeth had become the “blade of choice” by the site for general-purpose cutting. The manufacturer recommended not using the woodcutting blade for cutting plastics, but recommended another blade product designed specifically for plastics. The process to assure employees were provided with the proper tool was not adequate. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review adequacy of man-machine interface and adequacy of assumptions used in tool selection among employees and supervisors. A4B2C08 - Means not provided for assuring adequate equipment quality, reliability, or operability Definition: A process for assuring personnel’s equipment was satisfactory did not exist. Example: During a confined space entry into a valve box to leak test inter-connecting pipeline to a low level waste system, the Radiation Work Permit (RWP) required Personal Protective Equipment (PPE), including two sets of Tyvek [water-resistant, disposable coveralls], booties and a respirator. Blotter paper was placed into the floor area of the pit to help control transfer of contamination while the employee was standing on the floor. The employee began leak-testing piping using a leak test soap solution. Once the leak was fixed, the employee exited the pit and removed shoe covers, harness, first layer of Tyvek and outer gloves with assistance from the Radiological Controls Technician. Upon proceeding to the buffer area and removing the second layer of Tyvek, respirator and inner gloves, DOE G 231.1-2 Attachment 7 08-20-03 Page 29 contamination of 20,000 dpm beta-gamma was discovered on the right shoe and 24,000 dpm beta- gamma was on the left pant leg. The RWP called for two sets of Tyvek and non-skid shoe covers. The work package, which included the use of liquid soap solution in a dry work environment, did not include the need for waterproof PPE. The process for assuring reliable and operable equipment was available to adequately protect the employee was unsatisfactory. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Include guideline for waterproof PPE when working with water-based solutions. Note: this should be multiple

coded under Written communications content LTA [A5B2]. • Review implementation of organization interfaces with focus on hazards analysis completeness. A4B2C09 - Personnel selection did not assure match of worker motivations / job descriptions Definition: Personnel selection processes failed to determine a mismatch between motivation and job description prior to task. Note: Mismatch with motivations is under this code. Mismatch with skills is under A4B4C09. Example: An employee was assigned, along with a small group, to routine production of work packages. Under the system in use at the time, each package had to be individually created in several separate databases for the different forms involved. The employee took it upon himself to integrate the various files into a single platform for work package creation for use by the entire group. This development effort detracted from the employee's work output, however, and his manager voiced disapproval with the distraction. The manager failed to realize that the investment involved with upgrading the work process would eventually lead to vastly improved efficiency for the entire work group. The employee's motivation - increasing long-term productivity - was in conflict with management's desire for short- term increased work output. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Consider methods to increase manager’s ‘big picture.’ • Review implementation of management processes in assigning personnel to tasks based on proper knowledge and training required in meeting performance standards/expectations and motivation of employee in accomplishing assignment. A4B2C10 – Means / method not provided for assuring adequate quality of contract services Definition: A process for assuring quality contract services was being provided was nonexistent or inadequate. Example: A subcontract had been awarded to a vendor for supplying low level radioactive waste containers that met appropriate waste acceptance criteria and Department of Transportation packaging requirements. The vendor utilized welding procedures as administrative controls to assure that welding processes and qualifications met American Society of Mechanical Engineers standards. During a contract renewal assessment visit, the vendor’s inspection/test records and their respective results were found to have no irregularities. However, information entered on welding procedures and their corresponding qualification records revealed discrepancies that did not meet welding code. The technical direction provided to the welders responsible for fabrication and assembly of the waste containers had compromised the quality of the services required by the subcontract. The process for assuring quality contract deliverables was inadequate. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of specific vendor’s internal assessment methods focusing on methods for detecting and correcting discrepancies in quality. A4B3C01 - Insufficient time for worker to prepare task Attachment 7 DOE G 231.1-2 Page 30 08-20-03 Definition: Scheduling of the task did not adequately address the time frame required for accepted worker preparation practices to occur. Example: An electrical job was placed on the facility schedule, as normal, eight weeks in advance of the planned

work start. Despite foreknowledge of the need for a lockout/tagout (L/T) plan to perform the work, no L/T was requested from the lockout writer until the day before the job was scheduled to begin. The lockout writer, given the time constraint, re-used an old L/T plan that had been written for a similar job some months before. However, the work boundary was different on the new job, resulting in an inappropriate isolation (i.e., the lockout plan did not adequately isolate the planned work boundary). The lockout writer did not take the time to verify the work boundary against the lockout due to the ‘rush’ nature of the job. The time frame for scheduling the task did not adequately address the time frame required for accepted worker preparation practices to occur. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Require Work Control Supervisor to review the facility schedule on a periodic basis. Any work on the schedule would be assessed for L/T requirements. • Review implementation of the organizational function or structure to plan and assign work consistent with work priorities, examining work planning and communication barriers impacting teaming efforts. A4B3C02 - Insufficient time allotted for task Definition: Scheduled duration of the task did not adequately address known conditions or account for reasonable emergent issues. Example: A job was planned to perform decontamination activities in an Airborne Radioactivity Area (ARA), competing with another job also requiring the use of the building’s breathing air system. Only one job could be accommodated at a time. The facility manager decided to reduce the allotted duration of the decontamination task from 3 days to 2 days to accommodate the other remaining breathing air work deemed critical to the facility’s mission. During the course of the decontamination job, one of the workers fell over waste bags that were left in the area, resulting in a sprained wrist. The workers were under a time constraint to complete both tasks within the allotted 3-day period. The removal of the waste bags prior to starting the decontamination task was not part of the initial work scope. The work plan was to make a separate entry to remove the waste bags at a later time rather than add an additional person for the decontamination entry. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of work practices, focusing on shortcuts used to accelerate job completion when there is perceived pressure to complete work. A4B3C03 - Duties not well-distributed among personnel Definition: The work loading of individuals within a group or team did not adequately address training, experience, task frequency and duration, or other situational factors such that responsibility was inappropriately distributed. Example: As part of an organizational shuffle, a new engineer had been assigned as the Design Authority for the breathing air system in the facility. The engineer held a degree in electrical, not mechanical engineering, and as such was unfamiliar with the calculations performed on breathing air relief devices. As a result, a pressure relief calculation error was not discovered, resulting in a premature activation of the relief device which caused a job stoppage and additional protective clothing (i.e., plastic suit) expense. The work loading process did not adequately address situational factors to assure responsibility was appropriately distributed among individuals within the group.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Provide the new engineer with training concerning the breathing air system. • Review implementation of management processes in assigning personnel to tasks based on proper knowledge and training required in performing the job assignment. DOE G 231.1-2 Attachment 7 08-20-03 Page 31 A4B3C04 - Too few workers assigned to task Definition: Job planning did not allot a realistic number of man-hours or the number of people necessary to complete the task based on the scope of work described. Example: A job was planned to perform a test of an electronic control system. This test typically took two hours and involved three workers, one to manipulate controls, one to observe the time-dependent system changes, and one to record results. The supervisor only allotted two workers, informing the second that he would have to note the system changes and record them. During the middle of the test, the observer/recorder had to abort the test as one of the test readings was missed while he was recording previous observations. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Reschedule and perform test when three workers are available. • Put a note in the test procedure prerequisites that this test requires three people to accomplish. Note: this should be multiple coded under A5B2. A4B3C05 - Insufficient number of trained or experienced workers assigned to task Definition: Though the overall number of personnel assigned matched the planned man-hour allotment, organization methods failed to identify that the personnel assigned did not have adequate experience or training to perform the work. Example: Four jobs underway were utilizing the facility breathing air system, since work was being performed in Airborne Radioactivity Areas. There was a shortage of trained and qualified operators to perform manifold attendant duties, so facility management assigned untrained operators at two of the job sites, while providing for a third “trained and qualified” operator to move between the two sites to ‘check up’ on the untrained coworkers. During the time the “trained and qualified” operator was unavailable to one of the untrained operators, a fluctuation in breathing air pressure was observed. This fluctuation did not trigger a breathing air alarm; however, the inexperienced operator immediately ordered the exiting of the airborne area, resulting in a costly, unnecessary work stoppage. The organization failed to assign personnel with adequate experience and training to perform the work. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Designate additional operators to become qualified as a Breathing Air System manifold attendant. • Review implementation of work practices, focusing on shortcuts used to accelerate job completion when there is perceived pressure to complete work. A4B3C06 - Planning not coordinated with inputs from walkdowns / task analysis Definition: The job plan did not incorporate information gathered during field visits or task analysis concerning the steps and conditions required for successful completion of the task. Example: An electrical job was planned to replace a malfunctioning light fixture. This fixture was not shown on

the facility drawings, so the lockout writer included all lighting circuits in the general area on the lockout, as well as a warning that the power source could not be confirmed. It was later discovered that Electrical & Instrumentation had previously determined the correct feed for the light fixture in question on a “Fix-It-Now” task, but this information was not communicated to the lockout writer or work planner. As a result, one section of the facility was without lighting for half a day, when all that was really necessary was to de-energize a single circuit. Additionally, operator time was wasted from hanging a documented lockout/tagout, when a single-point lockout/tagout installed by the work group would have sufficed. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] Attachment 7 DOE G 231.1-2 Page 32 08-20-03 • Review implementation of interface requirements required by one program but belonging to another program, focusing on program design and work planning processes for standardization between the groups (Electrical & Instrumentation, lockout writers and the work planners). A4B3C07 - Job scoping did not identify potential task interruptions and/or environmental stress Definition: The work scoping process was not effective in detecting reasonable obstructions to work flow (e.g., shift changes) or the impact of environmental conditions. Note: This code applies to disruptions of circadian rhythms [biological functions based on 24-hour schedule] caused by scheduling of work. Example: Work was conducted in the underground liquid waste transfer cells. The cells were located in an outdoor area between the facility’s buildings. Workers require plastic suits and breathing air systems in this area to perform work. Previous entry to this area had been made when ambient temperatures were in the mid-to-low 70s. A job required entry into this area later when ambient temperatures typically reached 90 degrees or more during the hottest part of the day. The work package, which was scheduled for a mid-morning start, required the use of ice barrels to chill breathing air being used by the six workers. During the 8-hour job, 2 of the 6 workers became ill and asked to be cut out of their suits and relieved from work. This resulted in premature termination of the job. Medical diagnosed both workers as first aid cases due to heat stress. The work scoping process did not examine other provisions or options for minimizing the impact of environmental conditions on the workers. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of work practices that could potentially lead inadequately planning for contingencies. A4B3C08 - Job scoping did not identify special circumstances and/or conditions Definition: The work scoping process was not effective in detecting work process elements having a dependency upon other circumstances or conditions. Example: The facility was planning work for an upcoming outage period. Several of the jobs involved outages to

building systems and equipment. One such case involved an electrical outage of Motor Control Center (MCC) 1 to perform planned maintenance on a pump that served as a primary pump for the cooling water to the instrument air compressor for that section of the facility. The primary pump was fed directly from MCC 1. The secondary pump for the instrument air compressor was fed from a secondary sub-feeder coming from MCC 2. MCC 2 was also scheduled for planned maintenance, unrelated to work on MCC 1. Lockouts were applied for both MCC 1 and MCC2 simultaneously, resulting in both the primary and secondary pumps rendered inoperative for the cooling water system to the instrument air compressor. Neither the shift manager nor the operators recognized the impact to the cooling water system and the instrument air compressor when the lockouts were applied. The work scoping process did not detect the dependency the components had on other systems and circumstances. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of work planning processes, examining program-to-program interface (configuration management, work planning, operations, engineering, maintenance) requirements. A4B3C09 - Work planning not coordinated with all departments involved in task Definition: Interdepartmental communication and teamwork did not support the work flow being planned. Note: The key word is “coordinated.” By not getting input from affected departments, the work plan is likely not to succeed. Example: During a planned outage, the planned work flow called for conducting lockout/tagout procedures in a specified order to support safe facility shutdown. The order of the lockouts dictated that verification of isolation was performed by Electrical & Instrumentation (E&I) personnel at the same time in three DOE G 231.1-2 Attachment 7 08-20-03 Page 33 different locations to support the work as scheduled. When tasked to support the plan, E&I could not support lockout/tagout due to limited resources availability. As a result, the outage work schedule was revised and extended four hours beyond the original timeline, since one of the lockouts had to be removed and re-installed at a later time in order to accommodate the availability of E&I. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of interface requirements required by one program but belonging to another program, focusing on work planning processes between the groups (E&I, lockout writers and the work planners). A4B3C10 – Problem performing repetitive tasks and/or subtasks Definition: The work flow plan repeated tasks or subtasks to the detriment of successful completion of the evolution. Example: A lockout plan was written to install Ground Fault Circuit Interrupter (GFCI) receptacles in a room. Since these devices are polarized, it was necessary to provide a temporary lift for the lockout in order to test the polarity and verify correct installation. The lockout used involved multiple points, as all receptacles in the room were being changed. Because of this, seven separate lockout plans were written to allow for lifts to take place on each of the lockouts. It would have been more efficient to install seven single-point lockouts and treat each receptacle as a separate task on the work order. Then, any number of lifts could be performed on a given receptacle without the need to install a time- consuming multiple-point lockout. The work flow plan process did not recognize the repetitive nature of the job and the subsequent impact on effective utilization of resources.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of lockout design, prioritization of work and staffing resources, focusing on excessive implementation requirements. A4B3C11 - Inadequate work package preparation Definition: Though scoping and planning were adequately performed, the work package did not reflect the information gathered from these activities. The work package did not accurately reflect the work that was to be completed. Example: A job was planned to replace a defective motor on a fan. Previously, Electrical & Instrumentation personnel had verified that the control voltage for the motor was fed from the control transformer in the Motor Control Center cubicle. As a result, de-energizing the single point would completely de- energize the work boundary. However, the information was not included in the work package or the lockout order. When the work crew arrived to perform the maintenance, they refused to sign onto the lockout until the work boundary could be independently verified. Significant time was lost in confirming that the lockout did indeed properly cover the scope of the job. Although scoping and planning were adequately performed, the work package did not reflect the information gathered from these activities. A first line supervisor prepared a detailed job plan for changing out a pump. The new pump was installed perfectly. The plan, however, did not provide instructions for handling the pump that was removed from service. As a result, the crew disassembled the pump and sent the scrap metal to the salvage yard. A significant amount of money was lost, since the original pump was expensive and was to be rebuilt. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of methods to assure necessary information used in decision-making by all involved parties. • Review implementation of work practices, examining supervisory actions or decisions made without assessing the entire situation and lacking the big picture. A4B4C01 - Tasks and individual accountability not made clear to worker Attachment 7 DOE G 231.1-2 Page 34 08-20-03 Definition: Tasks (and the individual accountability for the task) that were outside written guidance or training were not made clear to the worker. Example: The facility heating, ventilation and air conditioning (HVAC) control system reported a variation in humidity control in one area of the building. The system engineer was contacted. The engineer indicated that the humidistat for that area appeared to be out of adjustment, and suggested that one of the operators adjust it to the correct set point. No procedure existed for adjustments to the controls. The Shift Manager dispatched an operator to perform the adjustment. The operator was new and not yet qualified on the system. When the operator arrived at the HVAC unit, he observed a hand- inscribed hash mark on the adjustment knob for the instrument. He did not know that this mark was the factory setting, not the correct setting for the building. When he adjusted the instrument to the factory setting, the humidity situation worsened rather than improving, resulting in condensation forming on the floor and creating a potential slip and fall hazard. The task and accountability, which was outside written guidance and training, was not made clear to the worker.

A step in the waste acceptance procedure required the waste receipt operator to compare the manifest that arrived with the waste to the manifest that was sent to the site for review and approval prior to the waste being shipped. This was done because changes were sometimes made in the waste before it was sent. The procedure did not specify what was to be compared on the two manifests. The waste receipt operator typically compared only the box numbers and weights. In one case, the box numbers and weight had not changed but the box contents were significantly different. This box of waste was put in the wrong location based on its actual contents. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] Review implementation of task assignments, focusing on assigning the right people to the right jobs. Note: this should be double coded under A5B3. • • State in the waste acceptance procedure what items are to be compared between the original manifest and the manifest that arrives with the shipment. Note: this should be double coded under A5B2. A4B4C02 – Progress / status of task not adequately tracked Definition: Supervision did not take the appropriate actions to monitor the task progress or status. Example: An employee was tasked to design and develop a new program and related information management system that would provide an assessment of team performance for the unit. The unit did not have any defined integrated process and application tool available to the supervisors and workers that could provide an assessment of the unit’s overall team performance. The supervisor did not have any experience with development of administrative systems, so he left the project to the employee. Working through the details and benchmarking with other groups, the employee presented the new program to the supervisory team, only to be criticized for its perceived complexity and exposure of performance information to the management team. Supervision did not take the appropriate actions to monitor the task progress or status of the overall task. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of the supervisory and technical task assignment, examining whether the task complexities exceeded the capability of the supervisor to perform supervisory duties. A4B4C03 - Appropriate level of in-task supervision not determined prior to task Definition: Supervision did not adequately assess the task for points of supervisory interaction prior to assignment to workers. Example: The work package for an evolution included full details on the work to be done, but did not expressly identify hold points for supervisory intervention. During his review, the supervisor scanned the work instructions, looking for safety problems and his ability to execute the task. He made a few notations to the planner about proper protective equipment, entering them on the Work Clearance Permit. However, the supervisor failed to note that, at one point in the evolution, the mechanics were being asked to make adjustments to an instrument. The supervisor failed to notify the planner to include a DOE G 231.1-2 Attachment 7 08-20-03 Page 35 hold point in the work package so that he could be contacted. The planner scheduled this job on a day when the supervisor who initiated the work package was on vacation. The stand-in supervisor performed a pre-job brief, but did not realize that the instrument adjustment needed a hold point. The work was completed without the needed supervisor’s check.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of supervisory methods/work practices, focusing on supervisory actions or decisions that are made without assessing the entire situation. A4B4C04 - Direct supervisory involvement in task interfered with overview role Definition: Supervision became so involved with the actual task steps that overall command and control were adversely affected. Example: During the installation of a new computer system, the immediate supervisor of the responsible crew became so interested in the technical installation of the central control unit that he started performing more of the technician duties. As a result, he was not as attentive to other members of his crew who were installing the auxiliary unit. Some important checks were missed on the auxiliary unit. Upon powering both units, the auxiliary unit failed to start, prolonging the completion of the task. Supervision became so involved with the details of the new system that they failed to maintain perspective on their overview role of the larger team performance picture. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review adequacy of supervisory methods, focusing on the supervisor’s necessary perspective. A4B4C05 - Emphasis on schedule exceeded emphasis on methods / doing a good job Definition: Accepted standards for methods were not met due to supervision's focus on completing the activity within a certain time frame. Example: A project called for renovation of two rooms in a facility. As part of the renovation, a new electrical panel was installed. The project was experiencing budget and scheduling pressures, and there was an urgency to turn over the project to the operations organization before the project funding was exhausted. As a result, a new electrical panel was never energized prior to turnover, and the normal startup testing was not conducted. When the electrical panel was energized for the first time, the breaker feeding it tripped immediately. It was discovered that the panel had been wired incorrectly by the contractor, but the fault was never found due to a lack of startup testing. Accepted standards for methods were not met due to supervision’s focus on completing the activity within a certain time frame. Emphasis on schedule exceeded emphasis on doing a good job. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Rewire affected panel. • Review implementation of supervisory methods and communications, focusing on supervisor’s not paying attention and/or taking shortcuts to secondary tasks or indications during a task of perceived tight schedule. A4B4C06 - Job performance and self-checking standards not properly communicated Definition: Supervision failed to adequately communicate how standards for job performance and self-checking could be applied to the actual job at hand. Example: A plant crew was scheduled to cut up a large piece of equipment using a plasma arc cutter for the first time. The first day’s activities proceeded with no problems, however, during an informal post-job review among some workers, the workers modified the assignment and sequence of setup steps to streamline the process. The only first day duty for the fire watch was to assure that the cutter was not in danger while cutting. During the second day, the fire watch set up the work area for cutting, including attaching the ground clamp to the piece to be cut and energizing the cutter. A rigger positioning the material to be cut removed the grounding clamp from the material and placed it on a

Attachment 7 DOE G 231.1-2 Page 36 08-20-03 metal cabinet where the energized cutter gun was resting. When the rigger looked up to locate the crane hook, he took a step back and contacted the box and the cutter gun. He apparently trapped the gun between the box and his thigh and depressed the trigger causing a pre-spark. The pre-spark slightly shocked the rigger and burned a hole through his Personal Protective Equipment and burned his leg. Supervision failed to adequately communicate how standards for job performance and self- checking could be applied to the actual job. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of supervisory methods in communicating adherence to job performance standards and reinforcing application of self-checking methods to the task at hand by the workers, particularly for workers not familiar with the task or associated job standards. A4B4C07 - Too many concurrent tasks assigned to worker Definition: Supervision failed to detect that concurrent job assignments for an individual exceeded the individual's abilities. Example: An engineering employee was responsible for multiple tasks, including the written preparation of lockouts. Other tasks included: design, development, maintenance and upgrade of a computer database system (used for multiple tasks in the facility); vice-chair of the facility Work Scope Review Team; scheduling of project tasks; chair of scheduling process improvement task team; point of contact for computer user support; and various ad hoc tasks assigned by management. As a result of this varied and heavy workload, the employee had developed and utilized a database containing historical lockouts for multiple items of equipment in the facility. During a lockout incident, the engineer re- used a similar, but not identical, lockout job, and, as a result, the work boundary was inadequate. Some of the equipment to be maintained was still energized when the mechanic tested it. Supervision failed to detect that concurrent job assignments for an individual exceeded the individual’s abilities. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review implementation of supervisory methods and work planning prioritization practices for appropriately assessing task assignment work load of employees. A4B4C08 - Frequent job or task “shuffling” Definition: Supervision transferred a worker from one task to another without adequate time to shift attention away from previous task. Example: Two Electrical & Instrumentation mechanics, one experienced and the other with less than two years experience, were completing a job to rewire a motor. The experienced mechanic was called away by the supervisor to perform some emergent work. He left verbal instruction with the new mechanic to ‘bump the motor’ for rotation to assure that they had connected it correctly for purposes of phase rotation. The new mechanic did as he was told, releasing the lockout and asking the operator to energize the motor. However, the mechanic did not realize that his partner had forgotten to tape the motor leads located inside the junction box in his haste of leaving for the emergent work. As a result, the leads were resting against the inside of the junction box causing a ground fault explosion when the operator energized the motor. Supervision transferred a worker from one task to another without adequate time to shift attention from the previous task.