DOE G 450.4-1, Vol 1, Integrated Safety Management System Guide,

THIS PAGE MUST BE KEPT WITH DOE G 450.4-1, INTEGRATED SAFETY MANAGEMENT SYSTEM GUIDE, REVISION 0. THE OFFICE OF ENVIRONMENT, SAFETY AND HEALTH (EH) HAS REQUESTED THAT THIS GUIDE BE ISSUED AND USED FOR AT LEAST SIX MONTHS FROM THE APPROVAL DATE IN ORDER TO OBTAIN MORE EXPERIENCE IN THE USE OF THIS GUIDE IN THE DEVELOPMENT OF SAFETY MANAGEMENT SYSTEMS. EH WILL THEN FORMALLY REQUEST ADDITIONAL COMMENTS AND FEEDBACK FOR USE IN A PLANNED REVISION TO THE GUIDE. CANCELE D DOE G 450.4-1 11-26-97 Volume 1 of 2 INTEGRATED SAFETY MANAGEMENT SYSTEM GUIDE for use with DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY, AND DEAR SAFETY MANAGEMENT SYSTEM CONTRACT CLAUSES Volume One: Guidance Assistant Secretary for Environment, Safety and Health CANCELE D Page ii - Safety Management System Guide - Volume 1 11-26-97 This page intentionally left blank. CANCELE D Volume 1 - Safety Management System Guide - Page iii Foreword 11-26-97 FOREWORD This DOE Guide is approved for use by the Office of Environment, Safety and Health (EH) and is available for use by all DOE components and their contractors. Revision 0 is an approved consensus document, which was coordinated by DOE/EH. It addresses comments received from throughout the Department during the July through September 1997 review period, and it has been reconciled with relevant sections of the Department of Energy Acquisition Regulation (the DEAR; 48 CFR Chapter 9) and DOE M 411.1, THE MANUAL OF FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES (the FRAM). These directives were approved and issued recently by DOE to convey integrated Safety Management System (SMS) requirements. In addition, several recent activities have provided new information for the Guide. These include: feedback from the integrated SMS implementation review activities at some of the 10 priority facilities; information on tailoring guidance developed by the Department’s Standards Process Action Team (SPAT) 13 Working Group; several DOE-wide meetings on authorization agreements and protocols; and a DOE-wide survey on worker protection. Although this Guide was developed largely as a result of initial experience in Safety Management at the 10 priority Defense facilities, the information is useful for implementation of integrated SMSs throughout the Department. Personnel from Defense and non-defense program offices and field sites participated in the development of this Guide as part of the Safety Management Implementation Team (SMIT). Experience has shown that once guidance originally developed for Defense Nuclear facilities is examined technically, it has been discovered to be beneficial when tailored appropriately for non-defense applications. This Guide provides guidance for addressing the requirements of DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY, and DEAR integrated SMS clauses promulgated in 48 CFR 970.5204-2, 48 CFR 970.5204-78, and 48 CFR 970.1001. Attachments 1 and 2 to Volume 1 contain the full text of the Policy and the relevant SMS sections of the DEAR. Volume 1 of this Guide addresses the following topics: • Introduction • Chapter I, Safety Management System Integration and Products • Chapter II, Discussion of Integrated Safety Management System Core Functions and Principles • Chapter III, Integrated Safety Management System Implementation Volume 2 of the Guide includes the following appendixes: Appendix A: Glossary Appendix B: Resources for Complying with the SMS Policy and the DEAR Appendix C: Development and Evaluation Guidance for an integrated SMS at a Hazard Category 2 Nuclear

Facility Appendix D: Discussion of Safety Management Assessment Appendix E: Integrated SMS Verification Team Leader Guidance CANCELE D Page iv - Safety Management System Guide - Volume 1 11-26-97 Foreword It is intended that this edition of the Guide be used for a significant time (at least 6 months) to obtain experience with its use during the development of integrated SMSs. The Department will then formally request comments and feedback for use in future editions. Information on integrated Safety Management is contained on the Safety Management Home Page (http://tis-nt.eh.doe.gov/ism). The Home Page includes this Guide, the Policy, and products from individual organizations, such as authorization agreements and functions, responsibilities, and authorities (FRA) documents. All products on the Home Page should be used FOR INFORMATION ONLY when developing organization-specific integrated Safety Management documents and should not be interpreted as the only satisfactory way to perform a function or task. Questions concerning the SMS Policy should be directed to Mr. Richard C. Crowe, Director, Safety Management Implementation Team, at 301-903-6214. Questions concerning administration or content of this Guide should be directed to Mr. Richard Stark at 301-903-4407. CANCELE D Volume 1 - Safety Management System Guide - Page v Contents 11-26-97 CONTENTS FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 CHAPTER I, SAFETY MANAGEMENT SYSTEM INTEGRATION AND PRODUCTS . . . . . . . . . . . . . 3 1. GENERAL ASPECTS OF INTEGRATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.1 Safety Management System Integration by Site, Facility, and Activity . . . . . . . . . . . . . . . . . . . 4 1.2 Integration of DOE and Contractor Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.3 Integration of Safety and Business Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.4 Integration by Risk and Hazard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.4.1 Integration of Risk (Worker, Public, and the Environment) . . . . . . . . . . . . . . . . . . . . . 8 1.4.2 Hazard Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2. INTEGRATED SMS DEVELOPMENT AND IMPLEMENTATION PROCESSES AND PRODUCTS10 2.1 Develop and Document the integrated SMS in Accordance with Requirements in the DEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.2 Review and Approve the Integrated SMS as Required by the DEAR and in Accordance with DOE Responsibilities in the FRAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.3 Verify the Integrated SMS Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.4 Monitoring and Annual Update of Integrated SMS Implementation in Accordance with Requirements in the DEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3. TAILORING THE INTEGRATED SAFETY MANAGEMENT SYSTEM . . . . . . . . . . . . . . . . . . 12 3.1 Why Tailor? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.2 What is Tailoring? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.3 Who Tailors? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 CHAPTER II, DISCUSSION OF INTEGRATED SAFETY MANAGEMENT SYSTEM CORE FUNCTIONS AND GUIDING PRINCIPLES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1. GUIDING PRINCIPLES 1, 2, AND 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.1 DOE Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.2 Contractor Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2. CORE FUNCTION 1, DEFINE SCOPE OF WORK, AND GUIDING PRINCIPLE 4, BALANCED PRIORITIES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.1 Describing the Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2.2 Determining the Level of Detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.3 Establishing Expectations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.4 Providing for Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.5 Establishing Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 3. CORE FUNCTION 2, ANALYZE HAZARDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 CANCELE D Page vi - Safety Management System Guide - Volume 1 11-26-97 Contents 4. CORE FUNCTION 3, DEVELOP/IMPLEMENT CONTROLS; GUIDING PRINCIPLE 5, IDENTIFICATION OF SAFETY STANDARDS AND REQUIREMENTS; AND GUIDING PRINCIPLE 6, HAZARD CONTROLS TAILORED TO WORK BEING PERFORMED . . . . . . . . 26 4.1 Identification of Appropriate Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 4.2 Sitewide Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 4.3 Facility-Specific Requirements [Identification of Appropriate Controls] . . . . . . . . . . . . . . . . . 29 5. CORE FUNCTION 4, PERFORM WORK, AND GUIDING PRINCIPLE 7, OPERATIONS AUTHORIZATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.1 Authorizing Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 5.1.1 Authorization Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 5.1.2 Authorization Agreement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 5.2 Sample Format and Content for Authorization Agreements . . . . . . . . . . . . . . . . . . . . . . . . . . 34

6. CORE FUNCTION 5, FEEDBACK/ IMPROVEMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 CHAPTER III, INTEGRATED SAFETY MANAGEMENT SYSTEM IMPLEMENTATION . . . . . . . . . . . 39 1. DOE IMPLEMENTATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 2. GENERAL GUIDANCE FOR INTEGRATED SMS DEVELOPMENT, IMPLEMENTATION AND REVIEW AT ALL FACILITIES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 3. REVIEW CONSIDERATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 3.1 Considerations for Core Function 1, Define Scope of Work and Guiding Principle 4, Balanced Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 3.2 Considerations for Core Function 2, Analyze Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 3.3 Considerations for Core Function 3, Develop/Implement Hazards Controls, Guiding Principle 5, Identification of Safety Standards and Requirements; and Guiding Principle 6, Hazard Controls Tailored to Work Being Performed . . . . . . . . . . . . . . . 43 3.4 Considerations for Core Function 4, Perform Work and Guiding Principle 7, Operations Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 3.5 Considerations for Core Function 5, Feedback and Improvement . . . . . . . . . . . . . . . . . . . . . . 45 3.6 Considerations for Guiding Principle 1, Line Management Responsibility For Safety, and Guiding Principle 2, Clear Roles and Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.7 Considerations for Guiding Principle 3 Competence Commensurate with Responsibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 ATTACHMENT 1, DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY . . . . . . . . . . . . . . . . . . 1-1 ATTACHMENT 2, DEPARTMENT OF ENERGY ACQUISITION REGULATIONS (DEAR) . . . . . . . . . 2-1 CANCELE D Volume 1 - Safety Management System Guide - Page 1 Introduction 11-26-97 INTRODUCTION PURPOSE. This Guide has two purposes. One purpose is to assist DOE contractors in developing, describing, and implementing an integrated Safety Management System (SMS) in compliance with DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY (the SMS Policy), and the following provisions of the Department of Energy Acquisition Regulation (DEAR): • 48 CFR 970.5204-2, which requires integration of environment, safety, and health into work planning and execution; • 48 CFR 970.5204-78, which deals with laws, regulations, and DOE directives; and • 48 CFR 970.1001, which requires performance-based contracting. Attachments 1 and 2 to Volume 1 contain the full text of the Policy and the relevant SMS sections of the DEAR. A second purpose of this Guide is to assist DOE line managers and contracting officers who– • review and approve integrated SMS products, • verify implementation of the integrated SMS, and • perform various integrating activities that complement the SMS. DOE responsibilities for these activities are provided for in DOE P 411.1, SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES POLICY, and are described in DOE M 411.1-1, THE MANUAL OF SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES (the FRAM).

This Guide cannot override or minimize the requirements of the SMS Policy, the DEAR, the FRAM, or other DOE regulations and requirements. It is not a prescriptive document but instead offers flexible guidance that complies with the requirements of Policy and law. Other practices that meet the intent of this Guide may be used. INTEGRATED SMS OBJECTIVE. The objective of an integrated SMS is to incorporate safety into management and work practices at all levels, addressing all types of work and all types of hazards to ensure safety for three sectors: the workers, the public, and the environment. To achieve this objective, DOE has established key guiding principles and core functions, which must CANCELE D Page 2 - Safety Management System Guide - Volume 1 11/26/97 Introduction be addressed in an integrated SMS. These principles and functions are set forth in the attached Policy and DEAR and are discussed in detail in this Guide. An effectively integrated SMS must address these principles and functions while considering the following: • the planning and performance of all types of potentially hazardous work, including construction, operation, and decommissioning, as well as design, conceptual studies, environmental analyses, safety analyses, and risk analyses; • all types of hazards, including chemical, occupational, environmental, nuclear, electrical, transportation, etc.; and • the identification, analysis, and control of hazards, and the use of feedback for continuous improvement in defining, planning, and performing work. For the purposes of this Guide, safety encompasses environment, safety, and health. Management and workers should understand that safety is an integral part of each work activity. Safety should be a prime consideration in the work practices of all personnel, including line management at the field office, corporate, and division levels, and program personnel at all management and working levels. INTEGRATED SMS PROCESS AND PRODUCTS. The DEAR specifies the following processes and products in developing and implementing an integrated SMS: • The contractor develops and documents the integrated SMS description, which may include provisions for reports on SMS performance. • DOE reviews and approves the integrated SMS description. • The contractor implements the integrated SMS, subject to DOE monitoring and verification. • The contractor provides an updated SMS annually. • DOE reviews and approves the updated SMS. APPLICABILITY. This Guide is provided to assist DOE line managers and contracting officials (referred to as contracting officers, heads of contracting authorities, or field element managers) in fulfilling their responsibilities, as specified in the SMS Policy, the DEAR, and the FRAM. This Guide is also provided to assist DOE contractors in fulfilling their responsibilities, as specified in the Policy and in the DEAR. CANCELE D Volume 1 - Safety Management System Guide - Page 3 Chapter I 11-26-97 DOE P 450.4, SAFETY MANAGEMENT SYSTEM, is contained in Attachment 1.1 The applicable clauses of the DEAR, 48 CFR Chapter 9, are contained in2 Attachment 2. CHAPTER I SAFETY MANAGEMENT SYSTEM INTEGRATION AND PRODUCTS DOE is responsible for ensuring that work performed at its sites is performed safely, and that hazards to the worker, the public, and the environment are minimized, mitigated, and controlled. To formalize this responsibility, DOE issued DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY (hereafter cited as the SMS Policy) on October 15, 1996. The SMS Policy1

specifies a formal, organized process based on key guiding principles and core functions for ensuring the integration of safety into all types of work, at all DOE sites and facilities, for all types of potential hazards. As a result of the SMS Policy, DOE subsequently issued the related Department of Energy Acquisition Regulation (48 CFR Chapter 9, the DEAR), on June 27,2 1997, which, with regard to integration, requires the following: • . . . The contractor shall ensure that management of environment, safety and health (ES&H) functions and activities become an integral but visible part of the contractor’s work planning and execution process. . . . [48 CFR 970.5204-2(b)] • . . . the System shall be integrated with the contractor’s business processes for work planning, budgeting, authorization, execution, and change control. [48 CFR 970.5204-2 (e)] DOE also issued DOE P 411.1, SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES POLICY, on January 28, 1997, and DOE M 411.1-1, MANUAL OF SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES (hereafter cited as the FRAM) on October 8, 1997. The DEAR describes integrated SMS responsibilities for both DOE and contractors; the FRAM provides functions and responsibilities for DOE. Section 1 of this chapter discusses the general nature of integration and Section 2 discusses the processes and products associated with the development and implementation of an integrated SMS. Section 3 of this chapter discusses the concept of tailoring integrated safety management systems. 1. GENERAL ASPECTS OF INTEGRATION In general, the development and implementation of an SMS involves integration of safety into all aspects of work planning and execution through the use of the guiding safety principles and core functions set forth in the SMS Policy. Integration means that all facets of work planning and CANCELE D Page 4 - Safety Management System Guide - Volume 1 11-26-97 Chapter I execution, including programs, organizations, and activities, are used to ensure that all relevant aspects of safety are addressed. This is especially important for programs and activities with conflicting or competing goals or requirements (e.g., fire protection and criticality safety, or personnel safety and safeguards and security). These aspects of integration are discussed in Sections 1.1 through 1.5 below. The processes for integrating an SMS include development, documentation, review and approval, implementation of the SMS, and authorization for operation. These processes generate a number of documents, products, and actions that are used to track and record the progress and success of the integrated SMS, as discussed in Section 2 of this chapter. The development of a management system for integrating safety with the work can be viewed from a variety of perspectives (i.e., by site, facility, or activity). Integrated SMSs can vary significantly among sites (even for similar activities), among facilities (even at the same site), and among activities (even within the same facility). They can differ in the nature of the hazard involved (nuclear, chemical, fire, industrial, environmental, and combinations of these potential hazards) and in the scope of the threat (local, sitewide, public, environmental, and combinations of these individuals and sectors). 1.1 Safety Management System Integration by Site, Facility, and Activity

In general, operating organizations use corporate, sitewide safety systems (e.g., fire protection and emergency planning), as well as specific facility and activity safety systems. Both DOE and the operating organization should review these systems to ensure adequacy with reference to SMS requirements while minimizing overlap and redundancy. Some of these systems are established at the site level for such health and safety issues as radiation protection, industrial hygiene, industrial safety, and emergency planning. Other systems, such as those for configuration management and conduct of operations, are more appropriately specified at a program or facility level. Still other systems, such as those for quality inspection, can be specified at the task level. All safety control measures, regardless of the level at which they are specified, must be implemented at the appropriate work level to achieve adequate safety. To ensure such implementation occurs, the integrated SMS must include processes for selecting and applying site and facility safety systems to use in developing work-specific control measures. Throughout the performance of work, all organization levels should be involved in developing, maintaining, and improving the controls that must be applied at the work level. Figure 1 illustrates how management personnel interact in an integrated SMS. Each of the circles represents a single organizational level, like that of the site, operating to carry out the five core CANCELE D Contract Define Institution Scope of Work Analyze Hazards for Institution Feedback & Improvement for Institution Identify Institution Standards & Requirements Work Output Perform Work Volume 1 - Safety Management System Guide - Page 5 Chapter I 11-26-97 Figure 1. An illustration of major interactions between organizational levels for the five SMS core functions. functions identified in the Policy. The integrated SMS also requires management at multiple levels to interact with one another. Complex activities are likely to require management at all levels to exchange information. In addition, establishment and implementation of an integrated SMS may require the reiteration of core functions in order to achieve a system that suits the work and its associated hazards. Individuals at all levels of the organization play a role in work planning and safety planning, as illustrated in Figure 1. The illustration shows the core safety functions as integrated activities at each level; that is, at the institution or site level, at the facility level, and at the activity level. At the facility and activity levels, workers (i.e., operational staffs) are important in identifying and CANCELE D Page 6 - Safety Management System Guide - Volume 1 11-26-97 Chapter I implementing controls and performing work. At the facility level, multiple activities are defined and the work is planned and integrated so as not to delay, interfere, or hinder other activities. The results of this lower-tier integration feed back to higher tiers in the line management chain for integration with other programs. At the institutional or facility level, the scope of work is defined using input from DOE (via contracts) and from the lower-level line managers and facility workers who have detailed knowledge of the work activities.

Figure 2 shows how sitewide activities overlay the facility, activity, and work for a Hazard Category 2 facility. Although the SMS Policy is the same for all facilities and activities, the contractors's safety control measures are tailored to the site, facility, and activity based on the hazards and work being performed. 1.2 Integration of DOE and Contractor Roles Another aspect of integration is the complementary nature of DOE and contractor responsibilities in ensuring integration of safety. Contractor responsibilities are typically defined in corporate policies and manuals, which are then adapted and delineated in more detail in the contractor’s integrated SMS description. DOE responsibilities, on the other hand, are described in the FRAM. Each line, support, oversight, and enforcement organization within DOE is responsible for establishing a lower-tier functions, responsibilities, and authorities (FRA) document specifying how their functions and responsibilities, as assigned in the FRAM, are to be properly discharged. The FRAM also provides an overview of the interfaces between DOE functions and those of operating organizations; that is, Government-Owned, Contractor-Operated (GOCO) facilities and Government-Owned, Government-Operated (GOGO) facilities. Such safety management responsibilities include budget management as well as the use of feedback from oversight and review functions. 1.3 Integration of Safety and Business Processes Another aspect of integration is the integration of safety planning with business processes, such as budget and resource allocation. A first step is to translate missions into work requirements in conjunction with the prioritization of budget and resources. By accomplishing the two tasks—work analysis and budget formulation—in tandem, DOE can more accurately estimate the funding required for safety analysis and control of hazards associated with the task. Both DOE and contractor line managers should take the lead in bringing safety expertise to bear in support of those programs/activities for which they are responsible [see DEAR 48 CFR 970.5204-2(b) and (e)]. CANCELE D SITE Quality Assurance Radiation Protection Emergency Planning & Preparedness Safety Analysis Reports . Engineered Controls . Safety Systems OSHA Standards OSHA Operational Safety Controls (OSCs) USQs .TSRs .Operational Limits (OLs) . OSCs . Inventory Limits . Facility Safety . Startup reviews Worker ProtectionSafety Functions & Responsibilities Occurrence Reporting & Follow-Up Surveillance & Monitoring . Dischargaes . Air . Water . Wastes Admin/Procedures Controls . Config. Mgt. . Maintenance . F&R . Personnel Selec & Trng . Waste Mgt/storage Admin/Procedural Controls . Safe Ops Practices . Special Work Permits . Rad Work Permits . Inventory Controls On-Site Transportation Safe Operations Practices (SOP) Technical Safety Requirements (TSRs) ES&H Reporting Volume 1 - Safety Management System Guide - Page 7 Chapter I 11-26-97 FIGURE 2. An illustration (derived from Defense Nuclear Facilities Safety Board Tech-16) of typical Safety Management programs and controls at various organizational levels for a Hazard Category 2 nuclear facility. CANCELE D Page 8 - Safety Management System Guide - Volume 1 11-26-97 Chapter I 1.4 Integration by Risk and Hazard

The integration process must also address all hazards and the possible risks these hazards may present to workers, the public, and the environment. Line management should ensure that contractors develop and effectively implement an integrated SMS tailored to the hazards of the work. Individuals responsible for engineering the processes (e.g., weapons assembly/disassembly, nuclear material fabrication/stabilization, criticality experiments, waste storage, hazardous waste cleanup, routine maintenance, pollution prevention, and waste minimization) should work with multidisciplinary teams who have direct responsibility for analyzing hazards, providing safety control measures derived from that analysis, and ensuring those measures are effective. Similarly, individuals responsible for operations should have direct responsibility for the safety of those operations and should be given the resources to implement the necessary controls. 1.4.1 Integration of Risk (Worker, Public, and the Environment). Hazards to various sectors largely originate in the same materials and processes. Although the controls are tailored to the considerations that apply to a particular sector, all controls must merge at the workplace; that is, all controls must be in place to support the work to be performed. Worker Safety. Key worker protection aspects include the following: • identification of existing and potential hazards of the workplace and evaluate the risk of associated injury or illness of workers; • communication of risk with the worker; • implementation of a process to ensure that all identified hazards are managed through a process of mitigation or control; • selection of hazard controls based on the following hierarchy: - engineering controls, - work practices and administrative procedures, and - personal protective equipment; • identification of Occupational Safety and Health Standards; and • implementation of radiological protection policy and practices based on the precept that radiological exposures for workers should be kept as low as reasonably achievable (ALARA). CANCELE D Volume 1 - Safety Management System Guide - Page 9 Chapter I 11-26-97 Public Safety Public protection is ensured in much the same manner as worker protection. DOE provides considerable guidance for the analysis and evaluation of both types of risks through its requirements for safety analysis reports (SARs) for nuclear facilities and operations or their equivalents for other types of facilities and operations (e.g., chemical and industrial activities). DOE has also established guidelines (including industry standards) for evaluating the adequacy of safety controls for workers. Guidelines should be established for contractors to use in evaluating the adequacy of safety controls designed to protect the public. Environmental Safety Techniques and methods consistent with the guiding principles and core functions to be addressed in an integrated SMS exist for dealing with environmental risks. Threats to the environment are generally addressed through environmental assessments (EAs) or environmental impact statements (EISs), which are required by NEPA (National Environmental Protection Act, 10 CFR 1021). In addition, environmental management systems (EMSs) used by the Federal government should be integrated with the integrated SMS. An EMS is that part of the overall management system that includes organizational structure, planning activities, responsibilities, practices, procedures, processes, and resources for developing, implementing, achieving, reviewing, and maintaining the environmental policy.

An EMS provides the structure by which specific activities can be carried out efficiently and in a manner consistent with key organizational goals; an EMS also allows an organization the flexibility to adapt the system to its needs and priorities. The EMS approach has its genesis in the same movement that created the “quality management” systems traditionally applied to manufacturing. The two predominant EMS systems are the Code of Environmental Management Principles for Federal Agencies (CEMP) and the ISO 14001. CEMP was developed by the Environmental Protection Agency (EPA) in response to Executive Order 12856, Federal Compliance with Right-to-Know Laws and Pollution Prevention Requirements, signed on August 3, 1993. EPA patterned the CEMP on the common critical elements of a comprehensive management system tailored to the environmental activities of an organization (i.e., an EMS). CEMP uses a construct of five broad principles and underlying performance objectives as the basis for Federal agencies to move toward responsible environmental management. CEMP principles help ensure environmental performance that is proactive, flexible, cost-effective, integrated, and sustainable. ISO 14001, developed by the International Organization for Standardization, provides a comparable EMS construct that is being implemented throughout the world. The elements of an EMS correspond to the guiding principles and core functions of an integrated SMS. CANCELE D Page 10 - Safety Management System Guide - Volume 1 11-26-97 Chapter I DOE is responsible for transitioning facilities from operational status to deactivation and eventual dismantlement or reuse. The characterization of hazards from residuals in such facilities and the establishment of controls to maintain safety during the interim must account for DOE responsibilities under the Atomic Energy Act. However, the controls should also be compatible with the subsequent transition to regulation by EPA and the States during the final disposition of facilities under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA, also known as the Superfund) and the Resource Conservation and Recovery Act (RCRA) (e.g., decommissioning of the plutonium concentration facility, 233-S, at Hanford). 1.4.2 Hazard Types. An integrated SMS should have similar and consistent processes for dealing with different types of hazards; that is, nuclear, chemical, and industrial hazards, and natural disasters. Such processes include analysis, development of technical or administrative controls, and implementation of any mitigating measures; for example, enhanced work planning, where permits issued by different groups are integrated at the activity level to preclude duplication of effort and to ensure a safe working environment. Further, processes involving multiple types of hazards should use worker/management teams with a variety of expertise to ensure that each type of hazard receives informed consideration. 2. INTEGRATED SMS DEVELOPMENT AND IMPLEMENTATION PROCESSES AND PRODUCTS DOE and the contractor should follow the steps below to develop, review, approve, implement, and monitor an SMS that is fully integrated with the work. a. The contractor develops and documents an integrated SMS in accordance with the requirements in the DEAR (48 CFR 970.5204-2) and guidance provided by the contracting officer. The integrated SMS description provides DOE and the contractor with an agreed-upon framework for safety management of contracted work.

b. DOE reviews and approves the integrated SMS documentation, in accordance with the DEAR and responsibilities specified in the FRAM. c. DOE verifies satisfactory integrated SMS implementation in accordance with the FRAM. d. On an annual basis, the contractor reviews and updates for DOE approval its safety performance objectives, performance measures, and commitments consistent and in response to DOE’s program and budget execution guidance and direction [48 CFR 970.5204.2(e)]. 2.1 Develop and Document the integrated SMS in Accordance with Requirements in the DEAR CANCELE D Volume 1 - Safety Management System Guide - Page 11 Chapter I 11-26-97 The process for developing and documenting an integrated SMS is specified in the DEAR, 48 CFR 970.5204. It includes the following provisions: • Contractors are to manage and perform work in accordance with a documented, integrated SMS that fulfills all conditions in 48 CFR 970.5204-2(b) and (c) at a minimum. Paragraph (b) of the clause describes the seven guiding principles of the SMS Policy. Paragraph (c) also lists the five core functions. • Contractors are to submit a description of its SMS to the contracting officer for review and approval. The contracting officer then establishes dates for submittal, discussions, and revisions to the SMS [per 48 CFR 970.5204-2(e)]. • The contractor-integrated SMS documentation is to describe how the contractor will perform the five core functions using the seven guiding principles [48 CFR 970.5204-2(c)]. In addition, the integrated SMS documentation is to describe how the contractor will establish, document, and implement safety performance objectives and performance measures and commitments in response to DOE program and budget execution guidance while maintaining the integrity of the integrated SMS. • The integrated SMS documentation shall also describe how the contractor will measure system effectiveness [48 CFR 970.5204-2(d)]. • The SMS is to be integrated with the contractor’s business processes for work planning, budgeting, authorization, execution, and change control [48 CFR 970.5204-2(e)]. The DEAR [48 CFR 970.5204-2(e)] requires the contract to include safety performance objectives and measures, which should cover both sitewide parameters (such as injury-caused lost days of work) and some specific program measurements (such as SAR approval). Because of the potentially broad application of performance measurement and the opportunity to share the results across programs and at all levels of management, the development of performance objectives and measures is an important integration activity. 2.2 Review and Approve the Integrated SMS as Required by the DEAR and in Accordance with DOE Responsibilities in the FRAM DOE personnel must review and approve integrated SMSs in accordance with the DEAR [48 CFR 970.5204-2(e)] and the FRAM. The FRAM has been organized in accordance with the Policy and the DEAR and addresses DOE responsibilities and authorities for each of the five core functions. 2.3 Verify the Integrated SMS Implementation DOE verifies implementation of the integrated SMS in accordance with the FRAM, while the contractor verifies implementation in accordance with its approved SMS description. This verification step is an effective process for ensuring the contractor’s integrated SMS is working as described in the integrated SMS documentation. CANCELE D Page 12 - Safety Management System Guide - Volume 1 11-26-97 Chapter I

2.4 Monitoring and Annual Update of Integrated SMS Implementation in Accordance with Requirements in the DEAR The DEAR requires the following: On an annual basis, the contractor shall review and update, for DOE approval, its safety performance objectives, performance measures, and commitments consistent with and in response to DOE’s program execution guidance and direction [48 CFR 970.5204.2(e)]. Work processes and organizational safety management performance should be continuously measured and evaluated to ensure that line management is aware of the contractor’s compliance with the documented SMS. Accordingly, DOE and contractor organizations perform management and independent assessments. These evaluations use quantitative and/or qualitative information obtained from a variety of sources (e.g., in-process monitoring, performance indicators, occurrence reports, trending, statistical analysis, management assessments, independent assessments, and workers, customers, suppliers, regulators, and stakeholders). Because such evaluations are conducted at all organizational levels, they contribute to the integration of the safety management. Improvement actions identified are shared with similar organizations and are tracked throughout implementation to determine whether they are yielding the anticipated improvements. Evaluation reports documenting the process followed, the results, and measurements indicating how successful the improvements have been are part of the safety management system. 3. TAILORING THE INTEGRATED SAFETY MANAGEMENT SYSTEM The following information on tailoring has been extracted using input to this Guide provided by the DOE Standards Process Action Team (SPAT) 13 Working Group on Tailoring. 3.1 Why Tailor? Because work can range in complexity and hazard potential from high hazard operations in major facilities to much simpler tasks, such as replacement of a contaminated component, DOE safety management directives are structured to apply to a variety of hazardous operations. In this context, tailoring is directed principally at developing safety controls fitted to the hazards and the work. Through tailoring, existing guidance and safety management processes can be selectively applied to planned work activities to meet applicable, enforceable requirements while maintaining adequate protection of health, safety, and the environment. Given the particular hazards involved in the work activities, tailoring may involve selective use of existing guidance to reduce the cost of compliance, or the development of additional controls or codes of practice from national consensus standards if the existing guidance is not adequate to ensure adequate levels of safety. Thus, tailoring is the tool by which line management departs from a one-size-fits-all approach to safety management, thereby focusing resources on activities that contribute meaningfully to health, safety, environmental protection, and production objectives. Because DOE work represents a broad range of complexity and hazard potential, tailoring safety management CANCELE D Volume 1 - Safety Management System Guide - Page 13 Chapter I 11-26-97 processes allows management to allocate resources according to risk potential, to maximize the efficiency and effectiveness with which the public, workers, and environment are protected.

The DEAR environment, safety, and health clause [48 CFR 970.5204-2(a)(6)] and the SMS Policy state explicitly that administrative and engineering controls to prevent and mitigate hazards shall be tailored to the work and associated hazards. To meet this requirement, DOE and contractor personnel at all levels should not only tailor their SMSs, but should also evaluate the effectiveness of their work management systems to continuously improve system performance. Work management systems must deal effectively with a full spectrum of work types and work activities. They must allow flexibility in planning, analysis, and work preparation, which, in turn, includes the tailoring of work controls to the work at hand. As a result, a successfully integrated SMS should ensure high quality work and compliance with predetermined performance expectations, ever mindful that work is to be conducted in an environmentally sound, safe, and healthy way. 3.2 What is Tailoring? Tailoring is an iterative work design process used during the planning and application of work management functions to scale expectations and acceptable performance to the needs of the site, activity, or facility and the work to be performed. • Applied to the five core functions (see Figure 3), tailoring creates a work management system that handles all types of work safely, efficiently, and cost-effectively. • Applied to hazards analysis, tailoring includes the selection of teams familiar with the work and hazards and the selection of hazards analysis methods suited to the work to result in a robust understanding of various risk sources. • Applied to controls, tailoring ensures that safety assurance measures increase in number and rigor as the potential for harm increases. • Applied to feedback and improvements, tailoring ensures the development of assessment data sufficient to support and confirm the safe performance of work; well-tailored assessments do not unduly intrude on or micro-manage the contractor’s work. Tailoring is dynamic and continuous; accordingly, integrated safety management presumes that work functions are continuously monitored and adjusted to meet changing mission, institutional regulatory requirements, and work conditions. 3.3 Who Tailors? Workers and managers in both small and large teams should use tailoring sensibly to arrive at a proper fit between safety management controls and the work and its associated hazards. Because tailoring centers on specific work, and thus requires informed judgment of the workers and CANCELE D Page 14 - Safety Management System Guide - Volume 1 11-26-97 Chapter I managers who are involved, DOE believes it is not appropriate to prescribe specific methods for tailoring. All DOE and contractor workers and managers are responsible for creating the process and environment necessary for achieving well-tailored management systems. DOE Headquarters and Field Offices have two primary responsibilities in the tailoring process: • to define mission goals and contract performance expectations, including requirements, and • to work with contractors to– - establish resource parameters and technical approaches so that work will safely and effectively carry out mission goals; - identify statutory, regulatory, and contractual requirements that apply to the work; and - evaluate the progress and success of the work. Contractors, in addition to working with DOE, have the added tailoring roles of–

• determining “how” work is actually conducted at all levels (site, project, activity, task); • selecting and implementing work controls to fit the work; and • effectively using resources to meet agreed-upon requirements. Given effective tailoring of work management, the Department can expect DOE site operations and contractors to establish work management systems that ensure safe and effective management of work in pursuit of DOE missions. Given effective tailoring of work management, contractors can expect that, so long as they meet statutory, regulatory, and contractual requirements, DOE Headquarters and Field personnel will allow them flexibility to manage work performance to fulfill DOE missions. For both DOE and the contractor, this expectation also requires the removal of roadblocks, especially at higher levels, and the elimination of activities with no benefit or with negative impact. CANCELE D Volume 1 - Safety Management System Guide - Page 15 Chapter II 11-26-97 Chapter II contains general discussions of the Core Functions and Guiding Principles. 3 Chapter III (in parentheses) provides review considerations regarding implementation of the Core Functions and Guiding Principles in an integrated SMS. CHAPTER II DISCUSSION OF INTEGRATED SAFETY MANAGEMENT SYSTEM CORE FUNCTIONS AND GUIDING PRINCIPLES This chapter describes the seven guiding principles and five core functions set forth in the SMS Policy and DEAR clauses. Attachments 1 and 2 contain the full text of the Policy and DEAR SMS clauses. The three guiding principles that relate to all core functions are discussed first. The remaining five sections in this chapter correspond to each of the five core functions and include discussions of related guiding principles that apply to the core functions (see Table 1 below). The four guiding principles that tie directly to three of the core functions are addressed in those sections. Table 1. Matrix Showing How and Where Core Functions and Guiding Principles are Addressed in this Guide Core Functions Guiding Principles Chapter and Section [See 48 CFR 970.5204-2(c).] [See 48 CFR 970.5204-2(b).] Number - 1. Line Management Responsibility II.1 (III.3.6)3 - 2. Clear Roles and Responsibilities II.1 (III.3.6) - 3. Competence per Responsibilities II.1 (III.3.7) 1. Define Scope of Work 4. Balanced Priorities II.2 (III.3.1) 2. Analyze Hazards - II.3 (III.3.2) 3. Develop and Implement 5. Identification of Safety Standards II.4 (III.3.3) Controls 6. Tailor Hazard Controls to Work 4. Perform Work 7. Operations Authorization II.5 (III.3.4) 5. Feedback and Improvement - II.6 (III.3.5) CANCELE D Analyze Hazards Perform Work Feedback/Improvement • Translate Mission into Work • Set Expectations • Prioritize Tasks and Allocate Resources • Identify and Analyze Hazards • Categorize Hazards • Collect Feedback Information • Identify Improvement Opportunities • Make Changes to Improve • Oversight and Enforcement • Confirm Readiness • Perform Work Safely DOE Direction Do Work Safely • Identify Standards and Requirements • Identify Controls to Prevent/Mitigate Hazards • Establish Safety Controls • Implement Controls Develop/Implement Hazard Controls Define Scope of Work Page 16 - Safety Management System Guide - Volume 1 11-26-97 Chapter II Figure 3. Relationship of the SMS Core Functions.

Figure 3 illustrates the conceptual relationship among the core safety management functions. These functions are not independent, sequential functions but instead, a linked, interdependent collection of functions that often occur concurrently. The output of each function can affect the results of each of the other functions and, potentially, the whole system. Work planning, for example, affects multiple functions several times before a plan is executed. For instance, hazards may be identified and eliminated during work planning, thereby reducing the potential for related accidents later. Similarly, assessment and feedback conducted at any time during the performance of one function can and should affect future planning. Generally, for complex sites or facilities, the five functions are conducted iteratively with the exchange of information progressing from a broad overview to detailed task descriptions. The reader of this Guide should, therefore, consider the core safety management functions as an integrated whole; however, for ease of presentation, the functions are discussed separately in this chapter. It is important to recognize the iterative character of SMS functions and the need to integrate specific activities within the functions. For example, an activity like training may be necessarily addressed in all five core functions. CANCELE D Volume 1 - Safety Management System Guide - Page 17 Chapter II 11-26-97 1. GUIDING PRINCIPLES 1, 2, AND 3 The following three guiding principles relate to responsibilities intrinsic in all five core functions and are therefore addressed here: • Line Management Responsibility for Safety, • Clear Roles and Responsibilities, and • Competence Commensurate with Responsibilities. These interrelated guiding principles help ensure the management structure has personnel who are focused on safety, understand their assignments, and are capable of carrying out the core safety management functions. The ultimate responsibility and accountability for ensuring adequate protection in the operation of DOE facilities, while meeting mission requirements, rests with DOE line management, as described below. This principle relies upon a chain of responsibility that extends from the Secretary, through DOE line management and contracting officers (COs), to contractor management and workers: • DOE, as described in the FRAM, assigns safety responsibility and authority to DOE and contractor line management. • DOE, as described in the FRAM, assigns safety support responsibilities to organizations outside of line management. • DOE and contractor line managers are responsible for integrating safety into work. • DOE and contractor line managers are responsible for ensuring competence of the workforces and their own line managers. 1.1 DOE Responsibilities The FRAM establishes the framework for managing those functions that are fundamental to safety management and that need to be performed consistently throughout the Department. In accordance with the first guiding principle, Line Management Responsibility for Safety, the FRAM specifies DOE safety management functions with clear lines of responsibility and authority that are necessary to– • define essential safety management functions, • ensure compliance with legal and contractual requirements, and • implement the standards necessary to provide reasonable assurance that workers, the public, and the environment are adequately protected. CANCELE D

Page 18 - Safety Management System Guide - Volume 1 11-26-97 Chapter II Line management includes any management level within the line organization that is responsible and accountable for directing and conducting work. Accordingly, line management (i.e., Secretarial Programmatic Officers and Field Managers) is responsible for ensuring operational safety and environment, safety and health (ES&H) compliance with requirements established by contract terms and conditions. The FRAM addresses DOE corporate-level functions, responsibilities, and authorities for DOE organizations responsible for overall direction of integrated safety for all DOE operations and facilities. The FRAM also describes roles and responsibilities for the direction-setting function of the Department that must precede application (i.e., implementation) of the safety management functions. Direction is set through strategic plans, mission statements, budget resource allocation, and the technical competence qualifications required of staff. Implementation details are addressed in lower-tier FRA documents, which are required by the FRAM Policy, DOE P 411.1, for each line, support, oversight, and enforcement organization within DOE. These lower-tier FRA documents specify how functions and responsibilities assigned in the FRAM are to be discharged, who has the responsibility and authority for those functions, and the specific disciplines and/or functional areas required to carry out the functions satisfactorily. The second guiding principle, Clear Roles and Responsibilities, builds upon the first by stating– Clear and unambiguous lines of authority and responsibility for ensuring safety shall be established and maintained at all organizational levels within the Department and its contractors. The FRAM establishes a continuous line of authority from the Secretary to the DOE interface with contractors by defining DOE roles and responsibilities for Headquarters and field element line management. The FRAM addresses the second guiding principle, Clear Roles and Responsibilities, as follows: • clearly delineate management and safety responsibilities for approving the contractor’s integrated SMS and other binding agreements that implement the SMS; • clarify the roles, responsibilities, lines of authority, and delegations between Headquarters and field organizations; • define functional relationships and responsibilities among DOE line, support, oversight, and enforcement organizations; and • address the coordination of line management direction from multiple program offices at a single site. The FRAM addresses the third guiding principle, Competence Commensurate with Responsibilities, by assigning each DOE element the responsibility for ensuring that its employees are qualified to perform their assigned functions. The Assistant Secretary for Human Resources and Administration (HR-1) is assigned responsibility for assisting DOE line managers in recruiting CANCELE D Volume 1 - Safety Management System Guide - Page 19 Chapter II 11-26-97 and retaining highly qualified technical personnel. In addition to the FRAM, other DOE directives provide direction for training and qualifying personnel; some are listed below: • DOE O 360.1, TRAINING, provides requirements for establishing, implementing, documenting, and evaluating training programs for Federal employees. • DOE O 541.1, APPOINTMENT OF CONTRACTING OFFICERS AND CONTRACTING OFFICER REPRESENTATIVES, specifies qualifications for contract officers.

• DOE 5700.6C, QUALITY ASSURANCE, establishes quality assurance objectives and requirements. The DOE Core Technical Group (CTG) has been established to support and supplement line management as needed for special issues or projects. This group consists of designated technical experts who may be used by DOE line organizations. 1.2 Contractor Responsibilities In accordance with the first guiding principle, Line Management Responsibility for Safety, contractor line management is responsible for ensuring that work is performed safely, in a manner that ensures adequate protection for employees, the public, and the environment. Line management includes those contractor and subcontractor employees managing or supervising employees performing work. The second guiding principle, Clear Roles and Responsibilities, builds upon the first by stating– Clear and unambiguous lines of authority and responsibility for ensuring safety shall be established and maintained at all organizational levels within the Department and its contractors. The DOE Quality Assurance rule (10 CFR 830.120) and DOE 5700.6C contain specific requirements for documenting the organizational structure, functional responsibilities, levels of authority, and interfaces for those managing, performing, and assessing the work. These details may be provided by reference to the contract, regulations, and other contractor-specific documents. The contractor’s integrated SMS organizational description should be sufficiently detailed to ensure the three guiding principles relating to responsibilities are implemented. The description should clearly define roles and responsibilities by specifying how contractor functions are to be carried out and identifying who has the responsibility and authority to carry out those functions. Note that the organizational description in the integrated SMS should not be so detailed that minor organizational or personnel changes would require revision of the integrated SMS. The organizational description section on contractor responsibilities should clearly demonstrate that line management has responsibility for safety. In addition, the organizational description CANCELE D Page 20 - Safety Management System Guide - Volume 1 11-26-97 Chapter II May also be called a “statement of work.”4 should indicate how responsibilities flow from the contractor’s senior management to the worker. Just as with DOE, the contractor emphasizes the flowdown of safety responsibilities through the chain of line management to the worker. In addition, the description should address contractor flowdown to subcontractors and suppliers, as required by DEAR 970.5204-2, as follows: Depending on the complexity and hazards associated with the work, the contractor may require that the subcontractor submit a Safety Management System for the contractor’s review and approval. In addition to requiring clear lines of responsibility and authority, DEAR 970.5204-2(b)(3) requires the contractor to ensure personnel possess the experience, knowledge, skills, and abilities that are necessary to discharge their responsibilities. Therefore, the contractor’s integrated SMS description should address the third guiding principle, Competence Commensurate with Responsibilities, by identifying the qualifications required for specific contractor positions.

Federal Acquisition Regulation (FAR) 15.605 and 41 USC 253a require that “evaluation factors” be used in selecting DOE contractors. FAR 15.605 also cites management capability and personnel qualifications as factors that must be evaluated. Accordingly, contractor management determines the basis for selecting individual qualifications for specific position/job responsibilities. Qualifications and capabilities are provided via position/job descriptions, resumes of key personnel, or other similar descriptions. The following directives contain information for ensuring that personnel have the necessary qualifications: • DOE 5480.20A, PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES; • DOE O 440.1, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES; and • DOE 5700.6C/10 CFR Part 830.120, QUALITY ASSURANCE. 2. CORE FUNCTION 1, DEFINE SCOPE OF WORK, AND GUIDING PRINCIPLE 4, BALANCED PRIORITIES DOE and the contractor identify and prioritize work and allocate resources. The contractor’s role is generally to translate broad missions into specific work packages. DOE provides performance expectations via strategic plans, goals, and objectives. A well-defined scope of work is critical to the success of an SMS because–4 • it sets the stage for the scope and depth of hazards identification/analysis, • it is the foundation for the budget formulation/allocation process, and CANCELE D Volume 1 - Safety Management System Guide - Page 21 Chapter II 11-26-97 • it is the primary factor in establishing expectations and accountability. A fundamental objective of Core Function 1, Define the Scope of Work, is to identify the scope, schedule, and costs of activities necessary to achieve DOE missions and expectations in a safe and environmentally sound manner. 2.1 Describing the Work To fulfill its operational responsibilities, line management must first determine the work to be performed. To do that, DOE and contractor line management organizations should have formal processes for translating DOE mission statements into a scope of work. These processes should be used to establish expectations for satisfactorily accomplishing the work, prioritizing tasks, and allocating resources. DEAR 970.5204-2(b)(4) requires resources to be effectively allocated to address ES&H, programmatic, and operational considerations to ensure that DOE attends to its most significant hazards first, in a cost-effective manner. In translating the mission and defining the work, DOE and contractor line management must prioritize resources to ensure that work and safety are integrated, and that sufficient resources are available for the safe conduct of work. Protecting workers, the public, and the environment is a priority in all work planning and performance. For that reason, when DOE line management and contract managers establish formal systems to integrate safety needs into all aspects of work, they should address risk- informed planning and resource allocation to meet regulatory requirements and control safety hazards.

At the Department or program level within DOE, work is generally defined in terms of broad mission objectives, major projects, key milestones, etc. At this level, DOE performance expectations (e.g., cost, safety, quality, schedules, etc.) address both the work processes and the work product and are described in DOE strategic plans, goals, and objectives and the contract. (Section 9.1 of the FRAM describes DOE’s development of strategic plans.) Within the safety management system established by DOE and its contractor organizations, a hierarchy of work planning processes should exist such that each successively lower tier provides an increasingly detailed description of the work to be performed. In this manner, broad DOE mission objectives are eventually translated into discrete tasks for contractor personnel to complete. DOE renders these descriptions into a formal scope of work through a variety of means, including the following examples: program execution guidance (PEG) documents, the Albuquerque Workload Planning Guide (AWLPG), the Nuclear Weapons Production and Planning Directive (P&PD), the Office of Environmental Management (EM) Ten Year Plan, and Project Data Sheets. 2.2 Determining the Level of Detail Between DOE and its contractors, it is extremely important to formally establish and clearly define the work to be performed, the priority assigned, and the expectations for completion. The level of detail required in a given scope of work should be commensurate with the importance of the work, its complexity, and the potential risk of the associated hazards. In some cases, the level of detail contained within the contract scope of work may be adequate for both parties to clearly understand what is to be performed. In other cases, a management and CANCELE D Page 22 - Safety Management System Guide - Volume 1 11-26-97 Chapter II operating contract for a large DOE site (e.g., the scope of work stated in the contract) may be expressed in broad, general terms. Whatever the case, the work scope should include those activities (such as fire protection, radiation protection, training, etc.) that support the control of hazards associated with the work. If the scope of work is highly dependent upon changes in mission or annual budgets, it may be necessary to adopt more formal means for clarifying the statement of work. For research and development work conducted in a laboratory environment, for example, the scope of work may be simple: to identify certain experiments to be performed and to require reports on the technical progress or results. But if additional detail is necessary, it can be provided through one or more documents formally required by the contract, such as the annual operating plan (AOP), project execution plan, implementation plan, award fee plan, ten-year plan, performance-based incentive, and activity description sheet (ADS). DOE Order 430.1, LIFE-CYCLE ASSET MANAGEMENT, establishes requirements for planning and planning approvals. Planning activities for decommissioning projects should be consistent with DOE and EPA memorandums of agreement. 2.3 Establishing Expectations

Internally, each contractor organization should have one or more methods for establishing expectations for satisfactorily accomplishing work, prioritizing tasks, and allocating resources, such as contractor project management system(s); site/facility/activity operational plans and budgets; work packages, job plans, and special work permits; and project management plans and work plans, which can include objectives, costs, and methods. The use of multidisciplinary teams, up-front hazard analysis, and control development can enhance the effectiveness of this activity. Again, the formality associated with such methods may depend upon the amount of work, its complexity, and the hazards. For complex hazardous activities, a detailed work plan may be warranted, using inputs from operational staff who follow written procedures that require verbatim compliance. For low hazard, simple activities, the method for establishing expectations may be much less formal; for example, simple verbal instructions provided by a supervisor to a worker may suffice for establishing a clear understanding of the work to be performed and how safety should be integrated with that work. 2.4 Providing for Integration The safety management system should integrate environment, safety, and health into the contractor’s business processes for work planning, budgeting, authorization, execution, and change control. This requires integration within each line organization and integration among the different organizational elements (e.g., legal, procurement, business administration, engineering, facility and laboratory management, etc.). Consistent with the guiding principles, some formal document should exist to establish clear lines of authority within each organization for defining the scope of work, including approval of subsequent changes. For contractors, this would typically be accomplished through a combination of company-level policies, charters established for organizational elements, and position descriptions. For DOE, the FRAM and the lower-tier FRA documents are the formal documentation that establishes clear lines of authority. In addition, ensuring that this integration flows down to the first line supervisors and workers can be accomplished by means of a single work permit that replaces several permits (i.e., radiological, CANCELE D Volume 1 - Safety Management System Guide - Page 23 Chapter II 11-26-97 confined space, hot work, etc.). This single document must include all hazard information and controls required by the individual permits while providing all information to the first-line supervisor and workers in a single document. 2.5 Establishing Priorities Irrespective of the organizational level (i.e., DOE Headquarters, DOE Field Element, contractor), methods should exist to ensure a proper balance among competing priorities of the organization (e.g., budget, schedule, safety, quality). In many cases there is a need to integrate into program work scopes those activities, such as fire protection, radiation protection, training, etc., that support or interface with other work activities. Each organization should have a process to reconcile any internal or external conflicts (i.e., over schedule, resource allocation, etc.) and to provide change control. Typically, these activities might be accomplished through the use of a senior management review committee or council within DOE or the contractor organization. In addition to Guiding Principle 4, Balanced Priorities, which demonstrates the Department’s focus on prioritization, DEAR 970.5204-2(b)(4) provides guidance for balancing priorities, as does DOE STD Project MISC-0002, Draft Guidelines for Risk-Based Prioritization of DOE Activities.

An integrated SMS should address a variety of options and tradeoffs to promote the safe completion of work. These tradeoffs include negotiating work scope, establishing performance objectives, identifying resources, selecting personnel, and adjusting schedules. The goal is to define work and allocate resources so that work is done safely and contributes to accomplishment of the DOE mission. Each work package should be clearly defined so that the sum of the work packages is necessary to accomplish the assigned mission. DOE O 130.1, BUDGET FORMULATION, and DOE O 135.1, BUDGET EXECUTION - FUNDS DISTRIBUTION AND CONTROL, address DOE budget formulation and execution activities. Contract performance measures are a key feature of performance-based contracting, which is required by 62 FR 34842 (which amends DEAR 48 CFR 970.1001). DOE Guide 120.1 gives guidance on contract performance measures. 3. CORE FUNCTION 2, ANALYZE HAZARDS The objective of hazards analysis is to develop an understanding of the potential for the hazard to affect the health and safety of the worker, the public, and the environment. Hazard controls are then established based on this understanding and other factors related to the work. The analysis includes two steps: (1) identifying and categorizing the hazard and (2) analyzing accident scenarios related to hazardous work. Categorization may address the character of the work [nuclear, chemical, thermal, electrical, and kinetic (motion)], and the magnitude of the hazard. Several other methods (e.g., checklist, “what-if,” HAZOP study, FMEA, etc.) are also suited to particular work environments and/or hazard magnitudes. DOE and its contractors have many acceptable ways of performing hazard analyses. For example, during work design, or in the early project planning stages, hazards may be identified and evaluated using broad, simple tools, such as checklists, that delineate hazards and assess the potential magnitude of the harm. At this stage, a simple hazard analysis can be sufficient as a tool CANCELE D Page 24 - Safety Management System Guide - Volume 1 11-26-97 Chapter II for design evaluation and design improvement. For nuclear facilities, the hazard analysis should be based on the direction in DOE 5480.23, NUCLEAR SAFETY ANALYSIS REPORTS, for identification of the safety-class and the safety-significant structures, systems, and components. This level of hazard analysis is then used as the foundation for more detailed analysis at the facility level, which in turn is used as the basis for the activity or task level hazard analysis. Two types of analysis method commonly used by industry for evaluating hazards at the facility and task level are the process hazard analysis (PHA) and the job hazard analysis (JHA). [See DOE O 440.1, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES and OSHA 29 CFR 1910.119, Process Safety Management (PSM) of Highly Hazardous Chemicals.] These hazard analyses are performed by experienced teams of hazard analysts, facility and systems engineers, process operators, and facility workers. For nuclear facilities, DOE has included the PSM process in its SAR preparation and review process through DOE Standard 3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, which also addresses worker participation in safety/hazard analysis preparations at this level. For environmental remediation and decommissioning hazardous waste work, the HAZWOPER requirements of 29 CFR 1910.120 and 1926.63 may be applied for hazard characterization. For those activities not covered by HAZWOPER, hazards analysis at the task (activity) level should be undertaken by multidisciplinary teams using standard techniques like those described in DOE G 440.1-1, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES GUIDE FOR USE WITH DOE O 440.1.

DOE has promulgated a number of directives (Policies, Rules, Orders, Notices, Standards, and Guides) that may be used for hazard analysis and hazard categorization. These include– • DOE 5480.23, NUCLEAR SAFETY ANALYSIS REPORTS; • DOE 5480.25, SAFETY OF ACCELERATOR FACILITIES; • DOE-STD-3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports; • DOE-STD-3011, Guidance for Preparation of DOE 5480.22 (TSR) and DOE 5480.23 (SAR) Implementation Plans; • DOE-EM-STD-5502, Hazard Baseline Documentation; • DOE-EM-STD-5503, Health and Safety Plan Guidelines; • DOE-STD-1027, Guidance on Preliminary Hazard Classification and Accident Analysis Techniques for Compliance with DOE Order, 5480.23, Safety Analysis Reports; and • DOE O 440.1, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES. CANCELE D Volume 1 - Safety Management System Guide - Page 25 Chapter II 11-26-97 Specific guidance has been drafted for safety management activities at facilities that are being deactivated or decommissioned. Draft DOE Standard, Integration of Safety and Health into Facility Disposition Activities (DOE STD 1120-97), provides guidance focused on the deactivation phase with respect to SMS Policy requirements for disposition activities. Such directives, when incorporated into a contract, establish the processes and expectations for contractor performance of hazards analyses. Note that, in addition, DOE has developed proposed regulations that correspond to existing DOE nuclear safety Orders. These proposed rules remain compatible with the integrated SMS and have provisions for implementation into SMSs. Requirements for hazards analyses to be performed to adequately protect the worker, the public, and the environment can also be found as statutory and regulatory requirements. Examples include 29 CFR 1910, 10 CFR 71, and 10 CFR 1021. Unless a DOE or contractor activity is specifically exempted or waived, such regulatory requirements are mandatory (see Attachment 2). Requirements for establishing processes and expectations for hazards analyses are also found in DOE 5480.23, which addresses nuclear facilities, and DOE O 5481.1B, which addresses non- nuclear facilities. DOE-STD-3009 has integrated the worker safety hazard review requirements of 29 CFR 1910.119 into the 5480.23 safety/hazard analysis and review process for identifying and understanding the hazards posed by those processes involving highly hazardous chemicals. DOE O 440.1 provides general worker protection requirements for all DOE operations and should be applied directly at the task or activity level. DOE G 440.1-1 provides specific guidance for undertaking exposure assessments at the worker task/activity level. DOE O 151.1, COMPREHENSIVE EMERGENCY MANAGEMENT SYSTEM, provides for comprehensive emergency management systems to accompany safety analysis. For decommissioning activities, 29 CFR 1910.120 and 29 CFR 1926.65 can be used to analyze hazards. Therefore, regulatory and contractual requirements applicable to the work (i.e., the set of safety standards and requirements) and the complexity and hazard of the work (i.e., scope of work) will dictate the methods used by a contractor to analyze hazards. This illustrates the importance of the relationship between the core functions of defining the scope of work and analyzing hazards, which will lead to Core Function 3, Develop and Implement Controls.

Regardless of the specific requirements and methods calling for different types of hazard analysis, each analysis should depend and build upon the others. In this way, activity hazard analyses can be totally integrated with site and facility level analyses (i.e., detailed hazard analyses performed for a specific work task may take into account the impact of the work on other areas of the site or facility, as well as how facility and site hazards affect the work task). As with all other aspects of the work, the level of management involvement in reviewing and approving the hazard analysis should be commensurate with the complexity of the work and the hazards entailed. For example, for activities involving nuclear hazards (e.g., Hazard Category 1, 2, and 3 nuclear facilities, as defined by DOE-STD-1027), DOE review and approval of the hazard analysis may be required. Such categorizing of facilities will aid in tailoring the DOE requirements and expectations to the work and hazards. Many DOE Orders use the hazard category to include or exclude specific requirements. For example, DOE 5480.23 for nuclear facilities excludes the requirement to address inadvertent criticality for Hazard Category 3 facilities as defined in DOE-STD-1027 CANCELE D Page 26 - Safety Management System Guide - Volume 1 11-26-97 Chapter II because such facilities do not contain sufficient fissile materials to present a criticality hazard. Similarly, the hazard category plays a significant role in DOE O 420.1, FACILITY SAFETY, relative to establishing seismic design requirements and seismic analysis requirements. 4. CORE FUNCTION 3, DEVELOP/IMPLEMENT CONTROLS; GUIDING PRINCIPLE 5, IDENTIFICATION OF SAFETY STANDARDS AND REQUIREMENTS; AND GUIDING PRINCIPLE 6, HAZARD CONTROLS TAILORED TO WORK BEING PERFORMED 4.1 Identification of Appropriate Standards After the associated hazards have been identified and before work is performed, hazard analysis should be used to develop appropriate controls and identify an applicable set of safety standards and requirements. Applicable standards are used to determine the minimum level of controls that must be put in place. Developing and implementing hazard controls at the site or facility level includes– • identifying applicable standards and agreed-upon sets of requirements (to the extent that appropriate requirements have not already been identified in the contractor’s manuals of practice), • identifying controls to prevent/mitigate hazards, • establishing boundaries for safe operations (establishing a safety envelope), and • implementing and maintaining configuration of controls [e.g., technical safety requirements (TSRs) and operational safety requirements]. Specific controls needed at the activity level are developed using the results of activity hazard analysis. The hierarchy of controls (i.e., engineering, administrative, and personal protective equipment) used at this level is the same as that used at higher management levels, which are applied in a risk-based manner. The controls developed, implemented, and maintained should be integrated with other controls and commitments, particularly those in sitewide safety programs, such as fire protection and radiation protection. In general, the use of administrative controls to address each hazard should be minimized where the effectiveness and value of engineering controls can be demonstrated.

The terms and conditions that define DOE safety expectations for its contractors are set forth as contract requirements. DOE has identified safety requirements in Rules and DOE Orders and has developed a wide variety of associated Technical Standards, Guides, and Manuals; in addition, DOE encourages the use of national consensus technical standards. Figure 4 illustrates how requirements flow down, through contractual requirements, to the contractor’s safety management program to form a standards-based integrated SMS. DOE approval of the contractor’s integrated SMS description and oversight of its implementation are fundamental to the Department in satisfying its own responsibilities for ensuring safety. Operation-specific controls, tailored to the hazards, to be mutually agreed upon by DOE and the contractor, become contractual terms and conditions for performing the work. CANCELE D Volume 1 - Safety Management System Guide - Page 27 Chapter II 11-26-97 DEAR 970.5204-78 requires the contractor to comply with the requirements of applicable Federal, State, and local laws and regulations (including DOE Regulations) in developing and implementing controls, unless relief has been granted in writing by the appropriate regulatory agency (List A). Additionally, the contractor must comply with the requirements of applicable DOE directives appended to the contract (List B). ES&H requirements appropriate for work conducted by a contractor may be determined using a DOE-approved process to (1) evaluate the work and the associated hazards and (2) identify an appropriately tailored set of standards, practices, and controls. When such a process is used, the set of tailored ES&H requirements, as approved by DOE pursuant to the process, shall be incorporated into List B as contract requirements with full force and effect. These requirements supersede, in whole or in part, the contractual ES&H requirements previously made applicable to the contract by List B. Approved processes for establishing ES&H requirements include– • incorporation of a Standards/Requirements Identification Document (S/RID) into the contract (per 90-2 Implementation Plan, Rev.5) and • use of the Work Smart Standards Processes (DOE M 450.3). Other DOE-approved processes may be used. Regardless of the method chosen, the contractor must select the appropriate set of controls to address the hazards. Appendix B lists helpful resources for complying with the SMS Policy and the DEAR. The DOE contracting officer must review the selected set for adequacy and approve the set selected for use by the contractor. CANCELE D REQUIREMENTS AND STANDARDS (THAT MUST BE SET OF ES&H REQUIREMENTS AND STANDARDS REGULATORY REQUIREMENTS W O R K P L N G M A I N T E N A N C E R A D C O N F I R E P R O T S A F E T Y D O C A S S E S S M E N T (HOW TO SATISFY REQUIREMENTS) FACILITY/ACTIVITY SCOPE OF WORK DEVELOP CONTROLS ANALYZE HAZARDS CONTRACTOR APPLIES IN PLANNING INDIVIDUAL SCOPES OF WORK SAFELY) Page 28 - Safety Management System Guide - Volume 1 11-26-97 Chapter II Figure 4. An illustration (derived from Tech-16) of the development and application of ES&H requirements in a standards-based safety management system. CANCELE D Volume 1 - Safety Management System Guide - Page 29 Chapter II 11-26-97 4.2 Sitewide Requirements

A multidisciplinary hazard analysis team composed of line management, health and safety professionals, and workers should tailor the set of standards that apply to the work at each management level. These standards should be commensurate with the hazards involved per Guiding Principle 5. To achieve this objective, DOE and contractor line management identify laws, statutes, and Federal regulations that apply. Such requirements are generally mandatory and non-discretionary for DOE and the contractor. However, exemptions may be obtained when necessary. DOE and contractor line management should establish (through the contract) additional requirements found in DOE directives and either DOE Technical Standards or national consensus standards. Whatever the approach, it should provide for DOE and contractor line management review and concurrence in the set of standards and requirements selected. The DOE contracting officer is responsible for ensuring that the set of requirements selected is sufficient to achieve an adequate level of safety. 4.3 Facility-Specific Requirements [Identification of Appropriate Controls] The safety management system should also identify engineering, administrative, and personal protective equipment controls imposed on the work, as derived from the agreed-upon set of standards and requirements. As with the set of standards and requirements, the derived controls should be tailored to the work and the associated hazards, in accordance with Guiding Principle 6. The controls should encompass all aspects of the work (including potential abnormal or emergency situations) and each phase of work performance (e.g., preparation, review, authorization, and execution). Emphasis should be on designing the work and/or controls to reduce or eliminate the hazards and to prevent accidents and unplanned releases and exposures [DEAR 48 CFR 970.5204-2(b)(6)]. Controls should be developed in a systematic manner at each management level and should address all relevant functional areas or disciplines of concern (e.g., quality assurance, fire protection, industrial safety, radiological protection, emergency preparedness, criticality safety, maintenance). The information developed for controls at each management level should be used as the basis for the next lower level of controls (i.e., site controls should be integrated with facility controls, which should be integrated with the controls applied to work at the task level). Controls should use inherently safe design aspects and should be based on defense in depth considerations. For nuclear facilities, DOE-STD-3009 provides guidance on inherently safe design measures and achieving adequate consideration of defense in depth aspects. Such controls should address preventive and mitigative considerations. Controls should also consider both passive and active aspects, as well as automatic versus manual operating needs. DOE Orders 5480.23, NUCLEAR SAFETY ANALYSIS REPORTS, and 5480.22, TECHNICAL SAFETY REQUIREMENTS, and corresponding DOE-STD-3009 provide guidance for nuclear facilities on establishing documented safety limits, limiting control settings, limiting conditions for operation, surveillance requirements, administrative controls, and design features that result from a disciplined safety analysis. DOE Order 5481.1B gives requirements and guidance for non-nuclear facilities. DOE Orders 452.1A and 452.2A (NUCLEAR EXPLOSIVE AND WEAPON SURETY and SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS, respectively) give corresponding guidance for DOE weapons facilities.

CANCELE D Page 30 - Safety Management System Guide - Volume 1 11-26-97 Chapter II Specific controls derived from the agreed-upon set of standards and requirements may take several forms: engineered controls, written procedures, or other administrative controls. The form selected for each control should be tailored to the hazard or importance of the desired attribute and, again, should be determined by line management responsible for the work based on safety/hazard analyses. The form of selected controls should also consider the knowledge, skills, and abilities of the work force. DOE and contractor agreement on the safety envelope is required as a condition for authorizing operations to proceed. Figure 5 shows the interconnection of DOE Rules and Orders that may be used to establish the safety envelope for nuclear facilities. Once a set of controls has been established, processes should be provided for maintaining work performance within the safety envelope established in the safety/hazard analysis. The processes should clearly identify the controls used to establish the safety envelope. Some processes used by contractors to achieve this objective include work packages, job plans, maintenance plans, and TSRs (nuclear facilities). A process to review, approve, and provide change control of the safety envelope should exist. 5. CORE FUNCTION 4, PERFORM WORK, AND GUIDING PRINCIPLE 7, OPERATIONS AUTHORIZATION DOE and the contractor confirm readiness to implement safety controls BEFORE starting to work. Once work begins, it is performed in accordance with those safety controls. Each contractor’s safety management system should have a process to confirm adequate preparation prior to authorizing the performance of work at the facility, project, or activity level. DEAR 970.5204-2(b)(7) requires that DOE and the contractor establish and agree upon the conditions and requirements that must be satisfied for operations to be initiated and conducted. These conditions and requirements are included in the contract and are therefore binding upon the contractor. The formality and rigor of the review process and the extent of documentation and level of authority for agreement should be based on the hazard and complexity of the work being performed. The process should ensure programs addressing all applicable functional areas are adequately implemented to support safe performance of the work. CANCELE D FACILITY ACTIVITY DOE Standard 1073-93 DOE Orders 4330.4B 5480.19 5480.20A 5820.2A DOE Orders 151.1 360.1 FRA documents DEAR DOE Orders 225.1 231.1 232.1 210.1 10 CFR 61 Subpart H 40 CFR 122 DOE Order 5400.5 29 CFR 1910.119 29 CFR 1910 10 CFR 830 10 CFR 835 10 CFR 708 DOE Orders 5480.21 5480.22 5480.23 5481.1B 420.1 425.1 440.1 452.1 452.2 5610.12 40 CFR 61 Subpart H 40 CFR 125 50 CFR 131 DOE Orders 5400.1 5400.5 10 CFR 830 10 CFR835 DOE Notice 441.2 DOE Orders 5480.19 5480.21 5480.22 5480.23 5480.24 5481.1B 5610.12 DOE Orders 430.1 460.1 460.2 DOE Order 5480.19 DOE Orders 420.1 440.1 452.1 452.2 29 CFR 1910 10 CFR 830 10 CFR 835 Volume 1 - Safety Management System Guide - Page 31 Chapter II 11-26-97

FIGURE 5. An illustration (derived from Tech-16) of applicable ES&H requirements at various organizational levels for a typical Hazard Category 2 nuclear facility. CANCELE D Page 32 - Safety Management System Guide - Volume 1 11-26-97 Chapter II For high-hazard operations (e.g., for the operation of a Hazard Category 1 or 2 nuclear facility), the process should clearly state whether an independent assessment of the readiness review, including a formal review and certification by DOE, is required. DOE O 425.1, STARTUP AND RESTART OF NUCLEAR FACILITIES, provides readiness guidance for nuclear facilities. The requirement for an independent assessment or DOE review should be established within the set of agreed-upon standards and requirements established for the scope of work. The process should provide for identification, evaluation, and resolution of deficiencies and recommendations made by internal or external oversight groups, review teams, and audit organizations. The process should ensure corrective actions are effective in establishing a state of readiness. Examples of methods used by DOE and contractors to confirm readiness include readiness assessments, operational readiness reviews (ORRs), and Title III inspections (project design). Guiding Principle 7 and the DEAR require conditions to be satisfied and established for operations to be initiated and operated. These agreed-upon conditions and requirements are requirements of the contract and binding upon the contractor. The extent of documentation and level of authority for agreement shall be tailored to the complexity and hazards associated with the work and shall be established in a Safety Management System [48 CFR 970.5204(b)(7)]. The QA Rule, 10 CFR 830.120, and DOE Order 5700.6C require work to be performed to established technical standards and controls. For certain sitewide systems and activities, such as fire protection, emergency planning, and operator training, readiness may be performed periodically. DOE Orders 5480.20A, PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES, 420.1, FACILITY SAFETY, and 460.1A, PACKAGING AND TRANSPORTATION SAFETY, and 10 CFR 835, RADIATION PROTECTION FOR OCCUPATIONAL WORKERS, provide guidance for sitewide programs involving nuclear operations. For nuclear facilities, DOE Order 5480.23 requires the development and description of facility initial testing programs, facility in-service surveillance programs, facility maintenance programs based on DOE 4330.4B (MAINTENANCE MANAGEMENT PROGRAM), conduct of operations programs that define worker communications, and activities based on DOE Order 5480.19 (CONDUCT OF OPERATIONS REQUIREMENTS FOR DOE FACILITIES). DOE O 430.1, LIFE-CYCLE ASSET MANAGEMENT, provides similar requirements for nonnuclear facilities. The safety management system should ensure that safety control measures that have been mutually agreed upon are integrated into work performance and that– • personnel are responsible and accountable for performance of work in accordance with the controls established; • the controls are adequate to ensure safe work performance and to prevent accidents, uncontrolled releases, or unacceptable exposures to hazardous materials; • the controls established for safety are a discernible part of the plan for work; and CANCELE D Volume 1 - Safety Management System Guide - Page 33 Chapter II 11-26-97

• the necessary safety support functions and interfaces required (e.g., training, maintenance, radiological protection, etc.) have been established. For nuclear facilities, DOE Order 5480.23 requires appropriate consideration of conduct of operations, emergency preparedness, fire protection, etc. Typically, contractors use a system of written Policies, Manuals, and procedures to ensure safety controls are integrated into work plans. Individual work plans, operating procedures, and maintenance procedures are often used to implement safety controls at the task level. Prejob briefings and walkdowns ensure workers understand the controls to be applied and allow an opportunity to correct hazardous conditions not previously noted. The safety management system should include a process to identify performance measures, including safety performance measures for the work as required by DEAR 48 CFR 970.1001 (see Attachment 2). 5.1 Authorizing Work DOE and the contractor should formally agree on the need for authorization agreements for those nuclear and significant hazard facilities necessary to perform work safely without any undue risk to the worker, the public, and the environment. The contractor's SMS description should clearly identify the role of the contractor and DOE in authorizing work at appropriate levels. Understanding DOE and contractor roles with respect to authorizing work and authorizing changes to the work is essential for successful implementation of the SMS. The following discussion on authorization protocol and authorization agreements provides elementary information and guidance for consideration in the development of contractor integrated Safety Management Systems. 5.1.1 Authorization Protocol The DOE FRAM, approved by the Secretary on October 8, 1997, defines authorization protocols as– Those processes used to communicate acceptance of the contractor's integrated plans for hazardous work. Such protocols are expected to range from preperformance review and approval by DOE of detailed safety-related terms and conditions for performing work (authorization agreement) to less rigorous oversight and postperformance assessment of the contractor's work. These protocols should be clearly delineated in the contractor's SMS description and should clarify the understanding and agreements between the contractor and the Department in performing hazardous work. CANCELE D Page 34 - Safety Management System Guide - Volume 1 11-26-97 Chapter II 5.1.2 Authorization Agreement An authorization agreement is a contractually binding agreement between DOE and the contractor for predetermined hazardous facilities, tasks or activities. The DOE FRAM defines an authorization agreement as– A documented agreement between DOE and the contractor for high-hazard facilities (Category 1 and 2), incorporating the results of DOE's review of the contractor's proposed authorization basis for a defined scope of work. The authorization agreement contains key terms and conditions (controls and commitments) under which the contractor is authorized to perform the work. Any changes to these terms and conditions would require DOE approval.

Authorization agreements would normally be required for nuclear Hazard Category 1 or 2 facilities. It may also include any other facilities or activities designated in the SMS description. The Department may determine that certain facility or project-level activities warrant an authorization agreement. When possible, this should be reflected in the contractors SMS description. The description should clarify which facilities, tasks, or activities identified require an authorization agreement. The description should also establish a process to trigger a review that determines the necessity of having (revising or eliminating) an authorization agreement. The authorization agreement incorporates the results of DOE's review of the contractor's proposed authorization basis for a defined scope of work. The authorization agreement contains key terms and conditions (controls and commitments) under which the contractor is authorized to perform work. These key terms and conditions must be clearly identified in the agreement and any changes to these key terms and conditions would require DOE approval. The SMS description and/or authorization agreement should delineate what key references DOE will approve versus what will be reviewed for information. Authorization agreements have been found to be useful for consolidating the basis for DOE determination to authorize operations by referencing key DOE and contractor authorization basis and assessment documentation into one document. Additionally, these agreements have been found to be beneficial to DOE and contractors for facilities being affected by significant changes in mission, those requiring significant upgrade for their authorization bases, and those undergoing decontamination and decommissioning. Authorization agreeements also minimize the amount of correspondence required between the contractor and the Department where agreements for routine tasks and activities, requiring approval at certain unique facilities, can be approved one time in an authorization agreement. 5.2 Sample Format and Content for Authorization Agreements The following sample format and content may be considered useful for inclusion. Like the numerous and varied Nuclear Regulatory Commission licenses, it is expected that the format and content of agreements will differ because of the unique and diverse facilities and activities in the complex. The agreement elevates the key terms and conditions (including the understanding of CANCELE D Volume 1 - Safety Management System Guide - Page 35 Chapter II 11-26-97 both the contractor and the Department) to conduct hazardous work in agreed-upon operating boundaries. 1. Scope of the Agreement This section should clearly describe the work being authorized and the facility or facilities where the work is to be performed. This should be consistent with the work analyzed in the authorization basis and the controls established. 2. DOE Basis for Approval This section should include the basis for DOE approval to perform the work and the basis for its conclusion that the work defined in the agreement can be performed without undue risk to the worker, the public, and the environment. This would include the key reviews and assessments that form the basis of DOE approval. Typical examples include DOE issuance of a SAR, review and approval of a SAR, review and approval of TSRs, operational readiness reviews or assessments, approval of the list of requirements required by the DEAR laws clause, and approval of the contractor's SMS description in accordance with the DEAR ES&H clause.

3. Listing of Documents that Constitute the Authorization Basis This section should include a summary listing of key documents such as SARs, the basis for interim operation, NEPA documentation including EIS, environmental permits, etc. 4. Terms and Conditions This section includes those specific items the contractor commits to perform and follow to ensure DOE that the authorized work will be performed safely. Key terms and conditions requiring DOE review and approval need to be clearly identified. This may include certain specific implementation procedures or manuals of practice. Other terms and conditions may only require DOE notification and review if deemed appropriate. Examples of terms and conditions include the following: • Controls identified in TSRs or TSR-like documents. Such controls would include controls established from hazard analyses and those derived from contractual requirements (i.e., List A and B from the DEAR laws clause). • Commitments to a configuration management program including an unreviewed safety question (USQ) or USQ-like process. • Commitments to a process for reporting noncompliances with established controls or terms of the authorization agreement. This process would include any special actions to be taken if an unplanned event were to occur. CANCELE D Page 36 - Safety Management System Guide - Volume 1 11-26-97 Chapter II • Any special conditions deemed necessary to be in the contract. NOTE: It is important to note that the agreement should be carefully written to avoid the need to revise the agreement whenever a key reference is updated. The authorization agreement should (1) make it clear what version of the referenced documents formed the bases for approval, and (2) specify whether DOE approval, concurrences, or review is required for future changes to such documents. Having to stop work and revise an authorization agreement every time a referenced document is updated or changed should be avoided. A review from the respective general counsel would probably prove beneficial since the agreement is, in effect, being added to the contract. 5. Contractor Qualification This section should make a positive statement about DOE's confidence in the contractor's ability to safely perform the work identified in the agreement. 6. Special Conditions This section should cover any other special conditions that DOE feels are necessary to make contractually binding in the agreement. Such conditions may include aspects of environmental management, safeguards and security, and protection of property. 7. Effective Date and Expiration Date (if it is to expire) This section would include the duration of the agreement and when it will be re-negotiated, reviewed, or extended. 8. Statement of Agreement This section would include signatures of the agreeing parties (DOE manager and contractor manager) and dates with the typed names below the signature line. 9. Exceptions (if required) This section would identify any specific exceptions or unusual circumstances that should be noted. For example, at Rocky Flats, authorization agreements might discuss appropriate liability and the understanding between DOE and the new contractor regarding less than fully analyzed bases for controls. CANCELE D Volume 1 - Safety Management System Guide - Page 37 Chapter II 11-26-97 EXAMPLES:

Examples of executed authorization agreements will be placed on the ISM home page (http://tis-nt.eh.doe.gov/ism). These examples should be used for information only and should not be interpreted as the only way to develop these agreements. Questions should be directed to the agreement originator or to the Director, Safety Management Implementation Team. 6. CORE FUNCTION 5, FEEDBACK/ IMPROVEMENT Work processes and organizational safety management performance should be routinely measured and evaluated to identify information that is meaningful to line management. Line management uses this information to confirm safe performance of the work and effective implementation of the SMS, and to identify improvement opportunities. These evaluations use quantitative and/or qualitative information obtained from a variety of existing and established sources (e.g., in- process monitoring, performance indicators, occurrence reports, trending, statistical analysis, management assessments, independent assessments, and workers, customers, suppliers, regulators, and stakeholders). Identified improvement actions should be shared with like organizations and tracked by management to determine whether they are yielding the anticipated improvements. Communicating the results of all levels of assessments upward in the contractor organization will allow the findings to reach the management level with the authority necessary to effect improvements. DEAR 970.5204-2(c)(5) requires the contractor to define its methods for providing feedback on the adequacy of controls and continuing to improve safety management. Most contractor organizations perform management assessments in accordance with the QA Order and Rule (DOE 5700.6C and 10 CFR 830.120, both titled “Quality Assurance”), which require managers to assess their management processes to identify and correct problems that hinder the organization from achieving its objectives. Applied at the institutional level, executive/senior management will determine whether the integrated SMS reflects how the corporation does work safely. To make this determination, these senior managers rely in part on the assessment results from facility managers and the institutional-level independent assessment body reporting to them. Management at the facility level will assess issues more closely related to operational safety performance. Such issues include determining that core safety functions have been applied to all normal/planned operations expected in the facility and that the guiding safety principles are applied to daily operations. Management assessments at the facility level can make extensive use of various forms of feedback data (e.g., DOE O 232.1, OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS INFORMATION) to plan and scope the assessment. A team comprised of facility and support services managers may be formed to evaluate shared/cross- cutting safety programs provided at the institutional/site level. This approach teams those managers and staff most knowledgeable about the shared program’s capabilities with those who rely on those safety features. Together, they can identify significant performance issues and improvements. To be free to focus on performance issues, facility-level management must be CANCELE D Page 38 - Safety Management System Guide - Volume 1 11-26-97 Chapter II assured that workers (and first line supervisors) are competent to routinely assess basic compliance with operating procedures that include hazard controls.

A well-integrated assessment program will give contractor senior management confidence in the effectiveness of the institutional integrated SMS. Another benefit of a comprehensive assessment program is increased confidence of the DOE line management and independent oversight organizations that contractors are able to perform the feedback and improvement function, thereby reducing the level of DOE line management oversight necessary (per DOE P 450.5, LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT) and mitigating Price Anderson Act enforcement penalties. Appendix D provides guidance for assessment programs that contribute to the integration of safety management with mission accomplishment, while giving line management maximum flexibility in program design. This guidance includes references to DOE and national standards for assessment programs, the use of the other feedback and improvement elements (e.g., performance indicators), and the assessment of specific safety programs and hazard controls (e.g., conduct of operations). CANCELE D Volume 1 - Safety Management System Guide - Page 39 Chapter III 11-26-97 CHAPTER III INTEGRATED SAFETY MANAGEMENT SYSTEM IMPLEMENTATION This chapter provides guidance on development, implementation, verification, and review of an integrated SMS. The guidance is based on the SMS Policy, the DEAR, the FRAM, and experience obtained during integrated SMS implementation activities at various facilities. 1. DOE IMPLEMENTATION The DEAR requires approved integrated SMSs for all DOE contracts. The DEAR ES&H clause (48 CFR 970.5204-2) requires the contractor to develop a description of its proposed integrated SMS and submit that description to the contracting officer for review and approval, as described in the FRAM. Successful implementation of an integrated SMS involves addressing all of the SMS core functions and guiding principles. The Head of the Contracting Activity and the DOE review staff (e.g., budget specialists, environmental, safety and health professionals, and other technical personnel) should use the review considerations in Section 3 of this chapter when reviewing the contractor’s SMS description. 2. GENERAL GUIDANCE FOR INTEGRATED SMS DEVELOPMENT, IMPLEMENTATION AND REVIEW AT ALL FACILITIES The following guidance has been developed to assist contractors in developing, implementing, and describing their integrated SMSs to satisfy the requirements of the SMS Policy, DOE P 450.4 (Attachment 1), and the DEAR, 48 CFR Chapter 9 (Attachment 2). This guidance will also be useful to the DOE line manager responsible for reviewing an integrated SMS and ensuring it is incorporated into the contract. This guidance is based on a number of documents: the SMS Policy, the DEAR, the FRAM, and the Draft Integrated Safety Management System Verification (ISMSV) Process, Team Leader’s Handbook (DOE-SAFT-0065). The ISMSV Handbook is being developed by DOE through DOE reviews of existing SMSs. Portions of this handbook are included in Appendix E. This chapter provides a list of considerations that the Head of Contracting Authority or other review personnel can use during contract preparations to focus discussions on the SMS guiding principles and core functions necessary to achieve an integrated SMS. Contractors should use these considerations to develop and implement SMSs that integrate appropriate contractor programs, procedures, controls, and initiatives affecting safety. In developing an integrated SMS, an audit of the existing safety management practices relative to these considerations will be useful to ensure the integrated SMS addresses all aspects of the guiding principles and core functions required in DEAR 970.5204-2.

The SMS description should describe how site, facility, and work/task hazard controls will be established based on an approved set of ES&H requirements (see 48 CFR 970.5204-78, CANCELE D Page 40 - Safety Management System Guide - Volume 1 11-26-97 Chapter III Attachment 2). The SMS description should identify the integrated environment, safety, and health management processes and programs that apply to site, facility, and work activities. Typical integration programs may include engineering support, fire protection, emergency preparedness, maintenance, environmental protection, waste management, industrial hygiene, occupational safety, chemical safety, radiological protection, training, and conduct of operations (including procedures). An SMS description should provide for the integration of environment, safety, and health into the contractor’s business processes for work planning, budgeting, authorization, execution, and change control. This requires integration within the line organizations and integration with the organizations supporting the line. The SMS should describe the flowdown of safety management to subcontractors. The operational implementation of an integrated SMS should then be demonstrated through a verification process, as required by the FRAM, and may use the guidance in DOE-SAFT-0065. The following considerations will assist a contractor in developing, evaluating, and implementing the SMS core functions and guiding principles. (See Chapter II, Sections 1 through 6, for more detail.) 3. REVIEW CONSIDERATIONS The considerations below focus on the five core functions and the seven guiding principles, as defined in the SMS Policy, that must be addressed in the contractor’s SMS, as required by the DEAR. DOE and its contractors should ensure that the integrated SMS is consistent with the objectives, guiding principles, and core functions discussed in this Guide. The acceptability of the level of detail given to each item in an integrated SMS should be based on the work and its associated hazards to ensure adequate protection for employees, the public, and the environment. Appendix C, which provides an example of considerations involving an integrated SMS for a Category 2 nuclear facility, provides specific references and guidance for developing and implementing an integrated SMS that meets the requirements of the SMS Policy and the DEAR. 3.1 Considerations for Core Function 1, Define Scope of Work and Guiding Principle 4, Balanced Priorities DOE establishes a set of processes to ensure that the scope of work is adequately reviewed and that interactions with the contractor proceed efficiently and effectively. a. Translate Mission into Work. An integrated SMS should include a process to identify the activities necessary to accomplish the assigned mission and a process to develop these activities into discrete tasks. DOE uses strategic plans, goals, objectives, and mission statements to define the contractor’s broad work assignments; the contractor in turn uses these assignments to prepare its work proposals (see Chapter II, Section 2.1). b. Set Expectations. An integrated SMS should include processes for establishing performance objectives that address safety objectives and the work assignments for CANCELE D Volume 1 - Safety Management System Guide - Page 41 Chapter III 11-26-97 the site. Such processes should include DOE budget execution guidance and employee performance review and appraisal (see Chapter II, Section 2.3).

c. Provide for Integration. The DEAR ES&H clause (48 CFR 970.5204-2) and DOE P 450.4 require that environment, safety, and health functions and activities be integrated into work planning and execution. Integration should be evident throughout all organizational functions at all organizational levels from the site to the individual activity. Chapter I, Section 1, provides detailed discussions of important considerations for proper integration. The following sections provide an outline of key integration elements for planning work: (1) An integrated SMS should invoke integrated environment, safety, and health management processes and procedures and/or programs that apply to site, facility, and work activities. Typical sitewide processes, procedures, and/or programs would include engineering support, fire protection, emergency preparedness, maintenance, environmental protection, waste management, industrial hygiene, occupational safety, chemical safety, radiological protection, and training. (2) An integrated SMS should establish clearly that it will be applied to all types of work and address all types of hazards. (See Chapter II, Section 2.4.) d. Prioritize Tasks and Allocate Resources. An integrated SMS should include processes for prioritizing and allocating work, as described in DOE Project MISC-002, Draft Guidelines for Risk-Based Prioritization of DOE Activities, or site-specific methods. Protecting the public, the workers, and the environment is always a priority in the planning and performance of work activities. Balancing priorities is particularly important when defining work, assessing hazards, identifying controls, and designing feedback and continuous improvement programs. Once a decision is made to accomplish a particular task, all the controls identified for that task are also necessary; as a result, the decision to do the work includes a prioritization decision to apply the necessary resources as defined by the agreed-upon controls (see Chapter II, Section 2.5). Note that each of the processes described above would generally be part of the contractor’s project management system, which would be used in defining operations plans, work plans, and budgets (see Chapter II, Sections 2.1 and 2.5). 3.2 Considerations for Core Function 2, Analyze Hazards Hazard analyses are performed at each organizational level—from the work defined in the sitewide mission statement (as in an EIS), to the processes at an individual facility (as in a SAR), to the individual operational or maintenance item contemplated within a facility (as CANCELE D Page 42 - Safety Management System Guide - Volume 1 11-26-97 Chapter III in a job task analysis or job hazard analysis). The objective of hazards analysis is to develop an understanding of the potential for a hazard to affect the worker, the public, and the environment and to develop a seamless hazard analysis covering the site, facility, and work task being performed. The selection of controls is then developed, in part, based on the hazard analysis. Each level of hazard analysis is used as the foundation for more detailed analysis; that is, a facility-level hazard analysis is used as the basis for the site level, which in turn is used as the basis for the activity or task-level analysis. a. Identify Hazards. An integrated SMS includes processes for identifying all types of hazards (nuclear, industrial, fire, external events, construction, etc.). The identification process would normally be tailored to the type of hazard (e.g., walk- throughs for industrial hazards), as well as to the magnitude of its risk.

b. Analyze Hazards. An integrated SMS includes processes for analyzing hazards. These processes implement DOE and other regulatory requirements (e.g., those addressed by DOE 5480.23, DOE 5480.25, 29 CFR 1910, 40 CFR, etc.) that apply to the type of hazard identified and the magnitude of its risk. c. Categorize Hazards. An integrated SMS should include a process for categorizing hazards, such as that defined in DOE-STD-1027 for nuclear facility operations. Revised DOE O 430.1, LIFE-CYCLE ASSET MANAGEMENT, and its associated guides, and Draft DOE-STD-1120-97 provide special hazard identification and analysis methods that apply to facility disposition activities. The hazard analysis method, level of detail, and resultant controls would be determined according to the hazard category (see Chapter II, Section 3). CANCELE D Volume 1 - Safety Management System Guide - Page 43 Chapter III 11-26-97 3.3 Considerations for Core Function 3, Develop/Implement Hazards Controls, Guiding Principle 5, Identification of Safety Standards and Requirements; and Guiding Principle 6, Hazard Controls Tailored to Work Being Performed Before work is performed, the associated hazards are evaluated and DOE and the contractor agree upon a set of ES&H requirements that, if properly implemented, will provide adequate assurance that the public, the workers, and the environment are protected. Figure 4 (Chapter II) illustrates the conceptual process for establishing sitewide ES&H requirements. a. Identify Standards and Requirements. (Core Function 3 and Guiding Principle 5). An integrated SMS should include processes to establish the set of ES&H requirements for the work consistent with the requirements of the DEAR (see Attachment 2). The process for identifying ES&H requirements should be one of the existing, accepted approaches, or it should be consistent with the objectives and concepts of these existing, accepted approaches (Chapter II, Section 4.1). If a method/approach other than an existing, accepted one is proposed, the contractor should provide a description for DOE review and approval. The use of applicable laws, statutes, Federal rules, national consensus standards, DOE directives, and DOE Technical Standards is described in Chapter II, Section 4.1. b. Identify Controls to Prevent/Mitigate Hazards. An integrated SMS should include a process for identifying and tailoring administrative controls, safety controls, safety programs, and other conditions that affect the work to be performed (Guiding Principle 6). The processes used should use information obtained in the hazard analysis and define the requirements for each phase or discrete task of the planned work (see Chapter II, Section 4.3). As with the hazard analysis, controls developed at the site level should be used as the basis for facility controls and those in turn used to develop controls at the work/task level. c. Establish Safety Controls. An integrated SMS should include a process to establish and document administrative controls, safety controls, safety programs, and other conditions that affect the work to be performed. An integrated SMS should include process(es) for establishing and maintaining the safety boundaries (safety envelope) for the work. Some contractors achieve this objective through the use of work packages, job plans, maintenance plans, and TSRs (which apply to nuclear facilities only) (see Chapter II, Section 4.3).

d. Implement Controls. An integrated SMS should provide a method to implement the controls identified at every level of work and hazard. The methods should provide assurance that the controls remain in effect so long as the hazard is present. CANCELE D Page 44 - Safety Management System Guide - Volume 1 11-26-97 Chapter III (1) An integrated SMS should include processes the contractor will use to implement administrative controls, safety controls, safety programs, and other conditions that affect the work to be performed. A method should be briefly described for translating these processes to the working level (“floor level”) controls used by workers performing the program work (see Chapter II, Section 4.3). (2) An integrated SMS should include processes (e.g., a personnel training and qualification program) to ensure that personnel are qualified to discharge their responsibilities satisfactorily (Guiding Principle 3) (see Chapter II, Section 1). 3.4 Considerations for Core Function 4, Perform Work and Guiding Principle 7, Operations Authorization a. Confirm Readiness. An integrated SMS should include a process to confirm that the facility or process and the operational work force are in an adequate state of readiness prior to authorizing the performance of the work [e.g., Guiding Principle 7, readiness assessments, ORRs, Title III inspections (project design), etc.]. (See Chapter II, Section 5.) The processes should ensure that– • personnel are qualified and trained for performance of work in accordance with the controls established (Guiding Principle 3) (Chapter II, Section 1); • controls are adequate to ensure safe work performance and to prevent accidents, uncontrolled releases, or unacceptable exposures to hazardous materials (Chapter II, Section 5); • the necessary safety support functions and interfaces required (e.g., training, maintenance, radiological protection, etc.) have been established (Chapter II, Section 5); and • the operability of the necessary facility or process systems required for safe operation has been verified in accordance with the bases established in appropriate authorization agreements. b. Operations Authorization. An integrated SMS should provide for gaining authorization to conduct operations. Provisions should be included to grant operations authorizations for each level of effort at the site, facility, activity, or process. Such provisions or procedures may include an ORR, approval to resume operations following a weekend shutdown, and authorization to start individual procedures or work items using controls such as work clearance permits, shift orders, or shift manager’s control. An integrated SMS should also provide for updating and configuration control for the operations authorization documentation, such as authorization agreements, permits, SARs, etc. (See Chapter II, Section 5.) CANCELE D Volume 1 - Safety Management System Guide - Page 45 Chapter III 11-26-97 c. Perform Work Safely An integrated SMS should include processes for ensuring that safety requirements are integrated into work performance (e.g., via work practices and floor level procedures, described in Section 3.3.d(1) above). Processes should be adequate to ensure that work is performed within the controls that have been developed and implemented. Controls may include site or facility commitments, such as conduct of operations and maintenance programs; worker safety programs; specified engineered safety systems; or specific controls in worker safety permits. The controls may be specified in site-level programs or facility- specific authorization bases documents. An integrated SMS should include provisions to ensure that ongoing work continues to be performed within the specified and agreed-upon controls. The processes should ensure that—

• personnel are responsible and accountable for performance of work in accordance with the controls established (Chapter II, Section 1), and • the controls established for safety are a discernible part of the plan for work. d. Performance Measures. An integrated SMS should include a process to identify performance measures, including safety performance measures for the work (see Section 3.1.b above and Chapter II, Sections 5 and 6). The performance measures should— • provide information that is truly a direct indicator of how safely the work is being performed, • be clearly linked to the performance objectives and expectations, and • be performance based. 3.5 Considerations for Core Function 5, Feedback and Improvement All aspects of an integrated SMS should be subject to continuous improvement through an assessment and feedback process, which should function at each level of work and at every stage in the work process. The feedback/improvement process includes the following: • Feedback information on the adequacy of controls is gathered. • Opportunities for improving work execution and planning are identified and implemented. • Line and independent oversight is conducted. • If necessary, regulatory enforcement actions occur. CANCELE D Page 46 - Safety Management System Guide - Volume 1 11-26-97 Chapter III a. Collect Feedback Information. An integrated SMS should include processes for operational safety, such as self assessment, monitoring against performance objectives, occurrence reporting, and routine observation. The processes should include line management and worker feedback as well as independent oversight (see Chapter II, Section 6, and Appendix D). b. Identify Improvement Opportunities. An integrated SMS should evaluate feedback and oversight information. Such an evaluation should include processes for translating this operational information into recommendations for improvement and processes for translating lessons learned both onsite and from other sites into recommendations for improvement. An integrated SMS description should include a worker suggestion program for improving safety. c. Make Changes to Improve. An integrated SMS should contain processes for management to consider and dispose of recommendations for improvement, including worker suggestions. The description should illustrate the process for translating feedback from assessments, lessons learned programs, external oversight and enforcement, and other inputs into improvements. d. Oversight and Enforcement. An integrated SMS should include processes for oversight by contractor management. Interfaces for communication with external oversight organizations should be indicated (for example, EPA, OSHA, DOE Office of Oversight, etc.). 3.6 Considerations for Guiding Principle 1, Line Management Responsibility For Safety, and Guiding Principle 2, Clear Roles and Responsibilities At every level of control, line management must be responsible for safety; therefore, clear and unambiguous roles and responsibilities should be defined and maintained at all levels within the organization defined by the integrated SMS description. All aspects of work identification, planning, and execution must be under the control and responsibility of line management. Support organizations, such as ES&H or Human Resources, must have clearly defined roles and responsibilities that ensure work is performed safely within the clearly defined principle that line management is responsible for safety (see Chapter II, Section 1).

3.7 Considerations for Guiding Principle 3 Competence Commensurate with Responsibility All organizations and activities within the integrated SMS should be evaluated to ensure that personnel have the experience, knowledge, skills, and abilities necessary to discharge their assigned responsibilities. Accordingly, the integrated SMS description should establish core competencies for support and line personnel—workers as well as managers. In addition, the integrated SMS description should provide for programs to define personnel performance expectations, provide training, and evaluate performance to determine whether expectations are met (see Chapter II, Section 1). CANCELE D Volume 1 - Safety Management System Guide - Page 47 Chapter III 11-26-97 This page intentionally left blank. CANCELE D Volume 1 - Safety Management System Guide - Page 1-1 Attachment 1 11-26-97 ATTACHMENT 1 DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY CANCELE D Page 1-2 - Safety Management System Guide - Volume 1 11/26/97 Attachment 1 This page intentionally left blank. CANCELE D Volume 1 - Safety Management System Guide - Page 1-3 Attachment 1 11-26-97 DISTRIBUTION: INITIATED BY: All Departmental Elements The Office of Environment, Safety and Health DOE P 450.4 U.S. Department of Energy POLICY Washington, D.C. 10-15-96 SUBJECT: SAFETY MANAGEMENT SYSTEM POLICY PURPOSE AND SCOPE Safety Management Systems provide a formal, organized process whereby people plan, perform, assess, and improve the safe conduct of work. The Safety Management System is institutionalized through Department of Energy (DOE) directives and contracts to establish the Department-wide safety management objective, guiding principles, and functions. The system encompasses all levels of activities and documentation related to safety management throughout the DOE complex. The objective of this policy is achieved by other means for Naval Reactors (Naval Nuclear Propulsion Program). Throughout this policy statement, the term safety is used synonymously with environment, safety and health (ES&H) to encompass protection of the public, the workers, and the environment. POLICY The Department is committed to conducting work efficiently and in a manner that ensures protection of workers, the public and the environment. It is Department policy that safety management systems described herein shall be used to systematically integrate safety into management and work practices at all levels so that missions are accomplished while protecting the public, the worker, and the environment. Direct involvement of workers during the development and implementation of safety management systems is essential for their success. The DOE safety management system establishes a hierarchy of components (see figure 1) to facilitate the orderly development and implementation of safety management throughout the DOE complex. The safety management system consists of six components: 1) the objective, 2) guiding principles, 3) core functions, 4) mechanisms, 5) responsibilities, and 6) implementation. The objective, guiding principles, and core functions of safety management identified below shall be used consistently in implementing safety management throughout the DOE complex. The mechanisms, responsibilities, and implementation components are established for all work and will vary based on the nature and hazard of the work being performed. CANCELE D Page 1-4 - Safety Management System Guide - Volume 1 11-26-97 Attachment 1

2 DOE P 450.4 10-15-96 COMPONENT 1 Objective of Integrated Safety Management The Department and Contractors must systematically integrate safety into management and work practices at all levels so that missions are accomplished while protecting the public, the worker, and the environment. This is to be accomplished through effective integration of safety management into all facets of work planning and execution. In other words, the overall management of safety functions and activities becomes an integral part of mission accomplishment. COMPONENT 2 Guiding Principles for Integrated Safety Management The guiding principles are the fundamental policies that guide Department and contractor actions, from development of safety directives to performance of work. Line Management Responsibility for Safety. Line management is directly responsible for the protection of the public, the workers, and the environment. As a complement to line management, the Department's Office of Environment, Safety and Health provides safety policy, enforcement, and independent oversight functions. Clear Roles and Responsibilities. Clear and unambiguous lines of authority and responsibility for ensuring safety shall be established and maintained at all organizational levels within the Department and its contractors. Competence Commensurate with Responsibilities. Personnel shall possess the experience, knowledge, skills, and abilities that are necessary to discharge their responsibilities. Balanced Priorities. Resources shall be effectively allocated to address safety, programmatic, and operational considerations. Protecting the public, the workers, and the environment shall be a priority whenever activities are planned and performed. Identification of Safety Standards and Requirements. Before work is performed, the associated hazards shall be evaluated and an agreed-upon set of safety standards and requirements shall be established which, if properly implemented, will provide adequate assurance that the public, the workers, and the environment are protected from adverse consequences. Hazard Controls Tailored to Work Being Performed. Administrative and engineering controls to prevent and mitigate hazards shall be tailored to the work being performed and associated hazards. Operations Authorization. The conditions and requirements to be satisfied for operations to be initiated and conducted shall be clearly established and agreed-upon. COMPONENT 3 Core Functions for Integrated Safety Management These five core safety management functions provide the necessary structure for any work activity that could potentially affect the public, the workers, and the environment. The functions DOE P 450.4 3 CANCELE D Volume 1 - Safety Management System Guide - Page 1-5 Attachment 1 11-26-97 10-15-96 are applied as a continuous cycle with the degree of rigor appropriate to address the type of work activity and the hazards involved. Define the Scope of Work. Missions are translated into work, expectations are set, tasks are identified and prioritized, and resources are allocated. Analyze the Hazards. Hazards associated with the work are identified, analyzed and categorized. Develop and Implement Hazard Controls. Applicable standards and requirements are identified and agreed-upon, controls to prevent/mitigate hazards are identified, the safety envelope is established, and controls are implemented. Perform Work within Controls. Readiness is confirmed and work is performed safely.

Provide Feedback and Continuous Improvement. Feedback information on the adequacy of controls is gathered, opportunities for improving the definition and planning of work are identified and implemented, line and independent oversight is conducted, and, if necessary, regulatory enforcement actions occur. COMPONENT 4 Integrated Safety Management - Mechanisms Safety Mechanisms define how the core safety management functions are performed. The mechanisms may vary from facility to facility and from activity to activity based on the hazards and the work being performed and may include: Departmental expectations expressed through directives (policy, rules, orders, notices, standards, and guidance) and contract clauses. Directives on identifying and analyzing hazards and performing safety analyses. Directives which establish processes to be used in setting safety standards. Contractor policies, procedures and documents (e.g., Health and Safety Plans, Safety Analysis Reports, Chemical Hygiene Plans, Process Hazard Analyses) established to implement safety management and fulfill commitments made to the Department. COMPONENT 5 Responsibilities for Integrated Safety Management Responsibilities must be clearly defined in documents appropriate to the activity. DOE responsibilities are defined in Department directives. Contractor responsibilities are detailed in contracts, regulations and contractor-specific procedures. For each management mechanism employed to satisfy a safety management principle or function, the associated approval authority needs to be established. The review and approval levels may vary commensurate with the type of work and the hazards involved. 4 DOE P 450.4 CANCELE D Page 1-6 - Safety Management System Guide - Volume 1 11-26-97 Attachment 1 10-15-96 COMPONENT 6 Implementation of Integrated Safety Management Implementation involves specific instances of work definition and planning, hazards identifications and analysis, definition and implementation of hazard controls, performance of work, developing and implementing operating procedures, and monitoring and assessing performance for improvement. CANCELE D Volume 1 - Safety Management System Guide - Page 1-7 Attachment 1 11-26-97 DOE P 450.4 5 10-15-96 CANCELE D Page 1-8 - Safety Management System Guide - Volume 1 11-26-97 Attachment 1 This page intentinally left blank. CANCELE D Page 2-1 - Safety Management System Guide - Volume 1 11-26-97 Attachment 2 ATTACHMENT 2 DEPARTMENT OF ENERGY ACQUISITION REGULATIONS (DEAR) Related to the DOE SAFETY MANAGEMENT SYSTEM POLICY CANCELE D Volume 1 - Safety Management System Guide - Page 2-2 Attachment 2 11-26-97 970.1001 Performance-based contracting. (a) It is the policy of the Department of be developed to facilitate the assessment of Energy to use, to the maximum extent contractor performance and ensure the practicable, performance-based contracting appropriateness of any award or incentive fee methods in its management and operating payment. Such plans shall be tailored to the contracts. Office of Federal Procurement contract performance objectives, criteria, and Policy Letter 91-2 provides guidance measures, and shall, to the maximum extent concerning the development and use of practicable, focus on the level of performance performance-based contracting concepts and required by the performance objectives rather methodologies that may be generally applied than the methodology used by the contractor to management and operating contracts. to achieve that level of performance. Performance- based contracts: describe performance requirements in terms of results [62 FR 34842, Jun. 27, 1997] rather than methods of accomplishing the work; use measurable (i.e., terms of quality, timeliness, quantity) performance standards and objectives and quality assurance surveillance plans; provide performance incentives (positive or negative) where appropriate; and specify procedures for award As prescribed in 48 CFR (DEAR) or incentive fee reduction when work 970.2303-2(a), insert the following clause. activities are not performed or do not meet contract requirements. INTEGRATION OF ENVIRONMENT,

(b) The use of performance-based statements PLANNING AND EXECUTION of work, where feasible, is the preferred (JUNE 1997) method for establishing work requirements. Such statements of work and other documents (a) For the purposes of this clause, used to establish work requirements (such as work authorization directives) should describe (1) Safety encompasses environment, safety performance requirements and expectations in and health, including pollution prevention and terms of outcome, results, or final work waste minimization; and products, as opposed to methods, processes, or design. (2) Employees include subcontractor (c) Contract performance requirements and expectations should be consistent with the (b) In performing work under this contract, Department's strategic planning goals and the contractor shall perform work safely, in a objectives, as made applicable to the site or manner that ensures adequate protection for facility through Departmental programmatic employees, the public, and the environment, and financial planning processes. Measurable and shall be accountable for the safe performance criteria, objective measures, and performance of work. The contractor shall where appropriate, performance incentives, exercise a degree of care commensurate with shall be structured to correspond to the the work and the associated hazards. The performance requirements established in the contractor shall ensure that management of statement of work and other documents used environment, safety and health (ES&H) to establish work requirements. functions and activities becomes an integral (d) Quality assurance surveillance plans shall 970.5204-2 Integration of environment, safety, and health into work planning and execution. SAFETY, AND HEALTH INTO WORK employees. but visible part of the contractor's work planning and execution processes. The CANCELE D Page 2-3 - Safety Management System Guide - Volume 1 11-26-97 Attachment 2 DEAR Clauses Related to ISMS contractor shall, in the performance of work, the contractor. The extent of documentation ensure that: and level of authority for agreement shall be (1) Line management is responsible for the associated with the work and shall be protection of employees, the public, and the established in a Safety Management System. environment. Line management includes those contractor and subcontractor employees (c) The contractor shall manage and perform managing or supervising employees work in accordance with a documented Safety performing work. Management System (System) that fulfills all (2) Clear and unambiguous lines of authority minimum. Documentation of the System shall and responsibility for ensuring ES&H are describe how the contractor will: established and maintained at all organizational levels. (1) Define the scope of work; (3) Personnel possess the experience, (2) Identify and analyze hazards associated knowledge, skills, and abilities that are with the work; necessary to discharge their responsibilities. (4) Resources are effectively allocated to (3) Develop and implement hazard controls; address ES&H, programmatic, and operational considerations. Protecting (4) Perform work within controls; and employees, the public, and the environment is a priority whenever activities are planned and (5) Provide feedback on adequacy of controls performed. and continue to improve safety management.

(5) Before work is performed, the associated (d) The System shall describe how the hazards are evaluated and an agreed-upon set contractor will establish, document, and of ES&H standards and requirements are implement safety performance objectives, established which, if properly implemented, performance measures, and commitments in provide adequate assurance that employees, response to DOE program and budget the public, and the environment are protected execution guidance while maintaining the from adverse consequences. integrity of the System. The System shall also (6) Administrative and engineering controls to system effectiveness. prevent and mitigate hazards are tailored to the work being performed and associated (e) The contractor shall submit to the hazards. Emphasis should be on designing contracting officer documentation of its the work and/or controls to reduce or System for review and approval. Dates for eliminate the hazards and to prevent accidents submittal, discussions, and revisions to the and unplanned releases and exposures. System will be established by the contracting (7) The conditions and requirements to be review, and approval of the System will be satisfied for operations to be initiated and provided by the contracting officer. On an conducted are established and agreed- upon annual basis, the contractor shall review and by DOE and the contractor. These update, for DOE approval, its safety agreed-upon conditions and requirements are performance objectives, performance requirements of the contract and binding upon measures, and commitments consistent with tailored to the complexity and hazards conditions in paragraph (b) of this clause at a describe how the contractor will measure officer. Guidance on the preparation, content, CANCELE D Volume 1 - Safety Management System Guide - Page 2-4 Attachment 2 11-26-97 and in response to DOE's program and budget applicable to this contract regardless of the execution guidance and direction. Resources performer of the work. shall be identified and allocated to meet the safety objectives and performance (i) The contractor shall include a clause commitments as well as maintain the integrity substantially the same as this clause in of the entire System. Accordingly, the System subcontracts involving complex or hazardous shall be integrated with the contractor's work on site at a DOE-owned or -leased business processes for work planning, facility. Such subcontracts shall provide for budgeting, authorization, execution, and the right to stop work under the conditions change control. described in paragraph (g) of this clause. Depending on the complexity and hazards (f) The contractor shall comply with, and associated with the work, the contractor may assist the Department of Energy in complying require that the subcontractor submit a Safety with, ES&H requirements of all applicable Management System for the contractor's laws and regulations, and applicable review and approval. directives identified in the clause of this contract on Laws, regulations, and DOE [62 FR 34842, Jun. 27, 1997] Directives. The contractor shall cooperate with Federal and non-Federal agencies having jurisdiction over ES&H matters under this contract.

(g) The contractor shall promptly evaluate and resolve any noncompliance with applicable ES&H requirements and the System. If the contractor fails to provide resolution or if, at any time, the contractor's acts or failure to act causes substantial harm or an imminent danger to the environment or health and safety of employees or the public, the contracting officer may issue an order stopping work in whole or in part. Any stop work order issued by a contracting officer under this clause (or issued by the contractor to a subcontractor in accordance with paragraph (i) of this clause) shall be without prejudice to any other legal or contractual rights of the Government. In the event that the contracting officer issues a stop work order, an order authorizing the resumption of the work may be issued at the discretion of the contracting officer. The contractor shall not be entitled to an extension of time or additional fee or damages by reason of, or in connection with, any work stoppage ordered in accordance with this clause. (h) The contractor is responsible for compliance with the ES&H requirements 970.5204-78 Laws, regulations, and DOE directives. As prescribed in 48 CFR (DEAR) 970.0470-2, insert the following clause. LAWS, REGULATIONS, AND DOE DIRECTIVES (JUNE 1997) (a) In performing work under this contract, the contractor shall comply with the requirements of applicable Federal, State, and local laws and regulations (including DOE regulations), unless relief has been granted in writing by the appropriate regulatory agency. A List of Applicable Laws and regulations (List A) may be appended to this contract for information purposes. Omission of any applicable law or regulation from List A does not affect the obligation of the contractor to comply with such law or regulation pursuant to this paragraph. (b) In performing work under this contract, the contractor shall comply with the requirements of those Department of Energy directives, or parts thereof, identified in the List of Applicable Directives (List B) appended to this contract. Except as otherwise provided for in paragraph (c) of this clause, the contracting officer may, from time to time and at any time, revise List B by CANCELE D Page 2-5 - Safety Management System Guide - Volume 1 11-26-97 Attachment 2 DEAR Clauses Related to ISMS unilateral modification to the contract to add, to the contract by List B. If the tailored set of modify, or delete specific requirements. Prior requirements identifies an alternative to revising List B, the contracting officer shall requirement varying from an ES&H notify the contractor in writing of the requirement of an applicable law or regulation, Department's intent to revise List B and the contractor shall request an exemption or provide the contractor with the opportunity to other appropriate regulatory relief specified in assess the effect of the contractor's the regulation. compliance with the revised list on contract cost and funding, technical performance, and (d) The contractor is responsible for compliance schedule; and identify any potential with the requirements made applicable to this inconsistencies between the revised list and contract, regardless of the performer of the the other terms and conditions of the contract. work. The contractor is responsible for flowing Within 30 days after receipt of the contracting down the necessary provisions to subcontracts at officer's notice, the contractor shall advise the any tier to which the contractor determines such contracting officer in writing of the potential requirements apply. impact of the contractor's compliance with the revised list. Based on the information [62 FR 34842, Jun. 27, 1997] provided by the contractor and any other information available, the contracting officer shall decide whether to revise List B and so advise the contractor not later than 30 days prior to the effective date of the revision of List B. The contractor and the contracting officer shall identify and, if appropriate, agree to any changes to other contract terms and conditions, including cost and schedule, associated with the revision of List B pursuant to the clause entitled, Changes, of this contract.

(c) Environmental, safety, and health (ES&H) requirements appropriate for work conducted under this contract may be determined by a DOE approved process to evaluate the work and the associated hazards and identify an appropriately tailored set of standards, practices, and controls, such as a tailoring process included in a DOE approved Safety Management System implemented under 48 CFR (DEAR) 970.5204-2. When such a process is used, the set of tailored ES&H requirements, as approved by DOE pursuant to the process, shall be incorporated into List B as contract requirements with full force and effect. These requirements shall supersede, in whole or in part, the contractual environmental, safety, and health requirements previously made applicable CANCELE D This page intentionally left blank. CANCELE D