DOE G 450.4-1, Vol 2, Integrated Safety Management System Guide

THIS PAGE MUST BE KEPT WITH DOE G 450.4-1, INTEGRATED SAFETY MANAGEMENT SYSTEM GUIDE, REVISION 0. THE OFFICE OF ENVIRONMENT, SAFETY AND HEALTH (EH) HAS REQUESTED THAT THIS GUIDE BE ISSUED AND USED FOR AT LEAST SIX MONTHS FROM THE APPROVAL DATE IN ORDER TO OBTAIN MORE EXPERIENCE IN THE USE OF THIS GUIDE IN THE DEVELOPMENT OF SAFETY MANAGEMENT SYSTEMS. EH WILL THEN FORMALLY REQUEST ADDITIONAL COMMENTS AND FEEDBACK FOR USE IN A PLANNED REVISION TO THE GUIDE. CANCELE D DOE G 450.4-1 November 26, 1997 Volume 2 of 2 INTEGRATED SAFETY MANAGEMENT SYSTEM GUIDE for use with DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY, AND DEAR SAFETY MANAGEMENT SYSTEM CONTRACT CLAUSES Volume Two: Appendixes Assistant Secretary for Environment, Safety and Health CANCELE D Page ii - Safety Management System Guide - Volume 2 11-26-97 This page intentionally left blank. CANCELE D Volume 2 - Safety Management System Guide - Page iii Contents 11-26-97 CONTENTS APPENDIX A: GLOSSARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1 APPENDIX B: RESOURCES FOR COMPLYING WITH THE SMS POLICY AND THE DEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-1 APPENDIX C: DEVELOPMENT AND EVALUATION GUIDANCE FOR AN INTEGRATED SMS AT A HAZARD CATEGORY 2 NUCLEAR FACILITY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-1 APPENDIX D: DISCUSSION OF SAFETY MANAGEMENT ASSESSMENT . . . . . D-1 APPENDIX E: INTEGRATED SMS VERIFICATION TEAM LEADER GUIDANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-1 CANCELE D Page iv - Safety Management System Guide - Volume 2 11-26-97 Contents This page intentionally left blank. CANCELE D Volume 2 - Safety Management System Guide - Page A-1 Appendix A 11-26-97 APPENDIX A GLOSSARY ADMINISTRATIVE CONTROLS. Provisions relating to organization and management, procedures, record keeping, assessment, and reporting necessary to ensure safe operation of a facility. With respect to nuclear facilities administrative controls means the section of the Technical Safety Requirements (TSRs) containing provisions for safe operation of a facility including (1) requirements for reporting violations of TSRs, (2) staffing requirements important to safe operations, and (3) commitments to the safety management programs and procedures identified in the Safety Analysis Report as necessary elements of the facility safety basis provisions. AUTHORIZATION AGREEMENT. A documented agreement between DOE and the contractor for high-hazard facilities (Categories 1 and 2), incorporating the results of DOE's review of the contractor’s proposed authorization basis for a defined scope of work. The authorization agreement contains key terms and conditions (controls and commitments) under which the contractor is authorized to perform work. Any changes to these terms and conditions would require DOE approval. AUTHORIZATION BASIS. Safety documentation supporting the decision to allow a process or facility to operate. Included are corporate operational and environmental requirements as found in regulations and specific permits, and, for specific activities, work packages or job safety analyses. (See also nuclear safety authorization basis.)

AUTHORIZATION PROTOCOLS. Those processes used to communicate acceptance of the contractor’s integrated plans for hazardous work. Such protocols are expected to range from preperformance review and approval by DOE of detailed safety-related terms and conditions for performing work (authorization agreement) to less rigorous oversight and postperformance assessment of the contractor’s work. CHANGE CONTROLS. A process that ensures all changes are properly identified, reviewed, approved, implemented, tested, and documented. COGNIZANT SECRETARIAL OFFICER. That first-tier Headquarters office with responsibility and authority for the particular activity under consideration. CONTRACTING OFFICER. A DOE official with the authority to purchase or contract for goods and services in excess of $25,000. Contracting officers are appointed using Standard Form 1402, following procedures in DOE O 541.1, APPOINTMENT OF CONTRACTING OFFICERS AND CONTRACTING OFFICER REPRESENTATIVES, which superseded DOE 4200.4A. For Headquarters support contracts, the contracting officer is generally a member of the staff of the Assistant Secretary for Human Resources and Administration. CANCELE D Page A-2 - Safety Management System Guide - Volume 2 11-26-97 Appendix A CONTRACTOR. Any person under contract (including subcontractors or suppliers) with DOE with the responsibility to perform activities or supply services or products. CORE SAFETY MANAGEMENT FUNCTIONS. The core safety management functions for DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY, are (1) define the scope of work, (2) analyze the hazards; (3) develop and implement hazard controls; (4) perform work within controls; and (5) provide feedback and continuous improvement. These functions are also identified in DEAR 48 CFR 970.5204-2(c). DEACTIVATION. The process of placing a facility in a safe and stable condition to minimize the long-term cost of a surveillance and maintenance program that is protective of workers, the public, and the environment until decommissioning is completed. DECOMMISSIONING. Actions taken at the end of facility life to retire a facility from service with adequate regard for the health and safety of the public and workers and the protection of the environment. DECONTAMINATION. The removal or reduction of residual radioactive and hazardous material (after facility deactivation) by mechanical, chemical, or other techniques to achieve a stated objective or end condition. DEFENSE IN DEPTH. An approach to facility safety that builds-in layers of defense against release of hazardous materials so that no one layer by itself, no matter how good, is completely relied upon. To compensate for potential human and mechanical failures, defense in depth is based on several layers of protection with successive barriers to prevent the release of hazardous material to the environment. This approach includes protection of the barriers to avert damage to the plant and to the barriers themselves. It includes further measures to protect the public, workers, and the environment from harm in case these barriers are not fully effective. ENGINEERED CONTROLS. Physical controls, including set points and operating limits; as distinct from administrative controls. EXTERNAL EVENTS. Natural phenomena or man-caused hazards not related to the facility.

FACILITY. Any equipment, structure, system, process, or activity that fulfills a specific purpose. Facilities do not have to be structures. Examples include accelerators, storage areas, fusion research devices, nuclear reactors, production or processing plants, coal conversion plants, magnetohydrodynamics experiments, windmills, radioactive waste disposal systems and burial grounds, environmental restoration activities, testing laboratories, research laboratories, transportation activities, and accommodations for analytical examinations of irradiated and unirradiated components. FIELD ELEMENT. A non-Headquarters DOE organization that is geographically distinct. Field elements can be area offices; support offices; operations offices; field offices; regional CANCELE D Volume 2 - Safety Management System Guide - Page A-3 Appendix A 11-26-97 offices; or offices located at environmental restoration, construction, or termination sites. “FLOOR-LEVEL” PROCEDURES. Detailed instructions used by technicians, researchers, and other workers to directly accomplish work activities or tasks. GUIDING PRINCIPLES. Conditions for performance of work that an SMS must address. The guiding principles for the Safety Management System Policy (DOE P 450.4) are Line Management Responsibility for Safety, Clear Roles and Responsibilities, Competence Commensurate with Responsibilities, Balanced Priorities, Identification of Safety Standards and Requirements, Hazard Controls Tailored to Work Being Performed and Operations Authorization. These principles are also identified in DEAR 48 CFR 970.5204-2(b). HAZARD. A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to personnel or damage to a facility or to the environment (without regard to the likelihood or credibility of accident scenarios or consequence mitigation). HAZARD ANALYSIS. The determination of material, system, process, and plant characteristics that can produce undesirable consequences, followed by the assessment of hazardous situations associated with a process or activity. Largely qualitative techniques are used to pinpoint weaknesses in design or operation of the facility that could lead to accidents. The SAR hazard analysis examines the complete spectrum of potential accidents that could expose members of the public, onsite workers, facility workers, and the environment to hazardous materials. HAZARD CLASSIFICATION. Evaluation of the consequences of unmitigated releases, performed to classify facilities or operations into the following hazard categories: • Category 1: The hazard analysis shows the potential for significant offsite consequences. • Category 2: The hazard analysis shows the potential for significant onsite consequences. • Category 3: The hazard analysis shows the potential for significant localized consequences. HAZARDS CONTROLS. Design features; operating limits; and administrative or safety practices, processes, or procedures to prevent, control, or mitigate hazards. HEAD OF THE CONTRACTING ACTIVITY. Head of a DOE element who has been delegated authority by the Deputy Assistant Secretary for Procurement and Assistance Management to (1) award and administer contracts, sales contracts, and/or financial assistance instruments; (2) appoint contracting officers; and (3) exercise the overall responsibility for managing the contracting activity.

IMPLEMENTATION PLAN. A document prepared by a contractor that sets forth (1) when and how the actions appropriate to comply with DOE or other regulatory requirements, including the requirements of a plan or program committed to by the contractor, shall be taken, and (2) what relief will be sought if a contractor cannot attain full compliance with a requirement in a CANCELE D Page A-4 - Safety Management System Guide - Volume 2 11-26-97 Appendix A reasonable manner. INTEGRATED SAFETY MANAGEMENT SYSTEM. A Safety Management System (SMS) to systematically integrate safety into management and work practices at all levels as required by DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY. LIFE CYCLE. The life of an asset from planning through acquisition, maintenance, operation, and disposition. LINE MANAGEMENT. Any management level within the line organization, including contractor management, that is responsible and accountable for directing and conducting work. LINE ORGANIZATION. That unbroken chain of command that extends from the Office of the Secretary to Secretarial Offices that set program policy and plans and develop assigned programs, to the field element organizations responsible for execution of these programs, to the contractors that conduct the work. MANAGEMENT CONTROLS (INTERNAL CONTROLS). The organization, procedures, and methods managers use to achieve their goals, including processes for planning, organizing, directing, and controlling operations. Management controls are designed to provide reasonable assurance that(1) programs achieve intended results; (2) resource use is consistent with DOE’s mission and resources are protected from waste, loss, unauthorized use, and misappropriation; (3) laws and regulations are followed; and (4) decisions are based on reliable data. Management controls apply to all programs and administrative functions. MANUALS/CODES OF PRACTICE. As applied to integrated safety management, documented instructions that define methods, processes, and procedures for DOE and the contractor to use in implementing safety requirements and guidelines. These manuals/codes of practice document the safety infrastructure of an integrated SMS and provide the basis for work planning, authorization protocols, formality of operations, and feedback and improvement processes. NUCLEAR SAFETY. Aspects of safety that encompass activities and systems that present the potential for (1) uncontrolled releases of fission products or other radioactive materials to the environment or (2) for inadvertent criticality. NUCLEAR SAFETY AUTHORIZATION BASIS. The basis for the safe operation of a DOE nuclear facility, nuclear safety authorization basis includes hazard classification documents, Safety Analysis Reports, TSRs, DOE-issued safety evaluation reports, and facility-specific commitments made to comply with DOE nuclear safety requirements. OCCURRENCE REPORT. A documented evaluation of an event or condition that is prepared in sufficient detail to enable the reader to assess its significance, consequences, or implications and to evaluate the actions being proposed or employed to correct the condition or to avoid CANCELE D Volume 2 - Safety Management System Guide - Page A-5 Appendix A 11-26-97 recurrence. OPERATIONAL READINESS REVIEW/ASSESSMENT. A disciplined, systematic, documented, performance-based examination of facilities, equipment, personnel, procedures, and management control systems to ensure that a facility will be operated safely within its approved safety envelope as defined by the facility safety basis.

OPERATIONAL SAFETY CONTROLS. Safety limits, operating limits, surveillance requirements, safety boundaries, and management and administrative controls that significantly contribute to protecting workers, the public, and the environment from hazards other than nuclear detonation, high-explosive detonation and deflagration, and fire (which are addressed by Nuclear Explosive Safety Rules) for specific nuclear explosive operations and associated activities. OVERSIGHT. The responsibility and authority assigned to the Assistant Secretary for Environment, Safety and Health to independently assess the adequacy of DOE and contractor performance. Oversight is separate and distinct from line management activities, including self assessments. PERFORMANCE INDICATOR. Operational information indicative of the performance or condition of a facility, group of facilities, or site. PERFORMANCE-BASED REGULATIONS. Regulations that are outcome-oriented rather than procedure-oriented. PROCEDURE. A document that prescribes a process (a sequence of actions) to be performed to achieve a desired outcome. PROCESS. A series of actions that achieves an end or result. PROGRAM MANAGER. a. (Chief Financial Officer) An individual in an organization or activity responsible for the management of a specific function or functions and responsible for budget formulation and execution of the approved budget. The individual is the recipient of an approved funding program from the Office of Chief Financial Officer identifying his or her program dollars available to accomplish the assigned function. b. (Environment, Safety and Health) The Headquarters individual, or his/her designee, designated by and under the direction of a Secretarial Officer, who is directly involved in the operation of facilities under his/her cognizance, and holds signature authority to provide technical direction through heads of field elements/operations office organizations to contractors for these facilities. PROGRAM OFFICE. A Headquarters organization responsible for executing program management functions and for assisting and supporting Field Elements in safety and health, administrative, management, and technical areas. PROGRAM SECRETARIAL OFFICERS (PSO). See SECRETARIAL OFFICER. CANCELE D Page A-6 - Safety Management System Guide - Volume 2 11-26-97 Appendix A RISK. The quantitative or qualitative expression of possible loss that considers both the probability that a hazard will cause harm and the consequences of that event. RISK-INFORMED. Using knowledge of the risk. SAFETY ANALYSIS. A documented process to– (1) provide systematic identification of hazards within a given DOE operation; (2) describe and analyze the adequacy of the measures taken to eliminate, control, or mitigate identified hazards; and (3) analyze and evaluate potential accidents and their associated risks. SAFETY ANALYSIS REPORT (SAR). A report that documents the safety analysis for a nuclear facility to provide the basis for a determination that the facility can be constructed, operated, maintained, shut down, and decommissioned safely and in compliance with applicable laws and regulations. SAFETY CONTROLS. Safety significant controls or safety class controls (see also administrative controls). SAFETY DOCUMENTATION. Reports, memoranda, and other signed and dated documents that identify the hazards of a process or facility, and describe the measures for their control.

SAFETY ENVELOPE. The range of conditions covered by the safety documentation of a process or facility under which safe operation is adequately controlled. SAFETY EVALUATION REPORT (SER). A DOE document that describes the extent and detail of DOE review of a SAR or equivalent analysis report, the bases for approving the SAR (or equivalent), and any conditions of SAR (or equivalent) approval. Approval signifies that DOE has accepted the analysis as appropriately documenting the safety basis of a facility and as serving as the basis for operational controls necessary to maintain an acceptable operating safety envelope. SAFETY CLASS STRUCTURES, SYSTEMS, AND COMPONENTS. Nuclear safety structures, systems, and components (SSCs) that are relied upon to protect the safety and health of the offsite public as identified by safety analyses. SAFETY PROGRAMS. Programs, required by DOE or other regulatory authority or committed to in the contractor’s SMS description, that will be adhered to for a scope of work by a facility or site in support of the work. SAFETY SIGNIFICANT STRUCTURES, SYSTEMS, AND COMPONENTS. Structures, CANCELE D Volume 2 - Safety Management System Guide - Page A-7 Appendix A 11-26-97 systems, and components (SSCs) that are not designated as safety class SSCs, but whose preventive or mitigative function is a major contributor to defense in depth (i.e., prevention of uncontrolled material release) and/or worker safety as determined from hazard analyses. SAFETY STRUCTURES, SYSTEMS AND COMPONENTS. Both safety significant structures, systems, and components (SSCs) and safety class SSCs. SECRETARIAL OFFICER. The head of a first-tier organization; a DOE Headquarters employee reporting directly to the Secretary, the Under Secretary, or the Deputy Secretary. STANDARD. A generic, all-encompassing term used to describe documents that provide a specified set of mandatory or discretionary rules, requirements, or conditions concerned with performance, design, operation, or measurements of quality to accomplish a specific task. Standards may include Federal laws, regulations, State laws, Federal agency directives, national and internal technical standards, codes of conduct, or even organizational “internal use only” documents. SURVEILLANCE. Any periodic monitoring to ensure operability or adequacy of performance. TAILORING. Adapting something, such as a safety program, practice, or requirement, within the integrated SMS to suit the need or purposes of a particular operation/activity, taking into account the type of work and associated hazards. TECHNICAL SAFETY REQUIREMENTS (TSRs). Those requirements that define the conditions, safe boundaries, and management or administrative controls necessary to ensure the safe operation of a nuclear facility and to reduce the potential risk to the public and facility workers from uncontrolled releases of radioactive materials or from radiation exposures due to inadvertent criticality. TSRs consist of safety limits, operating limits, surveillance requirements, administrative controls, use and application instructions, and the basis thereof.

TECHNICAL STANDARD. A document that sets down a discretionary set of actions that must be accomplished to meet the purpose of the encompassing document. These actions are generally concerned with descriptions or steps which must be met to accomplish a specific task such as classification of components, operation of equipment, enhancement of quality, or protection of personnel. They may also be used for procurement activities such as specification of materials, products, or services in accordance with a specific set of conditions for delivery. Technical standards may only be made mandatory by direct reference in a requirements-type document, such as a contract, law, rule, or Federal agency directive. UNREVIEWED SAFETY QUESTION (USQ). a. An Unreviewed Safety Question exists if one or more of the following conditions is identified: CANCELE D Page A-8 - Safety Management System Guide - Volume 2 11-26-97 Appendix A (1) the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety as previously evaluated in the facility safety analyses could be increased; (2) the possibility for an accident or malfunction of a different type than any evaluated previously in the facility safety analyses could be created; and, (3) any margin of safety as defined in the bases of the TSRs could be reduced. b. A USQ determination is made when one of the following circumstances occurs: (1) temporary or permanent changes in the facility as described in existing safety analyses; (2) temporary or permanent changes in the procedures as derived from existing safety analyses; and (3) tests or experiments not described in existing safety analyses. USQ PROCESS. A process to determine when DOE is to be involved in decision making involving a USQ. WORK. Process of performing a defined task or activity; for example, research and development, operations, maintenance and repair, administration, software development and use, inspection, safeguards and security, data collection, and analysis. WORK FOR OTHERS. The performance of work for non-DOE entities by DOE /contractor personnel and/or the utilization of DOE facilities that is not directly funded by DOE appropriations. WORK PERFORMANCE. The act of performing work. WORK PLANNING. The process of planning a defined task or activity. Addressing safety as an integral part of work planning includes execution of the safety-related functions in preparation for performance of a scope of work. These functions include (1) definition of the scope of work, (2) formal analysis of the hazards bringing to bear in an integrated manner specialists in both ES&H and engineering depending on specific hazards identified, (3) identification of resulting safety controls including safety structures, systems and components, and other safety-related commitments to address the hazards, and (4) approval of the safety controls. CANCELE D Volume 2 - Safety Management System Guide - Page B-1 Appendix B 11-26-97 APPENDIX B RESOURCES FOR COMPLYING WITH THE SMS POLICY AND THE DEAR 1. INTRODUCTION

This Appendix is intended to be used as a resource for complying with 48 CFR Chapter 9 (DEAR) Part 970.5204-78, “Laws, Regulations, and DOE Directives” which standardizes the manner in which applicable requirements are included in contracts between DOE and its contractors. The appendix is developed as a resource tool rather than a comprehensive list. DOE maintains a web site that allows access to current Department directives (http://www.explorer.doe.gov:1776/htmls/directives.html). To focus the selection and aid tailoring of standards, DOE has prepared many guides for particular safety activities (e.g., fire protection) that link to acceptable codes and industry standards. Many canceled or partially canceled DOE directives are included in this list because they may have been incorporated into a contract (see Section 2.8 of this appendix). 2. RESOURCES BY TOPICAL AREA 2.1 DEFINE SCOPE OF WORK AND BALANCED PRIORITIES Federal Rules • 48 CFR 970.1001 and 970.5204: Department of Energy Acquisition Regulations DOE Policies, Notices, and Orders • DOE P 450.4: DOE SAFETY MANAGEMENT SYSTEM POLICY • DOE O 130.1: BUDGET FORMULATION PROCESS • DOE O 135.1: BUDGET EXECUTION - FUNDS DISTRIBUTION AND CONTROL • DOE O 251.1: DIRECTIVES SYSTEM • DOE P 251.1: DIRECTIVES SYSTEM • DOE O 331.1: DEPARTMENTAL EMPLOYEE PERFORMANCE MANAGEMENT SYSTEM • DOE O 350.1: CONTRACTOR HUMAN RESOURCE MANAGEMENT PROGRAMS • DOE O 413.1: MANAGEMENT CONTROL PROGRAM • DOE O 430.1: LIFE-CYCLE ASSET MANAGEMENT (see also DRAFT DOE O 430.1A) • DOE O 470.1: SAFEGUARDS AND SECURITY PROGRAM • DOE O 471.1: IDENTIFICATION AND PROTECTION OF UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION CANCELE D Page B-2 - Safety Management System Guide - Volume 2 11-26-97 Appendix B • DOE O 471.2A: INFORMATION SECURITY PROGRAM • DOE O 472.1B: PERSONNEL SECURITY ACTIVITIES • DOE O 541.1: APPOINTMENT OF CONTRACTING OFFICERS AND CONTRACTING OFFICER REPRESENTATIVES • DOE 4300.1C: REAL PROPERTY MANAGEMENT • DOE 4320.2A: CAPITAL ASSET MANAGEMENT PROCESS • DOE 4700.1: PROJECT MANAGEMENT SYSTEM • DOE 5500.6B: SHUTDOWN OF DEPARTMENTAL OPERATIONS UPON FAILURE BY CONGRESS TO ENACT APPROPRIATIONS DOE Guides and Technical Standards • DOE-STD-1082-94: Preparation, Review, and Approval of Implementation Plans for Nuclear Safety Requirements • DOE-STD-XXXX-YR: Guidelines for Risk Based Prioritization of DOE Activities • DOE G 120.1-5: GUIDELINES FOR PERFORMANCE MEASUREMENT • DOE G 430.1-1: COST ESTIMATING GUIDE • DOE G 440.1-4: CONTRACTOR OCCUPATIONAL MEDICAL PROGRAM GUIDE FOR USE WITH DOE O 440.1 • DOE G 460.2-1: IMPLEMENTATION GUIDE FOR USE WITH DOE O 460.2, DEPARTMENT MATERIALS TRANSPORTATION AND PACKAGING MANAGEMENT DOE Manuals and Handbooks • DOE M 135.1-1: BUDGET EXECUTION MANUAL • DOE M 411.1-1: MANUAL OF SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES AND AUTHORITIES (FRAM) • DOE M 471.2-1: MANUAL FOR CLASSIFIED MATTER PROTECTION & CONTROL Defense Nuclear Facilities Safety Board Technical Reports • DNFSB/TECH-5, Fundamentals for Understanding Standards-Based Safety Management of Department of Energy Defense Nuclear Facilities • DNFSB/TECH-6, Safety Management and Conduct of Operations at the Department of Energy’s Defense Nuclear Facilities • DNFSB/TECH-16, Integrated Safety Management CANCELE D Volume 2 - Safety Management System Guide - Page B-3 Appendix B 11-26-97 2.2 ANALYZE HAZARDS Federal Rules

• 10 CFR 830: Nuclear Safety Management • 10 CFR 835: Radiation Protection for Occupational Workers • 10 CFR 1021: National Environmental Policy Act • 29 CFR 1910: Occupational Safety and Health Standards • 29 CFR 1926: Occupational Safety and Health Regulations for Construction • 40 CFR 50 to 195: EPA Air, Water and Radiation Protection Requirements DOE Policies, Notices, and Orders • DOE P 410.1A: DEVELOPING NUCLEAR SAFETY REQUIREMENTS • DOE O 420.1: FACILITY SAFETY • DOE O 430.1: LIFE CYCLE ASSET MANAGEMENT • DOE O 440.1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES • DOE O 440.2: AVIATION • DOE O 452.1A: NUCLEAR EXPLOSIVE AND WEAPONS SURETY • DOE O 452.2A: SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS • DOE O 452.4: SECURITY AND CONTROL OF NUCLEAR EXPLOSIVES AND NUCLEAR WEAPONS • DOE O 460.1A: PACKAGING AND TRANSPORTATION SAFETY • DOE 5480.23: NUCLEAR SAFETY ANALYSIS REPORTS • DOE 5480.25: SAFETY OF ACCELERATOR FACILITIES • DOE 5480.30: NUCLEAR REACTOR SAFETY DESIGN CRITERIA DOE Guides and Technical Standards • DOE-STD-1021-93: Natural Phenomena Hazards Performance Categorization Guidelines for Structures, Systems, and Components • DOE-STD-1022-94: Natural Phenomena Hazards Site Characterization Criteria • DOE-STD-1023-95: Natural Phenomena Hazards Assessment Criteria (including Change Notice 1; January 1996) • DOE-STD-1027-92: Guidance on Preliminary Hazard Classification and Accident Analysis • DOE-STD-1088-95: Fire Protection for Relocatable Structures • DOE-STD-1101-96: Process Safety Management for Highly Hazardous Chemicals • DOE-STD-1104-96: Review and Approval of Nonreactor Nuclear Facility Safety Analysis Reports • Draft DOE-STD-1120-97: Integration of Safety and Health into Facility Disposition Activities • DOE-STD-3007-93: Guidelines for Preparing Criticality Safety Evaluations at CANCELE D Page B-4 - Safety Management System Guide - Volume 2 11-26-97 Appendix B Department of Energy Non-Reactor Nuclear Facilities • DOE-STD-3009-94: Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports • DOE-STD-3014-96: Accident Analysis for Aircraft Crash into Hazardous Facilities • DOE-STD-3015-97: Nuclear Explosive Safety Study Process • DOE-STD-6002-96: Safety of Magnetic Fusion Facilities: Requirements • DOE-STD-6003-96: Safety of Magnetic Fusion Facilities: Guidance • DOE-EM-5502-94: Hazard Baseline Documentation • DOE-EM-5503-94: EM Health and Safety Plan Guidelines • DRAFT DOE G 420.1-X: IMPLEMENTATION GUIDE FOR NONREACTOR NUCLEAR SAFETY DESIGN CRITERIA AND EXPLOSIVES SAFETY CRITERIA • DRAFT DOE G 420.1-Y: IMPLEMENTATION GUIDE FOR THE MITIGATION OF NATURAL PHENOMENA HAZARDS FOR DOE NUCLEAR FACILITIES AND NON-NUCLEAR FACILITIES DOE Manuals and Handbooks • DOE M 440.1-1: DOE EXPLOSIVES SAFETY MANUAL • DOE-HDBK-1100-96: Chemical Process Hazards Analysis • DOE-HDBK-1101-96: Process Safety Management for Highly Hazardous Chemicals • DOE-HDBK-3010-94: Airborne Release Fractions/Rates and Respirable Fractions for Nonreactor Nuclear Facilities, Vols. I & II Non-DOE Documents • Guidelines for Hazard Evaluation Procedures, Second Edition with Worked Examples, Center for Chemical Process Safety, AIChe, 1992 • Risk Assessment and Risk Management for the Chemical Process Industry, Stone and Webster Engineering Corporation, 1991 • Management of Process Hazards, American Petroleum Institute Recommended Practice 750, 1990

• DNFSB/TECH-5, Fundamentals for Understanding Standards-Based Safety Management of Department of Energy Defense Nuclear Facilities • DNFSB/TECH-6, Safety Management and Conduct of Operations at the Department of Energy’s Defense Nuclear Facilities • DNFSB/TECH-16, Integrated Safety Management CANCELE D Volume 2 - Safety Management System Guide - Page B-5 Appendix B 11-26-97 2.3 DEVELOP/IMPLEMENT HAZARDS CONTROLS, IDENTIFICATION OF SAFETY STANDARDS AND REQUIREMENTS; AND HAZARD CONTROLS TAILORED TO WORK BEING PERFORMED Federal Rules • 10 CFR 708: DOE Contractor Employee Protection Program • 10 CFR 830: Nuclear Safety Management • 10 CFR 834: Radiation Protection of the Public and the Environment (Draft) • 10 CFR 835: Radiation Protection for Occupational Workers • 10 CFR 1021: National Environmental Policy Act • 29 CFR 1910: Occupational Safety and Health Standards • 29 CFR 1926: Occupational Safety and Health Regulations for Construction • 40 CFR 50 to 195: EPA Air, Water and Radiation Protection Requirements DOE Policies, Notices, and Orders • DOE O 360.1: TRAINING • DOE O 420.1: FACILITY SAFETY • DOE O 440.1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES • DOE N 441.1: RADIOLOGICAL PROTECTION FOR DOE ACTIVITIES • DOE P 441.1: DEPARTMENT OF ENERGY RADIOLOGICAL HEALTH AND SAFETY POLICY • DOE P 450.1: ENVIRONMENT, SAFETY, AND HEALTH POLICY FOR THE DEPARTMENT OF ENERGY COMPLEX • DOE P 450.2A: IDENTIFICATION, IMPLEMENTATION, AND COMPLIANCE WITH ENVIRONMENT, SAFETY AND HEALTH REQUIREMENTS • DOE N 450.3: USE OF NECESSARY AND SUFFICIENT PROCESS • DOE P 450.3: AUTHORIZING USE OF THE NECESSARY AND SUFFICIENT PROCESS FOR STANDARDS-BASED ENVIRONMENT, SAFETY AND HEALTH MANAGEMENT • DOE P 450.4: SAFETY MANAGEMENT SYSTEM POLICY • DOE O 451.1A: NATIONAL ENVIRONMENTAL POLICY ACT COMPLIANCE PROGRAM • DOE O 452.4: SECURITY AND CONTROL OF NUCLEAR EXPLOSIVES AND NUCLEAR WEAPONS • DOE O 460.2: DEPARTMENTAL MATERIALS TRANSPORTATION AND PACKAGING MANAGEMENT • DOE O 470.1: SAFEGUARDS AND SECURITY PROGRAM • DOE O 471.1: IDENTIFICATION AND PROTECTION OF UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION • DOE O 471.2A: INFORMATION SECURITY PROGRAM • DOE O 472.1B: PERSONNEL SECURITY ACTIVITIES CANCELE D Page B-6 - Safety Management System Guide - Volume 2 11-26-97 Appendix B • DOE 4330.4B: MAINTENANCE MANAGEMENT PROGRAM • DOE 5480.20A: PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES • DOE 5480.21: UNREVIEWED SAFETY QUESTIONS • DOE 5480.22: TECHNICAL SAFETY REQUIREMENTS • DOE 5480.23: NUCLEAR SAFETY ANALYSIS REPORTS • DOE 5530.1A: ACCIDENT RESPONSE GROUP • DOE 5530.2: NUCLEAR EMERGENCY SEARCH TEAM • DOE 5530.3: RADIOLOGICAL ASSISTANCE PROGRAM • DOE 5530.4: AERIAL MEASURING SYSTEM • DOE 5610.13: JOINT DEPARTMENT OF ENERGY/DEPARTMENT OF DEFENSE NUCLEAR WEAPON SAFETY, SECURITY AND CONTROL ACTIVITIES • DOE 5820.2A: RADIOACTIVE WASTE MANAGEMENT DOE Guides and Technical Standards • DOE-STD-1023-95: Natural Phenomena Hazards Assessment Criteria (including Change No. 1; January 1996) • DOE-STD-1027-92: Guidance on Preliminary Hazard Classification and Accident Analysis Techniques for Compliance with DOE 5480.23 NUCLEAR SAFETY ANALYSIS REPORTS (above) • DOE-STD-1029-92: Writer’s Guide for Technical Procedures • DOE-STD-1030-92: Guide to Good Practices for Lockouts and Tagouts • DOE-STD-1040-93: Guide to Good Practices for Control of On-Shift Training • DOE-STD-1053-93: Guideline to Good Practices for Control of Maintenance

Activities at DOE Nuclear Facilities • DOE-STD-1066-97: Fire Protection Design Criteria • DOE-STD-1070-94: Guidelines for Evaluation of Nuclear Facility Training Programs • DOE-STD-1073-93: Guide for Operational Configuration Management Program • DOE-STD-1077-94: Training Accreditation Program Standard: Requirements and Guidelines • DOE-STD-1082-94: Preparation, Review, and Approval of Implementation Plans for Nuclear Safety Requirements • DOE-STD-1083-95: Requesting and Granting Exemptions to Nuclear Safety Rules • DOE-STD-1088-95: Fire Protection for Relocatable Structures • Draft DOE-STD-1120-97: Integration of Safety and Health into Facility Disposition Activities • DOE-STD-3007-93: Guidelines for Preparing Criticality Safety Evaluations at DOE Non-Reactor Nuclear Facilities • DOE-STD-3009-94: Prep. Guide for U.S. DOE Nonreactor Nuclear Facility Safety Analysis Reports • DOE-STD-3011-94: Guidance for Preparation of DOE 5480.22 TECHNICAL CANCELE D Volume 2 - Safety Management System Guide - Page B-7 Appendix B 11-26-97 SAFETY REQUIREMENTS (TSR) and DOE 5480.23 NUCLEAR SAFETY ANALYSIS REPORTS (SAR) Implementation Plans • EH-STD-0256T: Radiological Control Manual • EH-STD-0416: Criteria for the Department’s Standards Program • EH-STD-0433: DOE Voluntary Protection Program, Part I: Program Elements • EH-STD-0433: DOE Voluntary Protection Program, Part II: Procedures Manual • EH-STD-0433: DOE Voluntary Protection Program, Part III: Application Guidelines • EH-STD-0433: DOE Voluntary Protection Program, Part IV: Onsite Review Handbook • EH-STD-0486: Integrating Safety and Health During Deactivation, With Lessons Learned From Purex • EH-STD-0535: Handbook for Occupational Health and Safety During Hazardous Waste Activities • DOE/EH-0536: Management Perspectives on Worker Protection During DOE Hazardous Waste Activities • EM-STD-5502-94: Hazard Baseline Documentation • EM-STD-5503-94: EM Health and Safety Plan Guidelines • TSL-1-96: DOE Technical Standards List • DOE-76-45-19: Job Safety Analysis, 1979 • DOE-76-45: Barrier Analysis, 1985 • DOE G 414.1-1: IMPLEMENTATION GUIDE FOR USE WITH INDEPENDENT AND MANAGEMENT ASSESSMENT REQUIREMENTS OF 10 CFR PART 830.120 AND DOE 5700.6C, QUALITY ASSURANCE • DRAFT DOE G 430.1-2: SURVEILLANCE AND MAINTENANCE DURING FACILITY DISPOSITION • DRAFT DOE G 430.1-3: DEACTIVATION IMPLEMENTATION GUIDE • DRAFT DOE G 430.1-4: DECOMMISSIONING IMPLEMENTATION GUIDE • DOE G 440.1-1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES GUIDE FOR USE WITH DOE O 440.1 • DOE G 440.1-2: CONSTRUCTION SAFETY MANAGEMENT GUIDE • DOE G 440.1-4: CONTRACTOR OCCUPATIONAL MEDICAL PROGRAM GUIDE FOR USE WITH DOE O 440.1 • DOE G 440.1-5: IMPLEMENTATION GUIDE FOR FIRE SAFETY PROGRAM • DOE G 460.1-1: IMPLEMENTATION GUIDE FOR USE WITH DOE O 460.1A, PACKAGING AND TRANSPORTATION SAFETY DOE Manuals and Handbooks • DOE M 450.3-1: THE DEPARTMENT OF ENERGY CLOSURE PROCESS FOR NECESSARY AND SUFFICIENT SETS OF STANDARDS • DOE M 471.2-1: MANUAL FOR CLASSIFIED MATTER PROTECTION & CONTROL CANCELE D Page B-8 - Safety Management System Guide - Volume 2 11-26-97 Appendix B • DOE-HDBK-1078-94: Training Program Handbook: A Systematic Approach to Training • DOE-HDBK-1079-94: Primer for Tritium Safe Handling Practices • DOE-HDBK 1100-96: Chemical Process Hazards Analysis • DOE-HDBK 1101-96: Process Safety Management for Highly Hazardous

Chemicals • DOE-HDBK 1105-96: Radiological Training for Tritium Facilities • DOE-HDBK 1106-97: Radiological Contamination Control Training for Laboratory Research • DOE-HDBK 1107-97: Knowledge, Skills, and Abilities for Key Radiation Protection Positions at DOE Facilities DOE Documents • Department Report, Standards/Requirements Identification Document Development and Approval Instruction, September 1994 • Department Report, Standards/Requirements Implementation Assessment Instruction, September 1994 Non-DOE Documents • Management of Process Hazards, American Petroleum Institute Recommended Practice 750, 1990 • ISO/FDIS 2919: Radiation protection—Sealed radioactive sources—General requirements and classification • ISO 8194:1987, Radiation protection—Clothing for protection against radioactive contamination—Design, selection, testing and use • ISO 14001:1996, Environmental management systems—Specification with guidance for use • ISO 14004:1996, Environmental management systems—General guidelines on principles, systems, and supporting techniques • DNFSB/TECH-5, Fundamentals for Understanding Standards-Based Safety Management of Department of Energy Defense Nuclear Facilities • DNFSB/TECH-6, Safety Management and Conduct of Operations at the Department of Energy’s Defense Nuclear Facilities • DNFSB/TECH-16, Integrated Safety Management 2.4 PERFORM WORK AND OPERATIONS AUTHORIZATION Federal Rules • 10 CFR 71: PACKAGING AND TRANSPORTATION DOE Policies, Notices, and Orders CANCELE D Volume 2 - Safety Management System Guide - Page B-9 Appendix B 11-26-97 • DOE O 151.1: COMPREHENSIVE EMERGENCY MANAGEMENT SYSTEM • DOE O 425.1: STARTUP AND RESTART OF NUCLEAR FACILITIES • DOE O 440.1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES • DOE O 451.1A: NATIONAL ENVIRONMENTAL POLICY ACT COMPLIANCE PROGRAM • DOE O 452.2A: SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS • DOE 4330.4B: MAINTENANCE MANAGEMENT PROGRAM • DOE 5480.19: CONDUCT OF OPERATIONS REQUIREMENTS FOR DOE FACILITIES • DOE 5480.20A: PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES • DOE 5480.22: TECHNICAL SAFETY REQUIREMENTS • DOE 5530.1A: ACCIDENT RESPONSE GROUP • DOE 5530.2: NUCLEAR EMERGENCY SEARCH TEAM • DOE 5530.3: RADIOLOGICAL ASSISTANCE PROGRAM • DOE 5530.4: AERIAL MEASURING SYSTEM DOE Guides and Technical Standards • DOE-STD-1029-92: Writer’s Guide for Technical Procedures • DOE-STD-1030-92: Guide to Good Practices for Lockouts and Tagouts • DOE-STD-1032-92: Guide to Good Practices for Operations Organization and Administration • DOE-STD-1037-93: Guide to Good Practices for Operations Aspects of Unique Processes • DOE-STD-1039-93: Guide to Good Practices for Control of Equipment and System Status • DOE-STD-1040-93: Guide to Good Practices for Control of On-Shift Training • DOE-STD-1041-93: Guide to Good Practices for Shift Routines and Operating Practices • DOE-STD-1050-93: Guideline to Good Practices for Planning, Scheduling, and Coordination of Maintenance at DOE Nuclear Facilities • DOE-STD-1051-93: Guideline to Good Practices for Maintenance Organization and Administration at DOE Nuclear Facilities • DOE-STD-1052-93: Guideline to Good Practices for Types of Maintenance Activities at DOE Nuclear Facilities • DOE-STD-1053-93: Guideline to Good Practices for Control of Maintenance Activities at DOE Nuclear Facilities • DOE-STD-1055-93: Guideline to Good Practices for Maintenance Management

Involvement at DOE Nuclear Facilities • DOE-STD-1056-93: Guide to Good Practices for Line and Training Manager Activities Related to Training and Qualification • DOE-STD-1065-94: Guideline to Good Practices for Postmaintenance Testing at DOE Nuclear Facilities CANCELE D Page B-10 - Safety Management System Guide - Volume 2 11-26-97 Appendix B • DOE-STD-1070-94: Guidelines for Evaluation of Nuclear Facility Training Programs • DOE-STD-1077-94: Training Accreditation Program Standard: Requirements and Guidelines • DOE-STD-3006-95: Planning and Conduct of Operational Readiness Reviews • DOE-STD-3012-96: Guide to Good Practices for Operational Readiness Reviews • EH-STD-0256T: Radiological Control Manual • NE-STD-1001-91: Guide to Good Practices for Training and Qualification of Instructors • NE-STD-1002-91: Guide to Good Practices for Training and Qualification of Chemical Operators • NE-STD-1003-91: Guide to Good Practices for Training and Qualification of Maintenance Personnel • DOE G 120.1-5: GUIDELINES FOR PERFORMANCE MEASUREMENT • DRAFT DOE G 430.1-2: SURVEILLANCE AND MAINTENANCE DURING FACILITY DISPOSITION • DOE G 440.1-1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES GUIDE FOR USE WITH DOE O 440.1 • DOE G 440.1-2: CONSTRUCTION SAFETY MANAGEMENT GUIDE • DOE G 440.1-4: CONTRACTOR OCCUPATIONAL MEDICAL PROGRAM GUIDE FOR USE WITH DOE O 440.1 • DOE G 440.1-5: IMPLEMENTATION GUIDE FOR FIRE SAFETY PROGRAM DOE Manuals and Handbooks • DOE-HDBK-1078-94: Training Program Handbook: A Systematic Approach to Training • DOE-HDBK-1079-94: Primer for Tritium Safe Handling Practices • DOE-HDBK 1105-96: Radiological Training for Tritium Facilities • DOE-HDBK 1106-97: Radiological Contamination Control Training for Laboratory Research • DOE-HDBK 1108-97: Radiological Safety Training for Accelerator Facilities • DOE-HDBK-3012-96: Guide to Good Practices for Operational Readiness Reviews (ORR), Team Leader’s Guide • DOE-HDBK-5504-95: Guidance for Evaluation of Operational Emergency Plans Non-DOE Documents • DNFSB/TECH-5, Fundamentals for Understanding Standards-Based Safety Management of Department of Energy Defense Nuclear Facilities • DNFSB/TECH-6, Safety Management and Conduct of Operations at the Department of Energy’s Defense Nuclear Facilities • DNFSB/TECH-16, Integrated Safety Management CANCELE D Volume 2 - Safety Management System Guide - Page B-11 Appendix B 11-26-97 2.5 FEEDBACK/IMPROVEMENT DOE Policies, Notices, and Orders • DOE O 210.1: PERFORMANCE INDICATORS AND ANALYSIS OF OPERATIONS INFORMATION • DOE O 225.1: ACCIDENT INVESTIGATIONS • DOE O 231.1: ENVIRONMENT, SAFETY, AND HEALTH REPORTING • DOE O 232.1A: OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS INFORMATION • DOE O 413.1: MANAGEMENT CONTROL PROGRAM • DOE P 450.5: LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT • DOE 5480.29: EMPLOYEE CONCERNS MANAGEMENT SYSTEM DOE Guides and Technical Standards • DOE-STD-1010-92: Guide to Good Practices for Incorporating Operating Experience • DOE-STD-1036-93: Guide to Good Practices for Independent Verification • DOE-STD-1055-93: Guideline to Good Practices for Maintenance Management Involvement at DOE Nuclear Facilities • DOE-STD-1063-93: Establishing and Maintaining a Facility Representative Program at DOE Nuclear Facilities • DOE-STD-1065-94: Guideline to Good Practice for Postmaintenance Testing at DOE Nuclear Facilities • DOE-STD-1070-94: Guidelines for Evaluation of Nuclear Facility Training

Programs • DOE-STD-1077-94: Training Accreditation Program Standard: Requirements and Guidelines • DOE-STD-7501-95: Development of DOE Lessons Learned Programs • EM-STD- 5505-96: Operations Assessments • Draft DOE G 440.1/C-0: EXPERIENCE ASSESSMENT • DOE G 120.1-5: GUIDELINES FOR PERFORMANCE MEASUREMENT • DOE G 225.1-1: IMPLEMENTATION GUIDE FOR USE WITH DOE O 225.1, ACCIDENT INVESTIGATIONS • DOE G 414.1-1: IMPLEMENTATION GUIDE FOR USE WITH INDEPENDENT AND MANAGEMENT ASSESSMENT REQUIREMENTS OF 10 CFR PART 830.120 AND DOE 5700.6C, QUALITY ASSURANCE DOE Manuals and Handbooks • DOE-HDBK-1085-95: DOE Enforcement Program Roles and Responsibilities • DOE-HDBK-1089-95: Guidance for Identifying, Reporting, and Tracking Nuclear Safety Noncompliances • DOE-HDBK-5504-95: Guidance for Evaluation of Operational Emergency Plans CANCELE D Page B-12 - Safety Management System Guide - Volume 2 11-26-97 Appendix B • DOE-HDBK-7502-95: Implementing U.S. Department of Energy Lessons Learned Programs • DOE and contractor management self-assessment requirements • DOE-SAFT-0065-97: Draft Integrated Safety Management System Verification (ISMSV) Process, Team Leader’s Handbook Other Documents • DOE and contractor management self-assessment requirements, including– – Health and Safety Audit Report guidance – Industrial Hygiene Report guidance – Radiological Protection Audit Report guidance – Quality Assurance Audit Report guidance – Specific details from the contract being administered by DOE – Specific Site/Facility/Process/Activity Assessment and programs – Oversight Programs, such as Occurrence Reporting, Facility Representative, – Corrective Action, and Quality Assurance Programs • DNFSB/TECH-5, Fundamentals for Understanding Standards-Based Safety Management of Department of Energy Defense Nuclear Facilities • DNFSB/TECH-6, Safety Management and Conduct of Operations at the Department of Energy’s Defense Nuclear Facilities • DNFSB/TECH-16, Integrated Safety Management 2.6 LINE MANAGEMENT RESPONSIBILITY FOR SAFETY AND CLEAR ROLES AND RESPONSIBILITIES References • 10 CFR 820: PROCEDURAL RULES FOR DOE NUCLEAR ACTIVITIES • DOE M 411.1-1: MANUAL OF SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES AND AUTHORITIES (FRAM) • DOE P 411.1: SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES POLICY 2.7 COMPETENCE COMMENSURATE WITH RESPONSIBILITY References • Federal Acquisition Regulation 15.605 • 41 U.S.C. 253a • 10 CFR 830: Nuclear Safety Management • DOE O 360.1: TRAINING • DOE O 440.1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES CANCELE D Volume 2 - Safety Management System Guide - Page B-13 Appendix B 11-26-97 • DOE O 541.1: APPOINTMENT OF CONTRACTING OFFICERS AND CONTRACTING OFFICER REPRESENTATIVES • DOE 5480.20A: PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES • DOE 5700.6C, QUALITY ASSURANCE • DOE-STD-1056-93: Guide to Good Practices for Line and Training Manager Activities Related to Training and Qualification • NE-STD-1001-91: Guide to Good Practices for Training and Qualification of Instructors • NE-STD-1002-91: Guide to Good Practices for Trng. and Qual. of Chemical Operators • NE-STD-1003-91: Guide to Good Practices for Trng. and Qual. of Maintenance Personnel • DOE-HDBK-1107-97: Knowledge, Skills, and Abilities for Key Radiation Protection Positions at DOE Facilities 2.8 CANCELED DOE DIRECTIVES

Many canceled or partially canceled DOE directives remain on the list because they may have been incorporated into a contract. Requirements of the canceled directives remain applicable until the contract has been renegotiated. • DOE G 151.1-1: EMERGENCY MANAGEMENT GUIDE (CANCELED) • DOE 1540.1A: MATERIAL TRANSPORTATION AND TRAFFIC MANAGEMENT PROGRAM (CANCELED) • DOE 1540.2A: HAZARDOUS MATERIAL PACKAGING FOR TRANSPORTATION - ADMINISTRATIVE PROCEDURES (CANCELED) • DOE 3790.1B: FEDERAL EMPLOYEE OCCUPATIONAL SAFETY PROGRAM (PORTIONS CANCELED) • DOE 3792.2A: FEDERAL EMPLOYEE MOTOR VEHICLE SAFETY PROGRAM (CANCELED) • DOE 5400.1: GENERAL ENVIRONMENT PROTECTION PROGRAM (PORTIONS CANCELED) • DOE 5400.2A: ENVIRONMENTAL COMPLIANCE ISSUE COORDINATION (CANCELED) • DOE 5400.4: CERCLA REQUIREMENTS (CANCELED) • DOE 5400.5: RADIATION PROTECTION OF THE PUBLIC (CANCELED) • DOE 5440.4E: NATIONAL ENVIRONMENTAL POLICY ACT COMPLIANCE PROGRAM (PORTIONS CANCELED) • DOE 5480.4: ENVIRONMENTAL PROTECTION, SAFETY, AND HEALTH PROTECTION (PORTIONS CANCELED) • DOE 5480.6: SAFETY OF DEPARTMENT OF ENERGY-OWNED NUCLEAR REACTORS (CANCELED) • DOE 5480.7A: FIRE PROTECTION (CANCELED) CANCELE D Page B-14 - Safety Management System Guide - Volume 2 11-26-97 Appendix B • DOE 5480.8A: CONTRACTOR OCCUPATIONAL MEDICAL PROGRAM (CANCELED) • DOE 5480.9A: CONSTRUCTION PROJECT SAFETY AND HEALTH MANAGEMENT (CANCELED) • DOE 5480.10: CONTRACTOR INDUSTRIAL HYGIENE PROGRAM (CANCELED) • DOE 5480.11: RADIATION PROTECTION FOR OCCUPATIONAL WORKERS (CANCELED) • DOE 5480.13: AVIATION SAFETY (CANCELED) • DOE 5480.15: DEPARTMENT OF ENERGY LABORATORY ACCREDITATION PROGRAM FOR PERSONNEL DOSIMETRY (CANCELED) • DOE 5480.16A: FIREARMS SAFETY (CANCELED) • DOE 5480.17: SITE SAFETY REPRESENTATIVES NUCLEAR (CANCELED) • DOE 5480.18B: NUCLEAR FACILITY TRAINING ACCREDITATION PROGRAM (CANCELED) • DOE 5480.24: NUCLEAR CRITICALITY SAFETY (CANCELED) • DOE 5480.31: STARTUP AND RESTART OF NUCLEAR FACILITIES (CANCELED) • DOE 5481.1B: SAFETY ANALYSIS AND REVIEW SYSTEM (CANCELED) • DOE 5482.1B: ENVIRONMENT, SAFETY AND HEALTH APPRAISAL PROGRAM ASSESSMENT REQUIREMENTS OF 10 CFR PART 830.120 AND DOE 5700.6C, QUALITY ASSURANCE (CANCELED) • DOE 5483.1B: OCCUPATIONAL, SAFETY AND HEALTH PROGRAM FOR DOE CONTRACTOR EMPLOYEES AT GOVERNMENT-OWNED CONTRACTOR-OPERATED FACILITIES (CANCELED) • DOE 5484.1: ENVIRONMENTAL PROTECTION, SAFETY, AND HEALTH PROTECTION INFORMATION REPORTING REQUIREMENTS (PORTIONS CANCELED) • DOE 5500.1B: EMERGENCY MANAGEMENT (CANCELED) • DOE 5500.2B: EMERGENCY CATEGORIES, CLASSES, AND NOTIFICATION AND REPORTING REQUIREMENTS (CANCELED) • DOE 5500.3A: PLANNING AND PREPAREDNESS FOR OPERATIONAL EMERGENCIES (CANCELED) • DOE 5500.4A: PUBLIC AFFAIRS POLICY AND PLANNING REQUIREMENTS FOR EMERGENCIES (CANCELED) • DOE 5500.7B: EMERGENCY OPERATING RECORDS PROGRAM (CANCELED) • DOE 5500.10: EMERGENCY READINESS ASSURANCE PROGRAM (CANCELED) • DOE 5610.11: NUCLEAR EXPLOSIVE SAFETY (CANCELED) CANCELE D Volume 2 - Safety Management System Guide - Page B-15 Appendix B 11-26-97 This page intentionally left blank. CANCELE D Volume 2 - Safety Management System Guide - Page C-1 Appendix C 11-26-97 APPENDIX C DEVELOPMENT AND EVALUATION GUIDANCE FOR AN INTEGRATED SMS AT A HAZARD CATEGORY 2 NUCLEAR FACILITY

This appendix is specifically developed to provide a baseline of expectations for Category 2 nuclear facilities. Category 1 nuclear facilities would require more rigor and detailed descriptions while Category 3 nuclear facilities and other less hazardous facilities would require less rigor and detail. Each section has a separate list of references that provide helpful information for both developing and implementing an integrated SMS. Most contractors will have additional site specific references that will be important to include in their integrated SMS. The considerations below focus on the five core functions and the seven guiding principles, as defined in the SMS Policy, that must be addressed in the contractor’s SMS, as required by the DEAR. DOE and its contractors should ensure that the SMS is consistent with the objectives, guiding principles, and core functions discussed in this Guide. The acceptability of the level of detail given to each item in a specific case should be based on the work and its associated hazards to ensure adequate protection for employees, the public, and the environment. The following considerations will assist a contractor in developing, evaluating and implementing the SMS core functions and guiding principles. See Volume 1, Chapter II, Sections 1 through 6, for more detail. In addition, the general guidance in Volume 1, Chapter III, Section 2, should also be utilized. The considerations will also help DOE in review and approval of the contractor’s SMS. 1. CONSIDERATIONS FOR CORE FUNCTION 1, DEFINE SCOPE OF WORK AND GUIDING PRINCIPLE 4, BALANCED PRIORITIES As noted in Volume 1, Chapter II, Section 1.1, there are formal methods used internally by DOE and between DOE and its contractors and internal methods used by contractors to define the scope of work. Each organizational level contributes to the definition of the scope of work, (e.g., from the sitewide mission to the processes at an individual facility to the individual operational or maintenance item within a facility). Only through clear definition of the work, is it possible to manage the work safely. The DOE Approval Authority should have a set of processes which interface efficiently and effectively with the contractor organization. DOE processes should include elements of the other core requirements as they apply to the responsibilities of DOE to translate missions into work, set expectations, and allocate resources as well as to approve, control, and authorize operations. CANCELE D Page C-2 - Safety Management System Guide - Volume 2 11-26-97 Appendix C a. Translate Mission into Work. An integrated SMS should include the following: (1) a process to identify the activities necessary to accomplish the assigned mission safely. DOE uses strategic plans, goals, objectives and mission statements as input to define the contractor’s broad work assignments. (2) a process to identify the activities necessary to accomplish the assigned mission safely. The contractor uses DOE strategic plans, goals, objectives, mission statements and work assignments as input to define the contractor’s work proposals. (3) processes to be used by the contractor to develop these DOE approved proposals into discrete work activities with manpower loadings and schedules. The above processes would involve DOE and contractor line management, ES&H safety professionals and the workers, where appropriate [e.g., for tasks requiring work permits (WPs) and radiation work permits (RWPs)]. (See Volume I, Chapter II, Section 2.1.)

b. Set Expectations. An integrated SMS should include processes for establishing performance objectives (e.g., quality, schedule and quantity) including safety for work assigned to the site. The processes would include: (1) DOE budget execution guidance and direction. (2) the Department of Energy Acquisition Regulation including 48 CFR 970.1001. The processes should indicate: (a) the linkage of performance objectives to the work. (b) the integration of safety objectives with work performance objectives. (c) line management’s role in establishing these objectives. The performance objectives would then be negotiated with DOE as part of the contracting process (see Volume I, Chapter II, Section 2.3). CANCELE D Volume 2 - Safety Management System Guide - Page C-3 Appendix C 11-26-97 c. Provide for Integration The DEAR ES&H clause (48 CFR 970.5204-2) and DOE P 450.4 require that environment safety and health functions and activities are integrated into work planning and execution. Integration should be evident throughout all organizational functions at all organizational levels from the site to the individual activity. Volume I, Chapter I, Section 1 provides detailed discussions of important considerations for proper integration. The following sections provide an outline of key integration elements for planning work that should be considered for a hazard Category 2 nuclear facility: (1) An integrated SMS should invoke integrated environment, safety, and health management processes, procedures and/or programs that apply to site, facility, and work activities. Typical sitewide processes, procedures and/or programs would include engineering support, fire protection, emergency preparedness, maintenance, environmental, waste management, industrial hygiene, occupational safety, chemical safety, radiological protection and training. (2) An integrated SMS should establish clearly that it will be applied to all types of work and address all types of hazards. An integrated SMS should: (a) identify necessary processes so that provisions will flow down to each person (employees, subcontractors, temporary employees, visiting researchers, vendor representatives, etc.) performing work. (b) identify the contractor as responsible for compliance with integrated SMS requirements regardless of who is performing the work. (See Volume 1, Chapter II, Section 2.4 for additional details.) d. Prioritize Tasks and Allocate Resources Resources are effectively allocated to address safety, programmatic, and operational considerations. Protecting the public, the workers, and the environment is a priority whenever activities are planned and performed. Balancing priorities is particularly important when defining work, assessing hazards, identifying controls, and in designing feedback and continuous improvement programs. Once a decision is made that a work item is to be conducted, all the identified controls are necessary and thus the decision to do the work includes a prioritization decision to apply the necessary resources as defined by the agreed-upon controls. (1) An integrated SMS should include processes that will be used to prioritize the work performed such as the draft Standard on Risk-Based CANCELE D Page C-4 - Safety Management System Guide - Volume 2 11-26-97 Appendix C Prioritization (STDs Project MISC-002) or site-specific methods such as the Laboratory Integration and Prioritization System (LIPS) at Los Alamos National Lab (LA UR 94-1696). The processes should indicate:

(a) prioritization of tasks at all levels of planning (b) the bases for determining priority (c) line management’s role (d) ES&H safety professionals’ role (2) An integrated SMS should include processes for allocating resources based on priority. The processes would include: (a) specific details from the contract being administered by DOE (b) Activity Data Sheets (c) DOE budget execution guidance and direction (d) UNICALL budget requests (e) Internal Review Budget These processes would generally be part of the contractor’s project management system that would be used in defining operations plans, work plans and budgets (see Volume I, Chapter II, Sections 2.1 and 2.5 ). e. References Rules 48 CFR 970.1001 and 970.5204, DEPARTMENT OF ENERGY ACQUISITION REGULATIONS DOE Orders and Policies DOE P 450.4: SAFETY MANAGEMENT SYSTEM POLICY DOE O 130.1: BUDGET FORMULATION PROCESS DOE O 135.1: BUDGET EXECUTION - FUNDS DISTRIBUTION AND CONTROL DOE O 251.1: DIRECTIVES SYSTEM DOE P 251.1: DIRECTIVES SYSTEM CANCELE D Volume 2 - Safety Management System Guide - Page C-5 Appendix C 11-26-97 DOE O 331.1: DEPARTMENTAL EMPLOYEE PERFORMANCE MANAGEMENT SYSTEM DOE O 350.1: CONTRACTOR HUMAN RESOURCE MANAGEMENT PROGRAMS DOE O 413.1: MANAGEMENT CONTROL PROGRAM DOE O 430.1: LIFE CYCLE ASSET MANAGEMENT (See also DRAFT DOE O 430.1A.) DOE O 470.1: SAFEGUARDS AND SECURITY PROGRAM DOE O 471.1: IDENTIFICATION AND PROTECTION OF UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION DOE O 471.2: INFORMATION SECURITY PROGRAM DOE O 472.1B: PERSONNEL SECURITY ACTIVITIES DOE O 541.1: APPOINTMENT OF CONTRACTING OFFICERS AND CONTRACTING OFFICER REPRESENTATIVES DOE 4300.1C: REAL PROPERTY MANAGEMENT DOE 4320.2A: CAPITAL ASSET MANAGEMENT PROCESS DOE 4700.1C: PROJECT MANAGEMENT SYSTEM DOE Guides DOE G 120.1-5: GUIDELINES FOR PERFORMANCE MEASUREMENT DOE G 430.1: COST ESTIMATING GUIDE DOE G 440.1-4: CONTRACTOR OCCUPATIONAL MEDICAL PROGRAM GUIDE FOR USE WITH DOE O 440.1 DOE Manuals DOE M 135.1-1: BUDGET EXECUTION MANUAL DOE M 411.1-1: MANUAL OF SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES AND AUTHORITIES (FRAM) DOE M 471.2-1: MANUAL FOR CLASSIFIED MATTER PROTECTION & CONTROL Other Documents DOE-STD-XXXX-YR: Guidelines for Risk Based Prioritization of DOE Activities Specific details from the contract being administered by DOE Lower-level functions, responsibilities, and authorities (FRA) documents Specific site/facility/process/activity assignment, responsibility and reporting processes, procedures, and program Strategic Plans promulgated by DOE Headquarters Strategic Plans provided to the contractor from DOE Goals and objectives provided to the contractor from DOE Mission statements provided to the contractor from DOE CANCELE D Page C-6 - Safety Management System Guide - Volume 2 11-26-97 Appendix C 2. CONSIDERATIONS FOR CORE FUNCTION 2, ANALYZE HAZARDS Hazard analyses are performed at each organizational level from the work defined in the sitewide mission (as in an Environmental Impact Statement) to the processes at an individual facility (as in a Safety Analysis Report) to the individual operational or maintenance item which is contemplated within a facility (as in a Process Hazards Analysis). The hazards which are analyzed should include nuclear as well as chemical and common industrial hazards. The analysis should be balanced to the complexity of the work as well as the significance of the risk.

The objective of hazards analysis is to develop an understanding of the potential for the hazard to impact the worker, public and the environment. Hazard controls should be established based on this understanding and other factors related to the work. a. Identify Hazards. An integrated SMS should include methods for identifying hazards. (1) They should address all types of hazards that are present (e.g., nuclear, chemical, industrial, fire, natural phenomena, construction, etc.) (2) They should address hazards for all the stages of the work to be performed (e.g., normal operations, surveillance, maintenance, facility modification, decontamination and decommissioning, etc.) The identification process would normally be keyed to the type and magnitude of the hazards (e.g., walk-throughs for normal industrial hazards). b. Analyze Hazards. An integrated SMS should include methods for analyzing hazards. These methods should implement: (1) the requirements from DOE O 420.1, DOE O 452.2, and DOE 5480.23 appropriate to the identified hazards, (2) hazard prevention programs appropriate to the facility’s life cycle. For example, facilities in operation would implement criticality safety, fire protection, radiological protection, natural phenomena hazard protection, occupational safety, and maintenance programs. The hazard analysis methods should address: (1) all types of hazards (nuclear, industrial fire, external events, natural phenomena, construction, chemical, etc.) CANCELE D Volume 2 - Safety Management System Guide - Page C-7 Appendix C 11-26-97 (2) all types and stages of work (normal operations, surveillance, deactivation, maintenance, facility modification, decontamination and decommissioning, etc.) These methods should implement DOE and other regulatory requirements (e.g., DOE O 440.1, DOE 5480.23, DOE 5480.25, 29 CFR 1910, NEPA, EPA etc.) as applicable to the type and magnitude of the hazard. The hazard analysis methods should be tailored to the type and magnitude of identified hazards, and should consider alternatives that could eliminate or reduce the hazards. c. Categorize Hazards. An integrated SMS should include: (1) a process for categorizing hazards consistent with DOE-STD-1027 and DOE O 430.1. (2) a process which defines the use of the categories in the hazard analysis, including decommissioning. Revised DOE O 430.1A, LIFE CYCLE ASSET MANAGEMENT, and the associated Guides and Draft DOE- STD-1120-97 provide special hazard identification and analysis methods applicable to facility disposition activities. The analytical method and level of detail would be determined by the hazard category (see Volume I, Chapter II, Section 3). d. References Rules 10 CFR 830: NUCLEAR SAFETY MANAGEMENT 10 CFR 835: RADIATION PROTECTION FOR OCCUPATIONAL WORKERS 10 CFR 1021: NEPA 29 CFR 1910: OCCUPATIONAL SAFETY AND HEALTH STANDARDS 29 CFR 1926: OCCUPATIONAL SAFETY AND HEALTH REGULATIONS FOR CONSTRUCTION 40 CFR 50 TO 195: EPA AIR, WATER AND RADIATION PROTECTION REQUIREMENTS DOE Orders and Policies DOE P 410.1A: DEVELOPING NUCLEAR SAFETY REQUIREMENTS DOE O 420.1: FACILITY SAFETY DOE O 430.1: LIFE CYCLE ASSET MANAGEMENT (See also DRAFT DOE O 430.1A.) DOE O 440.1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES DOE O 452.2: SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS CANCELE D Page C-8 - Safety Management System Guide - Volume 2 11-26-97 Appendix C

DOE O 452.4: SECURITY AND CONTROL OF NUCLEAR EXPLOSIVES AND NUCLEAR WEAPONS DOE O 460.1A: PACKAGING AND TRANSPORTATION SAFETY DOE 5480.23: NUCLEAR SAFETY ANALYSIS REPORTS DOE 5480.30: NUCLEAR REACTOR SAFETY DESIGN CRITERIA DOE 5610.11: NUCLEAR EXPLOSIVE SAFETY DOE Guides and Technical Standards DOE-STD-1021-93: Natural Phenomena Hazards Performance Categorization Guidelines for Structures, Systems, and Components DOE-STD-1022-94: Natural Phenomena Hazards Site Characterization Criteria DOE-STD-1023-95: Natural Phenomena Hazards Assessment Criteria (including Change Notice 1; January 1996) DOE-STD-1027-92: Guidance on Preliminary Hazard Classification and Accident Analysis DOE-STD-1088-95: Fire Protection for Relocatable Structures DOE-STD-1101-96: Process Safety Management for Highly Hazardous Chemicals DOE-STD-1104-96: Review and Approval of Nonreactor Nuclear Facility Safety Analysis Reports Draft DOE-STD-1120-97: Integration of Safety and Health into Facility Disposition Activities DOE-STD-3007-93: Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Nonreactor Nuclear Facilities DOE-STD-3009-94: Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports DOE-STD-3014-96: Accident Analysis for Aircraft Crash into Hazardous Facilities DOE-STD-3015-97: Nuclear Explosive Safety Study Process EM-5502-94: Hazard Baseline Documentation EM-5503-94: EM Health and Safety Plan Guidelines DOE G 420.1-X: IMPLEMENTATION GUIDE FOR NONREACTOR NUCLEAR SAFETY DESIGN CRITERIA AND EXPLOSIVES SAFETY CRITERIA DOE G 420.1-Y: IMPLEMENTATION GUIDE FOR THE MITIGATION OF NATURAL PHENOMENA HAZARDS FOR DOE NUCLEAR FACILITIES AND NON-NUCLEAR FACILITIES DOE Manuals and Handbooks HDBK-1100-96: Chemical Process Hazards Analysis HDBK-1101-96: Process Safety Management for Highly Hazardous Chemicals HDBK-3010-94: Airborne Release Fractions/Rates and Respirable Fractions for Nonreactor Nuclear Facilities, Vols. I & II DOE M 440.1-1: DOE EXPLOSIVES SAFETY MANUAL CANCELE D Volume 2 - Safety Management System Guide - Page C-9 Appendix C 11-26-97 3. CONSIDERATIONS FOR CORE FUNCTION 3, DEVELOP/IMPLEMENT HAZARDS CONTROLS, GUIDING PRINCIPLE 5, IDENTIFICATION OF SAFETY STANDARDS AND REQUIREMENTS; AND GUIDING PRINCIPLE 6, HAZARD CONTROLS TAILORED TO WORK BEING PERFORMED Before work is performed, the associated hazards are evaluated and an agreed-upon set of safety standards and requirements are established which, if properly implemented, will provide adequate assurance that the public, the workers, and the environment are protected from adverse consequences of identified hazards. Figure 4 (Chapter II, Volume 1) illustrates the conceptual process for establishing sitewide standards and requirements. a. Identify Standards and Requirements (Core Function 3 and Guiding Principle 5) (1) An integrated SMS should include processes to establish the set of ES&H standards and requirements for the work consistent with the requirements of the DEAR (see Volume 1, Attachment 2, 48 CFR 970.5204 and 970.5204-78). The process for identifying standards/requirements should be one of the existing, accepted approaches (see Volume 1, Chapter II ), or it should be consistent with the objectives and concepts of existing, accepted approaches. Figure 5 (Volume 1, Chapter II) provides an illustration of typical standards and requirements for a Hazard Category 2 nuclear facility. The processes should :

(a) identify a set of ES&H standards and requirements that provide adequate assurance that employees, the public and the environment are protected from adverse consequences. (b) conform to applicable laws, statutes, Federal rules and DOE directives and use appropriate national consensus standards, DOE Technical Standards, and DOE Guides (see Volume I, Chapter II, Section 4.1 for additional details). (c) provide for DOE review and concurrence. b. Identify Controls to Prevent/Mitigate Hazards. An integrated SMS should include a process for identifying administrative controls, safety controls, safety programs, and other conditions on the work [e.g., Technical Safety Requirements (TSRs) and Operational Safety Limits]. Figure 2 (Volume 1, Chapter I) illustrates the types of controls and conditions that would be identified for work processes at a typical Hazard Category 2 nuclear facility. The process should: (1) tailor the controls to the work and associated hazards (see Volume I, Chapter II, Section 4.3 for additional details). CANCELE D Page C-10 - Safety Management System Guide - Volume 2 11-26-97 Appendix C (2) address controls for all activities (e.g., normal operations, surveillance, maintenance work, facility modifications, etc.) (3) address controls for all aspects of the work (e.g., initiation, review, authorization, and execution). c. Establish Safety Controls. An integrated SMS should include a process to establish and document administrative controls, safety controls, safety programs, and other conditions on the work. An integrated SMS should include process(s) for establishing and maintaining the safety boundaries (safety envelope) for the work. An integrated SMS should include method(s) for establishing and maintaining the safety boundaries (safety envelope) for the work. The method should: (1) define the composition of the safety boundaries (safety envelope). (2) identify appropriate controls, conditions, and requirements (e.g., TSRs or Operational Safety Limits) that constitute the safety boundaries (see Volume I, Chapter II, Section 4.3 for additional details). d. Implement Controls The integrated SMS should provide for a method to implement the controls identified at every level of work and hazard. The methods should provide for assurance that the controls remain in effect so long as the hazard is present. (1) An integrated SMS should include processes the contractor and subcontractors will use to implement the controls. Figure C.1 illustrates the types of procedures and documentation that Westinghouse uses to implement necessary controls at the Savannah River Site. Table C.1 provides the list of titles for the Westinghouse documents in Figure C.1. Figure C.2 provides a similar illustration of identified documents and procedures for a nuclear facility (Building 332) at LLNL. Table C.1 provides the list of topics for the LLNL documents cited in Figure C.2. The process of implementing controls should: (a) include processes the contractor will use to implement the administrative controls, safety controls, safety programs, and other conditions that affect the work to be performed. A method should be briefly described for translating these processes to the working level (“floor level”) controls used by workers performing the program work (see Volume I, Chapter II, Section 4.3 for additional details). CANCELE D Volume 2 - Safety Management System Guide - Page C-11 Appendix C 11-26-97 Including management personnel.1

(b) provide for testing or verifying the controls (self assessment). (2) An integrated SMS should include processes (e.g., a personnel training and qualification program) to ensure that personnel are qualified to discharge1 their responsibilities (Guiding Principle 3; see Volume I, Chapter II, Section 1). The process should include: (a) an analysis of work assignments to identify necessary experience, knowledge, skills, and abilities for each assignment. (b) provision for appropriate training of personnel in the knowledge, skills, and abilities required for their work assignments. e. References Rules 10 CFR 830: NUCLEAR SAFETY MANAGEMENT 10 CFR 835: RADIATION PROTECTION FOR OCCUPATIONAL WORKERS 10 CFR 1021: NEPA 29 CFR 1910: OCCUPATIONAL SAFETY AND HEALTH STANDARDS 29 CFR 1926: OCCUPATIONAL SAFETY AND HEALTH REGULATIONS FOR CONSTRUCTION 40 CFR 50 TO 195: EPA AIR, WATER AND RADIATION PROTECTION REQUIREMENTS DOE Policies and Orders DOE O 360.1: TRAINING DOE O 420.1: FACILITY SAFETY DOE O 440.1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES DOE P 450.1: ENVIRONMENT, SAFETY, AND HEALTH POLICY FOR THE DEPARTMENT OF ENERGY COMPLEX DOE P 450.2A: IDENTIFICATION, IMPLEMENTATION, AND COMPLIANCE WITH ENVIRONMENT, SAFETY AND HEALTH REQUIREMENTS DOE N 450.3: USE OF NECESSARY AND SUFFICIENT PROCESS DOE P 450.3: AUTHORIZING USE OF THE NECESSARY AND SUFFICIENT PROCESS FOR STANDARDS-BASED ENVIRONMENT, SAFETY AND HEALTH MANAGEMENT DOE P 450.4: SAFETY MANAGEMENT SYSTEM POLICY CANCELE D Page C-12 - Safety Management System Guide - Volume 2 11-26-97 Appendix C DOE O 451.1: NATIONAL ENVIRONMENTAL POLICY ACT COMPLIANCE PROGRAM DOE O 452.4: SECURITY AND CONTROL OF NUCLEAR EXPLOSIVES AND NUCLEAR WEAPONS DOE 4330.4B: MAINTENANCE MANAGEMENT PROGRAM DOE 5400.4: CERCLA REQUIREMENTS DOE 5480.18B: TRAINING ACCREDITATION DOE 5480.19: CONDUCT OF OPERATIONS REQUIREMENTS FOR DOE FACILITIES DOE 5480.20A: PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES DOE 5480.21: UNREVIEWED SAFETY QUESTIONS DOE 5480.22: TECHNICAL SAFETY REQUIREMENTS DOE 5480.23: NUCLEAR SAFETY ANALYSIS REPORTS DOE 5500.7B: EMERGENCY OPERATING RECORDS PROGRAM DOE 5500.10: EMERGENCY READINESS ASSURANCE PROGRAM DOE 5530.1A: ACCIDENT RESPONSE GROUP DOE 5530.2: NUCLEAR EMERGENCY SEARCH TEAM DOE 5530.3: RADIOLOGICAL ASSISTANCE PROGRAM DOE 5530.4: AERIAL MEASURING SYSTEM DOE 5610.13: JOINT DEPARTMENT OF ENERGY/DEPARTMENT OF DEFENSE NUCLEAR WEAPON SAFETY, SECURITY AND CONTROL ACTIVITIES DOE 5820.2A: RADIOACTIVE WASTE MANAGEMENT DOE Guides and Technical Standards DOE-STD-1023-95: Natural Phenomena Hazards Assessment Criteria (including Change No. 1; 01/96) DOE-STD-1027-92: Guidance on Preliminary Hazard Classification and Accident Analysis Techniques for Compliance with DOE 5480.23 NUCLEAR SAFETY ANALYSIS REPORTS (above) DOE-STD-1029-92: Writer’s Guide for Technical Procedures DOE-STD-1030-92: Guide to Good Practices for Lockouts and Tagouts DOE-STD-1040-93: Guide to Good Practices for Control of On-Shift Training STD-1053-93, Guideline to Good Practices for Control of Maintenance Activities at DOE Nuclear Facilities DOE-STD-1066-97: Fire Protection Design Criteria DOE-STD-1070-94: Guidelines for Evaluation of Nuclear Facility Training Programs DOE-STD-1073-93: Guide for Operational Configuration Management Program DOE-STD-1077-94: Training Accreditation Program Standard: Requirements and Guidelines

CANCELE D Volume 2 - Safety Management System Guide - Page C-13 Appendix C 11-26-97 DOE-STD-1082-94 Preparation, Review, and Approval of Implementation Plans for Nuclear Safety Requirements DOE-STD-1083-95: Requesting and Granting Exemptions to Nuclear Safety Rules DOE-STD-1088-95: Fire Protection for Relocatable Structures Draft STD-1120-97: Integration of Safety and Health into Facility Disposition Activities DOE-STD-3007-93: Guidelines for Preparing Criticality Safety Evaluations at DOE Nonreactor Nuclear Facilities DOE-STD-3009-94: Prep. Guide for U.S. DOE Nonreactor Nuclear Facility Safety Analysis Reports DOE-STD-3011-94: Guidance for Preparation of DOE 5480.22 TECHNICAL SAFETY REQUIREMENTS (TSR) and DOE 5480.23 NUCLEAR SAFETY ANALYSIS REPORTS (SAR) Implementation Plans EH-0256T: Radiological Control Manual EH-0416: Criteria for the Department’s Standards Program DOE/EH-0536: Management Perspectives on Worker Protection During DOE Hazardous Waste Activities EM 5502-94: Hazard Baseline Documentation EM-5503-94: EM Health and Safety Plan Guidelines DOE G 414.1-1: IMPLEMENTATION GUIDE FOR USE WITH INDEPENDENT AND MANAGEMENT ASSESSMENT REQUIREMENTS OF 10 CFR PART 830.120 AND DOE 5700.6C, QUALITY ASSURANCE DOE G 151.1-1: EMERGENCY MANAGEMENT GUIDE DOE G 414.1-1: IMPLEMENTATION GUIDE FOR USE WITH INDEPENDENT AND MANAGEMENT ASSESSMENT REQUIREMENTS OF 10 CFR PART 830.120 AND DOE 5700.6C, QUALITY ASSURANCE Draft DOE G 430.1-2: SURVEILLANCE AND MAINTENANCE DURING FACILITY DISPOSITION Draft DOE G 430.1-3: DEACTIVATION IMPLEMENTATION GUIDE Draft DOE G 430.1-4: DECOMMISSIONING IMPLEMENTATION GUIDE DOE G 440.1-1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES GUIDE FOR USE WITH DOE O 440.1 DOE G 440.1-2: CONSTRUCTION SAFETY MANAGEMENT GUIDE DOE G 440.1-4: CONTRACTOR OCCUPATIONAL MEDICAL PROGRAM GUIDE FOR USE WITH DOE O 440.1 DOE G 440.1-5: IMPLEMENTATION GUIDE FOR FIRE SAFETY PROGRAM DOE Manuals and Handbooks DOE M 450.3-1: THE DEPARTMENT OF ENERGY CLOSURE PROCESS FOR NECESSARY AND SUFFICIENT SETS OF STANDARDS CANCELE D Page C-14 - Safety Management System Guide - Volume 2 11-26-97 Appendix C DOE-HDBK-1078-94: Training Program Handbook: A Systematic Approach to Training DOE-HDBK-1079-94: Primer for Tritium Safe Handling Practices DOE-HDBK-1100-96: Chemical Process Hazards Analysis DOE-HDBK-1101-96: Process Safety Management for Highly Hazardous Chemicals DOE-HDBK-1105-96: Radiological Training for Tritium Facilities DOE-HDBK-1106-97: Radiological Contamination Control Training for Laboratory Research DOE-HDBK-1107-97: Knowledge, Skills, and Abilities for Key Radiation Protection Positions at DOE Facilities Other Documents Department Report: Standards/Requirements Identification Document Development and Approval Instruction, September 1994 Department Report: Standards/Requirements Implementation Assessment Instruction, September 1994 ISO/FDIS 2919: Radiation protection—Sealed radioactive sources—General requirements and classification ISO 8194:1987: Radiation protection—Clothing for protection against radioactive contamination—Design, selection, testing and use ISO 14001:1996: Environmental management systems—Specification with guidance for use ISO 14004:1996: Environmental management systems—General guidelines on principles, systems and supporting techniques 4. CONSIDERATIONS FOR CORE FUNCTION 4, PERFORM WORK AND GUIDING PRINCIPLE 7, OPERATIONS AUTHORIZATION

Contractor policies, procedures, and documents are established to implement safety management and fulfill commitments to DOE and are adequate for the work or process to be performed, safely. a. Confirm Readiness. An integrated SMS should include a process to confirm that the facility or process and the operational work force are in an adequate state of readiness prior to authorizing the performance of the work [e.g., Guiding Principle 7, readiness assessments, operational readiness reviews (ORRs), Title III inspections (project design), etc.]. (See Volume I, Chapter II, Section 5.) The processes should ensure that— (1) personnel are qualified and trained for performance of work in accordance with the controls established (Guiding Principle 3; see Volume I, Chapter II, Section 1); (2) controls are adequate to ensure safe work performance and to prevent accidents, uncontrolled releases, or unacceptable exposures to hazardous materials (see Volume I, Chapter II, Section 5); CANCELE D Volume 2 - Safety Management System Guide - Page C-15 Appendix C 11-26-97 (3) the necessary safety support functions and interfaces required (e.g., training, maintenance, radiological protection, etc.) have been established (see Volume I, Chapter II, Section 5); (4) the operability of the necessary facility or process systems required for safe operation has been verified in accordance with the bases established in appropriate authorization agreements. b. Operations Authorization. The integrated SMS should provide for gaining authorization to conduct operations. Provisions should be included to grant operations authorizations for each level of effort at the site, facility, activity, or process. Such provisions or procedures may include an Operational Readiness Review, approval to resume operations following a weekend shutdown, and authorization to start individual procedures or work items through mechanisms such as work clearance permits, shift orders, or shift manager’s control. The integrated SMS should also provide for updating and configuration control for the operations authorization documentation such as authorization agreements, permits, SARs, etc. (See Volume I, Chapter II, Section 5 for additional details.) (1) The scope of an authorization agreement should correspond to the scope and complexity of the operation(s) being authorized, and the scope and complexity of the operation should be clearly defined. For nuclear facilities, a formally established and documented authorization basis is required and it must be approved by DOE. For non-nuclear activities, a set of controls should be established and agreed to between DOE and the contractor. Such agreements are established in Health and Safety Plans (HASPs) or other similar documents. (2) An authorization agreement should clearly delineate terms and conditions for authorizing site, facility or activity operations. Reference should be made to formal documents [e.g., SARs, associated SERs, USQ process documents, TSRs and HASPs]. (3) An authorization agreement for operations that are conducted in more than one facility should identify the authorization basis for each part of the operation performed in a different facility. (4) An integrated SMS should include a process for determining when an additional authorization agreement is needed. (5) An authorization agreement should reference or describe the process for assessing and approving changes. It should also identify the types of changes that require revising an authorization agreement.

CANCELE D Page C-16 - Safety Management System Guide - Volume 2 11-26-97 Appendix C c. Perform Work Safely. An integrated SMS should include the processes (i.e., work practices) for ensuring that safety requirements are integrated into work performance (e.g., via work practices and floor level procedures). Procedures and programs should be adequate to insure that work is performed within the controls which have been developed and implemented. Controls may include site or facility commitments such as conduct of operations and maintenance programs, worker safety programs, specified engineered safety systems, or specific controls in worker safety permits. The controls may be specified in site-level programs or facility specific authorization bases documents. The integrated SMS should include provisions to insure that ongoing work continues to be performed within the specified and agreed-upon controls. The processes should ensure that– (1) personnel are qualified, trained, responsible and accountable for performance of work in accordance with the controls established (see Volume 1, Chapter II, Section 1); (2) the work practices routinely are applied commensurate with the hazards; (3) the processes are sufficiently rigorous to ensure safe work performance and to prevent accidents, releases, and exposures, considering the hazards; (4) the controls (TSRs, OSRs, etc.) are a discernible part of the work practices; (5) the necessary safety support functions (e.g., training, maintenance, radiological protection, etc.) are identified; and (6) interfaces with safety support organizations are identified. d. Performance Measures. An integrated SMS should include a process to identify performance measures, including safety performance measures for the work (see Section 1.b above and Volume I Chapter II, Sections 5 and 6). (1) The performance measures should provide information that is truly a direct indicator of how safely the work is being performed. (2) The performance measures should be clearly linked to the performance objectives and expectations. (3) The performance measures should be performance based. CANCELE D Volume 2 - Safety Management System Guide - Page C-17 Appendix C 11-26-97 e. References DOE Orders DOE O 425.1: STARTUP AND RESTART OF NUCLEAR FACILITIES DOE O 440.1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES DOE O 451.1: NATIONAL ENVIRONMENTAL POLICY ACT COMPLIANCE PROGRAM DOE O 452.2: SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS DOE 4330.4B: MAINTENANCE MANAGEMENT PROGRAM DOE 5400.4: CERCLA REQUIREMENTS DOE 5480.19: CONDUCT OF OPERATIONS REQUIREMENTS FOR DOE FACILITIES DOE 5480.18B: TRAINING ACCREDITATION DOE 5480.20A: PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES DOE 5480.22: TECHNICAL SAFETY REQUIREMENTS DOE 5500.7B: EMERGENCY OPERATING RECORDS PROGRAM DOE 5500.10: EMERGENCY READINESS ASSURANCE PROGRAM DOE 5530.1A: ACCIDENT RESPONSE GROUP DOE 5530.2: NUCLEAR EMERGENCY SEARCH TEAM DOE 5530.3: RADIOLOGICAL ASSISTANCE PROGRAM DOE 5530.4: AERIAL MEASURING SYSTEM DOE Guides and Technical Standards DOE-STD-1029-92: Writer’s Guide for Technical Procedures DOE-STD-1030-92: Guide to Good Practices for Lockouts and Tagouts DOE-STD-1032-92: Guide to Good Practices for Operations Organization and Administration DOE-STD 1037-93: Guide to Good Practices for Operations Aspects of Unique Processes

DOE-STD 1039-93: Guide to Good Practices for Control of Equipment and System Status DOE-STD-1040-93: Guide to Good Practices for Control of On-Shift Training DOE-STD-1041-93: Guide to Good Practices for Shift Routines and Operating Practices DOE-STD 1050-93: Guideline to Good Practices for Planning, Scheduling, and Coordination of Maintenance at DOE Nuclear Facilities DOE-STD-1051-93: Guideline to Good Practices for Maintenance Organization and Administration at DOE Nuclear Facilities DOE-STD-1052-93: Guideline to Good Practices for Types of Maintenance Activities at DOE Nuclear Facilities CANCELE D Page C-18 - Safety Management System Guide - Volume 2 11-26-97 Appendix C DOE-STD-1053-93: Guideline to Good Practices for Control of Maintenance Activities at DOE Nuclear Facilities DOE-STD-1055-93: Guideline to Good Practices for Maintenance Management Involvement at DOE Nuclear Facilities DOE-STD-1056-93: Guide to Good Practices for Line and Training Manager Activities Related to Training and Qualification DOE-STD-1065-94: Guideline to Good Practices for Postmaintenance Testing at DOE Nuclear Facilities DOE-STD-1070-94: Guidelines for Evaluation of Nuclear Facility Training Programs DOE-STD-1077-94: Training Accreditation Program Standard: Requirements and Guidelines DOE-STD-3006-95: Planning and Conduct of Operational Readiness Reviews DOE-STD-3012-96: Guide to Good Practices for Operational Readiness Reviews EH-0256T Radiological Control Manual NE-1001-91: Guide to Good Practices for Training and Qualification of Instructors NE-1002-91: Guide to Good Practices for Training and Qualification of Chemical Operators NE-1003-91: Guide to Good Practices for Training and Qualification of Maintenance Personnel DOE G 440.1-1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES GUIDE FOR USE WITH DOE O 440.1 DOE G 440.1-2: CONSTRUCTION SAFETY MANAGEMENT GUIDE DOE G 440.1-4: CONTRACTOR OCCUPATIONAL MEDICAL PROGRAM GUIDE FOR USE WITH DOE O 440.1 DOE G 440.1-5: IMPLEMENTATION GUIDE FOR FIRE SAFETY PROGRAM DOE Handbooks DOE-HDBK-1078-94: Training Program Handbook: A Systematic Approach to Training DOE-HDBK-1079-94: Primer for Tritium Safe Handling Practices DOE-HDBK-3012-96: Guide to Good Practices for Operational Readiness Reviews (ORR), Team Leader’s Guide DOE-HDBK-5504-95: Guidance for Evaluation of Operational Emergency Plans 5. CONSIDERATIONS FOR CORE FUNCTION 5, FEEDBACK AND IMPROVEMENT All aspects of the integrated SMS should be subject to continuous improvement through an assessment and a feedback process. At each level of work and at every stage in the CANCELE D Volume 2 - Safety Management System Guide - Page C-19 Appendix C 11-26-97 work process, the feedback and continuous improvement programs should be functioning. Feedback information on the adequacy of controls is gathered, opportunities for improving the execution and planning of work are identified and implemented, line and independent oversight is conducted, and if necessary, regulatory enforcement actions occur (see Volume I, Chapter II, Section 6). a. Collect Feedback Information. An integrated SMS should include processes for operational safety, such as self assessment, monitoring against performance objectives, occurrence reporting, and routine observation. The processes should include line management and worker feedback as well as independent oversight (see Volume 1, Chapter II, Section 6 and Appendix D).

b. Identify Improvement Opportunities. An integrated SMS should evaluate feedback and oversight information. Such an evaluation should include processes for translating this operational information into recommendations for improvement and processes for translating lessons learned both onsite and from other sites into recommendations for improvement. An integrated SMS description should include a worker suggestion program for improving safety. c. Make Changes to Improve. An integrated SMS should contain processes for management to consider and dispose of recommendations for improvement, including worker suggestions. The description should illustrate the process for translating feedback from assessments, lessons learned programs, and other inputs into improvements. d. Oversight and Enforcement. An integrated SMS should include processes for oversight by contractor management. Interfaces for communication with external oversight organizations should be indicated (for example, EPA, OSHA, DOE Office of Oversight, etc.). e. References DOE Policies and Orders DOE O 210.1: PERFORMANCE INDICATORS AND ANALYSIS OF OPERATIONS INFORMATION DOE O 225.1: ACCIDENT INVESTIGATIONS DOE O 231.1: ENVIRONMENT, SAFETY, AND HEALTH REPORTING DOE O 232.1A: OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS INFORMATION DOE P 450.5: LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT DOE 5480.18B: NUCLEAR FACILITY TRAINING ACCREDITATION PROGRAM DOE 5480.29: EMPLOYEE CONCERNS MANAGEMENT SYSTEM CANCELE D Page C-20 - Safety Management System Guide - Volume 2 11-26-97 Appendix C DOE 5482.1B: ENVIRONMENT, SAFETY AND HEALTH APPRAISAL PROGRAM Assessment Requirements of 10 CFR PART 830.120 and DOE 5700.6C, QUALITY ASSURANCE DOE Guides and Technical Standards DOE-STD-1010-92: Guide to Good Practices for Incorporating Operating Experience DOE-STD-1036-93: Guide to Good Practices for Independent Verification DOE-STD-1055-93: Guideline to Good Practices for Maintenance Management Involvement at DOE Nuclear Facilities DOE-STD-1065-94: Guideline to Good Practice for Postmaintenance Testing at DOE Nuclear Facilities DOE-STD-7501-95: Development of DOE Lessons Learned Programs EM 5505-96: Operations Assessments DOE-HDBK-7502-95: Implementing U.S. Department of Energy Lessons Learned Programs Draft DOE G 440.1/C-0: EXPERIENCE ASSESSMENT DOE G 120.1-5: GUIDELINES FOR PERFORMANCE MEASUREMENT DOE G 225.1-1: IMPLEMENTATION GUIDE FOR USE WITH DOE O 225.1, ACCIDENT INVESTIGATIONS DOE G 414.1-1: IMPLEMENTATION GUIDE FOR USE WITH INDEPENDENT AND MANAGEMENT ASSESSMENT REQUIREMENTS OF 10 CFR PART 830.120 AND DOE 5700.6C, QUALITY ASSURANCE DOE Handbooks DOE-HDBK-1085-95: DOE Enforcement Program Roles and Responsibilities DOE-HDBK-1089-95: Guidance for Identifying, Reporting, and Tracking Nuclear Safety Noncompliances DOE-HDBK-7502-95: Implementing U.S. Department of Energy Lessons Learned Programs DOE and contractor management self assessment requirements DOE-SAFT-0065: Draft Integrated Safety Management System Verification (ISMSV) Process, Team Leader’s Handbook Other Documents DOE and contractor management self assessment requirements, including: – Health and Safety Audit Report guidance – Industrial Hygiene Report guidance – Radiological Protection Audit Report guidance – Quality Assurance Audit Report guidance – Specific details from the contract being administered by DOE – Specific Site/Facility/Process/Activity Assessment and programs CANCELE D

Volume 2 - Safety Management System Guide - Page C-21 Appendix C 11-26-97 Oversight Programs, such as Occurrence Reporting, Facility Representative, Corrective Action, and Quality Assurance Programs 6. CONSIDERATIONS FOR GUIDING PRINCIPLES 1, LINE MANAGEMENT RESPONSIBILITY FOR SAFETY AND 2, CLEAR ROLES AND RESPONSIBILITIES At every level of control, line management must be responsible for safety. Clear and unambiguous roles and responsibilities should be defined and maintained at all levels within the organization defined by the integrated SMS description. All aspects of work identification, planning and execution must be under the control and responsibility of line management. Support organizations such as ES&H or Human Resources must have clearly defined roles and responsibilities which insure work is performed safely within the clearly defined principle that line management is responsible for safety. a. An integrated SMS should include processes that require and provide for the flowdown of authority and accountability and requirements for the flow-up of information. b. An integrated SMS should provide for communication of the potential impact of specific work across the institution, other programs, other facilities, other work, and the public. c. An integrated SMS should include processes for interfacing support activities with the work. (See Volume I, Chapter II, Section 1 for additional details.) References 10 CFR 820 PROCEDURAL RULES FOR DOE NUCLEAR ACTIVITIES DOE M 411.1-1, MANUAL OF SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES AND AUTHORITIES (FRAM) DOE P 411.1, SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES POLICY 7. CONSIDERATIONS FOR GUIDING PRINCIPLES 3 COMPETENCE COMMENSURATE WITH RESPONSIBILITY Personnel possess the experience, knowledge, skills, and abilities that are necessary to discharge their responsibilities. All organizations and activities within the integrated SMS should be evaluated to insure that the competence is commensurate with the assigned responsibilities. Support and line personnel, workers as well as managers, should have core competencies. The actual competence as well as the programs to define the expectations, provide the training, and evaluate whether expectations are met, should be CANCELE D Page C-22 - Safety Management System Guide - Volume 2 11-26-97 Appendix C addressed. The process for the determination of the required competence should consider the roles and responsibilities of each position. (See Volume I, Chapter II, Section 1, for additional details.) References Federal Acquisition Regulation 15.605 41 USC 253a 10 CFR 830: Nuclear Safety Management DOE O 360.1: TRAINING DOE O 440.1: WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES DOE O 541.1: APPOINTMENT OF CONTRACTING OFFICERS AND CONTRACTING OFFICER REPRESENTATIVES DOE 5480.20A: PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES DOE 5700.6C, QUALITY ASSURANCE DOE-STD-1056-93: Guide to Good Practices for Line and Training Manager Activities Related to Training and Qualification NE-1001-91: Guide to Good Practices for Training and Qualification of Instructors NE-1002-91: Guide to Good Practices for Training and Qualification of Chemical Operators NE-1003-91: Guide to Good Practices for Training and Qualification of Maintenance Personnel DOE-HDBK-1107-97: Knowledge, Skills, and Abilities for Key Radiation Protection Positions at DOE Facilities

CANCELE D TASK WSRC 2S WSRC 1Y SITE WSRC 5Q WSRC 6Q WSRC 8Q WSRC E7 WSRC 2Q WSRC 2S WSRC 4Q WSRC 5Q WSRC 14Q WSRC 7E WSRC 1Y WSRC 4B WSRC 1S WSRC 11Q WSRC 11Q WSRC 18Q WSRC 20Q WSRC 3Q WSRC 1-01 Policy Manual WSRC 9B WSRC 8B WSRC 3Q WSRC 12Q Volume 2 - Safety Management System Guide - Page C-23 Appendix C 11-26-97 Figure C.1. Example of documentation and procedures to implement the Safety Management System at Westinghouse/Savannah River. (See Table C.1 for document titles.) CANCELE D Page C-24 - Safety Management System Guide - Volume 2 11-26-97 Appendix C Table C.1. References for Westinghouse Savannah River Corporation (WSRC) Safety Management. WSRC No. Title 1-01 Management Policy Manual 4B Training and Qualification Manual 5B HR Policies, Practices, and Procedures 8B Compliance Assurance Manual 9B Site Item Reportability and Issue Management 7E Configuration Management 1Q Quality Assurance Manual 2Q Fire Protection Program 3Q Environmental Compliance Manual 4Q Industrial Hygiene Manual 5Q Radiological Control Manual 6Q Emergency Management Program Procedure Manual 8Q Employee Safety Manual 11Q Facility Safety Document Manual 12Q Assessment Manual 14Q Material Control and Accountability 18Q Safe Electrical Practices and Procedures 19Q Transportation Safety 20Q Health and Safety for Hazardous Waste Operations 1S SRS Waste Acceptance Criteria Manual 2S Conduct of Operations Manual 1Y Conduct of Maintenance Manual E7 Conduct of Engineering and Technical Support Procedure Manual SCD-3 Criticality Safety Manual IM-90-135 SRS Process Safety Management Manual CANCELE D Volume 2 - Safety Management System Guide - Page C-25 Appendix C 11-26-97 Figure C.2. Example of documentation and procedures to implement the Safety Management System at LLNL. Note that “chapter” and “suppl.” refer to chapters and supplements of the LLNL Health and Safety Manual (see Table C.2). CANCELE D Page C-26 - Safety Management System Guide - Volume 2 11-26-97 Appendix C Table C.2. References for LLNL Safety Management System. LLNL’s Health and Safety Manual Chapter 1: LLNL ES&H Policies and Responsibilities, November 1996 Chapter 2: Integrating ES&H into Laboratory Activities, September 1994 Supplement 2.02: Preparation of Operational Safety Procedures and Facility Safety Procedures Supplement 2.10: Guidelines for the Shutdown or Transfer of Operations or Buildings, October 1996 Supplement 2.19: Conduct of Operations for LLNL Facilities, November 1992 Supplement 2.20: Personnel Selection, Qualification, Training, and Staffing at LLNL Nuclear Facilities, November 1996 Supplement 2.21: Implementation Guide for the Unreviewed Safety Question Process, September 1994 Supplement 2.30: Guidelines for Decontamination and Disposition of Radioactively Contaminated Facilities and Associated Equipment, March 1994 Supplement 2.31: Startup and Restart of Nuclear Facilities, November 1996 Chapter 3: Emergency Management, January 1997 Chapter 4: Incidents-Notification, Analysis, and Reporting, February 1996 Chapter 6: Design and Construction, July 1990 Supplement 6.06: Safety Analysis Guide, September 1988 Chapter 8: Hazardous Material Control, November 1995 Chapter 10: Personal Protective Equipment, August 1991 Chapter 11: Access Control, Safety Signs, and Alarm Systems, July 1990 Supplement 11.07: Personnel Safety Interlocks, August 1989

Chapter 12: Ventilation, May 1991 Supplement 12.01: Evaluation and Control of Facility Airborne Effluents, February 1989 Supplement 12.03: Work Enclosures for Toxic and Radioactive Materials, August 1991 Supplement 12.05: High-Efficiency Particulate Air (HEPA) Filter System Design Guidelines for LLNL Applications, August 1991 T-4 CANCELE D Volume 2 - Safety Management System Guide - Page C-27 Appendix C 11-26-97 Chapter 21: Chemicals, December 1991 Supplement 21.01: Chemical Hygiene Plan for Laboratories, February 1994 Supplement 21.10: Safe Handling of Beryllium and Its Compounds, December 1991 Supplement 21.11: Safe Handling of Mercury, March 1989 Supplement 21.12: The Safe Handling of Fluorine, April 1990 Supplement 21.13: Hydrogen, July 1984 Supplement 21.14: Safe Handling of Alkali Metals, October 1994 Supplement 21.15: Safe Handling of Acids and Bases, July 1982 Chapter 22: Cryogens, May 1991 Chapter 23: Electrical Safety, February 1996 Supplement 23.01: Safe Work Practices for Electrical and Electronic Equipment, and Utility and Facility Power Systems, May 1996 Chapter 24: Explosives, January 1997 Chapter 25: Fire, May 1995 Chapter 26: Hazards—General and Miscellaneous, November 1992 Supplement 26.13: Lockout and Tag Program, April 1996 Chapter 27: Earthquakes, July 1990 Supplement 27.02: Seismic Safety Program, September 1995 Chapter 29: Material Handling, July 1990 Supplement 29.04: Fork Truck Safety, September 1995 Supplement 29.04B: Crane and Hoist Safety, February 1990 Chapter 31: Criticality, April 1996 Chapter 33: Radiation - Ionizing, January 1990 Supplement 33.011: LLNL ALARA Program, February 1990 Supplement 33.02: Occupational Radiation Protection; Implementation 10 CFR 835, November 1995 Supplement 33.03: Exposure to Radiation in an Emergency, September 1986 Supplement 33.10: LLNL Internal Dosimetry Program Manual Supplement 33.42: Workplaces for Radionuclides, July 1982 CANCELE D Page C-28 - Safety Management System Guide - Volume 2 11-26-97 Appendix C Supplement 33.45: Hazard Classification of Sealed Radioactive Sources, May 1987 Supplement 33.47: X-Ray Machine Safety Requirements, September 1993 Supplement 33.48: Uniform Accelerator Safety Standard, July 1988 Supplement 33.55: Exposures to Radioiodine, Aug. 86 Chapter 34: Sanitation, October 1989 Chapter 35: Vehicle Operations and Traffic, January 1997 Environmental Compliance Manual, June 1996 Guidelines for Soil and Debris Management Guidelines for Permitting of Air Emission Sources Guidelines for Polychlorinated Biphenyls Guidelines for Preparing Office and Shop Supplies for Disposal LLNL Radiological Control Manual, 1993 Nuclear Material Controls and Accountability Manual, (Vol. 1 to 7), 1990 Onsite Hazardous Materials Packaging and Transportation Safety Manual, February 1996 CANCELE D Volume 2 - Safety Management System Guide - Page C-29 Appendix C 11-26-97 This page intentionally left blank. CANCELE D Volume 2 - Safety Management System Guide - Page D-1 Appendix D 11-26-97 APPENDIX D DISCUSSION OF SAFETY MANAGEMENT ASSESSMENT 1. INTRODUCTION The purpose of this appendix is to provide supplemental guidance for the use of assessments in integrated Safety Management Systems (SMSs). An integrated SMS is implemented using the legal and contractual requirements established for doing work safely. All work that is subsequently performed should be performed within the framework of those requirements.

Integrated SMS-related assessments need to be conducted to verify that these contractual and legal obligations are being safely met. The feedback and continuous improvement function is directly related to the effectiveness of assessments. To effectively accomplish the objectives of an assessment program, the assessment process needs to be more than development of a list of deficiencies. The process must produce a robust, rigorous, and credible assessment that is acceptable to DOE and the contractor. The results can be used with confidence to accomplish the following: • Identify areas that do not meet the requirements. These departures from requirements are generally called “deficiencies” or “findings.” Coincident with identifying problems, specific strengths and successes may be discovered that may be worthy of identification. • Prioritize those problems identified using a prioritization system based upon each problem’s importance in the execution of integrated SMS policies. Such priority classification can be assigned by the assessor or the manager responsible for the expenditure of resources and program execution in the work area assessed or by both. • Correct problems and follow up to help ensure that the problems assessed and prioritized for correction have in fact been corrected, and that the correction has been effective enough to result in sustained, long-term improvement for generic problems. Deficiencies or potential problem areas (e.g., from “lessons learned”) would generally result in a “watch list” of items for followup assessments. Although finding and correcting problems associated with the implementation of an integrated SMS, as described in the three steps above, is fundamental to the proper and effective execution of integrated SMS in the organization assessed, a fourth effort is required to help ensure that other organizations learn from the problems identified and do not repeat them. Effective sharing of significant assessment issues and identified strengths and successes can and should be an important mechanism for improving the effectiveness of integrated SMS in the DOE complex. Such an effort will enhance safety, save scarce resources, and improve mission effectiveness. CANCELE D Page D-2 - Safety Management System Guide - Volume 2 11-26-97 Appendix D 2. (TYPES OF) ASSESSMENTS The overarching assessment should be developed within the framework of DOE P 450.5, LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT. This Policy’s key element is a rigorous and credible contractor self assessment program that is linked to the DOE SMS. Input to such an assessment is linked to and would derive substantial benefit from– • performance measures and performance indicators, • line and independent evaluations, • compliance with applicable requirements, • data collection, analysis, and corrective actions, and • continuous feedback and performance improvement. The results and conclusions of the contractor self-assessments are available to DOE. There are many different types of individual assessments within DOE. For example, some assess compliance with the law, while others seek areas for improvement. Some assessments are required by DOE directives as implemented at a site or facility. Many of the documents listed in Volume 2, Appendix B, to this Guide, “Resources for Complying with the SMS Policy and the Dear,” describe assessment requirements, and some describe specific assessment processes.

Examples of these referenced requirements and descriptions include DOE O 225.2, ACCIDENT INVESTIGATIONS, and DOE O 232.1, OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS INFORMATION, which describe specific types of assessments that focuses generally on a specific event. DOE O 425.1, STARTUP AND RESTART OF NUCLEAR FACILITIES, describes the much broader assessment processes involved in operational readiness reviews ORRs) and readiness assessments required to evaluate the readiness of DOE nuclear facilities to conduct initial startup or to restart after specific types of shutdowns. DOE G 414.1-1, IMPLEMENTATION GUIDES FOR USE WITH THE INDEPENDENT AND MANAGEMENT ASSESSMENT REQUIREMENTS OF 10 CFR 830.120 and DOE 5700.6C, QUALITY ASSURANCE, provide guidance in assessing Quality Assurance Programs with respect to the requirements of the Rule and the Order. Other types of assessments include– • assessments conducted by the Office of the Deputy Assistant Secretary, Oversight (EH-2), • assessments associated with the administration of the Price Anderson Amendments Act, • routine and frequent performance assessments conducted in DOE facilities by Facility Representatives, • Verification (see Appendix E) of effective implementation of the requirements of an CANCELE D Volume 2 - Safety Management System Guide - Page D-3 Appendix D 11-26-97 integrated SMS is a specific type of assessment associated with the establishment of an integrated SMS. 3. PRINCIPLES OF THE ASSESSMENT EFFORT As stated in DOE P 450.5, the contractor and DOE have the following common principles: a. Work together to develop ES&H performance objectives, measures, and expectations that are tied to Department strategic goals and objectives, as well as to performance goals and objectives of the SMS elements. Mutual agreement is reached on expected ES&H performance. b. Work together to develop contract performance measures and performance indicators that are linked to the DOE SMS. c. Work together to develop a high level of performance assurance that results in improved ES&H performance. 4. ATTRIBUTES OF ASSESSMENTS The introduction to this appendix briefly discussed the attributes of assessments. Those attributes were identification of problems/issues, prioritization of issues found with respect to significance, correction of identified issues, and promulgation of lessons learned from the identified issues/problems at other sites and facilities when doing so will add value to the complex. This section of this appendix provides additional information about these attributes. 4.1 IDENTIFICATION OF PROBLEMS/ISSUES A systematic, organized approach to assessing performance in a facility with respect to integrated safety is required. An ad hoc approach in assessing performance will, more than likely, not be focused and, as a result, will be ineffective in evaluating the key aspects of compliance with requirements. Chapter III and Appendix C of this Guide provide guidance to assist contractors in developing and implementing integrated SMS. Chapter III and Appendix C can also assist assessment personnel in determining areas for review. The features discussed in this section should be considered when planning an assessment. Those facilities in which the hazards are greatest should be the facilities that are assessed with the greatest rigor. However, all facilities should be assessed over some finite period of time.

Most assessments will probably be scheduled such that those doing the assessments can effectively schedule their time and prepare for the assessment and those being assessed can arrange the facility’s schedule to accommodate the assessment and minimize its impact on ongoing facility work. Because all assessments may affect a facility’s ability to do work, the impact of the assessments should be minimized wherever and whenever possible. For example, it CANCELE D Page D-4 - Safety Management System Guide - Volume 2 11-26-97 Appendix D is more cost effective to observe work when it is in progress than to schedule that work for observation outside normal operations. In addition, there is a distinct advantage to conducting some assessments on an unannounced basis. It is only human nature to want to do well during any evaluation. Consequently, strong efforts to prepare for an assessment that has been scheduled are not unusual. Conversely, it is probable that there may be a natural relaxing of performance after an assessment is completed. The possibility of unannounced assessments will help to minimize the potential for reduced performance, especially if some unannounced assessments are periodically conducted. The routine day-to-day assessments of performance by facility managers at any level and by DOE Facility Representatives similarly need to be sufficiently random to prevent complacency in a facility. If a manager or Facility Representative always does the same thing when he or she spends time in the facility or if those people only conduct their assessments during the normal work day, Monday through Friday, the workers in the facility may assume that areas not being assessed or efforts ongoing on back shifts, weekends, or holidays are not as important to assessors. As a result, workers may tend to emphasize effective safety performance only in those places and during those times that their management or local DOE personnel emphasize. Data derived from such observations will be a very valuable input to the assessment process. Assessors must also be knowledgeable in the areas they assess. They need to understand the requirements applicable to the areas they are assessing. These assessors also need to have technical competence in the areas being assessed. Assessors who are not knowledgeable in both the requirements to be evaluated and how to assess professionally will more than likely be ineffective. Assessors also need to be trained to the requirements for access to the facilities being assessed to the maximum extent practical to minimize the need for escorts from the facility. Additionally, training in areas in which facility personnel are trained, such as Rad Worker II, Criticality Safety, Conduct of Operations, etc., will prepare the assessor to consider those areas during the evaluation. An assessor who lacks the training required to perform effectively and professionally will not be credible and the effort may very well be wasted. In conducting assessments, it is essential that the evaluation be done to requirements identified and not to some expectation of the assessor that is not a requirement. Assessors who have their own agenda, which they use instead of identified requirements to find the organization deficient, will cause a diversion of effort that will be counter productive and that is inappropriate. On the other hand, an assessor who has good ideas for improving the requirements or the methods used for operating a facility should provide those ideas to the appropriate organization for evaluation. These good ideas should be offered for what they are and should not be subject to the same rigorous approach appropriate for correction of identified safety deficiencies.

It is not unusual during an assessment to identify individual departures from requirements that are inappropriate to formally report and track to closure. For example, if a fire door is found blocked open when it should be shut, the assessor should tell someone in authority in the facility when it is discovered so that the fire door’s function can be restored. If no other symptoms are found related to fire doors or similar fire safety discipline issues, cataloging this item as a deficiency would be inappropriate. Most Facility Representatives provide information concerning this type CANCELE D Volume 2 - Safety Management System Guide - Page D-5 Appendix D 11-26-97 of deficiency to facility management at the appropriate level. If continued assessment reveals generic problems rather than isolated individual problems, more formal deficiency identification and correction tracking action would be appropriate. 4.2 PRIORITIZATION OF DEFICIENCIES Once a deficiency has been formally identified as significant enough to be processed for correction, it should be assigned a priority for attention consistent with its significance. That prioritization may be made by the organization doing the assessment or by the one being assessed. If one of these two organizations disagrees on the priority assigned, a means should be available to resolve this difference. The priority assigned to the deficiencies identified should be based upon the safety significance of the items. There are many different schemes of assigning priorities to deficiencies. Whatever the scheme, it should not be too complicated and should help facility management focus on correcting the highest-priority and most important safety-related issues first. The scheme used should be understood both by the assessors and the facility staff. The number of priority categories should be sufficient to adequately categorize the comparative importance of the issues to be corrected and yet not so numerous as to make management impractical. Schemes observed have ranged from two to eleven priorities. Two categories probably do not give sufficient definition to prioritize while eleven make management of deficiency correction too complicated. A division of priorities into three or four categories based upon significance to safety will probably suffice. 4.3 PROBLEM CORRECTION The combination of managing deficiencies of limited significance on the floor of the facility when they are found and the more formal process of identifying issues/deficiencies using an effective prioritization scheme should establish the foundation for managing facility safety in compliance with requirements. But all of this effort will be of little consequence without an effective way of managing the correction of the deficiencies, validating that the correction has been completed, and, if the problem is generic, as some of the significant deficiencies may be, ensuring that the corrective actions taken are realistically extended to the areas in which they apply and not just to the correction of a specific deficiency. This diagnostic approach is the hallmark of effective assessment programs.

Many sites and facilities use an “issue management” or “deficiency tracking” scheme to manage the correction of identified problems, whether those problems are identified by the contractor, DOE locally or externally, or other assessment/oversight organizations such as EH-2 and the Defense Nuclear Facilities Safety Board. Normally, these management efforts use a computer tabulation of deficiencies, which can be sorted by priority as well as by other schemes useful to those responsible for managing the correction effort. Sorting by identification date, correction due date, variance with respect to schedule, responsible organization (such as “Maintenance”), or CANCELE D Page D-6 - Safety Management System Guide - Volume 2 11-26-97 Appendix D safety disciplines such as radiological controls or electrical safety are examples of other sorting categories that could be used. At some sites, a computer printout of the issues being tracked is used effectively as a management review document. At other sites, the computer program in use may be so cumbersome and user unfriendly that it may not be readily available for use as a management aid at all. At some sites, the facility manager and his staff use the tracking system daily to monitor the status of the highest priority deficiency listing. Whatever the scheme, the highest priority deficiencies should be reviewed by the responsible managers the most frequently and all deficiencies should be reviewed periodically depending upon priority assigned. This management technique helps facility management and staff focus on what is needed to correct the problems identified and helps them to determine what assets are needed to do the job; it also helps those responsible for the facility to be acutely aware of the safety status of the facility. A tracking system that is updated after each review and significant change in status is appropriate. A user-friendly system, reviewed and updated at an appropriate frequency, and available to those who need it, can be an extremely effective management tool. A facility manager who ensures the tracking system is current and accurate at an appropriate periodicity can make this data available to his staff for their use, to the management to whom he reports, and to the local DOE management interested in that facility. All concerned can keep themselves informed of problem resolution status without unduly intruding on the managers involved with the corrective action. 4.4 SHARING OF SIGNIFICANT ASSESSMENT ISSUES The results of assessments that contain significant issues/problems of general applicability should be shared with other parts of the organization (i.e., other facilities at the same site) and with other organizations in the DOE complex to preclude those problems from occurring elsewhere. As appropriate, the process used to correct the problem should also be shared. The objective of this sharing effort is to enable other organizations to evaluate their practices to determine if the same problem or a similar one exists requiring action to preclude departures from safety that could adversely affect the public, the workers, or the environment. Using information developed from assessments to avoid problems is an effective way to enhance safety and facility mission performance that will enhance integrated SMS when used well.

An excellent example of feedback concerning operational issues with respect to DOE nuclear facilities is the “Operating Experience Weekly Summary” published by the Office of Nuclear and Facility Safety (NFS). This summary is available in either hard copy or electronically. This document provides assessment-like information (mostly from ORPS reports), which contains timely, well written, easily understood descriptions of the problem reported, some analysis of previous problems that were similar, and describes some actions that were used or should be used to correct the problem and prevent recurrence. Even though these weekly summaries use information from nuclear facilities for the most part, the information provided for most of the events is valuable for evaluating safety performance in non-nuclear as well as nuclear facilities. Review of the material in these summaries on a weekly basis by those responsible for facility CANCELE D Volume 2 - Safety Management System Guide - Page D-7 Appendix D 11-26-97 operations, both government and contractor, will take but a few minutes, but has the potential to help enhance facility safety if the lessons learned are effectively applied. 5. OTHER CONSIDERATIONS Many modern management methods have been tried and are being used to enhance performance in the work place. Quality circles, process improvement teams, and process action teams are among those efforts and when done correctly can result in improved organizational performance and safety. These methods, however, are not a substitute for assessments that evaluate the results of the assessed organization’s safety performance. On the other hand, assessment results should be used as a source of information in the exercise of management techniques aimed at improving performance. Some approaches for improving safety performance rely on the individual worker being responsible for a self-assessment effort that would, when done correctly, be the major contribution to safety assessments. There is no question that the work force should participate in improving safety performance with involvement, for example, in developing new procedures or in revising others, in enhanced work planning, in ensuring that all hazards are evaluated before performing work, and in self-checking, etc. Employee-related programs, such as a beneficial suggestion program, an employee concerns program, or a “hot line” reporting scheme, are appropriate and can, when used properly, enhance safety. But these are not assessment programs. Some assessment regimes limit the window of time allotted to assessments. These limits, when applied, are intended to limit the impact of the assessment effort upon the facility being assessed from a time perspective and to force those doing the assessment to be organized and ready to perform the assessment in a reasonable period of time. Today, DOE ORRs are generally completed within 2 weeks. Several years ago, they required a significantly longer period of time. The DOE ORR process was improved when DOE streamlined the process and required facilities being assessed to be as ready as possible when the start of the DOE ORR was recommended. In this context, limiting the time allotted to assessment efforts has been effective. But declaring that other assessment efforts may be limited to a specific time window may be counter-productive. Obvious examples include self-assessments conducted by a facility’s manager. As a general rule, these managers should spend some significant portion of their time on a continuing basis evaluating the performance of work in their facilities.

The purpose of facility management assessment is two-fold: 1. To satisfy the facility managers doing the assessment that work is being done safely and effectively, in accordance with the requirements and standards that have been prescribed. 2. To find areas of execution of the prescribed safety requirements and facility mission that are not being done satisfactorily such that the assessing manager can take action to correct the problems found and bring the organization back into compliance. If these managers perform their assessment effort effectively, assessors from outside the facility CANCELE D Page D-8 - Safety Management System Guide - Volume 2 11-26-97 Appendix D will find should find little during their assessments. Assessments conducted by external organizations on facilities that have been effective in managing their own assessment program will have minimal impact because the facility staff will be found to be doing their work safely and effectively within the bounds of the specified requirements. Based upon the discussion in the paragraph above, one might conclude that a well-run facility would not need external assessments. Ideally, that is so. Probably the better conclusion would be that a facility found to have an exemplary integrated SMS would require less external assessment than a facility whose integrated SMS is not as strong. Key to DOE P 450.5 is the concept that DOE will first “verify, then trust.” And the best way to ascertain that a strongly performing facility stays that way is to assess facility performance. Some periodic assessment effort is required to ensure integrated SMS is still effective. The promise of routine scheduled, or unscheduled, external assessment also has the benefit of helping provide a stimulus to the facility to remain focused on performing its integrated SMS functions effectively. A natural tendency by many people who conduct assessments is to focus on administrative areas or documentation reviews. For many assessments, such efforts may be appropriate, but only if limited to the extent that they help assess the daily performance of the workforce. Performance- based assessments that evaluate conformance to safety requirements are the most effective assessment approach. When weaknesses are uncovered that may be based upon inadequate programs, the administrative programs can be explored to help determine how much of the problem is programmatic. 6. CONCLUSION Assessments in support of an integrated SMS are essential to validate compliance with requirements and to identify weaknesses requiring correction. Prioritization of problems found with respect to safety significance and managing the correction of these problems is required. Otherwise, the assessment process will be ineffective, no matter how well the assessment itself was done. Using the lessons learned from the problems uncovered in the assessments of other organizations is a cost-effective way to improve safety performance in a timely fashion. Well-run, effective assessment programs have been drivers in improving performance and in sustaining improved performance. Assessments are an integral part of integrated SMS. DOE P 450.4 established the integrated SMS core functions, which are discussed in Chapter II of this Guide. Assessing performance of an organization in execution of each of the five core functions can be accomplished. Assessments are a cornerstone of the integrated SMS core function to “Provide Feedback and Continuous Improvement.”

CANCELE D Volume 2 - Safety Management System Guide - Page D-9 Appendix D 11-26-97 This page intentionally left blank. CANCELE D Volume 2 - Safety Management System Guide - Page E-1 Appendix E 11-26-97 APPENDIX E INTEGRATED SMS VERIFICATION TEAM LEADER GUIDANCE This appendix replaces the draft protocol attached to the memorandum dated February 21, 1997, from Thomas P. Grumbly, Under Secretary. The following information is being developed by DOE based on reviews of integrated Safety Management Systems (SMSs) to date by a DOE team charged with implementing integrated SMS activities. When finalized, this guidance will be published as “Integrated Safety Management System Verification (ISMSV) Process, Team Leader’s Handbook,” currently in draft form as Project SAFT 0065. A key point of this review and approval process is the use of technically competent people with appropriate experience, knowledge, and training to review, assess adequacy relative to mission and hazards, and recommend approval of the documented integrated SMS descriptions. This is also a key point in the subsequent review of the implementation of the integrated SMS. The review team will consist of a team leader selected using the process described in Section 9.2.2.6 of the FRAM. The team leader will be selected by and report to the cognizant DOE Line Manager responsible for the approval of the documented SMS descriptions—the Approval Authority. Team composition will be approved by the Approval Authority. Team membership will include established Federal safety management professionals with appropriate experience, knowledge, and training from the line and staff and may be supplemented by independent contractor and laboratory personnel when needed or appropriate. Team qualification will be the responsibility of the team leader and will be accomplished through determination of– • established expertise in their area of review; • appraisal experience, which may include ORRs, SARs, or other types of appraisals with strong emphasis on the ability to recognize systems, programs, and products that acceptably satisfy safety management principles and functions without necessarily requiring “one size fits all” or requiring “only my way is right”; • familiarity with the mission and processes being reviewed; and • training on integrated SMS policy and expectations. Once selected, team members will be included in the Core Technical Group (CTG) database. The team may be supplemented with personnel who will be mentored by the established safety management professionals for inclusion in the CTG database as potential team members in the future. The review process may be accomplished in multiple phases as directed by the Approval Authority. The first part might involve a review of the documented SMS descriptions for CANCELE D Page E-2 - Safety Management System Guide - Volume 2 11-26-97 Appendix E acceptability. The final part of the review evaluates the acceptability of the SMS implementation.