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Repair junction box/motor, as necessary. • Review implementation of supervisory methods and work practices, examining environmental conditions and/or work planning processes that contribute to work overload and handling multiple tasks simultaneously where committed actions are not successfully carried out. A4B4C09 - Assignment did not consider worker's need to use higher-order skills Definition: Supervision did not consider the worker's talents or innovative strengths that could be used to perform more challenging work. DOE G 231.1-2 Attachment 7 08-20-03 Page 37 Note: For mismatch with motivations, see A4B2C09. Example: In an internal reorganization, three degreed engineers were changed in their job function from ‘engineers’ to ‘specialists’. One of the engineers, successful as a start-up engineer, was tasked to perform coordinator duties for Installed Process Instrumentation (IPI) and Radiation Monitoring Equipment (RME) as a specialist. Although the employee performed these functions extremely well, his talents were dramatically underutilized. Another of the engineers eventually left the organization and found more challenging work in another department. The third engineer remained in place and created more challenging work by designing essential information systems for monitoring, tracking and measuring business performance. While the engineers filled ‘specialist’ work positions on the organization’s staffing chart, supervision did not consider their talents or innovative strengths that could be used to perform more challenging work. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Return remaining Engineers to engineering positions. • Review implementation of normal supervisory-human resource support processes and lack of teamwork culture that contribute to the under utilization of human resources. • Review adequacy of supervision to cultivate people, focusing on successor planning processes where task assignments have been made where the wrong people are assigned to the wrong jobs. A4B4C10 - Assignment did not consider effects of worker's previous task Definition: Supervision did not adequately assess the previous task's impact upon the worker's ability to implement the current task. Example: An operator had completed a decontamination job in a hot environment. After a short break in a cool area, the supervisor asked the operator to perform a procedure checking emergency battery-operated exit lights. The procedure required the operator to climb ladders in several cases to reach the lights. Although the supervisor had given the worker a rest period, and the emergency lights were all in air- conditioned areas, the effects of several hours’ work, coupled with inadequate water intake, led to heat cramps in the worker’s leg muscles. The cramps caused the worker to fall from a ladder during the emergency light checks, resulting in an injury. Supervision did not adequately assess the previous task’s impact upon the worker’s ability to implement the current task. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review supervisory work practices, focusing on supervisory actions or decisions that are made without assessing the mental and physical task demands and work environment factors with the capabilities and limitations of workers to identify potential mismatches.

• Review supervisory work practices where task complexity, scope or depth is underestimated and contingency planning is inadequate. A4B4C11 - Assignment did not consider worker's ingrained work patterns Definition: Supervision failed to assess the incompatibility between worker's ingrained work patterns and necessary work patterns for successful completion of the current task. Example: A materials storage project called for converting a crane maintenance area in a former production reactor to a warehouse type facility to accommodate storage of other nuclear material. Painters were assigned the task of preparing the Crane Wash Area (CWA) floor for future painting activities. Preparation activities included the use of a scabbler machine to remove a thin layer of paint from the floor. The painters attended one of three pre-job briefings to address scabbling activities and noted that Radiological Control Operations (RCO) personnel were originally assigned to the job but were absent during the pre-job brief. The painters requested respiratory protection but the supervisor explained that none was necessary due to the recent hazard analysis. The CWA had been posted as a Contamination Area based upon a complete hazard review of known radiological conditions. Because of the hazard review, RCO, Construction and Operations supervision decided that RCO coverage was Attachment 7 DOE G 231.1-2 Page 38 08-20-03 not needed during the work activity. After each day’s activities, the painters successfully exited through personnel contamination monitors. Upon completion of the work, RCO conducted surveys of the CWA in efforts to rollback the work area and discovered fixed contamination on the floor. No transferable contamination was discovered, although a survey of the bagged paint chips revealed some low-level contamination. The fixed contamination resulted in RCO re-posting the area as a High Contamination Area. Supervision failed to assess the incompatibility of the RCO work patterns in working with known radiological conditions versus RCO analysis of unknown radiological conditions resulting from the painters’ task. Supervision also failed to assess the incompatibility of the RCO response with the safety concerns expressed by the painters prior to the work activity. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review supervisory interface among organizations, focusing on formality of pre-job briefings, interface documents and communications and promptly resolving conflicts between individuals and work groups before, during and after the task starts. A4B4C12 - Contact with personnel too infrequent to detect work habit / attitude changes Definition: Supervision not aware of deviation from desired work habits/attitudes due to lack of interaction with personnel. Example: An operator, working on the back shift, was experiencing marital difficulties. While always a reliable, conscientious employee previously, this new distraction created a somewhat indifferent attitude towards work. Since the employee was working on the back shift, he was without supervision a significant portion of the time. As a result, the employee began completing round sheets without actually looking at the equipment. It went unnoticed for several weeks, until a particular instrument was tagged out of service, and the shift manager noticed that the employee had continued to report normal readings on the instrument. Supervision was not aware of the worker’s deviation from desired work habits due to lack of interaction.