OV

ER

SIG

HTTable of Contents

1.0 INTRODUCTION ........................................................................1

2.0 POSITIVE ATTRIBUTES .............................................................3

3.0 WEAKNESSES ............................................................................6

4.0 SUMMARY ASSESSMENT .........................................................9

5.0 CONCLUSIONS ........................................................................ 13

6.0 RATINGS ................................................................................... 15

APPENDIX A - SUPPLEMENTAL INFORMATION ......................... 17

APPENDIX B - SITE-SPECIFIC FINDINGS ..................................... 19

Abbreviations Used in This Report

ACRR Annular Core Research ReactorCBDPP Chronic Beryllium Disease Prevention ProgramCFR Code of Federal RegulationsDOE U.S. Department of EnergyDSA Documented Safety AnalysisEMS Environmental Management SystemES&H Environment, Safety, and HealthFMOC Facilities Management and Operations CenterGIF Gamma Irradiation FacilityISM Integrated Safety ManagementMESA Microsystems and Engineering Sciences ApplicationNE DOE Office of Nuclear Energy, Science and TechnologyNNSA National Nuclear Security AdministrationOA DOE Office of Independent Oversight

and Performance AssurancePEP Performance Evaluation PlanPETL Processing and Environmental Technology LaboratoryPISA Potentially Inadequate Safety AnalysisPPE Personal Protective EquipmentSNL Sandia National LaboratoriesSSO Sandia Site OfficeTA Technical AreaUSQ Unreviewed Safety QuestionZ Machine Z Pulsed Power Reactor

1

Introduction1.0

The U.S. Department of Energy (DOE) Officeof Independent Oversight and PerformanceAssurance (OA) inspected environment, safety,and health (ES&H) programs at DOE SandiaNational Laboratories (SNL) during March andApril 2005. The inspection was performed by theOA Office of Environment, Safety and HealthEvaluations. OA reports to the Director of theOffice of Security and Safety PerformanceAssurance, who reports directly to the Secretaryof Energy.

Within the DOE, the National Nuclear SecurityAdministration (NNSA) has line managementresponsibility for SNL. NNSA providesprogrammatic direction and funding for mostnuclear weapons stockpile management, researchand development, facility infrastructure activities,and ES&H program implementation at SNL. TheDOE Office of Nuclear Energy, Science andTechnology (NE) has programmatic responsibilityfor SNL’s Annular Core Research Reactor(ACRR). At the site level, the NNSA Sandia SiteOffice (SSO) has line management responsibilityfor SNL. The NNSA Service Center providessupport to SSO in several areas (e.g., legal, humanresources, and employee concerns) and mayprovide technical ES&H specialists to supportSSO. Under contract to DOE, SNL is managedand operated by Lockheed Martin, which hasoperated SNL since 1993.

The primary mission of SNL is research anddevelopment in support of national security andthe NNSA stockpile stewardship program. SNL’smission areas include: nuclear weapons;nonproliferation and assessments; militarytechnologies and applications; energy andinfrastructure assurance; homeland security; andscience, technology, and engineering. SNL hasmajor facilities in Albuquerque, New Mexico, andLivermore, California. This OA inspection focusedexclusively on the SNL facilities in New Mexico.

SNL activities involve various hazards that needto be effectively controlled. These hazards includeexposure to external radiation, radiologicalcontamination, high explosives, beryllium,hazardous chemicals, and various physical hazards

associated with facility operations (e.g., machineoperations, high-voltage electrical equipment,pressurized systems, and noise). Significantquantities of radioactive materials and hazardouschemicals are present in various forms at SNL.

The purpose of this OA inspection was toassess the effectiveness of ES&H programs atSNL as implemented by Lockheed Martin underthe direction of SSO. OA used a selectivesampling approach to evaluate a representativesample of activities1 at SNL, including itsmanagement systems, programmatic research anddevelopment, facilities operations, maintenance,construction, and engineered safety systems.Specifically, the sampling approach was used toevaluate:

• SNL2 implementation of the core functions ofintegrated safety management (ISM) forselected activities, including programmaticwork activities at the Processing andEnvironmental Technology Laboratory(PETL), Z Pulsed Power Accelerator (ZMachine), and Gamma Irradiation Facility(GIF); maintenance; and construction workperformed primarily by subcontractors. OAfocused primarily on implementation of ISMat the facility and activity/task levels.

• NNSA, SSO, and SNL feedback andcontinuous improvement systems and selectedaspects of management roles, responsibilities,and authorities.

1 In this report, the terms “activity” and “activities” are usedin a manner consistent with DOE Policy 450.4, SafetyManagement System, to include programmatic activities,such as operation of the Z Machine, and all lower-tier workactivities and tasks, such as specific laboratory activities ortasks performed by researchers or maintenance personnel.

2 Consistent with common practice, the term “SNL” is usedto refer to both the physical facility and the onsite contractormanagement. The term “Lockheed Martin” is used to referto the Lockheed Martin management that provides corporatedirection to the onsite SNL management team and thatperforms corporate line management and evaluationfunctions for Lockheed Martin activities at SNL.

2

• Functionality of essential safety systems that aredesigned to prevent and mitigate accidents at theGIF, including containment barriers, ventilationsystems, and supporting systems and components.

• SSO and SNL effectiveness in managing andimplementing selected aspects of the ES&Hprogram that OA has identified as focus areas,including hoisting and rigging, safety systemsoversight, the Chronic Beryllium DiseasePrevention Program (CBDPP), implementation ofDOE Order 450.1, Environmental ProtectionProgram, and selected aspects of safety inprotective force training. OA selects focus areas—areas that warrant increased attention across theDOE complex—based on a review of operatingevents and inspection results.

GIF Building

Sections 2 and 3 provide a discussion of the keypositive attributes and weaknesses identified during thisreview. Section 4 provides a summary assessment ofthe effectiveness of the major ISM elements reviewedon this inspection. Section 5 provides OA’s conclusionsregarding the overall effectiveness of NNSA, SSO,and SNL management of the ES&H programs. Section6 presents the ratings assigned during this review.Appendix A provides supplemental information,including team composition. Appendix B identifies thespecific findings that require corrective action andfollow-up.

Volume II of this report provides four technicalappendices (C through F) containing detailed results ofthe OA review. Appendix C provides the results of thereview of the application of the core functions of ISMfor SNL work activities. Appendix D presents theresults of the review of NNSA, SSO, and SNLfeedback and continuous improvement processes andmanagement systems. Appendix E presents the resultsof the review of essential safety system functionality,and Appendix F presents the results of the review ofsafety management of the selected focus areas. Foreach of these areas, OA identified opportunities forimprovement for consideration by DOE and contractormanagement. The opportunities for improvement arelisted at the end of each appendix so that they can beconsidered in context of the status of the areas reviewed.

3

Positive Attributes2.0

Several positive attributes were identified inES&H implementation at SNL. Engineeringcontrols are used in a number of areas to ensuresafety, and there are noteworthy aspects of theSNL pollution protection approach.

PETL has many design features thatenhance safety and reduce worker exposuresto hazardous materials. PETL is a new facilitythat was designed with substantial input from bothSNL line management and ES&H personnel. Thefacility design incorporated a number of engineeringcontrols that are intended to reduce workerexposures to hazardous materials. Lessonslearned from the inadequacies in the older SNLresearch laboratories were identified andevaluated, and new design concepts wereincorporated into PETL. Some of the uniquedesign features at PETL that reduce the risk ofresearchers being exposed to hazardous materialsand operations include a central gallery for deliveryand removal of chemicals, chemical-free zonesadjacent to laboratories in which technologists maywork, and one-time, pass-though air in alllaboratories. In addition, most fume hoods haveautomatic sash adjustments and ventilation flowindicators and/or alarms to ensure the proper airflow. Local ventilation systems are usedextensively to control hazardous emissions andtested routinely to verify proper operation of safetyinterlocks and local ventilation exhausts.

GIF appropriately relies on the extensiveuse of engineering controls to mitigatepotential radiological hazards posed byoperations . The irradiation cells and pool are

heavily shielded, and numerous engineeringfeatures, such as door interlocks, warning lightsand sirens, ventilation systems, and radiationmonitors, have limited the need for administrativecontrols and personal protective equipment (PPE)during many GIF operations. While significantquantities of cobalt-60 are used to deliver very highdose rates for experiments, extensive use ofradiation shielding and engineered safety featuresare effective in preventing personnel from beingexposed to significant external radiation hazards inthe GIF.

Z Machine extensively uses proceduresand other technical work documents toeffectively control most activities. Technicalprocedures and other technical work documentsare generally well written and provide an adequatelevel of detail to ensure that the tasks can be

Annular Core Research Reactor

GIF Safety Door

4

performed safely. Prerequisites, notes, and cautionsare appropriately used to convey most hazard controlsnot otherwise covered by permits. For example,electrical hazard controls, such as groundinginstructions and lockout/tagouts, are extensivelyaddressed by technical procedures.

The Facilities Management and OperationsCenter (FMOC) has increased the use of job sitehazard evaluations, and established thresholds fortheir use in maintenance activities. The job sitehazard evaluations are being performed more frequentlynow because FMOC has established requirements fortheir use in specific cases. Approximately 250evaluations have been performed since September2004, many of which are for beryllium and/or radiationhazards. They are required when the work might involvechemical or biological agents, asbestos, environmentalrestoration sites, radiological operations/spaces, or othernon-standard industrial hazards.

SNL performs extensive industrial hygienemonitoring for noise at the live-fire range, andthe results have been analyzed for all existing andnew weapon systems used by the SNL protectiveforce. The SNL protective force recently transitionedto new weapon systems that have a higher decibel level.Correspondingly, SNL increased their attention on noisesampling and incorporated some noise monitoringtechniques that are more appropriate for live-fire ranges(e.g., focusing on measuring impulse levels rather thansustained sound levels). SNL also recently (February2005) approved a new guideline for protective forcehearing conservation that clearly outlines the hazardsand controls associated with impact and impulse noiseresulting from firearms and pyrotechnic devices usedduring training exercises and qualification examinations.

The Microsystems and Engineering SciencesApplication (MESA) Project has implemented arigorous policy for wearing protective gloves.Implementation of this glove policy required allindividuals conducting hands-on work to be wearinggloves specifically suited to the task (e.g., Kevlar®glove liners under leather gloves when handling sharpmaterials, or appropriate, snug-fitting protective gloveswhen conducting fine or detailed hands-on work). Thisadditional PPE requirement has resulted in a decreasein hand injuries and reduced the severity of injuriesthat have occurred. It has also gained acceptance bythe workforce, as the construction contractors haveembraced the requirement and made the appropriateglove type and fit available to workers.

SSO and SNL are effectively performing theactions necessary to implement an environmentalmanagement system (EMS), and their pollutionprevention program includes several noteworthypractices that have resulted in several awards.SNL actions to implement the EMS are on schedule tomeet the December 31, 2005, DOE order milestoneand include: forming a corporate team to lead thepreparation of an EMS, identifying sitewideenvironmental aspects and goals, communicating EMSexpectations to the public and internal managers,working with SSO and SNL representatives toexchange ideas and resolve problems, and assistingindividual divisions to set and achieve theirenvironmental goals. Several aspects of the SNLpollution prevention program, which is an integralelement of the EMS, are noteworthy practices. Forexample, SNL built a construction/demolition recyclingcenter to recycle construction waste and plans toestablish a construction specification to mandateconstruction waste recycling. SNL line managersdirectly support waste reduction goals and pollutionprevention projects, and SNL has received numerouspollution prevention awards, including the White HouseClosing the Circle Award.

SNL is using its analysis of assessmentfindings, injuries, and illnesses to identify systemicand institutional issues and drive developmentof focused corrective and preventive actions. SNLhas recently implemented formal processes at theinstitutional level and within the ES&H Center toroutinely screen assessment and other safetyperformance data to identify repetitive findings thatreflect broader weaknesses in processes orperformance. Issues identified through these screening

Sandia Waste Operations

5

processes or by management are then input to amanagement process to evaluate causes and developcorrective/preventive actions that are tracked to closurein formal tracking systems. For example, SNLperformed a detailed analysis of ergonomicdeficiencies, which constitute a large portion of SNLoccupational recordable injuries, and established afocused, structured, action plan to reduce repetitivemotion injuries.

SSO management initiatives are improvingSSO oversight processes. In a number of areas,such as the EMS and protective force training, SSOhas been actively involved in monitoring programeffectiveness and providing direction. SSO is alsodevoting significant attention and resources toeffectively implementing the relatively newrequirements for oversight of essential safety systems.SSO also has a new senior management team and hashired new staff who have the needed expertise andexperience. Recognizing that SSO oversight hassignificant weaknesses, the new management is takinga number of appropriate steps to develop and implementan effective oversight program, including placingemphasis on developing good site office proceduresand using the performance evaluation process to drivecontractor improvements. SSO has established aneffective process to formally communicate ES&Hperformance issues to the contractor through the annualPerformance Evaluation Plan (PEP). Joint

performance review teams, comprised of SSO and SNLsubject matter experts, meet quarterly to discussprogress, issues, and areas of attention. Issues areformally tracked, and corrective actions are developed.Review of quarterly and annual PEP results indicatesthat SSO is effectively using this mechanism tocommunicate ES&H issues to the contractor. SSOalso has taken positive steps through the PEP to addressSNL performance concerns and increase accountabilityfor ES&H performance at SNL. For example, as aresult of longstanding issues with inadequate contractorsubmittals of safety basis documents, SSO has includedmore specific milestones within the PEP directed atimprovement of quality and timeliness of submittedsafety basis documents, and performance deficienciesare reflected in the PEP ratings. SSO also has madeprogress in formalizing its ES&H assessment programand in scheduling and conducting assessments. SSO’srecent ES&H assessments of contractor performanceprovided an effective evaluation of programs andperformance in such areas as work planning and control,and feedback and improvement. Most of theseassessments were conducted with sufficient rigor andidentified contractor performance deficiencies that wereconsistent with some of the results of areas reviewedduring this OA inspection. Although much workremains, the initial efforts show potential and areappropriate to address the longstanding weaknesses inthe SSO line oversight program.

6

Weaknesses3.0

Although some aspects of ISM at SNL areeffective, there are weaknesses in safety systemsand in the implementation of hazards analysis andcontrol processes that protect workers fromindustrial and chemical hazards. There also areweaknesses in feedback and improvementprocesses that have hindered corrective actions.

Work descriptions, hazards identificationand analysis, and hazard controls have notbeen sufficiently documented at the activity/task level to ensure that risks to workershave been adequately identified, analyzed, andcontrolled. The SNL work control processes donot ensure that systems are in place to identify,analyze, and document activity-level hazards andensure that adequate controls are identified andclearly communicated to the workforce. In manycases, the selection and implementation of safetycontrols is left to the individual worker or researcherand rely too much on the knowledge and experienceof individuals rather than clear safety standardsand documented hazards and controls, as requiredby ISM. Weaknesses are evident in the hazardsanalysis and control processes as applied to workersafety elements, such as confined space, use ofhazardous chemicals, lead, hazards communication,and some aspects of radiation protection. Similarconcerns exist with regard to some aspects ofwaste management, primarily waste segregation.

SNL line management has notimplemented a comprehensive exposureassessment program that utilizes recognizedexposure assessment methodologies, asrequired by DOE Order 440.1A, WorkerProtection Management for DOE Federal andContractor Employees. SNL organizations havea number of processes for identifying, analyzing,and controlling worker exposures to chemical,physical, biological, or ergonomic hazards.However, these processes are not comprehensive,integrated, and consistently applied, and do notadequately ensure that worker exposures aresufficiently analyzed, sampled/monitored, anddocumented, and that the results are effectivelycommunicated to line management and integratedinto work documents. Specific concerns were

identified in exposure assessments for laboratorychemicals, epoxy, ozone, welding fumes, ultravioletradiation, lead, and noise.

SNL line management does not have anintegrated process for soliciting andevaluating ES&H expertise, incorporatingsafety recommendations/requirements intowork documents, and ensuring that safetycontrols fully meet ES&H requirements. In anumber of cases, line management organizationsinterpreted ES&H policies or requirements in a non-conservative manner or did not effectivelyimplement a required ES&H control. In somecases, line management received relevant and validrecommendations from safety professionals on howto meet an ES&H requirement but did notadequately evaluate the recommendations or takeaction to implement the recommendations orsuitable alternatives. Further, there are fewcontrols, triggers, or thresholds that require linemanagement to seek ES&H subject matter expertsto evaluate a situation that has ES&H implicationsthat might be beyond the expertise of linemanagement organizations. In some cases, linemanagement has not solicited ES&H input if it wasnot required by a site requirement document,although the ES&H input may have resulted in amore accurate analysis of the hazard or a moreappropriate selection of hazard controls. As aresult, there were a number of situations wherehazards to workers were not adequately controlledin such activities as welding, cutting, laseroperations, hoisting and rigging, and confined spaceentries.

Line management at Z Machine has notapplied a sufficient level of rigor in analyzingradiological hazards associated withoperations at the facility as necessary to meetinstitutional requirements and verify theadequacy of radiological controls andpractices. Current radiological practices date backa number of years and are based primarily oninformation informally communicated betweenvarious personnel. There is a lack of documentedinformation about expected activation products,decay times, and radiation energies for various

7

types of Z machine “shots” to establish and verify and/or alter the basis for current radiological practices andmonitoring methods. Z Machine lacks an approved,documented technical basis for the selection and useof facility radiological measuring instruments as requiredand has not ensured that its operations are conductedin accordance with institutional requirements relatedto control of activated materials. In addition, someradiological controls are not properly specified inradiation work permits or technical work documentsas required.

Some safety requirements are notimplemented effectively for construction work atSNL. SNL has included appropriate ISM requirementsfor defining work in construction subcontracts but hasnot provided sufficient guidance and direction to ensurefully effective implementation of these requirements.Some subcontractors have not established appropriatesystems for defining work, analyzing hazards, andestablishing controls, particularly for health hazards.The systems in place have not always been effectivelyimplemented. A number of required controls have notbeen implemented for construction projects. SNL hasnot imposed some of the worker safety requirementsfrom DOE Order 440.1A on its constructionsubcontractors, and subcontractor processes forspecifying controls have not been rigorouslyimplemented. Many work requirements that wereclearly defined in work control documents were notfollowed. The number and nature of these observationsindicate that expectations for compliance may not havebeen clearly conveyed by subcontractor management.

Several waste management activities thathave not been implemented effectively couldimpact compliance with SNL and external wastemanagement requirements. SNL does not alwaysensure segregation between regulated and non-

regulated waste; in some cases, containers labeled ashazardous waste are used to collect both wastestreams. Subsequently, waste management personnel,who are removed from the point of generation, make adetermination about whether materials are hazardouswaste or suitable for non-regulated disposal. In addition,polychlorinated biphenyls (PCBs) are not beingmanaged in accordance with requirements for labelingand length of storage, and a satellite accumulation pointis not being effectively managed to ensure compliancewith site requirements that reflect external regulations.

SNL engineering analysis and configurationmanagement programs are not implemented withthe rigor and formality expected for a DOE nuclearfacility. The review of the current ACRR documentedsafety analysis (DSA) identified several potentialdiscrepancies that need to be further evaluated andresulted in invoking the potentially inadequate safetyanalysis (PISA) process. One key area for review isthe lack of safety designations for the pool liner, reactorpiping, and control rod systems. At GIF, a safety-significant design deficiency was identified with respectto the capability of the elevators to lower the radioactivesource fast enough to preclude worker exposure. TheGIF DSA had numerous significant deficiencies,including inadequate classification of several structures,systems, and components that performed safety-significant functions; missing or inadequate analysesand supporting calculations; and miscellaneous othertechnical discrepancies. Although some elements ofconfiguration management were beginning to beestablished, the overall configuration managementprogram at the GIF is weak. Programmatic deficiencieswere identified in many areas. Procedures were notin place for such fundamental activities as generatingdesign modification packages and performing

Scene of Excavation Event

Excavation Event Involving a Water Pipe

8

replacement item equivalency evaluations. Documentcontrol processes were not established that would allowreliable and efficient identification, retrieval, and controlof facility historical documentation. Several exampleswere found where configuration control had not beenadequately maintained. The unreviewed safety questionprocedure contained numerous discrepancies thatrendered its use problematic. Personnel did notdemonstrate a full understanding of expectations foran effective nuclear safety configuration managementprogram.

SNL has not yet established and implementeda robust self-assessment program, with sufficientline participation and accountability or withsufficient focus on observing work activities/tasksand line implementation of ES&H programs andon the attributes of ISM. Assessment activities arenot consistently rigorous to effectively evaluate safetyprocesses and performance. Line self-assessmentsare generally limited to periodic walkthrough inspectionsof the physical condition of facilities by managers andES&H subject matter experts. Line organizations arenot performing functional area assessments as directedby SNL management, except for regulatory-driventopical assessments. The corrective actions to the 2003OA inspection finding regarding self-assessment werenot timely or effective in improving performance.

SSO and SNL have not yet established arobust, consistent, effective program toconsistently and rigorously document, prioritize,and evaluate ES&H deficiencies and developeffective corrective and preventive actions thatare timely, tracked to completion, and validatedas effective. These process and performanceweaknesses were observed in a variety of SNLprograms and processes, including injury and illnessinvestigations, construction safety deficiency notices,and various ES&H reporting and corrective actiontracking systems. Many of the deficiencies in correctiveaction management that were identified in the 2003OA inspection report have not yet been addressed bySSO or SNL. SNL’s corrective action plan for the2003 OA inspection finding regarding corrective actionprogram deficiencies was limited to establishment ofprocesses for conducting analyses to identify andaddress crosscutting, systemic issues rather thanaddressing the broader processes for managing theresolution of identified safety deficiencies. Furthermore,SSO has made limited progress in establishing aneffective issues management and commitment trackingsystem, and has not conducted adequate reviews ofcontractor corrective actions to verify closure andeffectiveness in ensuring resolution of OA findings andpreventing recurrence.

9

Summary Assessment4.0

The following paragraphs provide a summaryassessment of the SSO and SNL activities thatwere evaluated by OA during this inspection.Additional details relevant to the evaluatedorganizations are included in the technicalappendices in Volume II of this report.

PETL Work Activities. Material scienceresearch and development activities/tasks withinPETL are diversified and varied and are typicallyconducted safely by an experienced research staffthat is knowledgeable of the hazards. PETL hasmany design features that enhance safety andreduce exposures to hazardous materials.However, there were examples when the hazardsand appropriate controls were not readily apparentfrom the limited work descriptions, particularly forresearch work conducted at the experiment orbench level. In some cases, ES&H hazards havenot been adequately assessed by the appropriateES&H subject matter experts to ensure thatexposures to hazardous materials are minimal andthat the appropriate controls have beenimplemented. In a few examples, researchershave not implemented the appropriate controls asidentified by the ES&H Manual, the manufacturer,or ES&H professionals, or documented and/orjustified their selection of hazard controls. Muchresearch conducted at the experiment or benchlevel is performed as “skill of the researcher,”without the use of activity/task-level technical workdocuments. Although this approach may beacceptable for some low-risk, routine researchactivities, it is not adequate for research activities

that may present a higher risk, or for researcherswho are unfamiliar with the expected, butunwritten, hazards and controls.

Z Machine Work Activities. SNL hasimplemented the ISM process for Z Machine work,but there are longstanding and recurringimplementation deficiencies that have beenpreviously identified but not adequately corrected.Work is adequately defined, and most Z Machinehazards are adequately identified and analyzed;however, some activities are not adequatelyanalyzed for chemical or noise exposure hazards,and radiological hazards analyses are not detailedor documented sufficiently to ensure appropriatecontrols. SNL has identified the appropriate hazardcontrols for most work activities; however, severalexamples of inadequate implementation of controlsindicate that increased management attention isneeded to ensure appropriate worker protection.Most work is performed safely and in accordancewith established controls. Increased managementattention is needed to address deficiencies inimplementation of readiness review requirements,and workers need to increase their diligence inmeeting beryllium contamination controlrequirements.

GIF Work Activities. The scope of workfor GIF activities is generally well defined througha combination of mechanisms that include thefacility primary hazard screens, GIF operatingprocedures, and individual experiment plans. Mosthazards associated with GIF operations are alsoeffectively identified and analyzed through

PETL Building

Z Machine

10

implementation of these processes. Some higher hazardactivities receive additional hazards analysis throughthe Technical Area (TA)-V Radiological and CriticalitySafety Committee. However, ozone hazards were notaccurately identified in the primary hazard screen, andthe effectiveness of engineering controls in mitigatingthis hazard inside irradiation cells was not fullydetermined before allowing personnel to re-enter cellsafter experiments. The design of the GIF facilityincorporated numerous engineering controls, whichsignificantly enhance personnel safety and limit thenature and extent of hazards and administrative controlsneeded during normal operations. The engineeringcontrols are supplemented by administrative controls,such as operating procedures and radiation workpermits designed to ensure safe and consistentoperation of the facility. However, standard operatingprocedures did not specify sufficient controls forprotection against ozone hazards, and implementationof some radiological control requirements at GIF hasnot been effective. Although little work was ongoingat the time of the inspection, the work observed at theGIF was performed safely and in accordance withestablished controls.

Maintenance Work. Although there have beensome improvements in the use of job site hazardevaluations and primary hazard screens, there arelongstanding deficiencies in activity-level hazardsanalysis and controls that have not been adequatelyaddressed. Implementation of the core functions ofISM has not been driven down to the activity level formaintenance activities. From a risk managementstandpoint, SNL has effectively addressed somehazards (e.g., beryllium, radiation, confined spaces,elevated working surfaces), but they have not been aseffective in addressing some other hazards (e.g., liveelectrical equipment, chemicals, hoisting and rigging).The FMOC applied ISM principles to very broad classesof workers and activities, attempting to create anumbrella under which all work could be placed. Thisapproach fosters a sense of security in workers,supervisors, and managers that all applicable hazardsare being adequately identified, analyzed, and controlled.In reality, multiple hazards exist that have not beenidentified and analyzed, and are not being fully controlledat the time work is performed. Although these hazardsmay not have immediate health effects, the potentialfor long-term illness exists. The heavy reliance onworker knowledge to control these hazards creates asituation in which workers unnecessarily exposethemselves or others to increased risks. Worker trainingand skill of the craft knowledge are not sufficient to

ensure that all hazards present in the shop areas areadequately identified, analyzed, and controlled whileperforming work. The number and nature of hazardcontrol deficiencies identified during this OA inspectionindicate that workers are not routinely reviewingmaterial safety data sheets and manufacturers’ usagerecommendations and precautions, and are not sensitiveto safety deficiencies and applicable requirements.

Construction. The work control system appliedto SNL construction is largely expert-based. Safetyrelies on experienced and skilled superintendents,foremen, and safety professionals who prioritize safety.These individuals demonstrated a good understandingof safety requirements and a strong commitment toensuring safety. Increased assurance can be gainedby instituting more formal and systematic processes ofwork control, consistent with the ISM policy. Formalsystematic work control processes have beenestablished for the MESA line-managed projects, andsome facility-managed projects, but expectations fordocumenting tasks, hazards, and controls are not clear.Hazards and controls are documented in a variety ofdifferent documents, such as job hazards analyses andcontract specifications. However, documentation isinconsistent and not always adequate. Expectationsfor consolidating hazards and controls into a singledocument for use by workers are not clear. In mostcases, when requirements are clearly conveyed toworkers, they are followed. However, the number andnature of violations of clearly defined requirementsindicate the need for clarification of expectations forcompliance and increased accountability. Inadequateevaluation of potential health hazards at SNLconstruction sites is a particular concern. Documentedexposure assessments have not been performed asrequired by DOE orders. Contributing causes todeficiencies in this area include inadequate considerationof hazards and controls in material safety data sheets,lack of industrial hygiene expertise amongsubcontractors, and limited participation of the SNLindustrial hygienists in the review of subcontractor work.The high number of construction activities increasesthe risk of a serious accident at the site. This risk, andthe number of deficiencies identified by this review,indicates the need for increased management attentionon construction safety.

Essential Safety System Functionality. TheACRR DSA has a number of potential deficienciesthat SNL is further investigating using the PISA process.The ACRR is currently shut down, so these potentialdeficiencies are not an immediate risk. The essentialsafety systems at GIF, such as the pool, the irradiation

11

cells, the elevator power interrupt subsystem, and theradiation monitoring system, were generally robust,simple, and appropriately designed to perform theirsafety function. GIF personnel were technicallycapable and very knowledgeable of the facility. Mostaspects of the maintenance and testing programs wereadequate, and operator training and procedures weregenerally adequate. However, weaknesses wereidentified at GIF, primarily in design and configurationmanagement. The design of the source elevator powerinterrupt system was inadequate with respect to thesource elevator descent speed. Several structures,systems, and components were not properly classifiedas safety-significant in the DSA. Numerous supportinganalyses were inadequate or missing. Weaknesseswere identified with the configuration managementprogram and its implementation. Weaknesses werealso identified with the SNL unreviewed safety questionprogram.

Implementation of DOE Order 450.1,Environmental Protection Program. SSO and SNLactions to implement an EMS are effective. SNL isappropriately using central environmental staff andmanagers, line representatives, and ES&H coordinatorsto develop, integrate, and implement the EMS as partof the broader ISM program. SNL implementationplans and ongoing efforts in such areas ascommunication and training are adequate and onschedule, and SNL has appropriate plans for performinga corporate assessment prior to self-declaration of EMSimplementation. As part of EMS, SNL continues tohave a proactive pollution prevention program that hasachieved reductions in waste volumes and receivedseveral awards. Sustained management attention isneeded to ensure that pollution prevention effortscontinue to be effective under the new funding model.SSO has closely monitored SNL EMS efforts andactively participated in development efforts. However,SSO does not have a specific process for measuringand evaluating SNL performance in implementing EMSand has not identified a strategy for verifying SNL’sself-declaration that ensures sufficient independenceof the verification team leadership.

Hoisting and Rigging. Hoisting and riggingactivities at SNL are not meeting the current DOEstandards. Inspections for hand-operated hoists andmiscellaneous lifting equipment are not being conductedto ensure that rigging equipment used by workers issafe. Although SNL has adopted the DOE hoistingand rigging standard, they have not issued adequatelocal procedures to implement the standardrequirements and have not ensured that the

requirements are implemented by all constructionsubcontractors. Overall, hoisting and rigging by SNLpersonnel and subcontractors needs improvement.

Oversight of Engineered Safety Systems. SNLhas not been timely or proactive in implementing DOEorder requirements for a system engineer program,which includes cognizant system engineer support, andconfiguration management for TA-V nuclear facilitysafety systems. SNL did not comply with the schedulein its implementation plan for defining the program. SNLhas recently initiated a concerted effort to implementthe system engineer program, to include developingrelated configuration management procedures.However, the implementation plan is inadequate withrespect to specifying the schedules for completingtraining and qualification of cognizant system engineers,developing system design descriptions, and establishingconfiguration management. SSO has also recentlybegun its effort to formalize and enhance its safetysystem oversight program, but so far has not providedadequate oversight of SNL’s implementation of thesystem engineer program. SNL and SSO continue toexhibit weaknesses in their safety basis processes.Although both organizations are implementing correctiveactions to address gaps and deficiencies, the actionsare in the initial stage of development and implementationand have not yet had a positive impact on performance.

CBDPP. The program deficiencies revealed bythe 2003 beryllium-related event indicate that the originaldevelopment of the CBDPP did not receive sufficientSNL management attention and review. With the recentenhancements, the current SNL CBDPP and medicalsurveillance program are generally adequate. However,a number of ongoing corrective actions need to bemonitored by SNL and SSO ES&H personnel to ensuretheir effectiveness and to ensure that surface-contaminated areas are properly controlled andadequately decontaminated to prevent any additionaloccurrences. SSO will need to follow theimplementation of the specific CBDPP for the ZMachine, which was developed as one of the correctiveactions for the 2003 event, especially at the activitylevel to assure that requirements and controls haveadequately flowed to the line managers responsible forimplementing the site-specific beryllium concerns.

Safety in Protective Force Training. Protectiveforce training observed by OA was well controlled andconsistent with the associated safety and healthdocumentation. Firearms range safety and protectiveforce training activities are effectively supported by SNLES&H personnel. SSO and SNL audits andassessments are performed as required, and the various

12

SSO and SNL protective force and safety/industrialhygiene organizations communicate regularly.

SNL Feedback and Improvement. SNL hasvarious processes for conducting the basic elementsof feedback and continuous improvement. Someprogress has been made in improving the formality andeffectiveness of these processes since the 2003 OAinspection, including efforts to develop several long-term process tools and programmatic initiatives.However, most of the process and implementationdeficiencies identified in prior OA inspections continueto exist. Line self-assessments of safety programsand performance are not rigorously planned orperformed, with little observation of work or evaluationof ISM implementation. Corrective action processesare still insufficiently defined and fragmented,operational and injury and illness incidents are notrigorously evaluated, and causes and preventive actionsare not being adequately identified. The root causesof feedback and improvement program weaknesseshave not been identified, and thus timely, effectivecorrective and preventive actions have not beendeveloped and implemented. Organizational barriersand an inadequate requirements management flowdownstructure continue to impede effective and timely

resolution of longstanding deficiencies, and there isinsufficient accountability for ISM implementation andperformance improvement.

SSO Oversight. SSO is making progress instrengthening its site office programs and processesfor SNL oversight of ES&H operations. Improvementsin the ES&H assessment program, use of new SNLcontractual mechanisms for evaluating SNLperformance, recent new hires in key technicalpositions, and the new SSO senior management teamare starting to positively impact SNL ES&Hperformance. However, many of the processes arenew and have not yet fully matured, and actions arestill ongoing to fully establish internal managementsystems and processes at the site office. SSO actionsto address SNL’s longstanding weaknesses in suchareas as work planning and control and self-assessmentthrough greater use of available contractualmechanisms are significant positive steps. However,weaknesses in staffing and management of correctiveactions and issues continue to hinder progress ineffective oversight of the contractor. In addition, theemployee concerns program has not received sufficientmanagement attention to ensure that it is beingimplemented in accordance with DOE orders.

13

Conclusions5.0

SSO and SNL have established ISM systemsthat are conceptually sound but that areimplemented with varying levels of effectivenessby line management in the various lineorganizations. SNL personnel are typically veryexperienced, and many work activities wereperformed with a high regard for safety. In mostrespects, the primary facility hazards, such ashazards associated with operation of acceleratorsand large radiation sources, are well understoodand effectively controlled. Similarly, generallyadequate controls are in place for hazards thathave received higher levels of visibility andmanagement attention, such as beryllium. Despitethe design and analysis deficiencies, the GIFsafety systems are generally adequate to performtheir safety functions; GIF is generally operatedin a safe manner because of controls in placethat are not credited in the safety analysis butthat are implemented adequately in practice. SSOand SNL have addressed the complex issuesassociated with implementing an EMS and aCBDPP, and have implemented or initiatedappropriate actions to meet applicablerequirements.

However, SSO and SNL have not sufficientlyfocused on other aspects of ISM, such as activity/task-level hazards analyses and some aspects ofindustrial hygiene, radiation protection, hoisting andrigging, and worker and subcontractor safety.Deficiencies in these areas were evident in a widerange of facilities and activities, includinglaboratory research, facility support, maintenance,construction, and waste management. Similarly,there are weaknesses in engineering analysis andconfiguration management, and SNL nuclearfacilities are not managed with the rigor andformality expected of a DOE nuclear facility.Several important programs, such as thecognizant system engineer program, hoisting andrigging, construction contracts, and CBDPP, eitherdid not adequately address important DOErequirements or were not effectively implementedin their initial stages, necessitating significant andaccelerated corrective action efforts to addressdeficiencies. Collectively, the deficiencies indicate

that SNL still largely relies on an expert-basedapproach to safety rather than the ISM principleof clear standards and requirements, and that SNLline management has not sufficiently implementedtheir responsibilities for ensuring that safetyprocesses are clearly defined and effectivelyimplemented.

While some enhancements have been madein SSO and SNL feedback and improvementprocesses, many process and performanceweaknesses remain in assessments, issuesmanagement, lessons learned, and injury andillness reporting at the institutional and activitylevels. SSO and SNL have made only limitedprogress in correcting a number of longstandingand systemic deficiencies. Various internal andexternal assessments, including previousindependent oversight inspections, have identifieda number of critical issues, but SSO and SNLhave not sufficiently made use of the reports andaddressed and resolved the issues. Furthermore,because of weaknesses in developing andverifying corrective actions, many findings wereclosed before the effectiveness of the correctiveactions was validated and verified. Improvementsin feedback and improvement processes are keyto achieving the needed improvements in safetymanagement across SNL activities and essentialsystems.

Both SSO and SNL have made a number ofchanges in personnel and have hired some newmanagers and staff. SSO and SNL seniormanagement indicated that they recognize thatsome corrective actions have not been timely oreffective and recognize a need for improvementin this area. While much work remains, some ofthe recent initiatives are appropriate steps towardaddressing longstanding deficiencies.

Some of the areas that warrant increasedSNL management attention include:

• Enhancing worker safety and environmentalprotection through more rigorous hazardsanalysis and implementation of controls forindustrial hazards and hazardous substances

14

• Ensuring that line management and subcontractorsunderstand and effectively implement ES&Hrequirements

• Enhancing and effectively implementing hoistingand rigging requirements

• Increasing the rigor and attention to detail on safetysystem design analyses, DSA quality, andconfiguration management

• Enhancing SNL feedback and improvementprocesses, particularly in issues management, inthe rigor and quality of assessments, and in thedisciplined and effective implementation of thecontractor assurance system.

SSO line management oversight also needs to focuson SNL efforts in the above areas; address weaknessesin its line management oversight of assessments, issuesmanagement, and the employee concerns program; andcontinue to use the performance evaluation processfor evaluating and correcting contractor performancedeficiencies.

15

6.0 Ratings

The ratings reflect the current status of the reviewed elements of the SNL ISM program.

Implementation of Core Functions for Selected Work Activities (See Appendix C, Section C.4, for amore detailed breakdown of the Core Function ratings.)

Core Functions #1-4 Implementation – PETL..............................................NEEDS IMPROVEMENTCore Functions #1-4 Implementation – Z Machine .......................................NEEDS IMPROVEMENTCore Functions #1-4 Implementation – GIF ......................................... EFFECTIVE PERFORMANCECore Functions #1-4 Implementation – Maintenance ....................................NEEDS IMPROVEMENTCore Functions #1-4 Implementation – Construction ....................................NEEDS IMPROVEMENT

Feedback and Improvement

Core Function #5 – Feedback and Continuous Improvement ........................NEEDS IMPROVEMENT

Essential System Functionality

Engineering Design ....................................................................................NEEDS IMPROVEMENTConfiguration Management ................................................................... SIGNIFICANT WEAKNESSSurveillance and Testing ..................................................................... EFFECTIVE PERFORMANCEMaintenance ..................................................................................... EFFECTIVE PERFORMANCEOperations ................................................................................................NEEDS IMPROVEMENT

16

This page intentionally left blank.

17

APPENDIX ASUPPLEMENTAL INFORMATION

A.1 Dates of Review

Planning Visit February 28 – March 3, 2005Onsite Inspection March 14-25, 2005Report Validation and Closeout April 5-7, 2005

A.2 Review Team Composition

A.2.1 Management

Glenn S. Podonsky, Director, Office of Security and Safety Performance AssuranceMichael A. Kilpatrick, Director, Office of Independent Oversight and Performance AssurancePatricia Worthington, Director, Office of Environment, Safety and Health EvaluationsThomas Staker, Deputy Director, Office of Environment, Safety and Health Evaluations

A.2.2 Quality Review Board

Michael Kilpatrick Patricia WorthingtonDean Hickman Robert Nelson

A.2.3 Review Team

Patricia Worthington, Team LeaderVic Crawford Brad Davy Robert Freeman Michael GilroyMarvin Mielke Bill Miller Ching-San Huang Seth ShivajiBob Compton Al Gibson Joe Lischinsky Jim LockridgeJoe Panchison Don Prevatte Michael Shlyamberg Ed StaffordMario Vigliani

A.2.4 Administrative Support

MaryAnne SirkTom Davis

A.3 Ratings

The Office of Independent Oversight and Performance Assurance uses a three-level rating system to provide linemanagement with a tool for determining where resources might be applied toward improving environment, safety, andhealth. It is not intended to provide a relative rating between specific facilities or programs at different sites becauseof the many differences in missions, hazards, and facility life cycles and the fact that these reviews use a samplingtechnique to evaluate management systems and programs. The three ratings and the associated management responsesare:• Effective performance, which indicates that management should address any identified weakness• Needs improvement, which indicates a need for significantly increased management attention• Significant weakness, which indicates a need for immediate management attention, focus, and action.

18

This page intentionally left blank.

19

APPENDIX BSITE-SPECIFIC FINDINGS

FINDING STATEMENTS

Table B-1. Site-Specific Findings Requiring Corrective Action

1. SNL has not sufficiently documented work descriptions, identification and analysis of hazards, and hazardcontrols at the work activity/task level to ensure that risks to workers and the environment have beenadequately identified, analyzed, and controlled.

2. SNL line management has not defined an exposure assessment strategy or implemented a comprehensiveexposure assessment program that utilizes recognized exposure assessment methodologies, as required byDOE Order 440.1A, Worker Protection Management for DOE Federal and Contractor Employees.

3. SNL line management does not have an integrated process for soliciting and evaluating ES&H expertise,incorporating safety recommendations/requirements into work documents, and ensuring that safety controlsfully meet ES&H requirements.

4. SNL procedures are not used or referenced by FMOC workers to ensure that all identified controls arefollowed during the course of work.

5. SNL has not assured that all construction tasks are defined in sufficient detail to support the subsequentidentification of task-specific hazards and controls.

6. SNL has not ensured that construction subcontractors establish and effectively implement systems foridentification and analysis of safety hazards.

7. SNL has not ensured that ES&H requirements flow down to construction subcontractors to the extentnecessary to ensure compliance as required by the prime contract.

8. SNL has not ensured that hazard controls are adequately addressed in subcontractor work control documentsand conveyed to the workforce.

9. SNL has not adequately ensured that its construction subcontractors comply with required controls.10. NNSA has not clearly defined and assigned functions and activities for implementation of the employee

concerns program, as required by DOE Manual 411.1.11. SSO has not formally defined and documented nuclear safety oversight authorities and functions for NE-

managed nuclear facilities at SNL, as required by DOE Manual 411.1.12. SSO has made limited progress in establishing an effective issues management and commitment tracking

system, and has not conducted adequate reviews of contractor corrective actions to verify closure andeffectiveness in ensuring resolution of OA findings and preventing recurrence, as required by DOE Order414.1B and DOE Order 470.2B.

13. NNSA Service Center and SSO have not ensured that a formal, documented program for implementing theemployee concerns program has been maintained, and have not provided effective oversight of the SNLemployee concerns program, as required by DOE Order 442.1A.

14. SNL has not established a program of effective assessment activities with sufficient scope and rigor toensure that ES&H performance at all levels and in all organizations is consistently and accurately evaluated.

15. SNL has not established an effective corrective actions program that ensures that safety deficiencies areappropriately documented, rigorously categorized, and evaluated in a timely manner, with root causes andextent of condition accurately identified, and appropriate recurrence controls identified.

16. SNL injury and illness investigations lack sufficient rigor to ensure that causes are identified and appropriateand that effective corrective and preventive actions are identified and implemented.

17. At SNL, the ACRR DSA accident analysis for the seismic event with a loss-of-coolant accident is notsupported by rigorous analysis that ensures acceptable safety performance for the design basis accidentconditions.

20

FINDING STATEMENTS

Table B-1. Site-Specific Findings Requiring Corrective Action (continued)

18. At SNL, the design of the safety-significant cell source elevator power interrupt system is deficient in meetingthe required DSA objective of preventing worker fatalities or serious injuries due to radiation exposure.

19. At SNL, several GIF structures, systems, and components required to prevent worker fatalities or mitigateserious injuries are not classified as safety-significant, as required by the GIF DSA.

20. At SNL, the controls established at GIF to protect workers from ozone exposure are not adequate, includinginadequate DSA analyses, uncontrolled non-conservative cell ventilation system modifications, inadequateozone monitoring during past irradiations, and an inadequate cell ventilation system design.

21. At SNL, numerous DSA analyses and/or supporting calculations required to demonstrate the capabilities ofthe GIF safety systems to perform their safety functions are either inadequate or not available.

22. At SNL, many of the fundamental processes and procedures for effective configuration management havenot been established and implemented at the Gamma Irradiation Facility and, as a result, instances of inadequateconfiguration control have occurred.

23. The SNL site USQ procedure contains numerous areas where its directions are non-conservative, inconsistent,or ambiguous with respect to 10 CFR 830 and/or the DOE USQ Guide; as a result, compliance with theserequirements would be problematic using this procedure.

24. SNL has not fully evaluated the GIF crane load brake issues that result from infrequent crane operation andhas not developed an adequate testing and maintenance program that considers all the relevant factors neededto ensure safe and reliable crane operations.

25. SNL has not established formal GIF operating procedures to control some potentially hazardous processes,including re-entering a cell following irradiation, and using the bypass key to permit a raised elevator in a cellwith the cell door open.

26. At SNL, requirements for inspection, testing, and maintenance of miscellaneous lifting devices have not beenimplemented in accordance with Chapter 16 of the current DOE hoisting and rigging standard.

27. At SNL, controls for the procurement, testing, inspection, and use of hand-chain-operated or manual-lever-operated hoists are inadequate to ensure that hoists are tested and inspected as required by Chapter 8 of theDOE hoisting and rigging standard.

28. The SNL implementation plan for the system engineer program requirements of DOE Order 420.1A isinadequate and has not been implemented as scheduled.

29. SSO has not provided adequate oversight of SNL’s implementation of DOE Order 420.1A system engineerprogram requirements.