The integrated SMS description is not intended to be a “plan for a plan,” such as a plan to develop a given process, or a plan to define responsibilities by a certain date. Rather, the essential elements of an integrated SMS must be defined—not necessarily implemented at the facility level—but defined. For instance, relative to “provide feedback on the adequacy of controls and continue to improve safety management,” the feedback and continuous improvement system should be defined. Lower-level or implementation programs for that system, such as self- assessment and independent assessment, quality surveillances, performance indicator utilization, lessons learned, and corrective action, etc., should also be described and documented through a system of programs, manuals, and procedures. It is important to note that although the programs, manuals, and procedures would be assessed (on a sampling basis) for determination of adequacy relative to the integrated SMS description, they are not intended to be subject to DOE approval within the integrated SMS review and approval process itself. During this initial phase of a multi- phased review, programs should be implemented at the corporate level. The strategy for review and recommendation for approval of the integrated SMS description as well as the evaluation for adequacy of implementation of these systems is to employ a cadre of recognized senior safety management professionals utilizing a review plan that includes core objectives. It is recognized that the development and implementation of an integrated SMS is at various stages at sites and facilities throughout the complex. The review and approval approach should be appropriately tailored to the given site or facility. For example, a site or facility with a fully implemented integrated SMS could complete the review of both the description and implementation of the system simultaneously. Conversely, for sites or facilities where implementation is not fully complete, a phased approach should be considered. The first phase could include the review and approval of the description, with verification of implementation at the facility level deferred to a later date. As noted previously however, the integrated SMS description is not a “plan for a plan” and implementation at the corporate level should be achieved prior to beginning any review processes. Specific attributes of this review process follow: • It is a line review, not an independent review. The team leader and team reports to and supports the Approval Authority. • The review can be done in phases and as such assists management in the development and implementation of the system. In view of the partnership of the team and the Approval Authority in this approval processes, it is necessary that the responsible party, the Approval Authority, communicate clearly to the team the expectations and requirements of the specific review and approval process. This guidance should be provided formally and should include such items as the phased approach (if used), the scope of the review (particularly if the reviews are conducted at the facility level), the reporting requirements, and any other items deemed necessary by the Approval Authority. CANCELE D Volume 2 - Safety Management System Guide - Page E-3 Appendix E 11-26-97

The integrated SMS review and approval is most effective if conducted in accordance with a prepared plan. This plan should include objective criteria by which the integrated SMS would be evaluated. To assist in this process, a team leader’s handbook is available that contains sample Criteria and Review Approach Documents (CRADs), which guide the review and identify the basis for the review. These criteria are drawn from a group of core requirements that, if met, will ensure a satisfactorily integrated SMS plan has been proposed for implementation, and that, when implemented will result in a satisfactory condition to “do work safely.” A suggested set of core requirements for both corporate- and for facility-level implementation phase review of the integrated SMS is included with this guidance. These core requirements will serve as a guide for achieving consistency in the implementation of integrated Safety Management across the complex. Further, the team leader’s handbook will contain additional suggested processes, formats, and lessons learned from previous reviews. This information will also be available on-line on the ISM home page. CANCELE D Page E-4 - Safety Management System Guide - Volume 2 11-26-97 Appendix E INTEGRATED SAFETY MANAGEMENT SYSTEM VERIFICATION (ISMSV) CORE REQUIREMENTS From the initial ISMSV at the Savannah River Site (SRS), it became evident it would be helpful in the design of future reviews to have a set of core requirements upon which the review could be based. The following core requirements were developed from the requirements of DOE P 450.4, the requirements of the DEAR, and the fundamental attributes that support implementation of the integrated SMS. Each core requirement is accompanied by an explanatory paragraph to further assist the team in developing a Criteria and Review Approach Document (CRAD) for a specific review. The elements of the explanatory paragraph, when developed into criteria for the CRAD, should ensure all the principles for integrated SMS evaluation are covered. Two CRADs from the Savannah River evaluation are offered as examples following this discussion. They are site- specific and so they are examples only. A. The following core requirements should permit a full evaluation of an integrated SMS for a site, facility, activity, or process. Completion of the 13 core requirements will verify successful implementation of an integrated SMS. However, the Approval Authority may want to use two phases for the evaluation. In that situation, a second set of core requirements that focuses on implementation is provided (see Section B.). 1. Consistent and Responsive Integrated SMS Description The integrated SMS description should be consistent with DOE P 450.4, the DEAR, and the guidance as to the expectations for integrated safety management provided to the contractor by the Approval Authority. 2. Define the Scope of Work This requirement should be assessed at each organizational level (e.g., from the sitewide mission tasks to the processes at an individual facility to the individual operational or maintenance item within a facility). Only through clear definition of the work is it possible to manage the work safely. Some elements of this requirement, as discussed in DOE P 450.4 include the statement, “Missions are translated into work, expectations are set, tasks are identified and prioritized, and resources are allocated.” 3. Analyze Hazards

This requirement should be assessed at each organizational level from the work defined in the sitewide mission tasks [as in an Environmental Impact Statement (EIS)] to the processes at an individual facility [as in a Safety Analysis Report (SAR)] to the individual operational or maintenance item contemplated within a facility [as in a Process Hazard Analysis (PHA) or a Radiological Work Permit (RWP)]. The hazards analyzed should include nuclear as well as CANCELE D Volume 2 - Safety Management System Guide - Page E-5 Appendix E 11-26-97 chemical and common industrial hazards. The analysis should be balanced to suit the complexity of the work as well as the significance of the risk. As described in DOE P 450.4, “Hazards associated with the work are identified, analyzed and categorized.” 4. Develop Controls Controls are developed that provide satisfactory mitigation for the hazards analyzed. The controls may include programmatic, administrative, and engineering requirements. Those controls should be appropriate to the hazards that have been identified for work at all levels from the sitewide mission to the facility processes to the individual operation or maintenance action. As specified in DOE P 450.4, the controls include “applicable standards and requirements which are identified and agreed-upon, controls to prevent/mitigate hazards are identified, and the safety envelope is established.” 5. Implement Controls The integrated SMS should provide for a method to implement the controls identified at every level of work and hazard. The methods should provide assurance that the controls remain in effect so long as the hazard is present. 6. Operations Authorizations The integrated SMS should provide for gaining authorization to conduct operations. Provisions should be included to grant operations authorizations for each level of effort at the site, facility, activity, or process. Such provisions or procedures may include an operational readiness review, approval to resume operations following a week-end shutdown, and authorization to start individual procedures or work items using controls such as work clearance permits, shift orders, or shift managers control. The integrated SMS should also provide for updating and configuration control for the operations authorization documentation such as authorization agreements, permits, SARs, etc. 7. Perform Work within Controls Procedures and programs should be adequate to ensure work is performed within the controls that have been developed and implemented. Controls may include site or facility commitments, such as conduct of operations and maintenance programs, worker safety programs, specified engineered safety systems, or specific controls in worker safety permits. The controls may be specified in site-level programs or facility-specific authorization bases documents. The integrated SMS should include provisions to ensure that ongoing work continues to be performed within the specified and agreed-upon controls. CANCELE D Page E-6 - Safety Management System Guide - Volume 2 11-26-97 Appendix E 8. Provide Feedback and Continuous Improvement All aspects of the integrated SMS should be subject to continuous improvement through an assessment and feedback process. At each level of work and at every stage in the work process planning, the feedback and continuous improvement programs should be functioning. Feedback information on the adequacy of controls is gathered, opportunities for improving the definition and planning of work are identified and implemented, line and independent oversight is conducted, and if necessary, regulatory enforcement actions occur.

9. Line Management is Responsible for Safety and Clear Roles and Responsibilities are Established and Maintained. At every level of control, line management must be responsible for safety. Clear and unambiguous roles and responsibilities should be defined and maintained at all organizational levels within the organization defined by the integrated SMS description. All aspects of work identification, planning, and control must be executed under the control and responsibility of line management. Support organizations such as ES&H or personnel departments must have clearly defined roles and responsibilities that ensure work is performed safely within the clearly defined principle that line management is responsible for safety. 10. Competence is Commensurate with Responsibility. Personnel shall possess the experience, knowledge, skills, and abilities necessary to discharge their responsibilities. All organizations and activities within the integrated SMS should be evaluated to ensure that competence is commensurate with the assigned responsibilities. Support and line personnel, workers as well as managers, should be included within the verification of this core requirement. Actual competence as well as programs to define the expectations, provide the training, and evaluate that expectations are met, should be assessed. The process for the determination of the required competence should consider the roles and responsibilities of each position. 11. Balanced Priorities Resources shall be effectively allocated to address safety, programmatic, and operational considerations. Protecting the public, the workers, and the environment shall be a priority whenever activities are planned and performed. Balancing priorities is particularly important when defining work, assessing hazards, identifying controls, and designing feedback and continuous improvement programs. Once a decision is made that a work item is to be conducted, all the identified controls are necessary and thus the decision to do the work is a prioritization decision to apply the necessary resources as defined by the agreed-upon controls. 12. Adequate Implementation and Integration Mechanisms. Implementation and integration mechanisms should be identified. Integration should be CANCELE D Volume 2 - Safety Management System Guide - Page E-7 Appendix E 11-26-97 evident throughout all organizational functions and at all organizational levels from the site to the individual activity (horizontal and vertical integration). Integrated SMS-specific programmatic requirements should include assessment, continuous improvement, and annual updates. 13. DOE Organization and Processes Support ISM. The DOE Approval Authority should have a set of processes that interface efficiently and effectively with the contractor organization. DOE processes must include elements of the other core requirements as they apply to the responsibilities of DOE to translate missions into work, set expectations, and allocate resources as well as to approve, control, and authorize operations. B. Phase II ISMSV Core Requirements. The following core requirements were developed to conduct the separate Phase II ISMSV for identified facilities at SRS. They should be considered for any Phase II-facility specific assessment of integrated SMS implementation in those circumstances in which a Phase I ISMSV determined that the contractor-integrated SMS description, as well as its implementation at the corporate or site level, was satisfactory.

1. Define the Scope of Work A process has been established to clearly define facility missions. These missions have been translated into discrete tasks or processes that facility personnel understand and can adequately control. Specific tasks, operations, or work items are identified and prioritized. 2. Analyze the Hazards The full spectrum of hazards associated with work or a task have been identified, analyzed, and categorized. Those personnel responsible for the analysis of environment, safety, and health effects have been effectively integrated into the contractor’s organization and work closely with those individuals responsible for the analysis of the processes. 3. Develop and Implement Hazard Controls A process has been established that identifies appropriate safety requirements and readily adapts them to the diverse activities and hazards present within a facility. The set of requirements must be comprehensive and ensure adequate protection of the public, the worker, and the environment. The contractor has established adequate mechanisms for implementing the set of safety requirements agreed upon with DOE. These mechanisms ensure that consideration is given to the protection of the public, the worker, and the environment and that the appropriate controls merge at the workplace to prevent or mitigate the hazards that have been identified. CANCELE D Page E-8 - Safety Management System Guide - Volume 2 11-26-97 Appendix E 4. Authorize and Perform Work within Controls A process has been established for the effective planning of hazardous work. Personnel assigned responsibility for completing this work are instructed on the hazards and the engineered and administrative controls that will be used to control the hazards. Personnel performing the work are provided a single set of instructions that effectively integrate the necessary controls. Appropriate mechanisms are in place to authorize the performance of the work, including a process that confirms the readiness to perform the work before it is started. 5. Feedback and Continuous Improvement A process has been established to measure performance and identify opportunities for improvement. This includes identifying opportunities for improvement even in those cases where the current level of performance has been demonstrated to meet current expectations or safety goals. Recommended improvements are appropriately evaluated and are implemented when proven to be cost effective. Safety performance is measured by line management and is periodically validated by independent parties. 6. DOE Oversight DOE line management has a clearly defined oversight role and is appropriately involved in the management of safety at the site level, facility level, and the work or task level. DOE has established an effective operations authorization process. CANCELE D Volume 2 - Safety Management System Guide - Page E-9 Appendix E 11-26-97 EXAMPLES CRITERIA AND REVIEW APPROACH DOCUMENT The following CRADs are examples of the way a review might be structured for two core requirements: (2) Define the Scope of Work and (11) Balanced Priorities. It is important to understand that the examples draw from the manner in which WSRC defined their integrated SMS. A second variable in the specific content of the CRAD is the manner in which the ISMSV team is structured and the functional area selection by the ISMSV Team. For example, some of the criteria might appear in a different CRAD because they are within the expertise of the individual to whom that CRAD is assigned.

OBJECTIVE BBC.1 DOE and contractor procedures ensure that missions are translated into work, expectations are set, tasks are identified and prioritized, and resources are allocated. Criteria 1. DOE procedures translate programmatic missions reflected in strategic plans, binding commitments, and other requirements into work expectations and priorities, which are communicated to the contractor. 2. Contractor procedures translate mission expectations received from DOE into tasks that permit identification of resource requirements, relative prioritization, and performance measures. 3. DOE and contractor procedures provide for DOE approval of the contractor’s proposed tasks and prioritization of the mission expectations transmitted to the contractor. 4. DOE and contractor procedures provide change control of the approved task identification, prioritization, and funding. 5. Contractor procedures provide for flowdown of DEAR 970.5204-2, “Integration of Environment, Safety and Health into Work Planning and Execution,” requirements into subcontracts involving complex or hazardous work. 6. The prioritization and allocation process clearly addresses both ES&H and programmatic needs. The process involves line management input and approval of the results. 7. Maintenance items and process operations are adequately planned and prioritized to ensure that adequate resources are allocated to support adequate safety. CANCELE D Page E-10 - Safety Management System Guide - Volume 2 11-26-97 Appendix E Approach Record Review: Review WSRC 6B Manual. Review AOP, the Management Plan, Program Execution Guidance (PEG), and other WSRC Work Authorization and Control (WAC) documents, as well as the procedures for their development. Review DOE-SRS SRIPs or other procedures for identification of mission requirements, balancing of resource allocations, and approval of contractor AOP. Review WSRC and DOE-SRS change control procedures. Review WSRC and DOE-SRS procedures requiring safety requirements flowdown into subcontracts. Select several mission tasks from the Defense Programs (DP) requirements and the EM 10-year plan and track the tasks through the process to evaluate how the above criteria are met. Review future year planning and current year authorized work. Select several current year authorizations and track change control. Select several DOE and WSRC subcontracts and review for appropriate flowdown clauses. Review the 2S Manual and the 1Y manual to verify adequacy of the process by which resources are allocated to permit conduct of the scope of the work item or process procedure. Review several Work Clearance Permits (WCPs) to verify the adequacy of the process in practice. Interviews: Interview DOE-SRS personnel responsible for management of budget process. Interview line managers responsible for Headquarters-directed mission accomplishment. Interview ES&H manager to determine process for integration of safety into mission tasks. Interview WSRC personnel for management of the budget process. Interview managers at each level from the vice president to the facility manager to determine understanding and implementation of the defined process for translation of mission into work authorization. Interview ES&H professionals and managers at each level to determine how safety is incorporated into the budget plans and authorization. Interview DOE-SR and WSRC procurement personnel regarding subcontract flowdown requirements. Interview work planners and line managers to ensure that tasks are appropriately identified and prioritized with adequate resources being allocated.

Observations: If possible, observe actual budgetary discussions (including meetings involving the development of the FY98 AOP) within and between WSRC and DOE-SRS to observe the practical application and results of the procedures. OBJECTIVE BBC.2 Contractor-integrated SMS procedures ensure balanced priorities. Resources are allocated to address safety, programmatic, and operational considerations. Protecting the public, workers, and environment is a priority whenever activities are planned and performed. Criteria 1. The prioritization and allocation process clearly addresses both ES&H and programmatic needs. The process involves line management input and approval of the results. CANCELE D Volume 2 - Safety Management System Guide - Page E-11 Appendix E 11-26-97 2. Priorities include commitments to and agreements with DOE as well as stakeholders. 3. Contractor ISM procedures provide adequate resources to adequately analyze hazards associated with the work being planned. 4. Contractor ISM procedures and practice for resource allocations include provisions for implementation of hazard controls for tasks being funded. 5. Resource allocations reflect the tailored hazard controls. 6. The incentive and performance fee structure promote balanced priorities. 7. Contractor ISM procedures ensure that priorities are balanced to ensure feedback is provided and continuous improvement results. 8. The ISM procedures provide for balanced priorities to ensure adequate resources are made available to provide for a satisfactory level of safety for individual maintenance items as well as process procedures. Approach Record Review: Review WSRC 6B Manual. Review AOP, the Management Plan, PEG, and other WSRC Work Authorization and Control (WAC) documents, as well as the procedures for their development. Review DOE-SRS SRIPs or other procedures for identification of mission requirements, balancing of resource allocations, and approval of contractor AOP. Review WSRC and DOE-SRS change control procedures. Select several mission tasks from the DP requirements and the EM 10-year plan and track the tasks through the process to evaluate how the above criteria are met. Review future year planning and current year authorized work. Select several current year authorizations and track change control. Review 12Q manual to ensure balanced priorities associated with self assessment and management of self assessment findings and issues. Review 1Y and 2S manuals to verify adequacy of balancing of resource priorities in the selection and conduct of maintenance items and process activities. Review several plans of the day as well as associated work control documents to verify that balanced priorities are being practiced. Interviews: Interview DOE-SRS personnel responsible for management of budget process. Interview line managers responsible for Headquarters-directed mission accomplishment. Interview ES&H manager to determine process for integration of safety into mission tasks. Interview WSRC personnel for management of budget process. Interview managers at each level from the vice president to the facility manager to determine understanding and implementation of the defined process for translation of mission into work authorization. Interview ES&H CANCELE D Page E-12 - Safety Management System Guide - Volume 2 11-26-97 Appendix E professionals and managers at each level to determine how safety is incorporated into the budget plans and authorization. Observations: If possible, observe actual budgetary discussions (including meetings involving the development of the FY98 AOP) within and between WSRC and DOE-SRS to observe the practical application and results of the procedures. CANCELE D