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Provide employee with information on Employee Assistance Program and refer employee. • Review adequacy of formal supervisory interface with team and workers, focusing on pre/post job briefings and other team and individual settings. • Review ability of supervisor to monitor and coach workers through firsthand observations, active listening and questioning techniques that reinforce expected behaviors and resolve emerging human performance problems. A4B4C13 - Provided feedback on negative performance but not on positive performance Definition: Worker's performance adversely affected by supervision's focus on negative performance feedback. Example: A mechanic frequently performed tasks ahead of schedule, with no safety incursions. His jobs were always of a high quality. However, his supervisor never reinforced this positive behavior. Because the mechanic worked 10-hour days, and the supervisor only worked 8 hours, they did not see each other at the end of the shift. They met in the morning for the pre-job toolbox meeting, and then the mechanic was essentially ‘on his own’ to complete the day’s tasks. As a result, there was little opportunity for reinforcement of good behavior at the end of the workday, and in the morning, the focus was always on the present day’s work, not a recap of the previous day. On one occasion, the mechanic made a mistake, resulting in a potential safety situation. A critique was held, in which it was determined that the employee was at fault for the oversight. The employee was given constructive discipline (time off without pay) for the mistake. After the incident, the employee’s attitude became one of avoiding punishment, not of earning rewards. As a result of the supervisor’s focus on negative feedback, the worker’s subsequent job performance was significantly affected. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review adequacy of supervisory behaviors that cultivate and facilitate excellence in human performance, facilitating open communications; promoting teamwork to eliminate error-likely situations and strengthen defenses; searching for eliminating organizational weaknesses that create conditions for error; reinforcing desired jobsite behaviors; and valuing the prevention of errors. DOE G 231.1-2 Attachment 7 08-20-03 Page 39 • Review the adequacy of management’s commitment to cultivating people, focusing on supervisory training designed to provide appropriate interpersonal skills and tools for supervisors. A4B5C01 -– Problem identification methods did not identify need for change Definition: Existing problem identification methods did not recognize the difference between actual practices and expectations. Example: A site maintained over 2500 active pressure vessels and over 5000 active pressure relief devices. The

pressure safety program, administered by the Pressure Equipment Protection Committee (PEPC), was responsible for the initial and continued adequacy of the site’s pressure equipment. Verification records were standard site documents used for systematic evaluation to determine the adequacy of pressure equipment for the intended service application. At the beginning of the year, approximately 25% of the total population of active pressure equipment did not have verification records, with some equipment having been in service for several years, some dating to the 1950’s. An extensive 1-year effort was undertaken to complete verification records for all pressure vessels and pressure relief devices. Major pressure protection inadequacies were discovered during the verification assessment. The PEPC had been in place for many years; however the original focus was on the structure and administration of pressure protection activities and not the technical aspects of pressure protection. Existing problem identification methodologies had not recognized the significant difference between actual unsatisfactory practices and equipment and corporate safety expectations. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Develop schedule to fix major pressure protection inadequacies. • Review organization-to-program evaluation process implementation, examining skills and knowledge of analysts performing evaluations, use of technology-based causal analysis, strength and weaknesses of observation/event solving teams to identify critical problem areas. A4B5C02 - Change not implemented in a timely manner Definition: A change in expectations was not realized in practices within an acceptable time period. Example: A site maintained over 2500 active pressure vessels and over 5000 active pressure relief devices. At the beginning of the year, approximately 25% of the total population of active pressure equipment did not have verification records, with some equipment having been in service for several years, some dating to the 1950’s. The corrective action plan involving major physical modifications that included: selection of new and relocation of existing pressure relief valves, regulators and valves; and resizing and rerouting of piping configurations. Execution of the modifications was based on the risk associated with the pressure protection design. Problems were broadly classified as either safety or non-safety concerns with safety concerns referring to personnel and equipment safety, not nuclear safety. Less than 5% of overpressure protection problems were categorized as safety concerns. These issues required immediate action to either resolve the issue or shut down the system. Non-safety problems did not pose an immediate safety concern and implementation of the corrective actions was handled through a 4-year program. In order to maintain a consistent approach to pressure protection designs, the development of a detailed and comprehensive pressure protection design guide was prepared. The guide finally put pressure protection expectations into practice, although the corporate safety expectations had been reinforced significantly during the past 12 years. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review management’s implementation of pressure protection regulatory implications. A4B5C03 - Inadequate vendor support of change

Definition: Management failed to adequately assess the ability of vendors to supply products or services in support of changing expectations for a particular objective. Attachment 7 DOE G 231.1-2 Page 40 08-20-03 Example: An operator performing routine rounds discovered a leak at a weld on the discharge line of a chemical process cell vaporizer of a Safety Grade Nitrogen System (SGNS). Subsequent radiographic examinations indicated that the welds at the inlet and outlet flanges of all 5 SGNS vaporizers (10 welds) did not meet ASME code requirements. The SGNS were procured as Level 2 “non-safety class” equipment and were upgraded to Level 1 “Safety Class” by the Commercial Grade Dedication (CGD) process. The “Safety Class” system was leased from the system supplier. The system supplier obtained the vaporizers (including inlet and outlet flanges and welds) from a vaporizer supplier who provided documentation that the welds were fabricated to ASME code as required. However, prior to delivery to the job site, the system supplier had the inlet flanges of the 5 vaporizers and associated welds replaced to allow proper connection to facility piping. There was no documentation to substantiate the system supplier modifications was in compliance with ASME code. Management failed to adequately assess the ability of the system supplier to sustain modified products in support of the changing expectations when the leased equipment was modified to meet critical criteria of the CGD package and the procurement specifications, both while in-process and after delivery to the job site. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Review vendor program and self-verification process, examining inspection and testing activities, sampling plans, technology-based review and verification processes, and oversight methodologies. A4B5C04 - Risks / consequences associated with change not adequately reviewed / assessed Definition: Elements of the process change were not recognized as having adverse impact or increased risk of adverse impact prior to implementing the change. Example: New waste regulations promulgated by the program office affected the packaging of all waste products generated by the facilities. The new requirements involved the characterization of ‘waste streams’, including isotopic distributions, to assure that the waste storage vaults in areas of the site would not exceed their permit limits. These requirements created some level of difficulty for process facilities, which was understood at the time. Program personnel were available to assist the larger operating facilities. However, due to the complex, variant nature of radioisotopes handled in laboratory environments and related facilities, the new regulations were virtually impossible for laboratories to meet. This situation resulted in over two years of waste buildup in the laboratories, while they struggled to determine waste streams for various laboratory modules and methods. The waste accumulations resulted in significant housekeeping and safety issues, along with violations of ALARA principles due to increased material holdup in the working spaces. Some waste streams are at risk of regulatory violations with state and federal agencies. Elements of the process change were not recognized as having an adverse impact or increased risk of adverse impact prior to implementing the change.

Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Request 12-month exemption to the regulations so waste streams at risk of exceeding the regulations can be dispositioned. • Review radioisotope handling procedures in affected laboratory environments and related facilities. Develop program changes that allow waste stream segregation to comply with new regulations. • Review implementation of regulatory implications processing, examining the adequacy of the organizational structure in preparing for new regulations and responding to new regulatory challenges. A4B5C05 - System interactions not considered Definition: Changes to processes or physical systems caused interactions with other processes or physical systems that had were not identified prior to implementation. Example: A non-safety class piping system was inadvertently routed over safety class electrical equipment. The designers did not take into account potential system interactions [failure of electrical components] from rupture of the piping system during a design basis earthquake. DOE G 231.1-2 Attachment 7 08-20-03 Page 41 Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Reroute the affected piping. Include cautions in the appropriate manuals warning of potential interactions. A4B5C06 – Personnel / department interactions not considered Definition: Changes to processes created new requirements for interaction between personnel or departments that were not considered in the implementation phase of the change. Example: New waste requirements were added to the facility’s workload due to reconfiguration of solid waste regulations. These new requirements involved verification of proper waste packaging by Generator Certification Officials (GCOs). While procedures were revised to promulgate the requirement, these interactions were not woven into the work planning process. As a result, significant job delays were due to the scheduling organization being unaware of the need to schedule GCO time for any job requiring waste removal. Changes created new requirements for interaction between personnel and departments that were not considered in the implementation phase of the change. Potential Corrective Actions: [these are only examples, it is not an exhaustive list] • Provide briefing to work planners concerning the new GCO requirements. • Add GCO to process loop for waste removal activities. Review management’s implementation of regulatory changes for this case, examining the adequacy of the organizational structure in preparing for new regulations and responding to new regulatory challenges. A4B5C07 - Effect of change on schedules not adequately addressed Definition: Changes to processes that resulted in scheduled changes had effects on personnel or equipment that were not addressed in the change implementation. Example: New waste requirements were added to the facility’s workload due to reconfiguration of solid waste regulations. These new requirements consumed significant man-hours in the identification of waste streams, training personnel, dealing with rejected waste cuts, and other issues. However, facility schedules continued to show work duration as though the requirements did not exist. Work management did not follow-up with waste personnel in determining what effect the change would have on jobs previously scheduled. As a result, several schedule failures occurred that could have been avoided by adjusting schedule requirements earlier. Changes to the schedule resulting from the new waste requirements were not addressed in the change implementation. Potential Corrective Actions: