Inspection ofEnvironment, Safety,and Health Managementat the

Pacific Northwest National Laboratory

Office of Independent Oversight and Performance AssuranceOffice of the Secretary of Energy

December 2003

ISMISM

OV

ER

SIG

HTTable of Contents

1.0 INTRODUCTION .................................................................... 1

2.0 RESULTS ................................................................................. 4

3.0 CONCLUSIONS ...................................................................... 6

4.0 RATINGS ................................................................................. 8

APPENDIX A – SUPPLEMENTAL INFORMATION .................... 9

APPENDIX B – SITE-SPECIFIC FINDINGS ............................... 10

APPENDIX C – GUIDING PRINCIPLES OF SAFETY

MANAGEMENT IMPLEMENTATION ..................................11

APPENDIX D – FEEDBACK AND CONTINUOUS

IMPROVEMENT (CORE FUNCTION 5) .............................. 22

APPENDIX E – CORE FUNCTION IMPLEMENTATION

(CORE FUNCTIONS 1-4) ....................................................... 36

APPENDIX F – ESSENTIAL SYSTEM FUNCTIONALITY ....... 59

Abbreviations Used in This Report

ALARA As Low As Reasonably AchievableAMT RL Associate Manager for Science and TechnologyANSI American National Standards InstituteBMI Battelle Memorial InstituteCFR Code of Federal RegulationsCPP Chemical Process PermitCRD Contractor Requirements DocumentCSM Cognizant Space ManagerCY Calendar YearDOE U.S. Department of Energydp Differential PressureDSA Documented Safety AnalysisECR Environmental Compliance RepresentativeEDP Engineering Design PlanEEWP Energized Electrical Work PermitEJTA Employee Job Task AnalysisEM DOE Office of Environmental ManagementEMSL Environmental Molecular Science LaboratoryEPR Electronic Prep and RiskES&H Environment, Safety, and HealthESH&Q Environment, Safety, Health, and QualityESR Electronic Service Request

(Continued on inside back cover)

1

Introduction1.0

The Secretary of Energy’s Office ofIndependent Oversight and PerformanceAssurance (OA) conducted an inspection ofenvironment, safety, and health (ES&H) at the U.S.Department of Energy (DOE) Pacific NorthwestNational Laboratory (PNNL) during Novemberand December 2003. The inspection wasperformed by the OA Office of Environment,Safety and Health Evaluations.

The DOE Office of Science (SC) is thecognizant secretarial office for PNNL and hasoverall Headquarters line managementresponsibility for programmatic direction andES&H at PNNL. At the site level, the DOERichland Operations Office (RL) reports to theDOE Office of Environmental Management (EM)and currently has line management responsibilityfor operations and ES&H at PNNL.

Within RL, the Associate Manager for Scienceand Technology (AMT) performs most DOE linemanagement functions involving PNNL.However, DOE line management responsibility forPNNL is currently in transition. On December 5,2003, the Office of the Secretary of Energyapproved establishing the Pacific Northwest SiteOffice (PNSO) as an SC Site Office to providedirection to and oversee PNNL. According to SCplans, which are currently under review by theOffice of the Secretary of Energy, AMT and otherRL individuals will transfer to the new PNSO onDecember 14, 2003, which will report directly toSC and will receive support primarily from SCsupport offices in accordance with the ongoing SC

reorganization. The Head Contracting Authorityand Chief Financial Officer are expected to bereassigned from RL to the SC Office of the DeputyDirector for Operations (SC-3) and the Oak RidgeOperations Office, respectively, within the nextcouple of months.

PNNL is operated by Battelle MemorialInstitute (BMI), under contract to DOE. A newlaboratory director was selected on April 1, 2003.The new director has expressed a strongcommitment to ensuring that safety is integratedinto all work activities. The DOE/BMI contractincludes provisions that address the approach toDOE line management oversight of PNNL.Specifically, the contract addresses the principlesof contract management issued by the UnderSecretary for Environment, Science, and Energyin 2002, such as requiring contractor accountabilityfor ES&H performance. Contractor self-assessments and quantitative performancemeasures are also to be used as major elementsof monitoring and evaluating performance.

PNNL is a multi-program national laboratorythat delivers solutions to science and technologychallenges across all four of the DOE missions.As a federally funded research and development(R&D) center, PNNL performs work for most ofthe DOE program offices and other Federalagencies. PNNL is also a consolidated laboratorywith both private (BMI) and government facilities.One-third of the facilities are located in the 300Area of the Hanford Site, near Richland,Washington. PNNL has one Category 2 nuclearfacility—the Radiochemical ProcessingLaboratory (RPL)—and a number of radiologicaland industrial facilities comprising a total of 2.1million square feet. The PNNL activities includeR&D in a wide variety of areas, includingfundamental science, computational science,energy, environment, health and safety, informationtechnology, national security, and nucleartechnology. PNNL also operates and maintainsthe research facilities and performs various supportactivities, such as facility maintenance andconstruction. PNNL activities involve a variety ofpotential hazards that need to be effectivelycontrolled, including exposure to radiation,

Aerial View of PNNL

2

radiological contamination, chemicals, biological agents,hazardous materials, and various industrial hazards.

Throughout the evaluation of ES&H programs, OAreviewed the role of DOE organizations in providingdirection to contractors and conducting linemanagement oversight of contract activities. OAevaluations emphasized contractor self-assessments,including issues management, and DOE linemanagement oversight in ensuring effective ES&Hprograms. In reviewing DOE line managementoversight, OA focused on the effectiveness of RL andAMT in managing the PNNL contract, including suchmanagement functions as setting expectations, providingimplementation guidance, monitoring and assessingcontractor performance, and monitoring the quality ofcontractor self-assessments. Similarly, OA focusedon the effectiveness of the contractor managementsystem and self-assessment programs.

The purpose of the ES&H inspection was to assessthe adequacy and effectiveness of selected aspects ofES&H management as implemented by PNNL underthe direction of RL/AMT. The OA inspection teamused a selective sampling approach to determine theeffectiveness of RL/AMT and PNNL in implementingDOE ES&H performance expectations. The approachinvolved examining selected institutional programs thatsupport the integrated safety management (ISM)program and implementation of requirements inselected PNNL organizations, facilities, and activities.

The ES&H inspection was organized to evaluateselected aspects of the ISM program:

• RL, AMT, and PNNL implementation of selectedISM guiding principles, including safety-related rolesand responsibilities (ISM Guiding Principle #2) andidentification of safety standards and requirements(ISM Guiding Principle #5). The processes forimplementing suspect/counterfeit item (S/CI)requirements were a focus area.

• RL, AMT, and PNNL feedback and continuousimprovement systems, including the use of selectedperformance measures.

• PNNL implementation of the core functions ofsafety management for selected facility supportactivities and R&D activities. Facility supportactivities that were reviewed included construction,maintenance, electrical work, welding,maintenance, waste management, andsubcontractor activities. R&D activities reviewedincluded:

n Hot cell work and laboratory activities at RPLperformed by the Radiochemical Sciences andEngineering group, which is within the ProcessScience and Engineering Division of theEnvironmental Technology Directorate (ETD)

n Chemical and biology experiments at theEnvironmental Molecular Science Laboratoryperformed by PNNL and external users

n Biology experiments on molecular and cellprocesses involving chemical and physicalagents, performed by the FundamentalSciences Directorate and the ETD at Building331.

• Functionality of a selected essential system—theradioactive exhaust ventilation system (REVS) atthe RPL— including the unreviewed safety questionprocess.

During the review of these programs and activities,OA devoted particular attention to selected ES&Hrequirements, including work control processes, S/CIcontrols, subcontractor ES&H controls, radiologicalwork planning and permits, radiological controls,assessment and control of hazardous chemicals, injuryand illness record keeping, facility maintenance,electrical work, welding, and construction. In reviewingmanagement systems, OA examined both the currentoperations and SC, RL, and AMT plans for transitioningto the PNSO office.

Section 2 provides an overall discussion of thereview results for the PNNL ES&H programs,including positive aspects and weaknesses. Section 3

Building 331

3

provides OA’s conclusions regarding the overalleffectiveness of RL/AMT and PNNL management ofthe ES&H programs. Section 4 presents the ratingsassigned during this review. Appendix A providessupplemental information, including team composition.Appendix B identifies the specific findings that requirecorrective action and follow-up. Appendix C presentsthe results of the review of selected guiding principles

of ISM. Appendix D presents the results of the reviewof the RL/AMT and contractor feedback andcontinuous improvement processes. Appendix Eprovides the results of the review of the application ofthe core functions of ISM for the PNNL R&D activitiesand facility support activities. The results of the reviewof essential system functionality are discussed inAppendix F.

4

Results2.0

2.1 Positive Attributes

Several positive attributes were identified inthe AMT and PNNL implementation of ISM.Work activities, particularly those involving higherhazards, were performed with a high regard forsafety, and engineering controls and environmentalprograms were effective.

SC, EM, RL, and AMT are effectivelycoordinating their efforts to facilitate a smoothtransition to the PNSO. AMT is performingmost of the functions that will be performed byPNSO. SC, EM, and RL have identified the RLresources that will transfer to PNSO and the SCService Center. Plans have been developed thatprovide for a phased transition. The OA inspectiondid not identify any DOE line managementoversight functions that were not being performedwhile the transition is awaiting senior managementapproval. However, the transition has encounteredsignificant delays and thus the intended benefits(e.g., clearer lines of responsibility andaccountability) associated with the transition arenot yet being realized.

Most work activities at PNNL wereperformed with a high regard for safety.Although some weaknesses in identification andimplementation of controls were identified (seebelow), PNNL managers, staff, support personnel,and workers demonstrated a high regard for safety.Management was engaged and knowledgeableabout hazards and safety in their areas ofresponsibility. The workforce was competent andexperienced. Workers were involved in safety andindicated that PNNL management was supportiveof safety. PNNL actively participates in the DOEvoluntary protection program and has achieved Starstatus. The use of facility core teams, deployedstaff, cognizant space managers, and the buildingmanagement concept has helped ensure that safetyis integrated into line management and that theactivities of multiple organizations can becoordinated and controlled in PNNL laboratories.PNNL makes good use of electronic tools, suchas the Standards Based Management System(SBMS), Integrated Operating System (IOPS), and

Electronic Prep and Risk (EPR), to provideinformation to staff and facilitate development ofhazards analysis and permits. For many activities,including higher hazard activities and most Facilitiesand Operations (F&O) activities, clear proceduresare in place and effective controls have beenidentified and implemented. PNNL has developedeffective processes for the flowdown ofrequirements to subcontractors and implementingS/CI requirements.

Institutional and facility-specificenvironmental protection and wastemanagement programs are effectivelyimplemented. The deployment of environmentalcompliance and field services representatives tothe R&D and F&O organizations has ensured thatsufficient environmental and waste managementexpertise is available in the PNNL facilities andprogrammatic activities. In addition, PNNL hasbeen proactive in using International StandardsOrganization (ISO) 14001 as the basis for itsenvironmental management system, and has beencertified by an independent external organization.Further, the PNNL pollution prevention programhas been effective, and PNNL has received severalawards for its pollution prevention efforts. Forexample, PNNL received the White House“Closing the Circle Award” for being a goodsteward of natural resources for the GreenCustodial Products Initiative.

2.2 Items for ManagementAttention

Although many aspects of ISM at PNNL areeffective, PNNL hazards analysis and controlprocesses for some lower-hazard activities are notsufficiently rigorous or documented and the REVSdesign has not been adequately verified. RL, AMT,and PNNL feedback and improvement programsare not always effective in ensuring thatmanagement expectations and ES&Hrequirements are effectively implemented,monitored, and improved.

RL, AMT, and PNNL feedback andimprovement processes are not sufficiently

5

effective in identifying and correcting ES&Hdeficiencies. Although a significant number ofinspections are performed, PNNL’s self-assessmentprogram is not sufficiently rigorous to consistently andeffectively evaluate ES&H programs and measureperformance. In addition, there are weaknesses inPNNL issues/corrective action management processesthat hinder effective management evaluation ofperformance issues. As a result, some readilyobservable deficiencies are not being identified, andcorrective actions for identified deficiencies have notalways been implemented and verified to be sufficientto preclude recurrence. Further, PNNL is not alwaysconducting sufficient investigations of injuries andillnesses to ensure that root causes are identified andappropriate corrective actions and recurrence controlsare identified and implemented. RL and AMT havenot always been effective in achieving correction ofpreviously identified deficiencies in the PNNL self-assessment and corrective action managementprograms.

PNNL hazards analysis and control processesare not implemented with sufficient rigor at theactivity level to ensure that some hazards areeffectively addressed, particularly for lower riskactivities. PNNL chemical use documentation andimplementation of processes for identifying andcontrolling chemical hazards (i.e., IOPS, the ChemicalManagement System, and chemical use permits) donot always ensure sufficiently tailored hazard controls(i.e., specific personal protective equipmentrequirements and hazard communications) such thatappropriate protection is provided to the workers asrequired by SBMS. Worker exposure assessments andventilation surveys are not being performed as requiredby the Occupational Safety and Health Administrationand DOE Order 440.1A to provide assurance that

worker exposures are maintained below regulatorycompliance levels. In most instances, controls wereeffectively identified and implemented in higher hazardfacilities/activities, but hazards analysis and controlprocesses for some lower hazard activities are not welldefined and other controls were not implemented withsufficient rigor. As a result, needed controls were notin place for some PNNL R&D and F&O supportactivities.

RL and PNNL have not adequatelydemonstrated that the REVS at the RPL willperform its safety function for some credibleaccident scenarios. The amounts of radioactivematerial in the RPL are limited and the REVS design isgenerally robust. However, there are severalfundamental design weaknesses in REVS that couldprevent the system from performing its intended safetyfunction under certain accident conditions that are notadequately reflected in the documented safety analysis.These include: (1) the design does not account forpotential building pressurization and resultant unfilteredleakage during a design basis fire due to rapid loadingof the REVS high efficiency particulate air (HEPA)filters; (2) the design does not include adequate criteriafor maintaining negative building pressure that accountsfor wind effects; and (3) the REVS HEPA filter isolationdampers alone do not provide adequate isolation tomaintain the required system filtration efficiency whena filter bank is isolated. In addition, some REVS designrequirements are not translated adequately andcorrectly into the system procedures (i.e., the REVSHEPA filter and backup air supply testing wereinadequate to demonstrate operability). Further, PNNLdid not develop sufficiently rigorous and formal analysisto support the REVS design and operating requirementsand capabilities, resulting in some incorrect or non-conservative requirements and capabilities.

6

Conclusions3.0

Overall, implementation of ISM at PNNL hasimproved noticeably since the 1998 DOEHeadquarters independent oversight evaluation.This improvement is based on successfulimplementation of a number of initiatives andapplication of modern information managementtools. RL, AMT, and PNNL management aresupportive of safety and understand and accepttheir line management responsibility. SC, EM, RL,and AMT have coordinated their efforts to establishan appropriate plan for transitioning to PNSO.With a few exceptions, AMT and PNNL haveadequately identified and communicatedresponsibilities for ES&H functions. PNNL hasan effective process for identifying requirementsand ensuring that they are clearly incorporated intoworking-level processes and procedures. PNNLhas effectively integrated S/CI requirements intofacility procedures. However, PNNL linemanagement has notalways ensured thatm a n a g e m e n texpectations forr i g o r o u simplementation ofES&H requirementsare established andcommunicated.

The REVS atRPL is in goodmaterial condition,operators are well trained, and most operatingprocedures are well designed. Configurationmanagement is effective, and SC, RL, and PNNLhave taken appropriate actions to maintain andupgrade components in the aging system.However, REVS has several design elements thatwere not adequately analyzed in the safety analysis,and that could prevent the system from performingits design safety function. The REVS design andoperating requirements and capabilities are notadequately supported by formal, rigorous analyses,resulting in some incorrect requirements andcapabilities.

Most aspects of work that the OA teamobserved at PNNL were properly performed with

a high regard for safety. With some exceptions,effective hazard controls were in place andeffectively implemented, particularly for higherhazard activities, environmental protection/wastemanagement activities, and certain facility supportactivities. Some aspects of PNNL implementationof ES&H requirements are particularly rigorous(e.g., engineering controls in most laboratories andF&O activities).

However, weaknesses were identified in theimplementation of a number of hazard controls andprocedures, and ES&H requirements were notalways rigorously implemented for some activities,primarily lower hazard activities. Facilitymanagement, supervisors, and ES&H personneldid not always take sufficient action to ensure thatrequirements were being effectively implemented.For lower hazard activities, managementexpectations for the degree of rigor and

documentation arenot well defined,placing too muchreliance on individualexpertise andexperience ratherthan clear thresholdsand standards. MostPNNL personnel areexperienced andcompetent, arefamiliar with the

facilities and hazards, have experience with PNNLprocesses (e.g., SBMS, IOPS, and EPR), and oftenimplement effective controls. However,performance varied among individuals andorganizations, and documentation of decisions andcontrols was lacking in many cases. Improvementsare needed in implementation of a number of PNNLprocesses, including worker exposure andventilation assessments, interfaces between IOPSand EPR, chemical use documentation, anddocumentation of controls.

RL, AMT, and PNNL feedback improvementprograms include numerous inspections and havecontributed to improvements in ES&H programs.However, AMT and PNNL assessments and

Radiochemical Processing Laboratory (RPL)

7

corrective actions have not been consistently effectivein identifying and correcting deficiencies in facilities,processes, and work activities. The PNNL feedbackand improvement program is not sufficiently rigorousor effective in identifying and correcting ES&Hdeficiencies. RL and AMT have not always beeneffective in achieving correction of previously identifieddeficiencies in the PNNL self-assessments and issues/corrective action management processes.

Overall, the ISM programs at PNNL are matureand well structured and effectively address many of

the potential hazards. However, improvements areneeded in important aspects of the RL, AMT, andPNNL implementation of ISM, includingimplementation of activity-level controls, REVS safetybasis analysis and documentation, and RL, AMT, andPNNL feedback and improvement systems. Whileimprovements are needed in some of the areas, PNNLhas maintained a very good safety record.

8

Ratings4.0

The ratings reflect the current status of the reviewed elements of the PNNL ISM program:

Safety Management System Ratings

Guiding Principle #2 – Clear Roles and Responsibilities ...................... EFFECTIVE PERFORMANCEGuiding Principle #5 – Identification of Standards and Requirements ... EFFECTIVE PERFORMANCE

Feedback and Improvement

Core Function #5 – Feedback and Continuous Improvement .......................NEEDS IMPROVEMENT

Implementation of Core Functions for Selected Work Activities

Core Function #1 – Define the Scope of Work................................... EFFECTIVE PERFORMANCECore Function #2 – Analyze the Hazards ........................................... EFFECTIVE PERFORMANCECore Function #3 – Develop and Implement Hazard Controls .....................NEEDS IMPROVEMENTCore Function #4 – Perform Work Within Controls ............................ EFFECTIVE PERFORMANCE

Essential System Functionality

Design and Configuration Management .................................................SIGNIFICANT WEAKNESSSurveillance, Testing, and Maintenance .............................................. EFFECTIVE PERFORMANCEOperations ....................................................................................... EFFECTIVE PERFORMANCE

9

APPENDIX ASUPPLEMENTAL INFORMATION

A.1 Dates of Review

Scoping Visit September 9 - 12, 2003Onsite Review Visit November 10 - 21, 2003Report Validation and Closeout December 2 - 4, 2003

A.2 Review Team Composition

A.2.1 Management

Glenn S. Podonsky, Director, Office of Independent Oversight and Performance AssuranceMichael A. Kilpatrick, Deputy Director, Office of Independent Oversight and Performance AssurancePatricia Worthington, Director, Office of Environment, Safety and Health EvaluationsThomas Staker, Deputy Director, Office of Environment, Safety and Health Evaluations

A.2.2 Quality Review Board

Michael Kilpatrick Patricia WorthingtonDean Hickman Robert Nelson

Thomas Staker

A.2.3 Review Team

Patricia Worthington (Team Leader)Bill Miller (Deputy Team Leader)Ali Ghovanlou, Management Systems Lead Marvin Mielke, Core Functions LeadPhil Aiken Vic CrawfordRobert Compton Mark GoodAlbert Gibson Joe Lischinsky

Jim LockridgeBill Miller, Essential Systems Functionality Lead Edward StaffordMichael Gilroy Mario ViglianiDon PrevatteJoe Panchison

A.2.4 Administrative Support

Sandra PateTom Davis

10

APPENDIX BSITE-SPECIFIC FINDINGS

Table B-1. Site-Specific Findings Requiring Corrective Action Plans

FINDING STATEMENTS

1. RL and AMT have not always been effective in correcting previously identified deficiencies in the PNNLself-assessment and corrective action management programs.

2. PNNL has not applied sufficient rigor to feedback and improvement processes to ensure that ES&Hperformance is consistently and effectively evaluated and that ES&H-related incidents and program andperformance deficiencies are thoroughly and formally evaluated, resolved with effective recurrence controls,and analyzed for adverse trends.

3. PNNL line management has not sufficiently implemented SBMS requirements for chemical usedocumentation to ensure that specific activity-level hazard controls are identified for all chemical hazards.

4. Workplace exposure assessments and ventilation surveys are not being performed as required by OSHAand DOE Order 440.1A to provide assurance that worker exposures are maintained below regulatorycompliance levels.

5. The PNNL RPL REVS design contains fundamental weaknesses that could prevent it from performing itsdesign safety function and that are not adequately addressed in the DSA and associated TSRs.

6. PNNL has not adequately and correctly translated some REVS design requirements into system procedures,and REVS HEPA filter and backup air supply testing was not adequate to demonstrate operability.

7. PNNL has not ensured that the REVS design and operating requirements and capabilities are adequatelysupported by formal, rigorous analyses. The DSA and TSRs for the REVS were developed withoutsufficient formal technical analyses to support the design, operating parameters, or limits.

8. The safety evaluation process conducted by RL to support approval of the RPL DSA and TSRs for REVSdid not provide an adequate basis for approval.

11

APPENDIX CGUIDING PRINCIPLES OF

SAFETY MANAGEMENT IMPLEMENTATIONC.1 Introduction

The U.S. Department of Energy (DOE) Office ofIndependent Oversight and Performance Assurance(OA) evaluation of safety management systemsfocused on selected guiding principles of integratedsafety management (ISM) at the Pacific NorthwestNational Laboratory (PNNL). OA examined GuidingPrinciple #2 (Clear Roles and Responsibilities) andGuiding Principle #5 (Identification of Standards andRequirements). OA also reviewed the status of selectedongoing actions in areas of interest to the DefenseNuclear Facilities Safety Board, includingimplementation of suspect/counterfeit item (S/CI)requirements.

DOE Headquarters Office of Science (SC),Richland Operations Office (RL), PNNL, andsubcontractor personnel were interviewed to determinetheir understanding of the ISM program and theirresponsibilities, as well as the status of ongoinginitiatives and corrective actions. The OA teamreviewed various documents and records, including ISMprogram documents; environment, safety, and health(ES&H) procedures; functions, responsibilities, andauthorities manuals (FRAMs); ES&H manuals;contract provisions related to safety; subcontractprovisions; selected aspects of staffing, training, andqualifications of technical personnel; and various plansand initiatives relating to PNNL and RL oversight. Theevaluation of the guiding principles also considered theresults of the concurrent OA review of the corefunctions.

The review of the guiding principles focused oninstitutional and facility-level programs andimplementation of requirements at selected PNNLfacilities, including the Radiochemical ProcessingLaboratory (RPL), the Environmental MolecularScience Laboratory (EMSL), and Building 331, asimplemented by selected PNNL research anddevelopment (R&D) organizations, including theRadiochemical Sciences and Engineering group withinthe Process Science and Engineering Division, theFundamental Sciences Directorate, the EnvironmentalTechnology Directorate, and the Facilities andOperations (F&O) organization. The review of DOEline management focused on the current linemanagement responsibilities: SC as the cognizantsecretarial office, the DOE Office of EnvironmentalManagement (EM) as the landlord for the HanfordSite, RL as the onsite organization responsible forPNNL, and the Associate Manager for Science andTechnology (AMT), which is the organization withinRL that is assigned responsibility for implementing mostof RL’s line management oversight responsibilities. Inaddition, OA reviewed the SC, RL, and AMT plans totransition to the SC Pacific Northwest Site Office(PNSO). On December 5, 2003, the Office of theSecretary of Energy approved establishing the PNSOas an SC site office to provide direction to and overseePNNL. The Head Contracting Authority and ChiefFinancial Officer responsibilities are expected to bereassigned from RL to the SC Office of the DeputyDirector for Operations (SC-3) and the Oak Ridge

Environmental Molecular Sciences Laboratory (EMSL)

12

Operations Office, respectively, within the next coupleof months.

C.2 Results

C.2.1 Clear Roles and Responsibilities

Guiding Principle #2: Clear and unambiguouslines of authority and responsibility for ensuringsafety shall be established and maintained at allorganizational levels within the Department and itscontractors.

SC, RL, and AMT

SC has developed a restructuring project that willrealign the SC Headquarters and field structure in orderto clarify and streamline roles, responsibilities, authority,and accountability (R2A2) for management of sciencelaboratories. When this project is implemented, SCwill have a site office manager at PNNL and each ofits other science laboratories. The site office managerswill have primary line management responsibility foroperations and ES&H, and will report to the ChiefOperating Officer, SC, thereby eliminating one layerof management. The SC site offices will be augmentedby support centers, formed primarily from SC personnelat Headquarters and the current Chicago and OakRidge Operations Offices.

SC has developed a systematic three-phase planfor implementing the restructuring project across SC.The first phase includes defining the new organizationalstructure, appointing the new management team, andrelated activities (e.g., developing R2A2 documentationand memoranda of understanding with other affectedorganizations). However, the restructuring plan hasencountered significant delays. Phase 1 was initiallyprojected to be complete by the end of calendar year(CY) 2002, but senior DOE management has not yetapproved the reorganization.

Similarly, SC, EM, and RL have effectivelycoordinated efforts to develop a plan to transfer AMTand a few other RL support positions to the new SCPNSO, but the approval of the transfer has encounteredsome delays. Although no schedule has beenestablished, AMT anticipates the transition will beapproved in the near future by senior DOEmanagement. In anticipation of the formal approval ofthe new PNSO, AMT is currently performing mostDOE line management functions as a semi-autonomousorganizational element within RL. The RL Manager

maintains appropriate awareness of operations andissues but has authorized AMT to make most of thedecisions regarding the PNNL contract and operations.

The delay in the formal approval of the PNSOoffice has not had an adverse impact on ES&H atPNNL because the key DOE management functionsare presently being implemented by AMT and RL.However, the benefits of the clear lines of responsibilityand accountability are not yet being realized. Until thetransition to PNSO is complete, RL and EM (as thesite landlord and the organization that RL reports to)will continue to have line management responsibilitiesfor PNNL.

Although the current management structure doesnot reflect the planned streamlining and clarification ofline management responsibility, the current R2A2s forDOE’s management of PNNL are adequately defined,documented, and communicated. The SC FRAM anda signed management agreement (between SC, EM,and the RL Manager) clearly describe the relationshipsand flowdown of SC R2A2s to the RL Manager. TheRL FRAM describes the flowdown of R2A2s frommultiple Program Secretarial Officers (including SC)through 14 RL Management System Owners, and downto implementing documents. The RL FRAM providesan Applicability Matrix that “crosswalks” therequirements to RL implementing documents. Asindicated by the AMT transition plan, AMT anticipatesdeveloping a lower-tier FRAM document for PNSO(when the office is formally established) in accordancewith DOE Manual 411.1-1B.

AMT has adequate implementing documents thatdescribe AMT line management and oversightprocesses. AMT uses many of the RL implementingdocuments to perform line management and oversightresponsibilities at PNNL. There are a fewadministrative discrepancies in the AMT implementingdocuments because AMT uses different oversightprocesses than the rest of RL due to the provisions ofthe DOE/Battelle Memorial Institute (BMI) contract.Two processes used by AMT differ slightly from theRL processes (i.e., the performance assuranceprocedure and the proposal and work authorizationapproval procedure) and the AMT-specific processesare not listed in the RL FRAM Applicability Matrix. Inaddition, the AMT Facility Representatives (FRs) reportto AMT rather than to the RL organization specified inthe RL FR Process Description. The two FRs andfour other RL positions were reassigned to AMT inJuly as part of the preparation for establishing thePNSO. However, the corresponding AMT processesmeet the intent of the RL processes and requirements.

13

R2A2s for AMT, including those for FRs andsubject matter experts (SMEs), are well documented,and are understood by the AMT staff (however, seeAppendix D for discussion of weaknesses inimplementation of line oversight responsibilities). TheRL Manager recently (November 10, 2003) approveda new document, AMT Roles, Responsibilities,Accountabilities, and Authorities, that providesdetails on the identification and flowdown of AMTR2A2. The position-specific R2A2s are used to meetthe top-level SC R2A2s. Additional details on individual/position-specific R2A2s are provided in individualperformance plans, supervisory performance appraisalforms, the AMT management system description, themanagement system assignment matrix, and AMT-specific procedures. AMT personnel had a clearunderstanding of their respective roles, responsibilities,and authorities. Administration of the individualperformance plan process at AMT provides theframework for an effective accountability process.

PNNL

Institutional R2A2s. Many institutional ISMR2A2s for PNNL staff and managers are adequatelydescribed in the integrated ES&H program descriptiondocument, facility use agreements (FUAs), the workcontrol procedure (ADM-16), a number of StandardsBased Management System (SBMS) managementsystems and subject area descriptions, and the SBMSR2A2 document. (SBMS is a web-based electronicdelivery system that also describes a set of 20 PNNLmanagement systems.) At PNNL, two institutionalorganizations—the Environment, Safety, Health, andQuality (ESH&Q) and F&O Directorates—areassigned important support functions for PNNL R&Dline management in developing, implementing, andmaintaining systems that enable PNNL researchers toconduct their work safely.

ESH&Q provides SMEs and field-deployed staffto support line organizations. In addition, ESH&Q isresponsible for setting institutional policies, maintainingSBMS, and providing ES&H performance feedbackto the upper management. ESH&Q is the processowner for several important SBMS managementsystems, such as worker safety and health andintegrated ESH&Q. SBMS management systemowners and SMEs assigned to various subject areashave a clear understanding of managementexpectations and their roles and responsibilities. PNNLactively participates in the DOE voluntary protectionprogram and has achieved Star status.

However, with some exceptions (e.g.,environmental compliance representatives and wastemanagement field service representatives), detailedmanagement expectations and institutional R2A2s forfield-deployed ESH&Q personnel have not yet beenfully defined by the ESH&Q organization. Currently,the operation managers of the “host” organizationsdevelop the expectations for the support roles ofESH&Q staff, with the concurrence of the ESH&Qorganization manager. The lack of well-publicized anddocumented institutional expectations for safety andhealth (S&H) representatives, as part of the SBMSprocess for worker safety and health, has, in someinstances, reduced the effectiveness of deployedESH&Q staff in their interactions with R&D staff andmanagers. In addition, the SBMS worker safety andhealth management system description does not addressthe relationship of this process with the IntegratedOperations System (IOPS) and Electronic Prep andRisk (EPR) processes.

The F&O Directorate functions as the landlord formost facilities and buildings and has assigned buildingmanagers, engineers, and core team staff to providedirect facility support to the R&D line organizations.R2A2s for these individuals are generally well definedand implemented in PNNL documents. For example,the building management role includes ownership ofthe FUA and implementation of the work control processfor maintenance and constructions. FUAs define theoperating boundaries/requirements for each facility,including R2A2s for building mangers and occupants.Building managers lead an F&O “core team” that,depending on the size and other requirements of thebuilding, includes a building engineer, facility projectmanagers, work control specialists (planners), andsafety engineers. Implementation of roles andresponsibilities within the core team is comprehensive,and the interface between the support staff and theresearchers (through the building manager, buildingengineer, and cognizant space manager [CSM] position)has been well established and maintained.

The implementation of roles and responsibilities forPNNL support functions is generally well defined andsupported by such modern information managementtools as the electronic service request (ESR). Thesetools allow electronic distribution of documents (e.g.,the permit and/or forms) to those who need to reviewand approve them, or others who could benefit fromthe information. For example, the ESR system, amechanism used to obtain service and maintenancesupport from F&O, is linked to the IOPS database andautomatically displays hazards for the space where the

14

work is to be performed. In addition, the ESR isautomatically sent to the responsible CSM for earlynotification of pending work in his/her space or facility.In another example, the EPR automatically sends emailnotifications to SMEs and CSMs, alerting them to thehazards of new or proposed R&D projects.

Roles and Responsibilities for Authorizingand Conducting Work. R&D work at various PNNLfacilities, including Building 331, EMSL, and RPL, arebased on two related processes. In each building, theIOPS process is designed to allow performance ofR&D work at various “spaces” within a building wherethe hazards/controls for the intended type of work havebeen evaluated with respect to the IOPS requirementsin the laboratories and are bounded by the FUA/documented safety analysis (DSA). The secondprocess, the EPR, is intended to identify andcommunicate the risk and ES&H hazards of a new ora modified project for the IOPS space where the workis to be performed. With some exceptions, the EPRand IOPS processes are used for most R&D activities.

The overall responsibility for safety in theworkplace has been appropriately assigned to linemanagement. The line management chain flows fromthe PNNL Director, to associate laboratory directors,division directors, and technical group managers. Forspaces within their jurisdictions, the technical groupmanagers have authorized CSMs. The CSMs, whotypically perform R&D work within these spaces,implement a process to assure that only work allowedby the safety requirements for the space is performed.CSMs are assisted by support organizations for theirdivisions and/or facilities. These organizations provideadministrative and technical services associated withIOPS, support staff, ESH&Q, and F&O. R2A2s foridentifying, bounding, and communicating risks/hazards

of new R&D projects are assigned through the EPRprocess to product line managers (PLMs) and projectmanagers.

The IOPS is an effective process for conductingsmall R&D projects (most PNNL activities fall intothis category). The IOPS process and the associatedR2A2s at the facilities inspected are appropriatelydefined and, in most instances, were effectivelyimplemented. For example, most R2A2s for identifyingand documenting IOPS hazards for laboratory spacesused to conduct research in such fields as chemistryand molecular biology have been appropriately defined.Furthermore, CSMs were knowledgeable of theirduties and responsibilities, including building and facilityaccess control, self-assessment, and changes tohazards.

The CSMs’ R2A2s have also been clearlycommunicated and supported by all levels of PNNLmanagement, including the PNNL Director. CSMshave recently received a written delegation of authorityfrom line management, emphasizing their R2A2s, andconfirming their authority for IOPS laboratory spaces.The CSMs indicated that they believed they had theappropriate level of authority to perform their duties.

For RPL activities, additional measures have beentaken to ensure that R2A2s are clearly defined andunderstood. RPL’s DSA clearly describes operationaland programmatic (R&D) functions for performingwork. Further, the RPL Manager’s R2A2s forimplementing the DSA are clearly defined. The rolesand responsibilities of the Independent ReviewCommittee, which supports the RPL Facility Managerin authorizing new programmatic work, are also clearlydefined.

Although the R2A2s for many organizations andthe IOPS and EPR processes have generally beenappropriately defined, the OA team identified a numberof programmatic weaknesses in the area of R2A2s:

• SBMS has not adequately established requirementsor clear and detailed R2A2s for S&Hrepresentatives and for assessment, issuesmanagement, lessons learned, employee concerns,and injury and illness reporting.

• The span of control for some CSMs, who alsoperform research, is too great and detracts fromCSM responsibilities. A number of the CSMs haveto maintain continuous awareness of over ten otherprojects performed by other researchers in theirIOPS space(s). These CSMs may not have

New LAN Installation

15

sufficient time to effectively address oversight, newprojects, or project modifications.

• The interface between the resource managers whoown craft resources and the CSM who owns thespace where crafts work is not clearly established.

In addition, a number of deficiencies are evident inthe implementation of certain ES&H controls, asdiscussed in Appendices D, E, and F. For some ofthose deficiencies, PNNL management systems hadassigned responsibilities, but PNNL personnel did notrigorously and effectively execute their responsibilities.These include:

• The hazard identification/mitigation feature of theF&O job planning software was not used by a workplanner in the preparation of a job planning package(JPP) for electrical work. The JPP, however, hadbeen signed, authorized by several members of thecore team, and executed. F&O managementimmediately responded to this issue by conductinga management assessment of over 100 JPPs andfound additional instances of the same problem.

• Several deficient EPRs were approved by PLMs/project managers without the identified hazardsbeing appropriately addressed as required by therisk mitigation permit.

• There were instances where PLMs, who areaccountable for assessing the safety of theirprojects, failed to obtain appropriate ESH&Q SMEand ESH&Q representatives’ support to reviewtheir projects.

• There were instances where the responsible CSMsdid not ensure that IOPS hazards analysissummaries reflected all hazards present in the IOPSspaces or where the specific requirements for IOPSpermits were not met at the project/task level.

• There were several instances where the IOPShazards were not included in the JPPs and dispatchwork orders, although these documents had beensigned and work had been performed.

When viewed collectively, the deficiencies aboveindicate that PNNL management has not alwaysestablished sufficient expectations for rigorousperformance of safety responsibilities. However, many

of the weaknesses in R2A2 are most evident in small,stand-alone projects, most of which are categorized aslow-hazard activities. Additional controls are often inplace for larger projects and higher-hazard activities.For example, the EMSL user proposal process requiresthat all proposals be reviewed by the ESH&Q staff forverification of ES&H hazards before acceptance. Afteracceptance, a host familiar with EMSL processes isassigned to the outside user to establish access to theIOPS space where the project is to be performed.

Summary. Most aspects of RL, AMT, and PNNLR2A2s are well defined and communicated. SC, RL,and AMT have an appropriate transition plan for thePNSO, but the benefits of the planned reorganizationare not yet being realized because of delays inapproving and implementing the reorganization.Although not yet approved, SC, RL, and AMT havecoordinated effectively to develop a clear plan for thetransition to an SC PNSO office and have ensuredthat key DOE management functions are performedwhile the transition is pending. Many PNNL R2A2systems are mature and well documented. However,there are weaknesses in some aspects ofimplementation of the systems that are contributing todeficiencies in identification and control of somehazards, mostly in lower hazard activities.Notwithstanding these weaknesses, SC, RL, AMT, andPNNL have a good framework of R2A2s in place.Additional communication of management expectationsfor rigorous implementation of existing systems wouldfurther improve safety management at PNNL.

C.2.2 Identification of Standards andRequirements

Guiding Principle #5: Before work isperformed, the associated hazards shall beevaluated and an agreed-upon set of safetystandards shall be established that, if properlyimplemented, will provide adequate assurance thatthe public, the workers and the environment areprotected from adverse consequences.

DOE

RL has established ES&H requirements in theDOE/BMI contract consistent with currentDepartmental policy for managing these requirements.Recent Departmental policy encourages the relianceon Federal, state, and local laws and regulations andnational and industry standards to establish contractorrequirements and performance criteria, while minimizing

16

the use of DOE orders and directives for placingadministrative and operating requirements on thecontractor. Consistent with this policy, Special ContractRequirement H-18 was included in the DOE/BMIcontract to provide a mechanism for PNNL to proposeprocedures and standards as alternatives to DOEdirectives listed in the contract and to allowimplementation of these alternatives once approved bythe contracting officer.

AMT has worked effectively with PNNL, using aformal requirements integration and tailoring process,to identify a necessary and sufficient set of ES&Hrequirements for meeting DOE expectations.Redundant requirements that had been included in theprevious contract were eliminated. Requirements thatapply only to the PNNL RPL, the only nuclear facilityat PNNL, were listed separately in the RPLauthorization agreement, which is included as part ofthe new contract.

RL and AMT processes for administering thePNNL contract are in transition. The PNNL ContractAdministration Plan has not been updated to reflectthe transfer of contracting officer responsibilities fromRL to AMT and does not yet address recent contractchanges that encourage use of industry standards inlieu of DOE directives. For example, the plan does notspecify if alternate requirements, which are adopted inlieu of DOE directives, are to be included in thecontract. AMT currently relies on the RichlandIntegrated Management System and on technicalsupport from RL SMEs for review of new and revisedDOE directives and for development of records ofdecision regarding applicability of these directives, butthis support is not expected to be available in the future.AMT understands the need to update processes forcontract administration. A strategy has been developedand an update to the Contract Administration Plan isbeing prepared.

RL has not established clear expectations forincluding adopted industry standards in the contract,and no such standards are currently included. Managersinterviewed did not have a clear or consistentunderstanding of DOE expectations in this area. Aninternational standard, ANSI/ISO14001-1996,Environmental Management System, was adopted forenvironmental management in lieu of DOE Order 450.1,Environmental Protection Program, but the adoptedstandard was not included in the contract. In addition,some facility safety requirements specified in DOEOrder 420.1, Facility Safety, which were in theprevious contract, are not in the current contract.However, the Facility Safety requirements and

integration tailoring process negotiated with PNNL,AMT, and RL identifies that the following documents,as applicable to PNNL and PNNL-managed facilities,will be used as best practice approaches to addressthe design and natural phenomena criteria for newfacilities or modification to existing facilities: DOE Guide420.1-1, Nonreactor Nuclear Safety Design Criteriaand Explosives Safety Criteria Guide for Use withDOE Order 420.1, Facility Safety; and DOE Guide420.1-2, Guide for the Mitigation of NaturalPhenomena Hazards for DOE Nuclear Facilitiesand Nonreactor Facilities.

PNNL

The PNNL SBMS provides a systematic processfor the flowdown of ES&H requirements. Externalrequirements, including laws, regulations, and contractrequirements, are conveyed to the PNNL workforcethrough a formal hierarchy of documents, includingpolicies, standards (i.e., standards of conduct),management system descriptions, program descriptions,and subject area descriptions (e.g., laboratory-wideprocedures), which are delivered to users throughSBMS. Each external requirement is supported by arecord of decision that identifies the organizationresponsible for implementation and provides a link toimplementing documents. The SBMS electronicdelivery system is mature (established in 1995) andwell used by the PNNL staff.

An SBMS subject area, “RequirementsManagement,” provides adequate procedures foridentification and processing of new and revised DOEdirectives, laws, and regulations. New and revisedDOE directives are identified by DOE and processedby PNNL in accordance with specific terms in thecontract. New and revised laws and regulations arenot normally identified by DOE and are applicable toPNNL whether listed in the contract or not. Theprocedure for identifying changes to laws andregulations assigns responsibility for identifying suchchanges to management system owners but does notspecify a process or frequency for systematicallyperforming this task. Nonetheless, the individualsperformed their responsibilities effectively for thefollowing examples reviewed by the OA team:

• Recent Occupational Safety and HealthAdministration requirements for reducingoccupational injuries due to needle sticks and othersharps-related injuries were effectively managedby PNNL. Federal regulation 29 CFR 1910.1030,

17

Bloodborne Pathogens, was revised about twoyears ago to implement the Needle Stick Safetyand Prevention Act of November 6, 2000. A recordof decision was prepared and appropriaterequirements were included in the applicablesubject area.

• A March 2003 change to Federal transportationrequirements for hazardous materials has beenidentified and implemented by PNNL. Regulation49 CFR 172.800 requires shippers of hazardousmaterials to develop security plans for suchshipments by September 25, 2003. The PNNLSME for transportation was well aware of thisrequirement and had developed a record of decisionand the required security plan.

External ES&H requirements are adequatelyaddressed in SBMS and lower-tier documents. Toevaluate the effectiveness of SBMS, the OA teamtraced several external requirements throughimplementing documents in the SBMS to determinewhether the PNNL workforce was provided theinformation necessary for safety and compliance. Ingeneral, external requirements, including contractclauses and applicable Federal regulations and DOEdirectives, were adequately addressed in SBMS andlower-tier documents. For example:

• The guiding principles and core functions of ISM,as specified in Contract Clause I-87, are addressedin SBMS through a program description andsubject area procedures. In general, SBMSincludes adequate procedures for addressing roles,responsibilities, and authorities pursuant to GuidingPrinciple #2 and for the identification of safetystandards pursuant to Guiding Principle #5. ThePNNL IOPS and the F&O procedure set providesa means of ensuring that work is planned andaccomplished in accordance with the core functionsof ISM. The procedures for this system, whichare included as subject areas in SBMS, providemechanisms for staff members to identify hazardsassociated with proposed work and for CSMs toevaluate these hazards and define the ES&Hrequirements that the staff members must meet.

• The requirements in Federal regulation 10 CFR835, Occupational Radiation Protection, aresatisfactorily addressed in the radiation protectionprogram description in SBMS and in the PNNLRadiation Protection Manual, MA-266. These

requirements flow down to the workforce throughimplementing procedures and radiation workpermits.

• Fire protection requirements include a requirementin DOE Order 420.1A to comply with National FireProtection Association standards. This requirementis included in the fire protection program descriptionin SBMS. The requirement in National FireProtection Association-80, Standard for FireDoors and Fire Windows, for the annual testingof rolling fire doors is included in preventivemaintenance procedure PM 44574 for testing ofEMSL fire doors. This procedure does not requirefull documentation of test results, and some positiveresults of the most recent test were not recorded.

• The interface between PNNL and the HanfordReservation occupational medical provider,Hanford Environmental Health Foundation(HEHF), is effective and fulfills the contractorrequirements in DOE Order 440.1A, WorkerProtection Management for DOE Federal andContractor Employees, Chapter 19, OccupationalMedicine. PNNL and HEHF professional staffinteract regularly to address worker protectionhealth issues and have developed several specificmedical surveillance formats to better identifyhealth concerns while working with high-intensitymagnetic fields and biohazard environments. Theprimary medical surveillance tool managed byHEHF, the employee job task analysis (EJTA),provides a comprehensive set of questions toidentify a workers potential exposure to hazards.A proposed operations improvement initiative tobetter integrate the flow of data between PNNLand HEHF automated systems originally approvedin fiscal year (FY) 2001, but not yet funded, wouldimprove communication, improve accuracy, andreduce duplication of effort in the EJTA process.

In one instance reviewed by the OA team,flowdown of RPL maintenance requirements fromDOE Order 433.1, Maintenance ManagementProgram for DOE Nuclear Facilities, wasincomplete. The contractor requirements document(CRD) for this order was included in the contract as arequirement applicable to RPL. The CRD requiresPNNL to establish a DOE-approved maintenanceimplementation plan, and a record of decision in SBMSassigned development of this plan to the F&O

18

organization. This plan was being prepared but wasnot yet approved for implementation. Althoughimplementation of this order was not yet completed,the safety significance was low because PNNLprocedures met DOE Order 4330.4B, MaintenanceManagement Program, which was required by theprevious contract and contained most of the samerequirements.

The PNNL Requirements Management System hasnot been fully applied for the identification andprocessing of applicable industry standards. Industrystandards may be voluntarily adopted by PNNL or maybe adopted as alternatives to DOE directives in supportof commitments made to DOE. In either case, thestandards should be clearly identified as requirementsin the contractor’s Requirements Management Systemto ensure systematic flowdown through implementingprocedures. The PNNL Requirements ManagementSystem includes steps for identification, receipt, andprocessing of external requirement documents but, inthe past, industry standards were not generally regardedas external requirement documents and thus were notidentified or processed in the RequirementsManagement System. In the area of ES&H, many ofthese standards are indirectly included because theyare referenced by DOE directives that are listed in thecontract as requirements.

An SBMS subject area, “Requirements Integrationand Tailoring,” provides a process for proposing a setof ES&H requirements and industry standardsapplicable to each PNNL management system. Thisprocess was instrumental in developing the set ofadequate DOE directives that is included in the currentcontract and for establishing a list of agreed-uponindustry standards. The “Requirements Integration andTailoring” subject area specifies that the process iscontinuous and used on an ongoing basis but does notspecify a minimum frequency or other criteria forreevaluating and updating existing requirements. Theprocess was recently revised to require records ofdecision for applicable industry standards, but theserecords have not yet been generated, and few industrystandards have been identified as requirements inSBMS. For example, records of decision have not beenprepared for agreed-upon standards that were identifiedduring development of the current contract.

However, PNNL established an environmentalmanagement system pursuant to ISO 14001 as anapplicable external requirement in a record of decisionand established an environmental management systemwithin SBMS based on this international standard.PNNL was determined to be in conformance with ISO

14001 in November 2002 and was verified to be incontinuing conformance in October 2003.

PNNL understands the need to prepare records ofdecision for applicable industry standards. Preparationof these records is expected to begin early in CY 2004but has not yet been scheduled.

Formal processes are in place to assure thatapplicable ES&H requirements flow down tosubcontractors. The Acquisition Management Systemassigns project managers the responsibility forspecifying appropriate safety requirements, and the“Purchasing Goods and Services” subject areaprocedure includes procedures for identifying hazardsand including applicable ES&H requirements insubcontracts. The subcontracting process includesappropriate provisions for involvement of ESH&QSMEs in the planning and oversight of subcontractedactivities. Involvement includes review of safetyexpectations in requests for proposal, evaluation of

bidders’ past safety performance, participation in pre-construction meetings and job walkdowns, and oversightof work activities. Subcontractors are given the optionof using their own health and safety plan or adoptingthe Battelle Contractor Safety Guide. All subcontractedwork is controlled by JPPs and by IOPS when the workis performed in a space where IOPS is applied.

Flowdown of ES&H requirements tosubcontractors has been effective. Subcontracts forthe renovation of the first and third floors of Building331 and for upgrade of the Building 331 liquid monitoringsystem were reviewed. Both contracts contained

Building 331

19

appropriate ES&H requirements. Both includedworkplace exposure assessments, JPPs, and radiationwork permits. The contract for upgrading the liquidmonitoring system included the Battelle ContractorSafety Guide; however, the contract for renovation ofthe first and third floors did not include this guide or arequirement for a subcontractor’s health and safetyplan, but the guide was adopted after the contract wasawarded. This contract identified radioactive materials,asbestos, and mercury as potential hazards and specifiedappropriate controls for each.

Oversight of subcontractor activities is generallyconsistent with contractual requirements. Clause I-80of the DOE/BMI contract states that PNNL isresponsible for compliance with ES&H requirementsregardless of who performs the work and requires thatES&H requirements flow down to any tier to the extentnecessary to ensure compliance. This responsibility isreiterated in the integrated ES&H program descriptionand was understood by PNNL managers contactedduring this evaluation. PNNL ES&H personnelfrequently inspect construction subcontractor workactivities.

DOE requirements for control of S/CIs areadequately addressed in SBMS program descriptionsand procedures. DOE requirements in DOE Order440.1A, CRD Section 22, for identification and controlof S/CIs have been integrated into the PNNL qualityassurance program and into an S/CI programdescription. Requirements for implementing thisprogram are adequately addressed in two subject areaprocedures and lower-tier implementing procedures,which provide requirements for procurement, inspection,control, and reporting of S/CI. The programdescriptions and subject area procedures are availableto users through SBMS.

In the area of procurement, SBMS includesadequate restrictions and guidance to reduce theprobability of purchasing S/CI using purchase cards (P-Cards). A formal inspection process for all purchaseditems includes steps for identifying S/CI. Inspectioncriteria direct special attention to items purchased foruse in a nuclear facility and include provisions forindependent inspections by Quality Engineering whenappropriate. The procedures are supported withguidelines describing S/CI identified at DOE facilities.

Adequate processes are in place for identifying anddispositioning S/CI. Procedures direct staff memberswho identify potential S/CI to contact an S/CI singlepoint of contact (POC) for assistance in identification,reporting, and disposition of these items. Adequate

procedures have been established for tagging,segregating, and reporting items that are identified aseither suspect or counterfeit. The S/CI POC maintainsawareness of S/CI issues identified at other sites bymonitoring the DOE Lessons Learned List Server andby participating in periodic S/CI teleconferencessponsored by DOE’s Office of Environment, Safetyand Health. An Occurrence Reporting and ProcessingSystem coordinator in the F&O Directorate reviewsoccurrence reports and lessons-learned reports fromother DOE sites and notifies the S/CI POC of thoserelated to S/CI. The PNNL S/CI POC interfaceswith a DOE POC in AMT.

Deficiencies in the implementation of the S/CIprogram were recently identified through self-assessments and were corrected. A self-assessmentof the S/CI program performed by the S/CI POC inSeptember 2002 identified that some individualsreceiving purchased items were not familiar with S/CIinspection requirements. A follow-up management self-assessment performed in January 2003 determined thatmost staff members performing inspections of itemshaving high potential for being S/CI did not inspect forS/CI characteristics. These findings have beenadequately addressed through a retraining program.

Summary. AMT and PNNL have workedeffectively together to identify an adequate set of ES&Hrequirements for meeting DOE expectations.Redundant requirements that had been included in theprevious contract were eliminated, requirements thatapply only to RPL were listed separately in the contract,and increased reliance was placed on industry standardsconsistent with DOE policy. The SBMS electronicdistribution system provides an effective infrastructurefor conveying the requirements to the PNNL workforce,including subcontractors. ES&H requirements,including recent changes to these requirements, havebeen adequately addressed in SBMS subject areas andin lower-tier implementing procedures. Theeffectiveness of these processes was particularlyevident in the procedures for the identification andcontrol of S/CIs, which provide adequate direction tothe workforce for identification and control of S/CIs.Processes for management of adopted industrystandards do not ensure requirements are incorporatedinto contracts and procedures. AMT has not clearlyconveyed expectations regarding incorporation ofstandards into the contract and identification ofapplicable standards in SBMS is incomplete. However,these areas are being addressed by ongoing PNNLinitiatives.

20

The ratings of the guiding principles reflect the status of the reviewed elements of the AMT and PNNL programs.

Guiding Principle #2 – Clear Roles and Responsibilities ..................................... EFFECTIVE PERFORMANCEGuiding Principle #5 – Identification of Standards and Requirements .................. EFFECTIVE PERFORMANCE

This OA inspection identified the followingopportunities for improvement. These potentialenhancements are not intended to be prescriptive ormandatory. Rather, they are offered to the site to bereviewed and evaluated by the responsible linemanagement, and accepted, rejected, or modified asappropriate, in accordance with site-specific programobjectives and priorities.

DOE Office of Science and DOE Office ofEnvironmental Management

1. Consider accelerating efforts to gain approvalfor the establishment of PNSO, transferresources from RL to SC/PNSO, andimplement the transition plan for shiftingresponsibilities to PNSO.

RL Associate Manager for Science andTechnology

1. Ensure that appropriate national standardsare included as requirements in the DOE/BMIcontract. Specific actions to consider include:

• Establish screening criteria for determiningwhich national standards are to be included inthe contract.

C.5 Opportunities forImprovement

C.4 Ratings

C.3 Conclusions

AMT and PNNL have established acomprehensive framework for the institutional ISMprogram and have implemented most requirementseffectively. With some exceptions, clear roles andresponsibilities have been established andcommunicated to responsible staff. The processes forestablishing requirements and incorporating them intowork instructions are effective. S/CI requirements are

clearly established and communicated. However, linemanagers have not always ensured that managementexpectations are established, communicated, and met.These weaknesses contribute to deficiencies inimplementation of some aspects of ES&H requirementsand the quality of assessments and corrective actions.Although improvements are needed in communicationof management expectations, most AMT and PNNLinstitutional management systems are well defined andare contributing to a safe work environment at PNNL.

• Establish ongoing processes to periodicallyreview national standards for changes andrevise the contract as appropriate.

Pacific Northwest National laboratory

1. Clarify expectations and enhance the rigorof implementation of R2A2s, particularly withthe interfaces among SBMS, IOPS, and EPR.Specific actions to consider include:

• Establish and communicate clear seniormanagement expectations for rigorousimplementation of responsibilities at all levelsof management.

• For PLMs and project managers, includeperformance metrics related to hazardidentification and implementation of hazardcontrols through PNNL processes, such as theEPR and IOPS processes.

• Develop, document, and publicize theinstitutional expectations for S&Hrepresentatives as part of the SBMS processfor worker safety and health.

21

• In the SBMS worker safety and healthmanagement system description document,address the relationship between thismanagement system and the IOPS and EPRprocesses.

• Examine the span of control of CSMs todetermine whether assigned ES&Hresponsibilities are commensurate with theirworkloads. Identify additional supportrequirements or alternative distributions ofworkloads as appropriate.

• Formalize expectations for PLMs and projectmanagers to make timely notifications to CSMsabout the risks and hazards of new/modifiedprojects.

2. Further strengthen the requirementsmanagement processes in the areas ofmanagement of national standards,implementation plans for contractualrequirements, and review and approval ofsubcontract documents. Specific actions toconsider include:

• Use the requirements and integration tailoringprocess to identify national standards that areapplicable to PNNL. Enter applicablestandards as requirements in SBMS.

• Screen applicable national standards usingcriteria provided by AMT to develop an agreed-upon list of standards to be included in thecontract.

• Develop an implementation plan, includingmilestones and schedules, for implementationof CRD 433.1.

• Review implementation of other ES&Hcontractual requirements and submitimplementation plans for those that are not yetfully implemented.

3. Continue to promote operationalimprovement initiatives that will improve theefficiency and accuracy of the HEHF EJTAtool. Specific actions to consider include:

• Improve the efficiency and accuracy of thedata gathering process for the EJTA toolthrough the revised improvement initiative.

• Ensure that the initiatives reduce duplicationof effort by populating a single data systemand better inform managers concerning workermedical surveillance and training requirements.

• Ensure that the initiatives enhancecommunication of worker health informationbetween PNNL and HEHF medical providers.

22

D.1 Introduction

The U.S. Department of Energy (DOE) Office ofIndependent Oversight and Performance Assurance(OA) evaluated feedback and improvement programsat the Pacific Northwest National Laboratory (PNNL).The organizations that were reviewed included theDOE Office of Science (SC), the Richland OfficeOperations Office (RL), and PNNL. Within RL, OAfocused primarily on the Associate Manager forScience and Technology (AMT) organization, whichperforms most of the DOE line oversight functions onbehalf of RL. The OA review focused on feedbackand improvement programs as they are applied toenvironment, safety, and health (ES&H) programs atthe facilities and activities selected for review on thisinspection—the Radiochemical Processing Laboratory(RPL), Environmental Molecular Science Laboratory,Building 331, and Facilities and Operations (F&O)support activities—as implemented by selected PNNLresearch and development organizations, including theRadiochemical Sciences and Engineering group withinthe Process Science and Engineering Division, theFundamental Sciences Directorate (FSD), theEnvironmental Technology Directorate (ETD), and theF&O organization.

The OA team examined the RL line managementoversight of integrated safety management (ISM)processes and implementation of selected linemanagement oversight functions, including the FacilityRepresentative (FR) program, ES&H assessments,AMT oversight procedures, AMT self-assessments,the issues management process, the lessons-learnedprogram, and the employee concerns program. TheOA team reviewed PNNL processes for feedback andcontinuous improvement and implementation of thoseprocesses, including assessment processes, correctiveaction/issues management, lessons learned, injury andillness investigations, and employee concerns.

D.2 Results

D.2.1 SC, RL, and AMT LineManagement Oversight

SC uses a variety of informal weekly and monthlyphone calls, and an annual onsite meeting tocommunicate with RL and AMT and to stay informedabout major ES&H issues. However, SC historicallyhas not taken a proactive role in providing direction toor overseeing PNNL operations.

The SC reengineering effort is a significant step inchanging SC’s historical approach to line managementoversight. In the planned organization, the PacificNorthwest Site Office (PNSO) will report directly toSC without an intermediate layer of management (i.e.,RL). Therefore, SC will be more directly involved indecisions related to PNSO and PNNL activities.

SC has established expectations that guide linemanagement oversight activities and that emphasizecontractor self-assessments, encourage contractors touse external experts, and make extensive use ofperformance indicators to monitor and evaluatecontractor performance. As discussed below and inAppendices C, E, and F, there are some deficiencies inPNNL ES&H programs and PNNL self-assessmentsand issues management, indicating that increased SCattention is needed to enhance PNSO line oversight.

The AMT line management program has theappropriate elements, including FR and ES&Hassessment programs. The assessment and operationalawareness processes are well documented and theoperational oversight of the contractor is accomplishedin accordance with the AMT performance assuranceprocedure. As discussed in Appendix C, onDecember 5, 2003, the Office of the Secretary ofEnergy approved establishing the PNSO as an SC siteoffice to provide direction to and oversee PNNL. TheHead Contracting Authority and Chief Financial Officerresponsibilities are expected to be reassigned from RLto the SC Office of the Deputy Director for Operations(SC-3) and the Oak Ridge Operations Office,respectively, within the next couple of months.

APPENDIX DFEEDBACK AND CONTINUOUS IMPROVEMENT

(CORE FUNCTION 5)

23

AMT has been implementing a “partnering”paradigm with PNNL since 1995. This partneringapproach reflects longstanding SC guidance. As partof this paradigm, AMT emphasizes a coordinatedapproach to planning and performing assessments andemphasizes performance measures as a tool formonitoring and evaluating performance. The newDOE/Battelle Memorial Institute (BMI) contract(awarded October 2002, signed August 2003, andextending through fiscal year [FY] 2007) reinforcesthe basis for the partnering approach. The new contractincorporates the six principles from the April 2002memorandum from Under Secretary Robert Cardentitled “Principles for Office of Science LaboratoryContract.” In accordance with these principles, AMTmanagement emphasized to its staff that PNNLmanagement is fully responsible and accountable forPNNL activities and quality, including ES&Hperformance.

The 20 PNNL management systems defined in theStandards Based Management System (SBMS) areused by AMT and PNNL as a framework for lineoversight activities. AMT has designated leads for eachof the 20 systems, and these leads work with theirPNNL counterparts to reach agreements on theassessment expectations, deliverables, and schedulesfor the year.

AMT’s documentation of their contractor oversightactivities varies considerably and does not demonstratesufficient line oversight activities in some managementsystems. Recently, AMT began using Capture Tool (adesktop documentation application) to document itsactivities in each of the 20 areas. Partnershipagreements for the integrated quality, environment,safety, and health and environmental managementareas were reviewed, and documentation for theseareas was adequate. However, OA identified that sevenAMT primary leads for business management systemshad no Capture Tool entries during the period sampled.

The AMT FR program is a well-documentedprogram that meets or exceeds DOE requirements forcoverage of PNNL nuclear facilities. Master oversightplans and master surveillance plans are complete andmeet the requirements of the RL FR program sourcedocuments and procedures. However, AMT has onlytwo qualified FRs, and there are a large number ofPNNL facilities. Consequently, the degree of FRattention devoted to the many non-nuclear PNNLlaboratories is limited.

Sixty-one FR surveillances were conducted anddocumented between October 2001 and October 2003.Generally, findings are tracked to closure in a tracking

system known as ATS. However, observations arenot formally tracked. Further, a number of FRobservations were related to requirements and shouldhave been identified as findings so they could be trackedto closure. For example, one surveillance listed aninadequate lockout/tagout as an observation. Thepractice of not formally tracking observations reducesthe effectiveness of the FR program, since surveillanceobservations are not always verified to be corrected,and observations are not recorded so that they can betracked and trended.

AMT has not updated guidance for AMT staff toreflect the new contract. The new contract was signedAugust 26, 2003. AMT has not yet developed a contractadministration plan to provide guidance on AMT roles,responsibilities, and authorities relative to contractimplementation and execution. The AMT contractingofficer advised that the contract administration planfor the previous contract is being utilized until a newone is written and approved. In addition, AMT has notrevised its internal performance evaluation andmeasurement plan (PEMP) procedure, which providesguidelines for the AMT staff in developing year-endevaluation reports, for the new contract. The PEMP,which would normally be approved prior to the start ofthe fiscal year, is still in draft form, but a final draft isexpected to be sent to SC in late December 2003,although it is not clear that the PEMP will be approvedbefore the end of the year.

The new DOE/BMI contract provides thecontracting officer with the authority to take significantactions if PNNL ES&H performance is not adequate.The contract specifies that the contractor must meetminimum standards for an ES&H program. ES&Hminimum standards are to be developed by the

Performing Facility Rounds

24

contractor, and approved by DOE. The contract givesthe DOE official (i.e., the operations office manager)the authority to reduce the award fee by up to theamount earned for failure to meet the approved ES&Hminimum requirements or for catastrophic events (suchas a fatality, or a serious workplace-related injury orillness to one or more Federal, contractor, orsubcontractor employees or the general public, orsignificant damage to the environment).

The PEMP establishes four top-level performanceobjectives and metrics for AMT: programimplementation, contract management, laboratorystewardship, and internal operations. Metrics and sub-metrics are defined under each of the top-levelperformance objectives. AMT staff members areassigned for each of the metrics. Data is gathered bythese responsible AMT staff members, and isdocumented in the capture tool. The PEMP requiresmonthly exception reports, quarterly program reviewmeetings, and an annual year-end self-assessment.Data collected in the capture tool is collected andcollated to provide AMT management and staffinformation relative to performance for monthlyprogram reviews.

The RL employee concerns program is consistentwith the requirements specified in DOE Order 442.1A,Department of Energy Employee Concerns Program.RL implementing procedures adequately define Federalactions in administration of the program.

Corrective action tracking for Federal actions needsimprovement. Currently, Federal corrective actions arebeing tracked manually by individual action officerswithin AMT. A new automated, computer-basedcapture tool (with corrective action capability) has beendeveloped by AMT (accessed from the newlydeveloped PNSO website) and is anticipated to be fullyoperational by the end of December.

AMT has the framework for a line oversightprogram that meets SC expectations and contractualprovisions. However, many of the key features are intransition or in various stages of development (e.g.,internal PEMP procedure, contract administration plan,and PEMP). Further, as discussed in Section D.2.2,AMT has not been effective in ensuring that PNNLestablishes and maintains an effective program of self-assessments and corrective action management. AMTsurveillances and reviews have identified repeatdeficiencies with the PNNL corrective action program,but AMT has not ensured adequate enhancements. Inaddition, AMT has not required PNNL to formallyrespond to recent surveillance reports, and PNNL hasnot always taken adequate corrective actions. As

discussed in Appendices E and F, many aspects ofPNNL’s safety management program are effective buta number of weaknesses are evident. AMT lineoversight activities have not always been effective inidentifying weaknesses and ensuring that PNNLaddresses identified weaknesses. Some ES&Hdeficiencies (e.g., electrical safety deficiencies) werereadily observable during facility tours, indicating thatAMT has not performed effective reviews ofoperations in some areas.

D.2.2 PNNL Feedback and ImprovementSystems

Assessments. PNNL performs a variety ofassessments to evaluate the adequacy of ES&Hprograms and performance using processes that aredefined in an SBMS management system entitled“Integrated Planning and Assessment.” The associatedSBMS documents apply to all types of business andoperational programs and activities and addressdevelopment of business plans by organizations andmanagement system owners, preparation of Laboratoryinvestment proposals, performance assessment plans,conducting assessments, evaluating performance, andimplementing improvement actions. Each directorateand management system owner is required to developand implement an annual comprehensive performanceassessment plan, which is to include roles andresponsibilities, detailed schedules for assessments, andadministrative processes. These plans, which includeES&H programs and activities, vary from directorateto directorate in the level of detail, with some providingspecific assessment schedules and others describing ahigher-level description of how PEMP metrics will beaddressed. In accordance with the independentoversight (IO) management system, PNNL schedulesand conducts a variety of institutional-level assessmentsand special reviews requested by the line, as well asformal root cause analyses for events or significantissues. BMI also arranges for the conduct of an annualindependent corporate assessment of PNNLenvironment, safety, health, and quality (ESH&Q)programs. Suggested guidelines for areas to considerfor assessment and techniques and tools for conductingassessments are provided in SBMS attachments.

Finding #1. RL and AMT have not always beeneffective in correcting previously identified deficienciesin the PNNL self-assessment and corrective actionmanagement programs.

25

PNNL organizations perform a variety of types ofassessments with varying degrees of rigor andformality. Documented ES&H-related self-assessments are performed by research and supportdirectorates and include management and ES&Hwalkthrough inspections, cognizant space manager(CSM) Integrated Operations System (IOPS) spaceassessments, line and support functional area self-assessments, requested IO assessments, andcontracted external assessments. F&O has establishedthe most comprehensive and formal assessmentprogram, employing a variety of mechanisms to evaluateperformance. F&O and RPL have written internalimplementing procedures describing their self-assessment processes. CSMs in research directoratesand F&O conduct regular self-assessment inspectionstailored to the hazards and activities present in theirassigned spaces using formal checklists. Thesewalkthrough inspections are typically conductedquarterly, but the frequency can be adjusted based onindividual risks and activity levels. F&O hasimplemented a risk ranking process for job planningpackages (JPPs) that flags high-risk jobs formanagement consideration for performing activity-based assessments. Some high-risk tasks are beingselected for work observation assessments. PNNLmanagement has indicated an expectation for and theimportance of managers conducting regularwalkthroughs of work areas. Many managementwalkthroughs are scheduled and conducted by researchand F&O managers, often accompanied by ES&Hstaff. Matrixed ES&H representatives conductinformal inspections and walkthroughs during routineoversight and support of work activities. ES&Hfunctional area subject matter experts (SMEs) conductprogrammatic assessments required by regulations andperiodic elective program reviews. Research andsupport organizations conduct a limited number of topic-specific self-assessments, many in reaction to eventsor identified performance issues.

Notwithstanding the number of assessmentactivities performed at PNNL, the OA team identifieda lack of rigor in the planning and conduct ofassessments that is limiting the effectiveness of theseactivities in evaluating ES&H programs andperformance. Although numerous inspections ofmaterial conditions are performed, there is much lessfocus on performing formal, structured assessments,both of processes and performance, and of the resultsof inspection activities. SBMS documents, written toaddress top-level business processes, do not alwaysprovide clear and specific requirements that drive a

consistent and fully effective ES&H self-assessmentprogram. Specific expectations for managementwalkthroughs have not been established, including whomust perform them, to what level of formality, and atwhat expected frequency. Although some records arebeing maintained to indicate the number of managementwalkthroughs conducted, with the exception of ETD,the other evaluated components had no processes tomonitor and ensure that management walkthroughs arebeing conducted by all designated managers asfrequently as expected. The conduct of planning andassessments by research and support directorates andmanagement system owners is not always thoroughand in compliance with the SBMS documents.Directorate assessment plans have not been issued ina timely manner, and issued plans are not consistentbetween directorates and do not contain all the elementsspecified in the SBMS documents. For example, theESH&Q FY 2003 plan was not issued until June 2003,and the ESH&Q and ETD FY 2004 plans have not yetbeen issued. The ESH&Q plan for FY 2003 containedan assessment schedule for only two of the six ES&Hgroups, with the remainder submitting a performancemetrics summary. The ETD FY 2003 self-assessmentplan and schedule did not include a schedule ofassessments. A 2003 schedule, managed by the ETDOperations Manager’s Office, existed independent ofthe document that was reviewed. It does not appearthat management is adequately reviewing the submittedplans to assure that effective assessment programs arebeing established or holding the directoratesaccountable for meeting SBMS requirements. Althoughsome annual plans were issued late and did not containassessment schedules, inspections and assessmentswere still being performed. Although SBMS requiresdirectors and management system owners to performa “performance evaluation” of assessment and otherdata to feed into the next year’s assessment plan/schedule, no format for reporting the performanceevaluation results is specified. ESH&Q has notdocumented any analysis or analyses for FY 2003 andFY 2004. Each ESH&Q organization and managementsystem owner is expected to perform their own analysisand make adjustments to their individual inputs to thefollowing year’s assessment plan/schedule, but thisexpectation is not documented. Each of theorganizations in the OA review scope submitted widelyvarying reports, many focused on high-level metricsand non-ESH&Q business performance, with littleevaluation of self-assessment results or identificationof areas for improvement, as specified in SBMSrequirements and guidance.

26

The OA team identified weaknesses in the rigorand quality of self-assessment planning and execution.Although improvements have been made over the lastfew years, the line organizations still do not consistentlyperform appropriate elective assessments based on riskand site/facility-specific circumstances. The researchdirectorates have not developed implementingprocedures, desk instructions, or guidance on howassessments are selected, planned, and performed, orhow findings are to be handled or tracked (e.g., issuesmanagement/corrective action management). FSD hasno formal, written procedure for tracking issues resultingfrom self-assessments, and no training or guidance isavailable for line and support personnel to communicateeffective assessment techniques or develop assessmentskills.

Other than IO and mandatory ESH&Q functionalarea assessments, much of the self-assessment activitythat was performed addressed inspection of physicalconditions, rather than process and program adequacyor observation of work activities. FSD focused self-assessments are very limited in number (eight in FY2003) and in scope. These included two assessmentsthat were performed to address Occurrence Reportingand Processing System (ORPS) events and severalongoing inspection processes (chemical inventories,trend analysis of accident/injury rates, andenvironmental compliance summaries). Although atthe beginning of this calendar year ETD (including RPL)required ESH&Q SMEs to perform documentedactivity-based assessments (e.g., watching work), thereis no similar expectation for managers, except for RPL.Further, although the expectation was that the sevenSMEs would each conduct three of these assessmentseach quarter, only seven were performed during thefirst six months of the year. Of the more than 600deficiencies recorded since June 2002 in the ETD andRPL databases of self-assessment findings (e.g.,management and ES&H walkthroughs, non-RPLactivity-based assessments, and CSM IOPSinspections), none identified issues describing workobservations or programmatic weaknesses. Some RPLactivity-based assessments identified work observationperformance deficiencies, but all were related toradiological control or waste issues. Although CSMassessments and management walkthroughs areevaluating physical conditions and hazards/controls andsome limited individual activity-based assessments arebeing performed, it is not clear whether the overall work

control processes are being comprehensively evaluated.Functional areas and programs, such as ORPS reporting,employee concerns, and injury and illness reporting,have not been assessed in recent years. Assessmentof the lessons-learned program was limited toevaluation of usage. Some management system ownersare not conducting regular self-assessments of theeffectiveness of their processes as indicated in themanagement system maturity evaluation tool listed inSBMS and the FY 2003 instructions for developingmanagement system business plans. Although therewas an employee concern related to health concernsfor working with lead, this topical area has not beenincluded in PNNL self-assessments. (See Appendix Efor further details on OA team concerns about controlsand requirements related to lead exposure.)

Weaknesses were identified in the conduct of CSMspace assessments. Few deficiencies were noted onthe sample of IOPS checklists reviewed by the OAteam. Some staff indicated that if deficiencies werefixed on the spot, they would not be recorded. In onecase, a checklist item for laser interlock tests that arerequired by the SBMS subject area for lasers waschecked as satisfactory, although there is no record ofthe tests being performed. There are no proceduresor forms for documenting the completion of the requiredlaser interlock surveillances. There were otherindicators of weaknesses in self-assessment activitiesfor hazard recognition and space inspections, includingthe material condition deficiencies and programweaknesses identified by the OA team (see discussionin Appendix E), the recent Occupational Safety andHealth Administration (OSHA) inspection results, andthe results of special studies performed by PNNL. Forexample, because of a high-voltage shock event thisspring, extensive inspections were conducted in Juneand July for “high risk” installations (high voltage) andsome unspecified number of lesser risk installations.Approximately 200 deficiencies were identified,including approximately 80 additional installations withexposed energized parts that would have imparted ashock on contact with exposed skin. The wide rangeof readily identifiable deficiencies indicated the failureof self-assessment programs to identify deficiencies.These deficiencies also indicate complacency, a lackof attention to safety deficiencies, or weaknesses inexpectations for workers and supervisors who occupythe maintenance shops and laboratories on a daily basis.

27

Issues Management. PNNL has defined a tieredcorrective action management program description inSBMS. The program description outlines four tieredsignificance categorizations: accident investigations areSignificance Level 1, Price-Anderson Amendments Actnon-compliances and ORPS-reportable events areLevel 2, radiological problem reports and qualityproblem reports are Level 3, and problems that aredescribed as minor, easily fixed, and relatively low riskare Level 4. Problems in the first three categories arerequired to be tracked in the ATS. The resolutions ofLevel 4 problems do not require any documentation,and each directorate is given the flexibility to track theseissues as deemed appropriate.

The ATS provides a generally adequate vehicle fordocumenting and tracking conditions and correctiveactions, including identification of responsible owners,due dates, and closure dates. The process for formallytracking deficiencies or improvement opportunities inATS is delineated in the “Assessment Closure” SBMSsubject area. The subject area document states thatthis process applies to external assessments, IOassessments, internal audits (business), Price-AndersonAmendments Act non-compliances, and Type A or Baccident investigations. This process documentspecifies that a closure package should be compiled,appropriate files should be attached to the ATS action,and a description of what was done to complete theaction should be documented in ATS. Condition ownersmay designate that prior to closure they must reviewand accept closure evidence.

The F&O and ES&H organizations have chosento use the ATS for tracking the resolution of deficienciesidentified during self-assessments. ETD has developedan internal tracking system for self-assessmentfindings, including CSM self-assessment deficiencies.In the FSD, self-assessment findings are tracked byindividual assessors or the assessed organizations.F&O formally tabulates and trends issues from bothinternal and external sources in over 50 topical areasin a defined “risk universe.” These areas are rankedby importance, and such factors as the number offindings and time since prior self-assessments are

computed to identify potential areas of weakness orprogrammatic concerns. Managers meet quarterly todiscuss this trend report and determine if additionalassessments are warranted. This process is detailedin an F&O procedure. FSD compiles all availableassessment information (internal and external) into adatabase and rates each one on a red/yellow/greenscale for significance of the findings in an attempt toidentify future focus areas and to prioritize assessmentresources.

As part of the performance evaluation and feeagreement (PEFA) process, PNNL performsmonitoring and analysis of several agreed-uponquantitative ES&H performance indicators andmeasures that are communicated regularly to AMT.These metrics are used by PNNL and DOE to measurecontract performance and to monitor performancetrends. However, evaluations of assessment findingsin other directorates and institutionally are much lessformal. Issues and potential adverse trends arediscussed at various staff and management meetingswithin directorates and among senior managers.However, with few exceptions, there is little evidenceof formal data analysis, and management discussionsand decisions are typically not documented.

Although many ES&H issues are documented andevaluated, with corrective actions developed,implemented, and tracked to closure, the multipletracking methods, many of which are informal, and thelack of a structured process to collect and evaluateissue and action data hinder effective management offeedback information. While evaluations andcorrective/preventive actions in reaction to significantevents are generally rigorous and comprehensive,insufficient attention is directed at the identification ofprecursors that could be identified by structuredevaluations of the many inspection and walkthroughfindings. Procedural and performance deficiencies arelimiting the effectiveness of corrective actionmanagement at PNNL. SBMS documents forcorrective action management are not always consistentand do not include several elements of effective issuesmanagement programs. Examples of processweaknesses include the following:

• The threshold for entry of items into the formaltracking mechanism of the ATS, as defined in SBMSdocuments, is based on the source of the issuesrather than the relative significance of the issues.Although the source in many cases does indicatesignificance (i.e., ORPS or Price-AndersonAmendments Act non-compliances) significant

Finding #2: PNNL has not applied sufficient rigor tofeedback and improvement processes to ensure thatES&H performance is consistently and effectivelyevaluated and that ES&H-related incidents and programand performance deficiencies are thoroughly andformally evaluated, resolved with effective recurrencecontrols, and analyzed for adverse trends.

28

deficiencies can and should be identified during theperformance of routine work activities and self-assessments, but they may not receive resources,management attention, and controls commensuratewith their significance.

• With the exception of the defined threshold for thetype of issues that must be tracked in ATS, theSBMS documents do not provide any individualrisk or significance prioritization element.

• Although the program description documentdiscusses the importance of determining andaddressing the causes of deficiencies, theimplementing assessment closure SBMS documentdoes not address the need to evaluate deficienciesfor extent of condition or conduct causal analysis,or specify that corrective actions (recurrencecontrols) must address causes. There is no field inthe ATS for documenting identified causes. TheSBMS document does not specify requirementsfor training and qualification, or processes forconducting causal analysis.

• The “Assessment Closure” subject area documentdoes not identify it as applicable to several typesof deficiencies identified in the corrective actionmanagement program description as requiringtracking in ATS (e.g., it does not identify it asapplicable to ORPS or radiological problemreports).

• The PNNL staff and SBMS documents useinconsistent terminology to identify issues (i.e.,problems, conditions, deficiencies, issues,opportunities for improvement, weaknesses,nonconformance, observations, and findings).

• The research directorates have not established anyprocedures detailing how issues are to be managedin the directorates.

• With the exception of F&O Radiation Controlradiological problem reports, suspect/counterfeititem reports, and quality problem reports, there isno routine trend analysis of the deficienciescompiled in ATS or other tracking systems. Analysismetrics are limited to aging of actions and a fewhigh-level dashboard quantitative metrics such asrecordable injury rates, ES&H training, and ORPS.

In addition, deficiencies in the implementation ofthe PNNL corrective action tracking processes werealso identified. Examples include the following:

• In many cases, evaluations, corrective actions,causal analysis, recurrence controls, closureevidence files, and references were not wellestablished or documented as required by theSBMS documents. Evaluations are not alwaysrigorously performed such that corrective actionsfully address the issues and provide appropriaterecurrence controls. Corrective actions that areapplicable at an institutional level are sometimeslimited to divisions or directorates, and somecorrective actions do not adequately addressrecurrence controls. For example, the issue ofexcessive delays in reporting of accidents andinjuries, a recurring problem at PNNL, wasaddressed by a one-time presentation to staff ratherthan more formal actions, such as strengtheningemployee training or written SBMS expectations.In response to a July 2003 IO analysis ofLaboratory events, senior management madecommitments and set expectations for managementassessments of their facilities in two limited-distribution memoranda without formally directingthe implementation of those expectations orestablishing any formal mechanisms to ensure thatthose commitments and expectations wereimplemented. The records that are available onmanagement walkthroughs indicate that somemanagers are not performing or documentingassessments as specified in these memoranda.Corrective actions to an employee concern in 2000related to hazard controls on working with leadwere not effective in preventing ongoing concerns.(See Appendix E for further discussion.) A recentself-assessment of ATS identified some of theseweaknesses, and corrective actions are beingdeveloped.

• Because ATS is an assessment tracking systemrather than an issue tracking system, and itsrequired use is limited in scope, some importantES&H issues may not be entered into ATS orentered in a timely manner.

• The management conclusions on the trend analysisof F&O deficiencies are not documented on thetrend report (as required by their procedure) or inmeeting minutes. Adverse trends are not entered

29

directly into ATS, but are used to target future self-assessments.

• The routine CSM IOPS space assessment reportsdocument adverse conditions but rarely identify thedispositions, and with the exception of the ETD,there is no system to record or track the completionof corrective actions.

Various internal and external assessments,including the BMI corporate assessment, IOassessments, and AMT surveillances, have identifiedconcerns with the effectiveness of the issuesmanagement program, but effective corrective actionshave not been taken by the Laboratory. For example,an October 1998 DOE Headquarters independentoversight evaluation and a 2001 DOE surveillanceidentified findings and observations citing undesirablevariations in the scope, methods, context, and rigor ofPNNL self-assessments, and inadequate self-assessment guidance in SBMS. The 1998 Headquartersevaluation, a 2000 BMI corporate assessment, and a2000 IO assessment all identified deficiencies in thecorrective action program, the failure of existingprocesses to provide causal analysis, and insufficienttracking data. The conditions reported in these variousassessments continue to exist (see Finding #2).

Lessons Learned. PNNL has established andimplemented a process for identifying, evaluating, andapplying lessons learned. PNNL has developed aninnovative and aggressive program to identify positivelessons/best practices. A number of comprehensiveand well-written lessons are posted to the website. Theinstitutional procedure provides for screening ofexternally generated lessons learned by self-assessmentpoints of contact (POCs) and SMEs to establishapplicability and any needed actions. Internal lessonslearned are being generated, and external lessonslearned are being disseminated to departmentmanagers/supervisors and to SMEs. Lessons learnedand best practices are posted to an institutional databaseon the PNNL intranet. The website contains 86 lessonslearned/best practices in 16 ES&H functional areas,and provides links to numerous external sources forlessons learned. The intranet websites for the electricalsafety functional area and for the ES&H organizationalso include lessons-learned postings. Variousdocuments reflect that lessons learned are beingcommunicated to managers and workers. A trackingfeature recording people accessing the online databaseindicates steadily increasing use.

Although many lessons learned are being reviewed,generated, and disseminated, consistent and effectiveevaluation and application of externally generatedlessons learned cannot be demonstrated due toweaknesses in the established process andimplementation. With the exception of an informalprogram description in F&O, there are no proceduresdescribing the implementation of the lessons-learnedprogram at the institutional or directorate/division level.Although the SBMS subject area provides high-levelexpectations for self-assessment POCs andunspecified SMEs to search and review informationsources for lessons, it does not provide the level ofdetail needed to clearly identify who is to review whatinformation, and the specific information sources. Itspecifies no requirements for documentation orfeedback on the review or results of lessons learned.Forty-one people are identified as lessons-learned orself-assessment contacts at PNNL, but the list on theintranet has not been kept up to date (e.g., the personseveral interviewees referred to as reviewing the DOElist server and ORPS for applicability to PNNL is notlisted as a lessons-learned or self-assessment POC).Further, the scope of some functional arearesponsibilities is not clearly delineated (i.e., the topicalareas for which the “field work” POC is responsibleare not defined). The SBMS subject area documentalso does not provide for adequate documentation orformal feedback to provide assurance that the programis being effectively implemented.

Implementation of the lessons-learned process issometimes inconsistent and incomplete. Externallyidentified lessons learned are not being consistently andrigorously reviewed for all functional areas. Severalof the listed POCs interviewed by OA stated that theydid not subscribe to or routinely access major sourcesof lessons learned applicable to DOE activities, suchas the list server or the Society for Effective LessonsLearned Sharing (SELLS) database. Further, thecriteria for when a lesson learned is to be posted to theintranet lessons-learned/best practices database are notclearly defined in SBMS, and the POCs are notconsistently submitting them for inclusion in the intranetdatabase even when the lessons learned aredisseminated to multiple Laboratory organizations.

Documentation related to lessons learned isinsufficient to demonstrate that lessons learned arebeing consistently and rigorously evaluated and actedupon. There are no formal collective records of theevaluation of external lessons learned (e.g., whichlessons are reviewed, applicability evaluations andresults, or actions needed or taken). When additional

30

reviews are requested by a POC or SME or whenlessons learned are disseminated, the only record iselectronic mail on the sender’s computer, and theelectronic mail is typically not maintained in a separatefile or as a record. Lessons learned and safety alertsposted on the institutional and electrical safety websitesdo not describe specific actions taken or to be taken.With the exception of the few best practices and somespecial lessons learned posted to the PNNL institutionalwebsite, actions are not tailored to PNNL.

Some external lessons learned with apparentapplicability to PNNL have not been identified andcommunicated to workers. For example, no evidencecould be provided that several recent ORPS-relatedlessons from the DOE list server had been evaluatedby POCs. There are no lessons learned posted to anyof the PNNL websites (electrical safety, ES&H, orinstitutional) related to the unintended penetration ofhidden energy sources (i.e., hitting energized piping orelectric lines in excavation or wall penetration work).However, hidden energy sources are a recurring eventthroughout the DOE complex and were the subject ofa special lessons-learned report by the DOEHeadquarters Office of Environment, Safety andHealth. Further, lessons learned from complex-wideblind wall penetration events have not been wellintegrated into site implementing procedures. TheSBMS subject area addresses some blind wall

requirements, but lower-tier implementing proceduresneeded to effectively apply these controls have not beendeveloped. In addition, several other functional areasdo not appear to have been kept up to date (i.e., thelast health bulletin posted to the ES&H website was in1999, and the latest nuclear facilities lesson posted onthe institutional website was in 2001).

Employee Concerns Program. PNNL hasestablished and implemented an employee concernsprogram that generally conforms to the expectations inDOE Order 442.1 and associated guidance and providesan effective avenue for workers to voice and obtainobjective evaluation and resolution of ES&H concerns.This program is advertised through posters, brochureshanded out to new hires, and an intranet website. PNNLstaff members are encouraged to report and seekresolution of safety concerns through their supervisors,but workers can also report concerns to the employeeconcerns staff. Few ES&H-related concerns arereported using the formal employee concerns process(only 13 ES&H-related employee concerns werereported in the last two years, and many were minor).The evaluations and dispositions for ES&H-relatedconcerns reviewed by the OA team were appropriate.

However, several aspects of the employeeconcerns program could be strengthened. There areno procedures detailing how the employee concernsprogram is to be implemented. The SBMS subjectarea documents only provide “suggested guidelines”for how staff should report concerns and for howmanagers, supervisors, or designated representativesshould address employee concerns. The SBMS doesnot describe how the Concerns Program Office is toreceive, advertise, document, investigate, refer,communicate, or resolve concerns. The opportunitiesto report concerns with anonymity or confidentialityare not discussed in the guidelines on reporting (butare discussed on the website and in the new-hirebrochure). The documentation and investigation filescould be more rigorously maintained. The files lackeda chronological log and verbatim documentation of theemployees’ concerns, and no attempt was made to getformal feedback from the concerned individuals on thefinal resolution. Investigation notes were often crypticand not well organized. Supporting evidence, such asreports/evaluations by support organizations or ATSentries, was not on file. However, overalldocumentation on file adequately supported the finalresolution of the concerns.

Injury and Illness Investigations. Injury andillness statistics for PNNL reflect that recordable andlost workday case rates are low when compared to

Installation of 16-ton Superconducting Magnet at EMSL

31

their DOE peers and have been improving for severalyears. Facts related to cases of OSHA-recordableinjuries and first aid cases, including evaluations of theconditions and causes and specification of correctiveand preventive actions, are documented on forms thatare consistent with DOE and OSHA requirements.PNNL has developed a detailed computerizedinvestigation reporting process (designated as the Safetyand Health Information Management System, orSHIMS) that is used by immediate supervisors andES&H investigators. A Safety and Health Departmentprocedure describes how investigators conduct reviewsand administer the program. Although injuries andillnesses are logged, categorized, and reported asrequired by OSHA and DOE requirements, PNNLprocedures are inadequate, and the requirements ofseveral SBMS subject area documents and the safetyand health (S&H) internal procedure are not beingimplemented as required.

The SBMS documents do not align with the S&Hprocedure or the actual process (e.g., SBMS specifiesthat a worker’s immediate manager interviews staffand submits a written report, but makes no mention ofthe S&H representative investigators who actually dothe evaluation and designation of corrective/preventiveactions.) Other weaknesses in the SBMS documentand the S&H procedure include:

• There are no specific steps/requirements to actuallyidentify or implement corrective or preventiveactions.

• There are no references to tracking identifiedpreventive/corrective actions in either SBMS orthe S&H procedure.

• The SBMS document does not clearly specify whatconstitutes an injury or require/encourageconservative reporting. For example, it specifiesthat medical attention should be obtained for“significant” injuries or illnesses and states only asa “suggested guideline” that staff members shouldreport any situation that could result in potentialinjury or illness or could have caused injury orillness. In another section, the SBMS specifiesthat staff who are potentially exposed to a chemical,radiological, biological, or physical hazard (shock,laser, noise) “must be provided the opportunity tobe evaluated by medical personnel,” rather than aclear expectation or requirement that potentialexposures are to be reported and evaluated bymedical and S&H personnel.

Although many investigations were effectivelyperformed and packages were complete, there werenumerous deficiencies in the evaluation anddocumentation of injuries and illnesses:

• The investigation reports by ES&H or supervisorsare often untimely or not performed. Injury andillness records indicate there are about 60 casefiles that remained open without investigationreports for accidents/illnesses reported three ormore months after the incidents, including 10 incalendar year (CY) 2001, 17 in CY 2002, 28 in CY2003, and several from 1997 and 1998.

• Many evaluations of the causes and correctiveactions for many injury cases were either notconducted or were conducted with insufficientrigor to demonstrate that the causes of injuries werebeing adequately identified or that appropriaterecurrence controls were being implemented.

• Not all fields on the SHIMS electronic form arefilled in when appropriate (i.e., the personalprotective equipment worn).

• Conditions and event descriptions are ofteninadequate (i.e., details of what work was beingdone or the work conditions are not specified orthe description is simply the statement from theinjured party reported to the clinic, rather than asupervisor’s description of conditions and events).

• Some causal analyses and corrective actions arenot appropriate or complete, and in some cases,corrective actions did not address the identifiedcauses. For example, the root cause specifiedwhen a worker was cut when a pipette broke was“defective part,” and in another case the specifiedcorrective action was to hold a lessons-learnedmeeting with the injured party to determine whethersomething needed to be done. These causes andactions are usually developed by ES&Hrepresentatives; however, SHIMS does not providesignature/prepared-by blocks for indicating whoprovided what information, even though this is partof the form that the SBMS specifies is to becompleted by the direct supervisor.

• In some cases, actions were closed in ATS withoutnotation of what or whether action was taken orthe attachment of closure evidence as required by

32

the SBMS “Assessment Closure” subject areadocument. The actions were closed by the ES&Hstaff, rather than the line action owners as specifiedin the SBMS document. Additionally, the ES&Hstaff did not verify that closure packages werecompiled and filed as specified in SBMS beforeclosure of the conditions (cases) in ATS (seeFinding #2).

Other Feedback Mechanisms. In addition tothe assessment program, other feedback mechanismshave been established to provide continuousimprovement. The Voluntary Protection Program andIOPS provide effective vehicles to involve workers ininspections and safety feedback. Union safetycommittee meetings and frequent senior managementand directorate-level staff meetings also providefeedback and continuous improvement information tocontractor management, including the current statusof safety performance and improvement initiatives, anddiscussions of recent incidents and lessons learned.

Cross-cutting or high-cost projects, identified asoperations improvement initiatives, including ES&Hprojects, are proposed by line and support organizationsand evaluated annually for funding. If funded asimprovement initiatives, milestones and incentives areestablished and included in the contract performanceevaluation and award fee process. Examples of pastand ongoing initiatives include IOPS, the Electronic Prepand Risk process, and waste management processimprovements.

Formal, documented post-job reviews by workersand supervisors specified in F&O procedures providefeedback to work package planners and managementafter completion of maintenance and modification work.The F&O work control process requires post-jobreviews and provides fields for comments and feedbackin JPPs. However, documented feedback on revieweddispatch work orders and JPPs was minimal. Dispatchwork orders do not contain a field for worker commentsor feedback.

D.3 Conclusions

AMT has the framework for a line oversightprogram that meets SC expectations and contractualprovisions. The FR program is mature and welldocumented. However, many of the key features arein transition or in various stages of development.Further, AMT has not been effective in ensuring thatPNNL maintains an effective self-assessment andcorrective action management program, and AMT lineoversight activities have not always been effective inidentifying weaknesses and ensuring that they arecorrected by PNNL.

PNNL conducts many feedback and improvementprocesses and has made many improvements in thesafe conduct of work at the Laboratory. SBMSdocuments describe programs for conductingindependent and line self-assessments, documentingdeficiencies and tracking corrective actions, addressingemployee concerns, and identifying and communicatinglessons learned. Several PNNL organizations haveprocesses for annually reviewing assessment resultsand determining areas where additional improvementsare needed. However, requirements for some aspectsof safety assurance processes have not been clearlydelineated in SBMS or rigorously implemented byresearch and support organizations, and have not beenfully effective in identifying and addressing performancedeficiencies. Results of inspection and assessmentsare not being analyzed for adverse trends or recurrence.The documentation, tracking, evaluation, and resolutionof deficiencies to prevent recurrence and the inclusionof evidence to support closure actions in ATS needmanagement attention. Many injury and illnessinvestigations have not been performed, and there aremany documentation deficiencies regarding conditiondescriptions and corrective actions. The adequacy ofevaluation and implementation of lessons learned cannotbe demonstrated because of insufficient rigor indocumentation for this program.

Core Function #5 – Feedback and Continuous Improvement ..................................... NEEDS IMPROVEMENT

D.4 Rating

33

D.5 Opportunities ForImprovement

This OA inspection identified the followingopportunities for improvement. These potentialenhancements are not intended to be prescriptive ormandatory. Rather, they are offered to the site to bereviewed and evaluated by the responsible linemanagement, and accepted, rejected, or modified asappropriate, in accordance with site-specific programobjectives and priorities.

RL Associate Manager for Science andTechnology

1. Improve systematic mechanisms within AMTto strengthen line oversight of the contractor.Specific actions to consider include:

• Increase the frequency of FR and SMEsurveillances of the PNNL self-assessmentprogram.

• Increase the DOE FR oversight of researchand F&O shop work activities.

• Strengthen management review of FRsurveillance findings and observations.

• Establish a formal mechanism for tracking FRsurveillance observations to closure.

• Encourage AMT “partnering agreements” toemphasize SME participation in field activitiesand PNNL self-assessments.

• Target training for AMT SMEs on conduct ofobservations/assessment of ES&Hrequirements in facilities.

• Develop a metric within the PEMP for SMEinvolvement in field activities and assessments.

• Strengthen the metric within the PEMP for useof the Capture Tool, beyond counting entries,to one that measures quality/substance of theinput.

Pacific Northwest National Laboratory

1. Strengthen self-assessment performance andhold line management accountable foreffective implementation. Specific actions toconsider include:

• Establish more specific requirements forassessment plans, performance evaluations,and self-assessment in SBMS documents,increasing the focus on observation of work,process/program evaluations, and analysis ofassessment results.

• Line organizations should develop formalinstructions to delineate the local processes andrequirements for implementing SBMSrequirements for assessments.

• Provide training materials or courses oneffective self-assessment techniques, andestablish a mentoring resource to improve therigor and effectiveness of self-assessments.

• Establish an independent SME assessmentreview function on an interim basis to providefeedback to line and support organizations, witha focus on strengthening the depth and rigorof management assessment criteria andevaluations. Establish a method to measureimprovement or attainment of acceptableperformance.

• Require and establish mechanisms to ensurethat required management walkthroughs arebeing performed as required.

2. Establish a more rigorous issues managementsystem that promptly documents issues in atracking system, assures management rigoris applied based on issue significance ratherthan the source of the issue, includes thegraded documentation of the causes ofdeficiencies in programs and performance inthe tracking system, provides effectiverecurrence controls, and provides accessibledata for effective trend analysis. Specific actionsto consider include:

34

• Revise and strengthen SBMS requirements fordocumenting, categorizing (risk-ranking),evaluating, resolving, and tracking issues,regardless of how they are identified. Providefor documenting all identified issues in theappropriate issues management system in amore timely manner.

• Line organizations should develop formalinstructions to delineate the local processes andrequirements for implementing SBMSrequirements for issues management andcorrective action.

• Develop and implement processes to rigorouslyanalyze inspection and assessment results atall levels in the organization to identify adversetrends (precursors) and to identify repetitiveissues that require recurrence controls.

• Revise the ATS to document root or probablecauses to promote the development of actionsthat will prevent recurrence. Strengthen therigor of root cause analyses to ensure that rootand contributing causes are more consistentlyand clearly defined.

• Ensure that SBMS requirements fordocumenting closure actions and evidence filesare met before actions and conditions in ATSare closed. Consider establishing a formal,routine monitoring mechanism until consistentcompliance is achieved.

• Strengthen the rigor and formality of issueevaluations and dispositions documented inemployee concerns and illness and injuryprograms.

3. Improve the rigor and formality inimplementing the lessons-learned program.Specific actions to consider include:

• Better define the responsible persons and theirroles and responsibilities for performingscreening and evaluation of externallygenerated lessons learned in SBMS documents.

• Establish requirements and processes todocument the screening of external lessonslearned and the results of applicability reviews

by POCs/SMEs and provide feedback to theinstitutional lessons-learned office.

• Ensure that applicability reviews evaluate anddocument that existing processes and hazardcontrols are sufficient to prevent the occurrenceof reported external events at PNNL.

• Tailor recommended actions to PNNLorganizations, programs, and systems. Ensurethat actions deemed necessary are notcategorized as “recommended.” Designatespecific responsible parties to take directedactions.

• Establish procedural requirements that line andsupport organizations provide formal feedbackto SMEs and the institutional lessons-learnedoffice detailing the actions taken and the results.

• Conduct a rigorous self-assessment of theimplementation of the lessons-learnedprogram.

4. Improve the rigor of documentation of theinvestigation of employee concerns. Specificactions to consider are:

• Strengthen SBMS documents to include theroles and responsibilities of the employeeconcerns office and processes for that officeto resolve employee concerns. Include adescription of the opportunity for andqualifications regarding maintainingconfidentiality and anonymity.

• Employ a written concerns record form, andencourage concerned individuals to sign theform. This would ensure consistentdocumentation of basic information and assurecommon understanding of the concern.Regardless of the method used, obtain verbatimdocumentation of the employee’s concern andget agreement from the concerned individual.Consider using the form to record finaldisposition/resolution and closure.

• Establish a chronological log in the investigationfile to provide a concise history and status ofall activities related to resolution of the concern.

35

• Use the most formal communication methodpossible to notify the concerned individual ofthe final disposition of their concerns andoptions for escalating their concerns if theyare not satisfied. Include a request forfeedback indicating acceptance, disagreement,or comments. Document in the records anyfeedback from the concerned individual.

• Provide concise summaries of investigationnotes from meetings and interactions with theconcerned individual and investigators. Includein the investigation package supportingdocumentation or such evidence as reports/evaluations by support organizations or ATSentries for identified issues and correctiveactions.

• Ensure that any required corrective actionshave been placed into formal tracking systemsand are completed satisfactorily before formalclosure of the case file.

5. Improve the process and performance forinvestigating and documenting preventiveactions for injuries and illnesses. Specificactions to consider are:

• Ensure that line supervisors and managementtake ownership of injury and illness incidentsand that ES&H provides a supporting role.Require the closure of actions to be performedby the owners and not the ES&H injury andillness staff.

• Include mechanisms in SHIMS to identify whosupplied what information and analysis.

• Ensure that all pertinent fields in investigationreports are consistently completed (i.e.,personal protective equipment worn).

• Resolve the backlog of missing investigationreports, and institute controls to monitor andensure timely completion of the investigationsand associated actions to prevent recurrence.

• Establish/strengthen a review process toensure that investigations are rigorouslyperformed and documented and that identifiedcauses and corrective and preventive actionsare appropriate.

36

APPENDIX ECORE FUNCTION IMPLEMENTATION

(CORE FUNCTIONS 1-4)

E.1 Introduction

The U.S. Department of Energy (DOE) Office ofIndependent Oversight and Performance Assurance(OA) evaluated work planning and control andimplementation of the first four core functions ofintegrated safety management (ISM) at selectedPacific Northwest National Laboratory (PNNL)facilities and activities. The OA review of the ISMcore functions focused on environment, safety, andhealth (ES&H) programs as applied to the two majortypes of activities performed at PNNL:

1. Research and development (R&D) activities(discussed in Section E.2.1)

2. Facility support activities (discussed in SectionE.2.2).

OA’s review of R&D activities focused on selectedfacilities, organizations, and activities:

• Radiochemical Processing Laboratory (RPL).The Radiochemical Sciences and Engineering(RS&EG) group is the primary R&D organizationin RPL. The RS&EG group provides capabilitiesin nuclear process engineering, radiomaterialscharacterization, and radiochemical separationsand processing. The High Level RadiochemistryFacility, the Shielded Analytical Laboratory hot cellcomplexes, and the stand-alone mini-cells are usedto conduct work with highly radioactive materials.RPL also serves as the radioactive material receiptand distribution center for approximately 70 percentof the radioactive materials utilized in the numerousresearch laboratories.

• Environmental Molecular Science Laboratory(EMSL). EMSL is a DOE-funded facility thatpromotes fundamental research in physical,chemical, and biological sciences. The facility isequipped with over 100 major instrument systemsand is classified as a low-hazard facility. The facility

and equipment are managed by the FundamentalSciences Directorate (FSD) and made availableto PNNL and external (e.g., university researchers)users. Currently, EMSL has over 550 activeprojects and supports over 800 distinct usersthroughout the facility.

• Building 331. PNNL Building 331 Life SciencesLaboratory houses research activities conductedby the PNNL FSD, and to a lesser extent researchbeing conducted by the Environmental TechnologyDirectorate (ETD). The FSD’s Biological SciencesDivision conducts experimental studies tounderstand molecular and cellular processesresulting from insult by physical and chemicalagents. Basic and applied research concerningmicroorganisms and/or their processes in variousenvironments is conducted within the facility. ETDcurrently has three technical resource groupsconducting work in the 331 Building. ETD workswith external clients to develop environmentalmonitoring programs and scientific andtechnological solutions for long-term stewardshipof waste sites. In general, the research conductedwithin Building 331 presents a variety of potentialhazards to researchers, including physical, chemical,biological, and radiological hazards. BiosafetyLevels 1 and 2 are permitted in this facility.

At all three R&D facilities, OA examined wastemanagement and environmental compliance activities,reviewed procedures, observed ongoing experiments,toured facilities and laboratories, observed equipmentoperations, interviewed managers and research staff,reviewed interfaces with Environment, Safety, Health,and Quality (ESH&Q) staff, and reviewed safetydocumentation (e.g., permits and safety analyses). AtRPL, most of the ongoing work during the assessmentoccurred in the hot cells and associated support areas.Work observed in these areas included adecontamination and inspection project involving controlrod drive mechanism housings removed from retiredcommercial reactor vessel heads, a project involvingradiochemical separation of uranium-232 decay

37

products for commercial medical isotope use, andgeneral hot cell activities, such as sample transfers.At Building 331, research observed included work thatinvolved biological, chemical, and radiological hazards,typically with small quantities of chemical and biologicalmaterials for which the exposure hazard was generallylow risk. FSD Product Line research projects wereobserved principally in Laboratories 169, 170, 317, and350. ETD Product Line research projects wereobserved principally in Laboratories 108 and 110.

OA’s review of facility support activities focusedon the Facilities and Operations (F&O) Directorate.F&O provides strategic planning, management systems,safeguards and security services, facility operations,craft resources, and facility projects and engineeringservices for PNNL government, private, and leasedfacilities. F&O provides a dedicated core team thatincludes the building manager, building engineer, facilityproject managers (construction managers), andmaintenance supervision and support craft. The F&Ocore team is an integral part of each research facilityand provides direct support to the research mission.Craft resources and central shops support both thefacility infrastructure systems and equipment, but alsoprovide requested support and manufacturing forresearch-related tasks.

F&O work activities are governed by acomprehensive procedural set, and a singleadministrative procedure ADM-16, FacilityOperations Maintenance Work Control, that governsF&O work in all facilities. The work control procedureand supporting procedures govern maintenance,fabrication, and construction, including subcontractedwork activities. More complex jobs are performedunder job planning packages (JPPs) and most routinecraft work is performed under “dispatch” work orders.Subcontracted activities are performed under contracts,but work is implemented by JPPs prepared by PNNLthat contain elements required of a planned maintenancejob package.

For F&O activities, OA reviewed work controlsystems and work performance for fabricationactivities, preventive and corrective maintenance, andconstruction for the RPL, Building 331, and EMSLfacilities. The review also included the Building 350central fabrication shops and associated work activities.

E.2 Results

E.2.1 R&D Activities

E.2.1.1 Core Function #1 – Define theScope of Work

Missions are translated into work, expectationsare set, tasks are identified and prioritized, andresources are allocated.

RPL. Research work at RPL is generally welldefined. Each R&D project has a formal scope ofwork that is provided through the proposal contract ora formal scope of work statement. The researchproposals describe the apparatus, needed materials, andthe overall approach in sufficient detail to permiteffective hazard identification and analysis. TheElectronic Prep and Risk (EPR) process providesdocumentation of the overall scope of work for R&Dprojects and also defines project-level risks associatedwith the scope of work. Product line managers approvethe submission of proposals and again approve the finalscope of work and risk profile presented in the EPRfor a funded project. At the activity level, the scope ofwork is further defined by technical work documentsand work practices used to control specific activities.

Although work scopes were generally well defined,information provided on the EPR documents for RPLprojects often did not provide enough details todetermine environmental risks. One document involvingdevelopment of sensors to detect radioactivecontamination in soil in the section on wastemanagement indicated “no comment” on the EPR.Therefore, the environmental compliance representative(ECR) had to contact the researcher to determine howmuch radioactive waste would be generated so thatarrangements could be made for proper management.

EMSL. Research work at EMSL is generally welldefined through the use of the proposal process. EachR&D project requires the submission of a formalproposal that includes a work statement and scope ofwork. The proposals describe the overall experimentalapproach in sufficient detail to permit effective hazardidentification and analysis that allows activities to beassigned to appropriate laboratory spaces. Additionally,the safety and health representative is involved with allphases of the proposal review and approval process.

38

The EPR also documents the project-level scope ofwork for R&D projects and defines the general risksassociated with the proposed project. Product linemanagers approve the submission of proposals and againapprove the final scope of work and risk profile definedin EPR for a funded project. At the activity level, thescope of work is further defined by technical workdocuments and project-specific information requestedby the cognizant space manager (CSM) that will beused to identify hazards and control specific activities.

Building 331. The research work scope withinthe FSD is typically defined in the research proposaland the EPR. Occasionally, a project plan is alsoprepared for larger research projects with multipleorganizational or resource interfaces. Work scopedetails are most often defined through communicationsamong the research staff and the CSMs, although thesecommunications are often informal and seldomdocumented. In general, the level of detail provided inresearch proposals and EPR mitigation permits issufficient to communicate the scientific nature of thework in order to obtain funding, identify the level ofresources, and initiate the EPR process. However,the research proposal and EPR, which, other thanresearch notes, may be the only written record of theresearch scope of work, are often not developed withsufficient detail for an independent party, such as theECR or FSD safety and health representative, to beable to evaluate the work activity and identify thehazards associated with the work. Figure 3.2, R&DPlanning Control, in the PNNL integrated ES&Hprogram description indicates that a function of the EPRis to define work scope. Based on a review of severalR&D projects in Building 331, the statement of workin the EPR is insufficient to describe specific risks ofthe work to be performed. To compensate for a limiteddefinition of work, some organizations, such as thePNNL Radiation Control organization, for example,require project managers who plan to use radiologicalmaterial to prepare a more explicit statement of workso that the radiological hazards and controls can beidentified. In addition, for radiological work, theradiation work permit (RWP) enhances the definitionof work scope.

As a work scope document, the level of detail inan EPR risk mitigation permit varies among projectswithin the same directorate. For example, someprojects are conducted in multiple laboratories withinBuilding 331. Informally, project managers will negotiatefor bench space in laboratories that have the requiredequipment and controls, and this will guide the worklocations. However, the EPR does not clearly link

research activities to laboratories. The ECRs, whenreviewing the EPR, use their knowledge of the researchand the building laboratories to forecast and linkresearch activities with laboratories. In most cases,the ECR will also discuss the research project with theresearcher. Again, the results of these discussions areseldom documented. As a result, the bases for theenvironmental waste accumulation, storage, and controlrequirements, which are imposed for a research project,are not well documented in the EPR or elsewhere.

Summary. The scope of most R&D workactivities is sufficiently described and defined to specifywhat work is to be performed, and to allow subsequentidentification of the associated hazards. Researchactivities have formal processes to define the scope ofwork for various R&D work activities. For major taskswith higher risks, the scope of work was generallyappropriately documented. However, in some cases,the details of the scope of work are not well documentedfor smaller projects and lower-risk work.

E.2.1.2 Core Function #2 – Analyze theHazards

Hazards associated with the work are identified,analyzed, and categorized.

RPL. A combination of established processes isused to identify hazards associated with research workat RPL. The EPR process establishes the risk profileand general hazard mitigation methods for the initialproject safety review process. The IntegratedOperations System (IOPS) and the technical workdocument development process further define theprincipal hazards specific to the proposed activity. TheIndependent Review Committee provides a finalverification of hazards analysis and control developmentfor all projects and technical procedures through aformal review process. At times, additional planning isrequired before allowing work to begin. Although somespecific deficiencies exist, particularly for the smallerand more routine R&D laboratory work (see below),the overall process provides for a systematic approachto safety reviews.

Most work at RPL involves actual or potentialradiological hazards, and RPL has a well-defined andmature process in place to ensure that radiological workreceives appropriate hazard review by ES&Hradiological professionals. Through Standards BasedManagement System (SBMS) requirements, users ofradioactive materials are required to complete anelectronic RWP request form for any new or revised

39

work involving use of radioactive materials. This formis forwarded to a dedicated facility radiological workplanner who is responsible for reviewing the hazardsand preparing an RWP for the proposed work. Thework planner also coordinates other reviews dependingon the complexity of the work and predefined reviewtriggers. For example, an internal dosimetrist is calledupon to evaluate bioassay requirements that areincorporated into the RWP, and additional reviews areperformed by radiological engineering staff and/or as-low-as-reasonably-achievable (ALARA) committeesbased on the complexity and involved hazards.

While adequate systems for scope definition andhazards analysis were in place, ineffective integrationof these systems has at times resulted in incomplete orineffective hazards analysis. Specifically, mechanismsfor communicating the specific scope of work forresearch projects do not ensure that all relevant detailsof the work are communicated to those individualsresponsible for analyzing and controlling hazards. Forexample, the AlphaMed medical isotope work involvedradiochemical separation and purification of differentradioisotopes from the uranium decay chain. However,the RWP request form only listed “uranium-232 isotopework” as the scope of work and hazards, and did notdefine the presence of concentrated radium or thoriumbeing handled, nor did it identify the potential for pre-existing tritium hazards in the hot cells that were usedwith this project. As such, corresponding controls werenot sufficiently defined or developed. While the EPRdid identify some of these hazards, the EPR is notreviewed or accessible to radiological work planners.

In some cases, IOPS hazard awareness summariesdid not reflect certain hazards present in IOPS spacesas required by SBMS. For example, the hazardawareness summary for Room 58 did not includereferences to any chemicals; however, both chemicaland lead hazards were present in the room. Similarly,the one for Laboratory 603 did not reflect the presenceof dry ice (carbon dioxide) hazards being used in supportof control rod drive mechanism work. Severallaboratories had lifting hazards that were not reflectedin the posted hazard awareness summaries.

EMSL. A combination of processes is establishedto effectively identify most hazards associated withresearch work. The EPR and proposal processesestablish general project-level requirements and hazardcategories for the initial proposal safety review process,and the IOPS process tailors the hazards analysis tothe laboratory spaces where a proposed activity takesplace. Safety representatives, peer researchers, andsubject matter experts (SMEs) regularly review and

analyze proposals and hazards related to projects andlaboratory-specific activities. For example, a fireprotection engineer reviewed a proposed catalystresearch project involving hydrogen to ensure that anyflammability concerns were adequately addressed.Overall, the process is appropriate for a systematicapproach to safety reviews.

In some cases, however, researchers are notrigorously applying the process, resulting in someactivity hazards associated with use of chemicals notbeing appropriately identified. Some chemical processpermits (CPPs) address the chemical quantities anduses specific to the research work, but do not addressthe handling and transfer of much larger quantities ofthe chemicals obtained from vendor containers. Forexample, a CPP for Laboratory 1410 addresses 50milliliter quantities of acids and bases used in researchactivities, but the activity of dispensing those quantitiesfrom vendor containers within the Laboratory is notaddressed. Consequently, hazards and associatedcontrols such as personal protective equipment (PPE)for handling the significantly larger (multi-liter)quantities of the bulk chemicals are not addressed.

In addition, some routine laboratory hazards, suchas handling sharp objects (syringes) and potentialergonomic concerns (moving heavy objects), are notanalyzed or identified in standard IOPS documentation,and the SBMS subject areas do not address somecommon hazards encountered in the laboratoryenvironment (see Appendix C).

Building 331. The Building 331 scientific,operations, and ES&H staff is knowledgeable of thehazards associated with the research projectsconducted within the facility. Researchers, projectmanagers, and CSMs are typically the individuals withprimary responsibility for identifying, recognizing, andcontrolling hazards within their laboratories and are alsothe individuals with the greatest knowledge of thepotential hazards associated with their research. On anumber of occasions, CSMs in Building 331 haveidentified potential research hazards and have takenaction to control those hazards. For example, incalendar year (CY) 2002, the CSM for Laboratory 350identified non-resident researchers attempting to storeinfectious biological samples in a laboratory that hadnot been approved for storage of such samples. Sincethe research was to be conducted as a non-fundedcollaborative research project, the EPR process hadnot been invoked. However, the quick recognition ofthe hazard by the CSM avoided a potential mishap.(Note: This gap in the EPR process for non-fundedresearch work has subsequently been addressed and

40

rectified). In addition to the research staff, the ES&HSMEs (e.g., industrial hygiene, radiation protection, andenvironmental protection/waste management) andoperations and building management have also beeneffective in identifying, analyzing, and controllingresearch-related hazards.

Changes to the EPR process in April 2003 haveresulted in an improved capability of this tool to identifybounding-level hazards for individual research projectsand ensure that projects can be accommodated inBuilding 331 laboratory spaces. The EPR identifiescategories of hazards associated with a researchactivity (e.g., chemicals, non-ionizing radiation, andlasers) such that those hazards can be comparedagainst the facility safety envelope (e.g., Building 331facility use agreement) and laboratory space controls(e.g., permits, training, engineering controls) to ensurethat the hazards can be appropriately controlled andmitigated.

The hazard awareness summary is another usefultool for communicating general classes of workspacehazards to Building 331 laboratory occupants. AllBuilding 331 laboratories were posted with currenthazard awareness summaries, which described thetypes of hazards that could be possible, based on theactive research being conducted in the laboratory.

Although the EPR and IOPS processes (training,permits, hazard awareness summaries) have provideda system for the identification and analysis of thosehazards with the most significant risk, some aspects ofthese processes could be further improved to providefor more consistent and effective identification andanalysis of hazards.

For example, some EPR risk mitigation permits,which are generated from implementing the EPRprocess and revised on an annual basis, containinaccurate or dated information concerning the hazardsof the research project. For some Building 331 researchactivities, the EPR risk mitigation permit identifieshazards that are not relevant to the research project.One EPR risk mitigation permit, for example, identifiesthere are large quantities of chemicals and a high-powered laser involved in the research, although neitherstatement is accurate. In some cases, the EPR hasnot remained current with changing hazards. Forexample, the recently revised EPR risk mitigation permitfor Project 27197 (Deinococcus Radiodurans forBioremediation) continues to identify uranium as ahazard, although uranium has not been used for thisresearch project for some time.

In a few cases, some laboratory hazards have notbeen sufficiently analyzed and/or documented to ensure

that the hazard control is appropriate. For example,routine radiochemical work performed in Laboratory152 involves the use of low-activity radioactive samples.A portion of Laboratory 152 has been established as aradioactive materials area. In this area, radiochemicalsample analysis by inductively coupled plasma (ICP)chromatography is conducted to analyze trace quantitiesof plutonium, uranium, and thorium, as well as othermetals. Since the samples are assumed to be low inradioactivity, an RWP request form was not generatedand a radiological hazards analysis was not conductedto determine the appropriate level of radiologicalcontrols, as would be required by procedure for all newprojects involving use of radioactive materials. Mostsamples processed in this area typically contain only afew picoCuries (pCi) of activity and have not givenrise to a detectable level of contamination. However,for samples that contain less than 10 milliliters of dilutenitric acid, each sample could contain as much as 30pCi. Because up to twenty samples at thisconcentration could be in process or available fordispersion (i.e., spill) at any one time, contamination ofprocess equipment and areas is possible. However,this aggregate hazard has not been analyzed ordocumented as required by PNNL procedures to ensurethat the existing controls are appropriate.

For a number of routine laboratory researchhazards, such as working with sharp instruments (e.g.,syringes), lead shielding, and ergonomics, the hazardsare not sufficiently addressed in SBMS or mapped intoIOPS such that hazards can be recognized anddocumented at the research activity level to ensurethat the appropriate controls are identified andimplemented. In general, expectations have not beenestablished for the identification, analysis,documentation, and control for routine, low-risk hazardstypically encountered when performing research. It isnot clear whether these hazards are to be consideredas “skill of the researcher,” which is not defined, orshould be addressed by some other mechanism withinIOPS. For example, the use of sharp instruments is acommon hazard within the Building 331 laboratories,but the hazards associated with the use of sharpinstruments are not addressed within the SBMS subjectareas, unless there is a potential bloodborne pathogenconcern. In another example, the “Working withChemicals” SBMS subject area identified a number of“safe practices” for preventing explosive reactionswhen working with laboratory heating equipment(ovens, burners, etc.), glass apparatus containing gasesor vapors under pressure, etc., and other commonlaboratory work practices. However, there is no clear

41

expectation or process for identifying, documenting, andcommunicating such routine hazards (such as a standardlaboratory practices instruction) for a research projectand ensuring that the appropriate administrative controls(training, permits, hazard awareness summary) havebeen identified and implemented through IOPS.

Many of these low-risk hazards are considered tobe routine and are commonly encountered whenperforming research. However, failure to recognize,identify, and control these hazards can also result inthe potential for injuries and illnesses. For example, inFebruary 2003, a culture bottle over-pressurized inLaboratory 108. A methane-producing bacterium wasintroduced into a bottle that was not vented, and theensuing buildup of gases shattered the bottle. The useof such bottles and culture medium (which containedno hazardous chemicals) is commonplace in thelaboratory. There is no mechanism within EPR or IOPSfor targeting and documenting this type of hazard.

Summary. The hazards for most work observedhad been properly identified and analyzed throughPNNL review and planning processes. Several positivepractices and initiatives were identified that minimizedor eliminated hazards, provided for communication ofhazards, and contributed to risk mitigation and saferwork. The use of an Independent Review Committeeat RPL and the IOPS database linked to EPRs improvedthe review of R&D operations and communication ofhazards to workers, respectively. The use of hazardawareness summaries that are posted at laboratoriesaided hazard communications for workers inlaboratories. However, some weaknesses wereidentified in the identification and analyses of hazardsthat in some cases decreased the effectiveness of workplanning and/or resulted in inappropriate or incompletehazard controls being applied. Although the processand procedures are in place and are effective foridentifying and analyzing hazards, some implementationdeficiencies need to be corrected to provide for a morerobust program.

E.2.1.3 Core Function #3 – Develop andImplement Hazard Controls

Safety standards and requirements areidentified and agreed upon, controls to prevent/mitigate hazards are identified, the safety envelopeis established, and controls are implemented.

RPL. At RPL extensive use of engineered controlsserve as the primary mechanism to control manyactivity-level hazards. Engineered controls include

items such as hot cells, gloveboxes, hoods, temporaryenclosures, and ventilation systems specific to the work.Engineered controls are complemented by a variety ofadministrative controls, including radiation work andchemical use permits, standard operating procedures,facility research practices, and in some cases specifictechnical work documents prepared to control aparticular activity. Although some specific deficienciesexist (see below), the overall process produces agenerally adequate set of hazard controls.

PNNL has established some innovative electronicmechanisms for certain radiological hazard controls.For example, the radioactive materials managementtool allows a user to identify the applicable SBMS andfacility-specific radioactive materials managementprocedures based on the users selection of the facility,the type of radioactive material, and the nature of theactivities. In addition, the radiological control technician(RCT) scheduling tool allows users to determineavailability of RCTs and schedule the necessary RCTresources to cover work.

Controls for waste management/environmentalcompliance for RPL are provided by documented workpractices and deployed ECRs and Waste Managementfield services representatives (FSRs) who are matrixedto the operations manager and are available to R&Dpersonnel as a resource for meeting complianceobjectives and proper waste management functions.Researchers who generate waste are required to followthe waste accumulation and disposal practice. Thispractice provides an easy-to-use method for meetingregulatory requirements and ensuring propermanagement of hazardous, mixed, and radioactivewaste.

While the combination of engineering andadministrative controls results in effective mitigativeand preventive controls for research work in most cases,deficiencies in implementation of some institutionalsystems governing chemical use and management haveresulted in ambiguous or undefined hazards and controlsduring some work evolutions, including improperselection of PPE. These deficiencies are discussed inthe following paragraphs.

SBMS requires documentation of the specific PPEfor each unique chemical hazard present in a workactivity. At RPL, the use of generic chemical usepermits does not fully comply with SBMS requirementsfor chemical use documentation. While the SBMSallows similar chemicals with similar controls to begrouped together in chemical use documentation, itrequires a separate listing for each group of chemicalsthat have unique hazards and controls. Contrary to

42

these requirements, RPL lists similar chemicals withdiffering PPE requirements in the same permits anddoes not provide the unique PPE requirements for thespecific chemicals. For example, specific glove typesfor differing acids are not provided. These ambiguitieshave resulted in workers performing activities withinadequate PPE. For example, a worker was observedusing concentrated nitric acid using latex gloves, whichare ineffective protection for that chemical. In anotherexample, a worker was observed using adecontamination chemical listed as being a severe eyeirritant without using any eye protection. In a thirdexample, large quantities of dry ice (500-pound storage)were introduced into the control rod drive mechanismdecontamination project. This chemical was procuredusing a Laboratory purchasing card (P-Card) withoutrequired SBMS training on P-Card chemical purchases.As a result, the dry ice did not get listed on the CMSchemical management inventory, and it was never listedas an IOPS hazard in the space in which it is used.While most controls for users were incorporated intothe operating procedure, IOPS permits were notrevised, chemical inventories were not updated to reflectthis chemical, exposure limits were not documented,potential work-level concentrations were not formallyanalyzed, actual work-level concentrations were notmeasured, and all personnel with access to the spacewere not made aware of the new hazard through thehazard awareness summary (see Finding #3 in SectionD.3.3).

In addition, chemicals covered by static inventoryrequirements are being stored in locations that are notaccurately reflected on CMS inventory listings, resultingin inaccurate chemical location listings. For example,a significant number of combustible materials arepermanently stored in RPL Room 58; however, thechemical inventory listing for Room 58 shows nochemical inventory. Another example included thepresence of cleaning solutions and the recently addeddry ice listing in shielded facility operations (SFO)spaces that do not appear under the chemical inventoryin their location of actual storage. Under SBMS andRPL IOPS practice, movement of a chemical locationfor more than one working day requires an update tothe CMS inventory listing to reflect the actual locationof storage.

Each laboratory in RPL has a hard-copy laboratoryhandbook containing a variety of information forresearchers, including RPL practices, permits, andrelated information. However, the informationpresented in these handbooks is not always tailored toor applicable to the space, and in some cases is not

complete. For example, the laboratory handbook forRoom 58 contains research practices, permits, and otherinformation that do not apply to F&O operations. Thelaboratory handbook for RPL 701 contained an outdatedRWP, and a number of other handbooks did not includecopies of any RWPs.

Some radiological controls specified in RWPs orother documents were not properly implemented ordefined. The RWP for the AlphaMed medical isotopeproduction specified the wrong type of air samplingusing a continuous air monitor rather than a high-volumeair sampler as an indicator of exposure in lieu ofbioassay monitoring. Work involving removal of thecontrol rod drive mechanism from the shippingcontainer subjected a worker to a higher dose potentialto the lower legs and feet, whereas only finger ringdosimetry was required to monitor extremity dose. Thejob required contamination measurements whenopening the shipping container and decontamination “asnecessary”; however, the specific levels requiringdecontamination and limitations on performingdecontamination without respiratory protection werenot specified.

Although most laboratory operator aids wereappropriate and controlled in accordance with RPLrequirements, laboratory operator aids were improperlyimplemented in two cases. One approved operator aidaddressing exhaust fans for a temporary gloveboxconflicted with the governing procedure, and anotheroperator aid providing an overhead crane pre-startchecklist was not approved and controlled inaccordance with procedure.

EMSL . In most cases, the combination ofengineering and administrative controls results ineffective prevention and/or mitigation of hazardsassociated with research work. Engineering controlsare prevalent in this relatively new facility and includestate-of-the-art controls, such as computer-assisted“auto balance” ventilation design and control for fumehoods and laboratory space. In another example,delivery systems for bulk hazardous gasses are locatedin external chase with vented stacks. Administrativecontrols include IOPS-generated activity permits (CPPs,laser use permits, etc.), such EMSL work practices asthe EMSL practice for chemical waste disposal, andthe EMSL chemical management system. In addition,an ECR and FSR have been matrixed from the PNNLEnvironmental Management Services Division to EMSLto provide direct support for control of wasteoperations. EMSL also uses IOPS-generated hazardawareness summaries as an administrative control forcommunicating general classes of workspace hazards

43

to occupants. EMSL rooms and laboratories wereposted with current hazard awareness summariesdescribing the types of hazards in the space. In anotherexample of strong administrative controls, EMSLresearchers working with strong magnetic fieldsdeveloped, in conjunction with the medical department,a magnetic field worker screening permit to determinewhether metal or other materials in workers’ bodies(particles or surgical implants) could be affected bythe magnetic field. In a combination of engineeringand administrative controls, the facility uses a proximitycard access system for the EMSL hallway and individuallaboratory spaces that is controlled by CSMs, who havefinal authority to authorize access and use of associatedequipment. Although some specific deficiencies exist(see below), the overall process produces acomprehensive set of hazard controls.

The EMSL IOPS-generated training process foruser access to laboratory areas sufficiently covers theidentified hazards and controls within the laboratoryspaces. The CSM establishes the training and reviewrequirements for access to specific laboratory spaces,and access is controlled through the proximity cardsystem. The OA team conducted a performance testof the CSM’s application of the access control systemtraining requirements by proposing a hypotheticalenvironmental chamber activity to the CSM in theEnvironmental Spectroscopy Laboratory. The CSMestablished the appropriate training and reviewrequirements for the postulated job. The IOPSeffectively integrated these requirements with thetraining department’s computer-based training courses,and the system mandated the appropriate requiredreading of the laboratory hazards summary as well astask-specific permits. The system tracks modulecompletion and does not allow access until all specifiedtraining is complete.

EMSL uses a teaming concept between chemicalpurchasing and environmental management thatprovides a “cradle to grave” approach for controllingchemical management. This close working relationshipbetween the chemical material manager and the ECR/FSR allows these types of controls to be implemented,since all three services are performed as a team concept,allowing application of pollution prevention to be appliedwhen purchasing new materials.

Although processes for developing hazard controlswere appropriate and most controls were adequatelyimplemented, ineffective or incomplete implementationof some processes have resulted in incomplete controls.Some EMSL CPPs do not sufficiently tailor PPE tospecific activities to ensure that the appropriate

protection is provided to the workers. SBMS requiresthat appropriate PPE be listed for specific chemicalhazards. While the SBMS allows similar chemicalswith similar controls to be grouped together in chemicaluse permits, it requires a separate listing for each groupof chemicals that have unique hazards and controls.Contrary to these requirements, some EMSL CPPslist similar chemicals with differing PPE requirementsin the same permits and do not always provide theappropriate PPE requirements for the specificchemicals. For example, specific glove types fordiffering acids are not provided in some cases. Inanother example, some CPPs addressing the handlingof corrosive chemicals that may splash only requirechemical safety goggles, closed-toe shoes, long pants,and a long-sleeved shirt. However, the material safetydata sheets (MSDSs) for many corrosive chemicalsrequire chemical-resistant aprons for adequateprotection. Although all the PPE requirements in atypical MSDS may not be required for a specificapplication, the current method of CPP implementationat EMSL does not ensure that the appropriate PPE isselected, documented, and linked to the hazard. Insome cases where small bench-top quantities areinvolved, the lesser controls may be appropriate;however, the differing activity hazards are notdelineated in the permits (see Finding #3).

Building 331. Overall hazard controls withinBuilding 331 laboratory spaces are well designed andeffectively implemented. Engineering controls, suchas fume hoods and room and local ventilation systems,are adequately maintained and are being operated asdesigned. PPE consisting primarily of chemical gloves,shields, and aprons are available to the research staff.Administrative controls, such as training and permits,were generally adequate for the hazards identified inthe laboratories. Training requirements and recordsare maintained through IOPS. Researchers weregenerally current with respect to their trainingrequirements. Furthermore, since the health risksresulting from exposure to most chemicals or biologicalmaterials used in Building 331 are low, researchers inthe conduct of their research utilize few formalprocedures or technical work documents.

Building emergency planning and radiologicalcontrol planning are comprehensive. The Building 331emergency plan is kept current with changing facilityconditions, and emergency responders from the HanfordFire Department are knowledgeable of the potentialhazards within the building, and are well trained andexperienced in addressing the diversity of potentialhazards, including biological hazards. Radiological

44

control planning for research activities involvingradiological materials is also comprehensive. A reviewof the radiological planning conducted in support of theintroduction of cesium-137 to an existing experimentat Building 331 indicated that the health physics staffconducted a rigorous review of the proposed activity.

PNNL has instituted an aggressive pollutionprevention program that has been implemented byinclusion of pollution prevention/recycling activities inwork practices and in review of EPR mitigation permits.For example, as part of the EPR process for oneresearch project conducted in Building 331, the ECRrecommended use of a less hazardous material in orderto reduce the generation of hazardous waste as part ofthe PNNL Pollution Prevention Program. A keycomponent of this program is the pollution preventionopportunity assessments. Because guidance forconducting these assessments for DOE laboratorieswas not available, PNNL has prepared a book for useby laboratories across the DOE complex, building onthe successes and lessons learned at PNNL. As aresult of this action, along with other aggressive pollutionprevention activities, PNNL has received numerousawards for preventing pollution, including the EPA’sNational Waste Champion Award.

Although the EPR and IOPS processes have beeneffective in identifying and implementing most hazardcontrols, the processes could be further improved in anumber of areas.

In some cases, the appropriate chemical protectiveglove could not be identified for one or more chemicalslisted in a CPP. For a number of chemicals listed inCPPs, researchers are directed to the chemical glovelist posted in Laboratory 170, Bay 4, for glove selectionguidance. However, this list does not include a numberof chemicals identified in the CPPs, and therefore theappropriate chemical glove could not be identified. Inother cases, the chemical glove required by thechemical glove charts was not in use or readily availablein the laboratory (e.g., butyl gloves). For some researchwork involving chemicals (Laboratories 170 and 350),it was not clear to the researchers who wereinterviewed which CPPs were applicable to theirresearch work, if any (see Finding #3).

Although procedures are not routinely used withinBuilding 331, a number of safe operating proceduresare used for radiochemical work performed inLaboratory 152. These safe operating procedures arenot adequately integrated into IOPS, and in some casesdo not address all aspects of the operation. In somecases, the training requirements mapped in IOPS areincorrect with respect to safe operating procedures.

For example, the IOPS training matrix for individualsworking in Laboratory 152 and the IOPS requirementsmapped to EPR mitigation permits for the same spacefailed to identify the two primary safe operatingprocedures routinely used by researchers working inthis lab. The RWP issued for Laboratory 152 includesa reference to these procedures; however, given theomissions in IOPS, there is no alternative mechanismfor CSMs or radiation control personnel to ensure thatindividuals are trained to these procedures. In anotherexample, the safe operating procedure developed forradiochemical work performed in Laboratory 152 doesnot address the use of ICP chromatography, which isone of the primary tools used by researchers in thelaboratory. The operations protocol (Procedure No.331-AF-001) omitted the use, hazards, and controlsassociated with the ICP, although other less significantequipment is addressed in detail. The ICP is routinelyutilized to analyze trace quantities of plutonium, uranium,and thorium, as well as other metals. In addition, theCPPs related to the operation of the ICP did not identifythe actinide metals and associated hazards (i.e., uraniumis a known kidney toxin).

In one case observed, the laboratory hazardawareness postings were not conspicuously posted.The radiological surveys for Laboratories 110 and 112were not posted at the normal entrance to theradiologically posted area. The normal entrance pathfor researchers working in the radiologically controlledportions of Laboratories 110/112 is through a contiguouslaboratory (i.e., Laboratory 108); however, radiologicalsurveys for Laboratory 110 are posted only at a doorthat is infrequently used. Furthermore, the radiologicalboundary transition point (where hand and footmonitoring and radiological surveys occur) between thebuffer area and the “clean area” is in an aisleway withinLaboratory 108. No survey information is available atthis location, where such information would be mostuseful to researchers entering the lab.

The EPR mitigation permit provides a means forinforming SMEs of potential new hazards, such thatthe SMEs can be involved in the planning of hazardcontrols. In some cases this notification to SMEs hasnot occurred or has not been effective. For example,for Project 48357 conducted in Laboratory 350, a high-powered laser and large quantities of chemicals wereidentified in the EPR mitigation permit. However, theEPR mitigation permit was approved by the productline manager without the PNNL facility safety taskgroup leader or the PNNL laser safety officer beingnotified of the large quantity of chemicals or the potentialuse of a high-powered laser, respectively. The PNNL

45

safety task group leader is responsible for ensuring theaccuracy of the technical basis for the Building 331facility use agreement that could be impacted by largequantities of chemicals. The laser safety officer, inconjunction with the FSD safety and healthrepresentative, are responsible for ensuring that lasercontrols (e.g., permits and PPE) are adequatelyspecified and in place in the laboratory. The lack ofnotification of SMEs in this example has been attributedto the use of an earlier version of the EPR process,which did not incorporate this capability. Regardless,the product line manager did not ensure that theappropriate SMEs had the opportunity to review theEPR prior to its approval.

One section of each EPR mitigation permit providesa summary of “IOPS requirements for the locationidentified.” For most EPR permits that were reviewed,the summary of IOPS requirements for the locationcould not be linked to the specific hazard controls forthe research project. In some cases, required permitswere not listed in this section of the EPR mitigationpermit. For example, a lead CPP was prepared forProject 27197, “Deinococcus Radiodurans forBioremediation,” for use with cesium-137 sources inLaboratory 110 because the project manager failed toidentify chemical hazards in that IOPS space. TheCPP, however, was not listed in the EPR mitigationpermit for Laboratory 110. In another case, the EPRmitigation permit associated with intercellular signalingresearch being conducted in Laboratories 149E, 320,and 350 did not identify any permit, training, or workpractice documents in these three laboratories, althoughthere are a number of IOPS requirements (e.g.,chemical permits and training) for working in theseareas. Furthermore, the EPR risk mitigation permit ismisleading by implying that all of the permits, training,and work practice controls listed are requirements,when only some of the listed controls are required bythe hazards presented by the research activity. Forexample, a number of EPR risk mitigation permitsrequire respiratory protection training, although noresearch hazards are identified in these EPR riskmitigation permits that require the use of a respirator.Another concern with the EPR risk mitigation permitis that the radiological work planning process is notlinked with either the EPR or IOPS processes.

Summary. PNNL uses extensive engineeringcontrols for many R&D activities, such as hot cells,fume hoods, room and local ventilation, and filtrationcontrol. Newer facilities, such as EMSL, use state-of-the-art, automatically balanced ventilation and externaldelivery chases for bulk gas delivery. Renovation of

Building 331 laboratories will improve research spaceand modernize fume hoods and local ventilation. Theengineering controls are supplemented by a variety offormal administrative controls that are generally wellestablished across PNNL. A variety of tools and permitsare in place and being used to adapt controls to specificR&D activities. However, weaknesses inimplementation of SBMS requirements, proceduralcontrols, and the application of chemical controls wereidentified at all facilities reviewed. Chemical permits,though viewed as a positive tool, were not consistentlyimplemented, resulting in ineffective identification andanalysis of hazards, which resulted in incompletedefinition of controls or selection of incorrect controlsby researchers. Weaknesses in the implementation ofEPR and/or IOPS were also identified whererequirements (permits, training and work practices)were incorrect or could not be linked to the specificresearch activity, and controls were not consistent withthe identified hazards. Overall, PNNL has a generallymature process for establishing proper hazard controls,but improvements are needed to resolve severalweaknesses in implementation.

Finding #3: PNNL line management has notsufficiently implemented SBMS requirements forchemical use documentation to ensure that specificactivity-level hazard controls are identified for allchemical hazards.

E.2.1.4 Core Function #4 – Perform WorkWithin Controls

Readiness is confirmed and work is performedsafely.

RPL. Most of the work the OA team observed inRPL was conducted safely and in accordance withestablished controls. RPL workers and linemanagement are knowledgeable of the RPL facilityand have considerable experience within their areas ofexpertise.

For SFO work, pre-job briefs for both hot cellsample prep and control rod drive mechanism transferwork were performed efficiently and in accordancewith the pre-job checklist as required by procedure.Precautions were covered, and hazards and associatedcontrols were discussed. During the work evolutions,radiological coverage and work practices by staff andRCTs were conducted in accordance with establishedwork practices and procedures. RCT presence on

46

reviewed jobs was clearly evident, and coverage wassufficient to limit exposures and the potential for spreadof contamination. RCTs took numerous job coveragesurveys, including radiation and contaminationmeasurements during work and were observed assistingand counseling workers regarding proper ALARApractices. Technicians effectively performed a controlrod drive mechanism housing move and hot celltransfers in accordance with controls established in theoperating procedures. The technicians demonstratedan effective awareness of the radiation hazards andsafe work practices needed to mitigate the hazards.

Only limited amounts of benchtop and fume hoodradiological work were being conducted during the timeof the assessment. A recent DOE surveillance of fumehood and benchtop radiological work identifiednumerous radiological conduct of operationsdeficiencies for these types of activities in RPL. As aresult, site management held a work stand-down andcounseling session with all RPL radiological workersin late October as an initial corrective action. Whileformal root cause analysis and corrective actions arenot yet due for completion, the stand-down occurredonly a short time before this OA inspection and mayhave contributed to better awareness of requirementsand improvement in compliance with requiredradiological work practices (based on the observedradiological performance during the limited fume hoodand benchtop laboratory work observed). In theseactivities, researchers practiced positive contaminationcontrol methods, including frequent glove changes aswell as alpha and beta surveys of gloved hands eachtime they were removed from the hood, as called for inradiological work practices. Workers transferringwaste materials from a hood had the proper RCTcoverage and followed all required radiologicalpractices and procedures, and RCT surveydocumentation was complete, legible, and accurate.

Waste management activities related to ongoingwork in RPL were in accordance with state and DOErequirements. This included satellite accumulation areas(SAAs), where waste containers were kept closedexcept when waste was being added, hazardous wastelabels were visible, and liquids were stored insidesecondary containment. Monthly inspections werebeing performed, logs of waste added to containerswere being completed, and SAA operator aids wereposted on doors into the laboratories. Management ofthe less-than-90-day storage area was also effective,including properly labeled containers and a storagelocation with secondary containment features. Keys

to the area were controlled by the FSR, and evidencethat weekly inspections were being performed wasavailable.

Permitted waste treatment, storage, and disposalfacilities are also operated within RPL and in Building305B. These areas were also effectively operated inaccordance with regulatory requirements. Radioactivewaste in RPL is being managed in accordance withthe requirements of DOE Order 435.1. Work areaswere well maintained, controls for access were beingfollowed, and inspections were performed as required.Containers and bags of low-level waste were stored indesigned areas that ensure the containers would notdeteriorate. Legacy low-level waste areas had beencleaned out except for a few remaining items as partof a PNNL effort to eliminate legacy waste.

In a few cases, workers failed to follow establishedwork practices and/or requirements contained in theprocedures or safety review documents.

• In some instances, items in hoods were locatedless than the 6-inch requirement from thecontamination area boundary and/or where hoodswere overloaded to the point that could result indegradation of airflow.

• Two workers performing required hand and footself-monitoring at the radiation boundary area exitdid not allow sufficient time for instruments torespond to potential contamination prior to movingthe probe away from the area, in conflict with theprovisions of the applicable work practice.

• The RWP for the AlphaMed medical isotope workincluded tritium contamination suspension limits;however, no analysis of the wipe sample for tritiumwas conducted.

• Chemical use permits require workers to contactthe safety and health professional for determinationof specific PPE requirements (glove types).However, in most cases, workers make their owndetermination, resulting in some inadequateimplementation of controls.

• Researchers were using the mezzanine catwalk inRoom 510 for storage of miscellaneous supplies.However, such items as metal piping of assortedlengths were being stored unsecured in such a waythat they might have accidentally fallen or been

47

pushed through the railing onto an active laboratorybench below.

• A monthly inspection of SAAs had not beencompleted as required by PNNL. The monthlyinspections are performed to help ensure properoperation of the SAAs. However, for one monththe newly hired FSR was unable to access thelaboratory, and no monthly inspection wasperformed.

• One SAA, intended only for accountability of wastefor ongoing operations, has been used to storemixed waste for over a year. The waste containershad been sealed by researchers, but arrangementsfor disposal of the waste had not been made.

EMSL. Although limited activities were observedduring the inspection, most work observed by the OAteam was conducted in accordance with establishedcontrols. EMSL researchers and technicians performedresearch work safely within CPPs and EMSL practices.CSMs were knowledgeable of the hazards and haveconsiderable experience within their areas of expertise.In addition, several higher hazard projects had specificprocedures generated to assure that specific controlswere followed.

EMSL workers are managing SAAs and the less-than-90-day storage area in accordance with State ofWashington regulations and PNNL administrativerequirements. Researchers and technicians kept wastecontainers closed except when waste was being added,hazardous waste labels were visible, and liquids werestored inside secondary containment. Required weeklyinspections were being performed, logs of waste addedto containers were being recorded, and SAA operatoraids were posted on each cabinet containing a wastestorage area. In the less-than-90-day area, containerswere properly labeled, no containers had been in storageover 90 days, and weekly inspections of the area werebeing performed. Required signs were on the door,and the doors were under key controls to preventunauthorized entry.

Although most work was performed safely, in somecases EMSL workers were not performing wastemanagement activities in accordance with specifiedcontrols. For example, two hazardous waste labels ontwo containers in the 90-day area did not have theregulatory-required start date. In addition, the FSR didnot identify the deficient labels during performance oftwo weekly inspections after these containers were

placed in 90-day storage. In another example, a four-liter unlabeled container was found in the flammablecabinet in a service corridor. EMSL chemicalmanagement requirements specify that all containersmust be labeled. In a third example, lecture-sizecylinders of hazardous waste are stored in thecompressed gas room at EMSL in an SAA instead ofthe more appropriate 90-day area because the 90-daystorage area is not approved for compressed gases.Since these cylinders are not being accumulated,regulations would require they be managed under morerestrictive 90-day requirements.

Building 331. Waste storage areas within Building331 were being operated in accordance with PNNLand Washington State environmental requirements. Atthe facility level, an FSR is deployed to Building 331 toensure that generators maintain compliance withResource Conservation and Recovery Act requirementsas well as radioactive waste limitations at the facility.Waste management is effectively conducted through apartnering methodology between the generator(researcher) and the FSR. Researchers have also beeneffective in maintaining SAAs in accordance withPNNL requirements.

Overall, few weaknesses were identified in theauthorization or performance of work in Building 331.Most activities were performed according to establishedcontrols. However, improvements in a few areas couldfurther enhance worker safety.

In some cases, EPR risk mitigation permits havebeen approved by the project managers and productline managers without the hazards or risks beingmitigated as indicated by the required permit. For oneresearch activity in Laboratory 350, both the projectmanager and the product line manager approved theEPR risk mitigation permit with clear warnings in thepermit that the proposed chemical and laser activitieswere not allowed in the laboratories selected for thiswork.

In other cases, hazard controls identified in permitshave not been followed. For example, somerequirements in the CPP for work performed inLaboratory 350 were not followed (e.g., laboratorycoats were not worn, and latex gloves were used inlieu of the nitrile gloves specified in the CPP). In anotherexample, researchers in Laboratory 170 were notutilizing the appropriate PPE when working with somehazardous chemicals. Furthermore, when questioned,several researchers were unsure of which specific PPE(primarily glove type) applied to which chemicals. Somework was being conducted without any chemical glovesbeing worn, contrary to the requirements stated in the

48

CPP, and in some cases the glove being used was notthe glove required by the CPP. Activities in Laboratory152 included working with dilute nitric acids (2%)containing plutonium, uranium, and thorium and wereconducted without any PPE other than safety glasses,which was contradictory to the CPP.

Summary. A variety of safe work activities byR&D organizations were observed in the three facilitiesreviewed. Workers were generally knowledgeable intheir technical areas and familiar with the facilities,systems, and equipment being worked on. Readinessto perform work, including ensuring appropriate training,qualification, and authorization prior to performing work,was well implemented. In most cases, work is beingperformed with a high regard for safety at PNNL byresearch organizations. Although most work observedwas safely performed, some weaknesses and specificdeficiencies were identified where SBMS, ES&H,IOPS, or other requirements were not properlyimplemented. These types of deficiencies could impactsafety and/or result in regulatory vulnerabilities.

E.2.2 Facility Support Activities

E.2.2.1 Core Function #1 – Define theScope of Work

Missions are translated into work, expectationsare set, tasks are identified and prioritized, andresources are allocated.

There are several common elements in F&O thatresulted in good definition for planned work and mostdispatch work across the facilities reviewed. The useof JPPs for higher-risk work, with input from craft,supervisors, ES&H, and work planners, improves workdefinition during the initial planning stage. Workinstructions further define elements of the job andprovide limits to ensure that work outside the scope isnot performed. On more complex activities, furthertask breakdown is accomplished by the use of a masterwork order and subordinate work orders linked to themaster work order that further define specific elementsof the overall task.

Construction work is well defined through contractprovisions and JPPs that define individual tasks undereach contract. Facility project managers, responsiblefor in-progress construction activities in various facilities,participate in plan-of-the-day (POD) meetings to ensurethat work for the day is clearly understood, listed onthe POD, and appropriately coordinated with facilityand R&D operations.

The F&O work control system provides forprioritization based on risk and mission needs. Theprioritization for reviewed work activities wasappropriately based on the risk of the work activityand the importance of the system and equipment. Workis further prioritized through interaction of buildingmanagers, building engineers, facility project managers,supervisors, and customers during formal PODmeetings. The prioritization includes both planned workpackages (JPPs) and “dispatch work” (skill-of-the-craft). Managers and supervisors allocate craftresources based on the priority, safety, and missionneeds. Defining the work during POD meetings andon the approved POD facilitates notification of theenvironmental compliance and field servicerepresentatives about the scope of potential chemicalusage and environmental impact on the facilities orsurroundings.

Although work was generally well defined, thedefinition of work on some dispatch work orders waslimited and did not fully address the scope and limitationsof intended tasks. Many dispatch jobs are relativelysimple, within the skill of the craft, and are self-explanatory, requiring minimal definition. However,because dispatch work does not typically include workinstructions, a more complete scope of work isnecessary for some dispatch work to ensure thatpersonnel clearly understand the scope of work andthe limitations. For some dispatch work orders, thesystem has evolved toward listing a limited scope andthen verbally modifying or amplifying the scope beforeand during the job. One RPL job, with a description toline three survey caves with ¼-inch lead sheet andpaint exposed lead with epoxy paint, actually involvedthe transfer of three 500-pound caves out of aradiological controlled area; surveys and release by anRCT; hoisting and rigging; handling, shearing, and filingof lead; modification of the caves and fabrication ofstainless steel doors; attaching the lead; and returningthe caves to the radiological controlled area. The workrequest did not define and address numerous elementsof this task.

Summary. The scope of most work activities issufficiently described and defined to specify what workis to be performed, and to allow subsequent identificationof the associated hazards. F&O activities have formalprocesses to define the scope of work for variousfacility and R&D work activities. Construction andsubcontracted work activities were well defined throughcontract provision and JPPs. However, F&O dispatchwork orders do not always fully describe or limit theallowable work scope.

49

E.2.2.2 Core Function #2 – Analyze theHazards

Hazards associated with the work are identified,analyzed, and categorized.

The review of work activities and associateddocumentation indicated that hazards associated withthe work were properly identified and understood byworkers. With few exceptions, work documentsincluded both the hazards of the tasks and hazards inthe workplace and surroundings. Dominant hazardswere also addressed during pre-job briefings.

PNNL has implemented a sitewide IOPS databaseto capture hazards related to facility spaces. Thesystem was linked to the Electronic Service Request(ESR) system on October 20, 2003, to automaticallyprint hazards associated with spaces where work isbeing performed on individual work orders. Integrationof the IOPS hazard database into planned and dispatchwork orders is a significant improvement that formalizesand documents communication of space-related hazardsto workers performing work in IOPS spaces. Thesystem will also improve compliance with DOE Order440.1A and Occupational Safety and HealthAdministration (OSHA) requirements forcommunicating hazards in the workspaces toemployees. F&O also improved a JPP electronic toolto automatically trigger flags to management of jobswith higher-risk profiles. Management can then usethat information to weigh which activities to assess.

PNNL and F&O have received several awardsassociated with “going green” initiatives by switchingto less-hazardous chemicals, solvents, and lubricants,thereby minimizing hazards and the potentialenvironmental impact of chemical use. PNNL receivedthe White House Closing the Circle Award for the GreenCustodial Products Initiative. A Certificate ofPartnership was awarded from DOE for green poweremission reductions associated with power generation.Several other facility management, energymanagement, and energy and water conservationinitiatives also garnered awards and contributed tosafety by removing the hazards associated withincreased preventive and corrective maintenance.Water and power conservation reduces waste streamsassociated with the generation of power and excessiveuse of water.

F&O has proactively managed the potential forberyllium exposure to workers. PNNL devotedconsiderable effort to identifying potential areas for

beryllium sampling, evaluating aluminum welding forthe presence of beryllium in the welding fumes;performing sampling in the central fabrication shopsand grinders throughout the Laboratory; identifyingolder fluorescent tubes containing trace amounts ofberyllium; identifying the potential for beryllium inelectrical bus bars, contacts, and breakers; andidentifying and eliminating beryllium-containing tools.These efforts have reduced the potential for workerexposure to beryllium across PNNL.

While most hazards were adequately identified anddocumented, some weaknesses were identified.Walkdowns of the RPL, Building 331, and EMSLmechanical equipment rooms indicated that mostconfined spaces, high noise areas, and other areahazards were properly identified with appropriatesignage. However, a number of EMSL ventilationplenums were not identified as confined spaces andhad not been evaluated and documented by Safety andHealth. Twenty-five maintenance access hatches forventilation plenums (five in each wing) had apparentlybeen overlooked, as other spaces in the mechanicalequipment rooms were properly marked. Many of thosespaces, upon evaluation, may qualify for “non-permitted” confined spaces, provided that no hazards(solvents, cleaners) are introduced into the space duringmaintenance. At Building 331, confined spaces in themechanical equipment rooms and outside were markedas confined spaces with one deficiency. Two wood-covered pipe trenches were marked by only one signnear the end of one of the trenches. OSHA 1910.146(c)(2) requires that spaces be marked by danger signsor other equally effective means to inform employees.Marking each space separately would provide moreeffective employee notification.

The implementation of the IOPS hazard databaseprovides ready access to space hazard information andis an effective tool in most respects. However, therecently implemented system has some softwareproblems that caused several dispatch work orders tobe issued with annotations of “No IOPS Hazards.”For several of the work requests, the work wasperformed in IOPS spaces that had numerous hazards(see Section E.2.2.3, Core Function #3).

Summary. The hazards for most F&O workobserved had been properly identified and analyzedthrough the PNNL review and planning processes.Several positive practices and initiatives were identifiedthat minimized or eliminated hazards, provided forcommunication of hazards, and contributed to less riskand safer work. For example, the F&O “green”

50

initiatives have reduced the chemical hazards profile,and special hazards, such as beryllium, have beenproactively managed to minimize exposure to workers.However, weaknesses were identified in theidentification and analyses of hazards that in some casesresulted in inappropriate hazard controls being applied.Overall, the process and procedures are in place andare generally effective to identify and analyze hazardssuch that appropriate controls can be implemented,although correcting implementation deficiencies couldresult in a more robust program.

E.2.2.3 Core Function #3 – Develop andImplement Hazard Controls

Safety standards and requirements areidentified and agreed upon, controls to prevent/mitigate hazards are identified, the safety envelopeis established, and controls are implemented.

Implementation of integrated core teams withdedicated maintenance management and maintenancestaff assigned to designated facilities is a significantimprovement promoting integration of F&O buildingmanagement, engineering, and maintenance personnelinto the “science” team. The dedicated buildingmanagers and engineering and maintenance personnelare more familiar with the facility, laboratories, andsystems, and are more knowledgeable of researchmissions, equipment, and interfaces between R&D andthe facility. Dedicated building engineers are readilyavailable to support facility and maintenanceengineering and R&D activities. During observationof work activities and walkdowns, the consistency ofcore teams from facility to facility was evident. Buildingmanagers, building engineers, and facility projectmanagers are well engaged in F&O and research work,and day-to-day operations in their respective facilities.Close interactions during walkdowns and observationof work activities indicated that they were experiencedand knowledgeable of systems and equipment.

PNNL facility use agreements are well written,detailed, and identify the boundary interfaces anddivision of responsibilities between F&O and userorganizations. The facility use agreements contain thehazardous material listings and quantity limits fordominant chemicals and hazardous material in thefacilities. For the evaluated facilities, the facility useagreements were current and in place and serve asthe “authorization basis” documents for the non-nuclearfacilities. The agreements also supplement thedocumented safety analysis for RPL.

PNNL subcontracts and F&O work proceduresrequire that subcontractors work to the equivalent of aplanned job package for all work. F&O requiressubcontractors to perform work in accordance with aJPP prepared by PNNL construction personnel, basedon the requirements in the F&O work control procedure(ADM-16). Requiring all subcontractors to work toPNNL-prepared JPPs adds to the formality, safety, andconsistency of subcontracted work activities. Toprovide better visibility and identification ofsubcontractor work activities, F&O requires the useof a clearly visible and posted subcontractor “job box”that names the subcontractor, the work activity, andthe site point of contact. Subcontractor job boxes allowfor easy access to the subcontractors job package andinformation. Job boxes were evident for the outfallconstruction and the first and third floor constructionrenovations in Building 331.

A variety of preventive and corrective maintenancejobs were observed. F&O procedures for preventivemaintenance were current and detailed, and workinstructions for planned job packages were detailed.Many work instruction and preventive maintenanceprocedures were in a step-by-step or checklist format,with check boxes for each work step. In general,signature blocks were used to certify that work wascomplete and that post-maintenance testing wassatisfactory.

The F&O administrative work control procedureappropriately addressed management of waste streamsfrom work activities. The procedure provides aneffective tool for ensuring that waste is managed inaccordance with DOE and regulatory requirements.In addition, this procedure contains guidance onrecycling materials in order to reduce disposal costsand protect the environment. Steps in the procedurelink the craft personnel to the FSR as a control to ensurethat waste management expertise is involved in decidingproper disposal paths for waste generated by F&Oactivities. For example, for management of emptycontainers, craft must verify, with the FSR, that thecontainer meets the criteria for proper disposal.

The OA team identified that a few modificationsare being performed without using the modificationprocess or permit required by site procedures. InBuilding 331, a structural modification was beingperformed on the building supply fans without amodification permit. Matrix-type filters were beingremoved from each supply fan, and the roll filters werebeing relocated to the intake side of the coils. Themodification required decontamination anddecommissioning of the existing matrix filters, the

51

removal of roll filters from the downstream side of theintake coils to the upstream side, and fabrication ofmounting plates, guards, and other miscellaneous partsfor the installation. As discussed previously, a door tothe high-voltage switchgear room had been permanentlyremoved, constituting a minor facility modification.Administrative procedure ADM-58 requires that amodification permit be completed for facilitymodifications to ensure that all elements of configurationmanagement are appropriately considered. After thisconcern was identified, the chief engineer indicatedthat a modification permit would be processed for thesupply ventilation roll filter job.

Adequate controls are not implemented to ensurethat dispatch work requests receive a final documentedreview by supervisors to verify that the scope of workis clear and that hazards appropriate for the location ofthe work activity are listed. As a result, some dispatchwork requests for work in IOPS space were issued tothe field with the hazard block marked as “no IOPShazards.” Although the cause was software interfaceproblems between the ESR and the IOPS database, areasonable supervisory review would have identifiedthat the work orders incorrectly listed no space hazards.Readiness to perform work was not assured beforethese work orders were released to the craft for work.Supervisors and craft should be accountable to performa careful review of work orders prior to starting work.

Most craft work is performed using dispatch (skill-of-the-craft) work orders. The dispatch work criteriainclude many effective elements that ensure thatplanned packages are used for higher-risk work, andtriage managers effectively use the criteria to screenand upgrade many jobs to planned work packages.However, the criteria for such work does not addressany criteria based on the complexity of the work, numberof craft or multiple trades involved, coordinationbetween organizations (Operations, RadiologicalControl, ES&H, F&O, and R&D), or using severaldispatch work orders in lieu of a JPP. Additionally, thepresent criterion does not fully address some non-permitted work that may require special planning, suchas asbestos or lead work. The RPL lead cave job, asdiscussed in Section E.2.2.1, contains several elementsthat may be more appropriately addressed by a JPPrather than a dispatch work order.

PNNL does not have sitewide institutional controlsin place to consistently control work activities involvinglead. Lessons learned from numerous events acrossthe DOE complex had indicated weaknesses in controlof work activities associated with lead. There havebeen exposures from handling seemingly small quantities

of lead. At PNNL, workers and researchers use lead(e.g., solder, shielding bricks, weights, and lead sheeting)in numerous facilities, sometimes without formalcontrols. Improper practices with lead were observedin RPL shops (cutting and stamping on bare lead), andoxidized bare lead was being used for manipulatorweights in Room 58. A recent work activity includedshearing, filing, and gluing lead to other surfaces withoutcontrols specified in the work order. Controls for leadmay be inconsistently implemented across the site. Onefacility used a CPP (because there was no othervehicle), and another facility performed shearing andfiling of lead on a dispatch work order. The onlydocumented guidance on lead at PNNL is a lessons-learned bulletin that is labeled with a course numberand called “site training”; however, it is a “read andsign” process that was put in place by the supervisorrather than being driven by the formal work controlprocess.

The review of the energized electrical work permit(EEWP) raised several concerns about sitewideprogram implementation of the EEWP program.Numerous completed R&D and F&O EEWPs werereviewed that identified several program andimplementation weaknesses. For example, the authorand reviewer for most of the EEWPs was the same,thereby reducing the value of the intended multi-levelreview of the permits. Standing permits are issued forone year, and the only approval required for eachenergized electrical job is by a “person in charge,” withno management review. Building and uppermanagement may be unaware of the true extent ofenergized electrical work being performed across theLaboratory. The standing permits were not fully tailoredto each particular job, so one cannot determine thespecific controls and PPE that were used for aparticular job. Standing permits listed the full range ofPPE and control options, and individual controls or PPEwere not circled or checked to indicate the particularcontrols that were used for the job. The compellingreason for performing energized work was not filled inon many of the standing EEWPs reviewed. The formatof the permit was such that reviewers could notdetermine whether each energized job used a secondperson or attendant. The specific work assignmentfor each worker assigned to the job was not listed.Energized electrical work requires clear delineation ofassigned tasks for each worker involved.

Workplace exposure assessments and hazardsassessments are required by OSHA regulations andDOE Order 440.1A. OSHA 1910.132 requiresemployers to assess the workplace to determine

52

whether hazards are present, or are likely to be present,that necessitate the use of PPE. It further requireswritten certification that the required workplace hazardassessment has been performed. DOE Order 440.1Arequires implementation of a comprehensive andeffective industrial hygiene program to reduce the riskof work-related disease or illness. The order requiresinitial or baseline surveys of all work areas or operationsto identify and evaluate potential worker health risks.It further requires periodic resurveys and/or exposuremonitoring as appropriate. PNNL workplace exposureassessments have a number of weaknesses:

• The Building 350 painting booth was being operatedwell above the maximum filter differentialpressure (dp). The increased pressure would resultin a substantial decrease in airflow needed toexhaust paint fumes from the booth. The paint boothwas operating at 0.86 inches of water dp with amaximum limit of 0.50 inches of water dp. It islikely that the condition had existed for some timewhile the booth was used for painting. Discussionswith one painter indicated that smaller painting jobswere performed in the booth without respiratoryprotection. The only workplace exposureassessments for the painting booth had beenperformed in 1993, and there was no evidence ofperiodic evaluation or re-surveys based on potentialchanges in painting materials over the past 10 years.The workplace exposure assessments werequalitative. If the potential to exceed the thresholdlimiting value (TLV) is low, a qualitative exposureevaluation without air sampling is normallyadequate. However, one workplace exposureassessment indicated that potential exposure wouldbe above action levels and that a respirator andmonitoring were needed. There was no evidencethat air sampling was performed or documentedor that ventilation surveys had been performed.

• The Building 350 and EMSL designated weldingarea ventilation trunks did not have inspection tagsindicating that face-flow velocities had been initiallyor routinely verified to ensure adequate airflow toexhaust welding fumes and potential ozonegenerated from arc welding. Discussions withF&O and Industrial Hygiene indicated thatventilation flow for both the welding booth roofexhausters and power ventilation trunks are notroutinely verified and may not have a baselineassessment. Several workplace exposure

assessments had been performed for the Building350 welding booth, all in 1993. No workplaceexposure assessments were located for the weldingbooth in EMSL. The workplace exposureassessments assumed adequate ventilation flow toensure that action levels were not exceeded;however, there was no ventilation or air samplingdata to verify that airborne concentrations ofcontaminants were below the TLVs.

• The Building 350 carpentry shop’s dust collectorventilation exhaust trunks for various power toolsdid not have initial or periodic surveys to ensurethat flow was sufficient to prevent workerexposures. Similar to the case for the paint boothand welding booths, several workplace exposureassessments had been performed in 1993.However, the exposure assessments lacked airsampling or ventilation measurements, and failedto justify the basis for not conducting thesemeasurements. The workplace exposureassessments assumed that local ventilation wassufficient to keep particulates away from thebreathing zone of employees. Two of theworkplace exposure assessments, one for sandingand routing of woods and plastics, and one forbonding woods and plastics using glues andadhesives, stated that potential exposures werelikely to be above action levels and recommendedexposure monitoring to ensure that action levelswere not exceeded. There was no evidence thatfollow-up monitoring had been performed. For thesanding and routing of wood, the workplaceexposure assessment did not indicate that the mostlimiting materials were used for the assessment.Some pressure-treated wood contains arsenic, andcertain types of bonded laminates containformaldehyde and would be more limiting thanwood or most plastics. One assessment for radialarm saw operation recommended that noisemonitoring and personal dosimetry be performedbecause the saw had an estimated noise level of95 to 100 decibels.

Finding #4: Workplace exposure assessments andventilation surveys are not being performed as requiredby OSHA and DOE Order 440.1A to provide assurancethat worker exposures are maintained below regulatorycompliance levels.

53

Summary. PNNL appropriately uses engineeringcontrols for maintenance and subcontracted workactivities. F&O work activity controls arecomprehensive and formal. The F&O core team andR&D function is well integrated, with seamless supportby effective building management teams. Workers inall buildings, including subcontractors, are subject tothe same consistent controls from building to building.A variety of effective electronic tools and permits arein place and being used to adapt controls to specificF&O work. However, several weaknesses wereidentified for F&O support operations in such areas asworkplace exposure assessments, EEWPs, controls forlead, and dispatch work orders that could adverselyaffect safety. Overall, PNNL has a generally matureprocess for establishing proper hazard controls, butimprovements are needed to resolve severalweaknesses in implementation.

E.2.2.4 Core Function #4 – Perform WorkWithin Controls

Readiness is confirmed and work is performedsafely.

The OA team observed a variety of F&O workactivities, including construction, preventive andcorrective maintenance, fabrication, and welding in theBuilding 350 shops, RPL, Building 331, and EMSL.All work observed was being performed safely andwithin work package and procedural controls. Workdocuments and procedures were present at the joblocations, appropriate PPE was worn where required,and the workers were knowledgeable of the hazardsinvolved. Construction areas were well marked withconstruction barricades and posted signs for EMSL andBuilding 331 outfall work and laboratory renovationconstruction areas.

Readiness to perform work was assured throughformal POD meetings held each morning prior to thestart of work and approved written PODs for eachfacility. The POD meetings at all facilities are drivenby formal F&O procedures and were consistentlyperformed in RPL, Building 331, and EMSL. PODswere well attended by the building manager, buildingengineer, facility project managers, maintenancesupervisors, and support personnel, such as RCTs andES&H representatives. An approved POD resulted informal work authorization for all planned and somedispatch work in the facility. Minor dispatch work, notlisted on the POD, was discussed at the POD and

individually authorized by the building manager, buildingengineer, or facility project manager. Emergent workwas formally added to the POD by a signed additionform appended to the approved POD.

Workers were experienced in their trades andknowledgeable of the facilities and equipment relatedto their work activities. The workers exhibited a goodregard for safety and procedural adherence whileperforming work activities. The numerous lockout/tagouts (LO/TOs) and safe energy checks observedwere performed safely and within procedural controls.One positive aspect of building configuration and systemcontrol is that system alignments for maintenance andLO/TOs are placed by Building Management/Operations personnel, and then craft over lock andverify the LO/TO. This ensures an additional level offacility authorization (in addition to the POD) on jobsinvolving LO/TO. When two craft were involved in awork activity, both craft over locked the tagout even ifonly one was doing the hands-on work.

Hoisting and rigging operations in EMSL and RPLwere safely conducted. Hoisting and rigging equipmentwas properly marked with current inspection tags andwas stored to prevent degradation and damage. Avariety of hoisting and rigging equipment was inspectedboth in shops and in use during work activities. Allinspections were current, and equipment was in goodrepair. In two Building 350 shop areas, deficient slingshad been marked and set aside for evaluation or disposal.Several recent improvements in hoisting and riggingincluded magnetic lifting devices for improved waterjet material handling; a counter-balanced boom craneto allow closer access to loads (no protruding legs);racks and stairs for trucks/vans to ease loading, entry,and exit; use of compressed gas carts to facilitatemoving bottles; and a below-the-hook lifting device forforklifts to avoid smaller portable cranes.

With one exception, storage of flammables in allfacilities was adequate. Flammable material wasproperly stored in flammable lockers and was neatlyarranged within the lockers. No instances ofincompatible storage were identified, and the lockerscontained no standing oil or excessive combustibles.However, the Building 331 high-voltage switchgearroom had a flammable locker stored directly againstthe building main feeder power panel and within a fewfeet of emergency standby feeder for building power.Additionally, one half of a double door that isolates theswitchgear room from the mechanical equipment roomhad been permanently removed. The building managerindicated that the door had been gone for years and did

54

not know when or why it was removed. Generally,building design features isolate high-voltage switchgearrooms from adjacent working spaces to reduce hazardsfrom electrical fires or malfunctions. The door removalmay have been an unapproved facility modification.

Notwithstanding the many strengths and positiveaspects of the F&O work control program, weaknesseswere identified that had potential to affect workersafety. Weaknesses were identified in the workerexposure program, in implementing proceduralrequirements that resulted in numerous facilitydeficiencies, and deficiencies in implementing theEEWP process.

While most work was performed safely, somework was being performed in workplaces (paintingbooth, welding booths, and the carpenter shop) that didnot have current workplace exposure assessments. Forthe Building 350 painting booth, painting operationswere being performed when the filter differentialpressure was significantly above the maximum allowedfor painting booth operation (see Finding #3).

Failures to follow PNNL and F&O proceduralrequirements resulted in numerous readily observablesafety deficiencies and OSHA violations in the Building350 central shops, and to a lesser extent at RPL,Building 331, and EMSL. The number of deficienciesacross several facilities indicated weaknesses inestablishing clear management expectations forrigorous self-assessment programs and day-to-daywalkthroughs by supervisors and craft. Thedeficiencies included (see Findings #1 and #2 inAppendix D):

• There were several cases where machinedisconnects and power panels were partiallyobscured by improper storage of material andequipment, and one fire extinguisher was blocked.

• Numerous heavy clamps in a welding booth werestored by hanging them on oxygen and acetylenepiping and had slightly bent a copper elbow on anoxygen line, which could cause oxygen andacetylene leaks.

• Welding areas at Building 350 and EMSL hadcombustibles within 35 feet, contrary to siterequirements, and welding curtains did not go downall the way to the floor, as required by siteprocedures. A microwave oven at EMSL and arefrigerator at Building 350 were located indesignated welding areas.

• Numerous bench grinders in all facilities hadevidence of minor grinding on aluminum, andseveral grinders had improperly adjusted toolguards.

• A gas cylinder bottle at Building 350 and one in aBuilding 331 research laboratory were not properlysecured.

• There was poor housekeeping in several areas,including the central shops, paint shop, EMSLmachine shop, and the Building 331 mechanicalequipment rooms. One lathe was identified in aBuilding 331 mechanical room that had a numberof safety deficiencies.

• Electrical safety deficiencies included a portablecooling fan with a blade guard that did not meetOSHA requirements in Building 350; extensioncords were daisy-chained in two areas ofBuilding 331 in violation of site electricalrequirements; and a drill with a defective powerswitch (always on) was being used in a Building 331research laboratory space.

• A planer in the central shops was modified toimprove the emergency shutoff by adding a largeknee plate that contacted the shutoff switch.However, misalignment of the plate could haveprevented the machine from being stopped. Afterthe modification, several people had reviewed theissue, which was then prematurely closed in theassessment tracking system.

• A construction barricade (plastic fence) around anexcavation at the Building 331 outfall did not provideadequate fall protection for the excavation. Thebarricade was located at the edge of the excavationand was not sufficiently strong to prevent a fall ofabout 10 feet into the excavation. (This deficiencywas corrected immediately by the constructionsafety inspector.)

Most of the safety deficiencies discussed abovewere promptly corrected during the course of theinspection. Extension cord deficiencies, blocked powerpanels and disconnects, and the blocked fireextinguisher were corrected soon after they wereidentified, and several machine grinders were removedfrom service. The paint booth and welding booths wereplaced out of service pending evaluation, and clamps

55

were removed from the oxygen and acetylene piping.F&O also initiated actions to review other facilities andareas for the same type of deficiencies.

Summary. Most work by F&O at PNNL is beingperformed with a high regard for safety. Workers weregenerally familiar with the facilities, systems, andequipment being worked on. Readiness to performwork, including ensuring appropriate training,qualification, and authorization prior to performing work,was well implemented. Formal, well-documented PODmeetings and schedules ensured appropriatecoordination between the facility core team and R&Dorganizations. Subcontracted construction activities atBuilding 331 were being performed safely within andadjacent to active R&D spaces. Although most workobserved was safely performed, some weaknessesrequiring management attention were identified. Theseinclude deficiencies in the worker exposure program,weaknesses in following procedural requirements thatresulted in numerous facility deficiencies, anddeficiencies in implementing the EEWP process. Thesedeficiencies are symptoms of weaknesses in feedbackand improvement processes, as discussed in Findings #1and #2 in Appendix D.

E.3 Conclusions

Most work activities reviewed by the OA teamwere performed with appropriate controls and a high

regard for safety for R&D and F&O activities. Further,PNNL has achieved a good safety record. For example,FSD injury and illness rates indicate a safe operatinghistory. The FSD fiscal year 2003 first aid case rate of1.43 is below comparable rates for most other PNNLdivisions for the same period of time. Furthermore,the FSD recordable case rate of 0.82 and the days-away restricted case rate of 0.20 are well below theCY 2002 DOE research contractor average rates of2.20 and 0.90, respectively.

Although some deficiencies were identified withlower-hazard activities, the scope of work is adequatelydefined, the processes for identifying and analyzinghazards were generally adequate, and most work wasperformed in accordance with identified controls forR&D and F&O activities. However, for both R&Dand F&O, processes for developing and implementinghazard controls were not always effective. Althoughsome aspects of controls were particularly effective,including the use of engineering controls andenvironmental controls, other aspects of hazard controlswere not rigorously implemented or well documentedfor some lower-hazard activities. Improvements areneeded in a number of areas, including exposureassessments, interfaces between IOPS and EPR, leadcontrols, EEWPs, and documentation of controls.

The ratings of the first four core functions reflect the status of the reviewed elements of ISM program elements atPNNL facilities. The ratings apply to both R&D and facility support activities.

Core Function #1 – Define the Scope of Work...................................................EFFECTIVE PERFORMANCECore Function #2 – Analyze the Hazards ...........................................................EFFECTIVE PERFORMANCECore Function #3 – Develop and Implement Hazard Controls .................................... NEEDS IMPROVEMENTCore Function #4 – Perform Work Within Controls ............................................EFFECTIVE PERFORMANCE

E.5 Opportunities ForImprovement

This OA inspection identified the followingopportunities for improvement. These potentialenhancements are not intended to be prescriptive ormandatory. Rather, they are offered to the site to bereviewed and evaluated by the responsible line

E.4 Ratings

management, and accepted, rejected, or modified asappropriate, in accordance with site-specific programobjectives and priorities.

Pacific Northwest National Laboratory

1. Conduct a review to determine the causes andcorrective actions for failures to properlyidentify and control all relevant radiological

56

hazards associated with AlphaMed work inRPL and in ICP analysis in Building 331.Review radiological control requirements for alarger sample of current projects using radioactivematerials to determine whether these examplesrepresent anomalies or a more systemic concern.

2. Consider establishing a mechanism tointegrate radiological work planningoutcomes with hazard awareness summariesand IOPS. Consider linking radiological workplanning with the EPR and IOPS processes tointegrate controls identified in RWPs (e.g., trainingand protective clothing) into the research workcontrol process.

3. Enhance the EPR process and interfaces.Specific actions to consider include:

• Provide a more complete description of thework activity in the EPR. Write the workdescription such that individuals who areresponsible for but not directly involved in theresearch (facility operations, ECR, ES&H,emergency management) can sufficientlyunderstand the research work scope in orderto identify workplace hazards or challenges tothe building safety envelope. Includereferences to other proposal and technicalwork documents that may also describe theresearch work.

• Hold product and project managers fullyaccountable for the accuracy of EPRs toensure that hazards are consistent with theresearch project, and that EPRs are maintainedcurrent with changing hazards.

• Increase the involvement of the Safety andHealth representative in the review of EPRs.

• Consider tailoring the IOPS requirementssection of the EPR to include only thosepermits, work practices, and training that arerequired based on the hazards identified in theEPR. For example, exclude requirements, suchas respiratory protection training, if theresearch project has no hazards requiring theuse of a respirator.

4. Conduct a survey and evaluation of routinelaboratory work activities to identify commonresearch hazards that may not be adequatelycaptured through application of the presentEPR and/or IOPS processes. Specific actionsto consider include:

• Define a “skill of the craft” activity categoryfor research work for which some routinehazards and their controls (e.g. use of syringes)may not need to be documented in either anEPR and/or through IOPS.

• Establish training and/or qualificationrequirements for “skill of the craft” activitiesto ensure that all researchers, including thosewith less laboratory work experience or training(e.g. visiting students), perform routine workwith the same level of hazard awareness andhazard controls.

5. Strengthen the sitewide implementation of theEEWP program such that specific controls aretailored to each use of a permit anddocumented on the EEWP. Specific actions toconsider include:

• Consider reformatting the EEWP form to allowthe exact job scope to be entered or checkedoff and the specific controls used for each joblisted or circled on the form.

• Reestablish the multi-level review (preparedby, reviewed by, approved by signatures) asintended by program requirements.

• Ensure that job-specific, compelling reasonsfor energized work are documented on theEEWP and receive some level of managementreview.

• Establish periodic and more rigorousassessments of the energized electrical work.

6. Improve the quality of the periodic self-assessments and day-to-day observation andwalkdowns of work activities and spaces.Specific actions to consider include:

• Consider further customizing the CSM self-assessment checklists for such spaces as the

57

Building 350 shops (paint booth, welding booths,etc.) and mechanical equipment rooms toensure that checklist attributes are clearlywritten and would reasonably identify safetydeficiencies.

• Include supervisors and crafts as a normal partof self-assessment functions to raise andreinforce management expectations formaintaining workspaces free of ES&Hdeficiencies.

• Review recent management and self-assessments to determine why assessmentshave not been fully effective in identifyingreadily-observable deficiencies.

7. Consider establishing sitewide institutionalwork controls for the use, cutting, machining,and handling of lead and lead products.Specific actions to consider include:

• Determine the quantities, locations, and usesof lead across PNNL by R&D and F&O, andverify the adequacy of existing controls.

• Review DOE complex-wide lessons learnedregarding improper control for lead and workerexposures.

• Determine whether implementing workcontrols and/or procedures are in place toensure that SBMS requirements will beconsistently implemented across the site toprotect workers.

8. Establish formal work practice instructions forsome shop operations, such as the paint boothand carpentry shops. Specific actions to considerinclude:

• Define operations and controls based on themost limiting materials to be used (epoxy paints,bonding adhesives, arsenic-containing wood,etc.).

• Verify the controls by baseline and periodicworkplace exposure assessments that includequantitative ventilation measurements andworker monitoring.

9. Consider implementing changes to RPLpractices to ensure compliance with chemicaluse documentation requirements of SBMSsuch that all individual chemical hazardsassociated with various processes areappropriately and uniquely identified andcontrols are tailored to the specific hazards.Specific actions to consider include:

• At RPL, use the SBMS permit authoring toolas a mechanism to better facilitate compliancewith SBMS and OSHA requirements fordocumenting hazards and controls associatedwith chemical use.

• Ensure that the appropriate PPE for eachhazardous chemical is either clearly identifiedin a CPP, or some other document, such as amanufacturer’s glove chart.

• Conduct periodic training for CSMs to increaseawareness of the need to continually reviewchemical inventories against existing permitsand IOPS hazard awareness summaries toensure accurate and complete hazardidentification.

• When using the “static inventory” location fieldof CMS for bulk chemicals, ensure that thestorage location of individual containers isaccurately reflected in CMS unless the productwill be used and returned to the bulk chemicalstorage location each day of use.

• Consider revising the CPP authoring tool toinclude maximum quantities of bulk chemicalsin laboratories and associated PPE for handlingbulk chemicals.

10. Improve systematic mechanisms within IOPSor other means to ensure that personnel withradiological work planning responsibilitieshave access to all available details concerningscope of work such that hazards can beappropriately analyzed and controlled. Specificactions to consider include:

• Establish a requirement to include EPRdocumentation along with RWP request forms.

58

• Establish an RWP request form writers guideto ensure that researchers and projectmanagers include all relevant details of workscope and isotopes to be encountered duringwork.

11. Increase emphasis on tailoring controls tospecific hazards within IOPS spaces and in thedevelopment of RWPs. Specific actions toconsider include:

• Ensure that hard-copy laboratory handbooksat RPL contain only the information thatuniquely applies to the IOPS space for whichit is intended and that CSMs keep theinformation current.

• Improve the rigor of laboratory self-assessments to include periodic evaluations ofCPPs to verify that the appropriate chemicalPPE is identified and is being followed byresearchers.

• For higher-hazard radiological work at RPL,conduct and document time motion evaluationsof actual work evolutions to ensure thatprescribed controls are optimized (i.e., locationof extremity dosimetry) and to documentaccuracy of pre-job dose estimates.

• Ensure that appropriate controls for the work,such as the need for respiratory protection or

appropriate suspension limits, are clearlyspecified in RWPs that allow such genericactivities as “perform decontamination.”

12. Consider enhancements to further improvewaste management activities. Specific actionsto consider include:

• Ensure that inspections of waste managementareas are performed on schedule and withsufficient rigor to identify non-compliance withrequirements.

• Ensure that all containers used for holdinghazardous chemicals are labeled as eitherhazardous materials or hazardous waste toassist in proper management of waste.

• Improve management of SAAs so that fullcontainers or containers from activities thathave ended are transferred to compliantstorage in a timely manner and not stored inthe accumulation areas.

• Consider creating a less-than-90-day storagearea in the EMSL compressed gas room forlecture-size compressed hazardous waste gascylinders.

59

APPENDIX FESSENTIAL SYSTEM FUNCTIONALITY

F.1 Introduction

The U.S. Department of Energy (DOE) Office ofIndependent Oversight and Performance Assurance(OA) evaluated essential system functionality at thePacific Northwest National Laboratory (PNNL). Thepurpose of an essential system functionality review isto evaluate the functionality and operability of a facility’ssystem(s) and subsystem(s) essential to safe operation.The review criteria are similar to the criteria for theDefense Nuclear Facilities Safety BoardRecommendation 2000-2 implementation plan reviews;however, OA reviews also include an evaluation ofselected portions of system design and operation.

The OA team selected the RadiochemicalProcessing Laboratory (RPL) radioactive exhaustventilation system (REVS) for evaluation. This systemstarts at the exhaust plenum in the RPL basement,includes the attached ductwork to the Filter BuildingAnnex, the final high efficiency particulate air (HEPA)filters, housings, dampers, and exhaust fans, and endsat the top of the stack. The system is designated as“safety significant” in the documented safety analysis(DSA) and is intended to ensure safe confinement ofradioactive materials under normal conditions andduring certain accident conditions, including a fire orexplosion in a laboratory room.

The OA team’s review of this system focused onelements of system design, configuration control,surveillance and testing, maintenance, and operationsthat are important to ensuring that the system canperform its safety function. The OA team performeda detailed analysis of the safety basis of the system,including a critical review of parameters andassumptions made in the DSA.

F.2 Results

F.2.1 Design and Configuration Control

Design. The RPL was designed and constructedin the 1950s and was subsequently modified andupgraded to meet changing mission needs and safetyrequirements in accordance with applicable design andsafety standards. The safety-significant REVS waspart of the original facility design and was designed to

prevent the release of radioactive materials from thefacility by establishing airflow from potentially lesscontaminated areas to potentially more contaminatedareas and ultimately to the environment through HEPAfilters. This OA inspection focused on the design ofthis system, its ability to accomplish the requirementsin the DSA and the technical safety requirements(TSRs), and the translation of this design intoprocedures and practices associated with the system.It also addressed design and configuration managementprocesses associated with the RPL, including theunreviewed safety question (USQ) program. Theinspection results were based on the RPL facility, theREVS, and the RPL DSA and TSRs as they werefound at the time of the assessment.

The Richland Operations Office (RL) and PNNLengineering and technical personnel and the managerscontacted were technically knowledgeable of the facilityand the REVS, were highly motivated, and possesseda very strong sense of “ownership” of RPL safetysystems. However, the degree of rigor and formalityof the engineering documentation was not sufficient toadequately support the safety basis for a Category 2nuclear facility. There was an absence of formal,detailed technical analyses to support the REVS designand its normal and accident operating parameters andlimits.

In general, REVS has a robust design. However,weaknesses were identified in the system’s DSA/TSRrequirements, in its physical design, and in its design,operational, and testing parameters. As discussed inthe following paragraphs, these weaknesses couldprevent the system from fully performing its intendedsafety function for some design basis conditions.

The REVS design does not account for potentialbuilding pressurization during a design basis fire due torapid loading of the REVS HEPA filters. The RPLheating, ventilation, and air conditioning (HVAC) systemnormally operates with three non-safety main supplyfans and three REVS exhaust fans running. Underboth normal and accident conditions, the exhaust fansmust operate at a higher flow rate than the supply fansto maintain the building at a slightly negative pressure,with building inleakage making up the fan flowsmismatch. However, for a design basis fire in one ofthe laboratories, the REVS HEPA filters would rapidlybecome loaded with combustion products, which could

60

rapidly increase the REVS filter differential pressureand the overall system resistance. The systemresistance increase could cause the exhaust fans tooperate at a lower flow rate, potentially less than thesupply fans, which could cause the building to becomepressurized, and building inleakage would be changedto outleakage, bypassing the REVS HEPA filters. Initialresearch by the OA team indicated that additional filterloading as low as 1¼-inch water column (w.c.)differential pressure (dp) above normal would reducethe building negative pressure to zero (the filters’ normaloperating range is 1 inch to 2 inches w.c., and they areintended to be capable of accepting fire loading up to10 inches w.c.). This previously unidentified systeminteraction could have been addressed with a designfeature to automatically trip the supply fans whenbuilding negative pressure lower limits are approached.The exhaust fans normally operate near the high staticpressure end of the fan curve data provided by thevendor. However, the additional system resistancefrom a fire would cause the fans to operate well outsidethe range of the vendor-supplied data.

The REVS design does not include criteria forbuilding negative pressure that adequately accounts forwind effects. For an HVAC system, such as REVS,to provide confinement in an accident, it mustaccomplish two functions: (1) it must establish acontrolled HVAC exhaust flow from the building througha filtered pathway that will remove sufficient radioactivematerial to prevent exceeding acceptable offsite andonsite exposures, and (2) it must establish buildingnegative pressure with respect to the outsideenvironment that is sufficiently low to prevent buildingleakage through unfiltered pathways for wind conditionsthat can produce localized negative pressures on thebuilding outer surfaces. The current DSA andassociated TSRs do not designate a minimum buildingnegative pressure to maintain, and thus do notadequately address the second function. Specifically,the DSA/TSRs do not specify a minimum buildingnegative dp requirement that will ensure no buildingleakage for wind velocities of concern nor, alternatively,does the DSA accident analyses for offsite and onsiteexposures account for a credible percentage ofunfiltered leakage that might occur in the absence ofcontrol of minimum building negative pressure.Therefore, these safety documents are insufficient toprovide positive assurance that a critical design safetyfunction of the REVS can be accomplished. Althoughexisting operator rounds sheets require a building

negative pressure, their minimum allowable dp of onlyminus 0.01 inch w.c. corresponds to wind velocities upto only 5 miles per hour (mph). The accident exposurecalculations were performed for a 22-mph windvelocity, which could generate localized outside buildingskin pressures as low as minus 0.17 inch w.c. Facilitiessuch as the RPL are typically maintained at about minus0.25 inch w.c. to provide margin above the analyzedwind velocity. Based on observations during systemwalkdowns, OA concluded that the REVS system mightnot be maintaining all areas of the facility at a negativepressure.

The REVS filter isolation dampers’ design isinadequate to accomplish their DSA-stated isolationfunction. The DSA, in Section 8.2.1.4 and otherlocations, states that the design basis function of thesedampers is isolation of the filter banks, which isdesirable in some situations (e.g., instances where abank may be found to be outside its TSR-requiredefficiency). However, the design of these dampers(shutter-type, without seals) is inappropriate to achievethe level of isolation necessary to maintain overallsystem filtration efficiency within the 99.95 percentTSR limits. Although this deficiency can be overcomethrough compensatory system procedure changes(some of which were accomplished during this OAinspection), the DSA should also be revised to removeany ambiguity regarding the dampers’ isolationcapability.

Finding #5: The PNNL RPL REVS design containsfundamental weaknesses that could prevent it fromperforming its design safety function and that are notadequately addressed in the DSA and associated TSRs.

The REVS HEPA filter efficiency testing procedureis non-conservative. The RPL TSRs require REVSfinal HEPA filter efficiencies greater than 99.95 percent.The system contains four parallel filter banks, and thesurveillance test procedure tests each bank separatelyby isolating three banks and performing a smokepenetration test on the remaining in-service bank. Thetest is performed by introducing smoke upstream ofthe banks and sampling the smoke concentrationupstream and downstream of the filter banks andcomparing the concentrations. However, the testmethod and sample configuration do not meet industrystandards and could cause non-conservative resultsbecause the sample point is in the common outletheader for the four filter banks rather than thedownstream flow from the specific filter being tested.This discrepancy is significant because of the potential

61

leakage of the isolation dampers. Any such leakagefrom the three “isolated” banks would mix with theoutlet flow from the bank being tested and could affectthe test results. Calculations indicate that the dilutionflow could be as much as 33 percent of the total flowwith the current incorrect damper test acceptancecriteria (discussed later). (Note: Even if anunacceptable individual filter bank is not detected as aresult of this procedure weakness, the overall systemfiltration efficiency will remain within the TSRrequirement, as long as the system is operated with allfour filter banks on line. Although allowed by the DSA,there was no indication that the system had ever beenoperated with less than four banks on line except duringfacility outages.)

Functional testing of the REVS backup air supplyis not adequate. The safety-significant compressedair system is a supporting system for REVS. Its safetyfunction is to provide operating air to the REVS damperactuators upon loss of the normal air supply to ensurethat the dampers remain in the correct position for alldesign safety basis conditions. Being a safety-significant system, it must be tested periodically toassure that it can perform its safety function. Althoughit is currently tested to verify that the backup aircompressor will automatically start when the normalair supply is lost, no testing is performed to show thatthe system leakage, including back-leakage through thecheck valve, which separates the backup air supplyfrom the normal air supply, is less than the backup aircompressor’s capacity. Such leakage would notnecessarily be detected during normal operation, sincethe larger normal air supply capacity may be capableof maintaining system pressure in spite of the leaks,whereas the backup air compressor may not.

Finding #6: PNNL has not adequately and correctlytranslated some REVS design requirements into systemprocedures, and REVS HEPA filter and backup airsupply testing was not adequate to demonstrateoperability.

Calculations are normally only performed to supporta new or unique modification or plant condition. Thesecalculations are usually filed with the projectdocumentation and do not become a part of the facilitydesign basis documents. When a facility change ismade, the acceptance of the plant change is based onits performance relative to the previous configuration(reverse engineering). However, analyses of itsperformance relative to the original design basis are

not generally performed because no calculations forthe original plant configuration are maintained or arereadily available. There is effectively no analytical basisfor the DSA descriptions or the TSR surveillance testacceptance criteria for the REVS. Two examples ofdesign conditions that do not have adequate analyticalbases are as follows:

· The REVS filter accident loading analysisis incomplete and incorrect. The RPL fire hazardsanalysis (FHA) contains a table of individual laboratorycombustible/flammable materials loading limits. Theseare intended to ensure that, in the event of a laboratoryfire, the particulate loading on the REVS final filterswould not exceed that which could cause their structuralfailure because of high dp. However, the values in theFHA table contain technical deficiencies with respectto operational constraints of REVS. For example, thevalues in the FHA table were based on 156 HEPAfilters or four filter banks in service, even though it ispermitted to be operational with 117 HEPA filters orthree filter banks in service. An analysis was conductedon PNNL’s source for the FHA table values.Experimental results were taken from a 1995 AmericanSociety of Fire Protection Engineers conference paperabout HEPA filter failure due to fire particulate loading.The paper evaluated a HEPA filter similar to the REVSsystem final filters and calculated the masses of variouscombustible/flammable materials required to causefailure. Although the paper may be valid, its calculatedcombustible/flammable materials limits were usedincorrectly in the FHA; no adjustments were made toaccount for differences between the worst case REVSoperating limits and the paper’s evaluated conditions.Also, the FHA did not arrive at a conclusion whetheror not controls are adequate or necessary for the RPLand whether or not a fire involving actual combustiblematerials contained in the RPL may cause final HEPAfilter plugging. (Actual laboratory combustible loadingswere observed to be well below the probable correctFHA limits.) As a result of this discovery, PNNLdeclared a potential inadequacy in the safety analysis(PISA), and an unreviewed safety questiondetermination (USQD) was initiated. Compensatorymeasures were initiated, which included cessation ofall planned fire alarm, detection, or suppression systemoutages, a fire protection program compliance fieldwalkdown was conducted, with no deficienciesidentified, and doubling of operator tours through theRPL to every two hours until the USQD evaluation iscompleted.

62

• The REVS HEPA filter isolation dampersurveillance test procedure does notdemonstrate their isolation capability. Section8.2.1.4 of the final safety analysis report statesthat the safety-significant final filter bank isolationdampers are required to be capable of isolating adefective final stage filter “to meet the REVS[99.95% filter efficiency] requirements.”Therefore, this capability should be verified bysurveillance testing. Although a statement in thecurrent test procedure and the procedure’s precisequantitative acceptance criterion imply that itprovides this verification, it does not for thefollowing reason. The acceptance criterionconsiders the dampers to be operable if the filterbank dp with the dampers closed is less than0.2-inch w.c. No valid analytical basis could beprovided for this value, and the OA team calculatedthat this value would allow damper leakage bankas high as 11 percent of the total system flow, whichwould potentially reduce overall system efficiencyto, at best, 89 percent.

Finding #7: PNNL has not ensured that the REVSdesign and operating requirements and capabilities areadequately supported by formal, rigorous analyses. TheDSA and TSRs for the REVS were developed withoutsufficient formal technical analyses to support thedesign, operating parameters, or limits.

Finding #8: The safety evaluation process conductedby RL to support approval of the RPL DSA and TSRsfor REVS did not provide an adequate basis forapproval.

Configuration Management. Configurationmanagement is important for maintaining the accuracyand validity of the safety basis and technical documents,such as the DSA, the TSRs, and drawings, procedures,and other technical documents used in day-to-dayfacility operations. PNNL has established the basicelements of an effective configuration managementprogram, including the USQ process, drawing controls,calculation controls, procedure revision protocols andcontrols, and a design change process to assure thatfacility modifications are properly evaluated,documented, reviewed, and verified to be within thebounds of the DSA, the TSRs, and applicable codes,standards, and DOE orders.

The DSA and the TSRs, in most instances,adequately document the safety functions, roles, andperformance requirements in detecting, preventing, andmitigating analyzed events. The descriptions of normaland accident conditions for the REVS, in most cases,were clear, adequately documented, and containedappropriate inputs, assumptions, and levels of detail.However, as previously discussed, significant aspectsof the DSA had not been adequately considered.

Based on a review of the Administrative ProcedureFacility Design Manual, the essential elements ofconfiguration management and control were adequatelyaddressed. Three design changes were reviewed, andthe change package documentation generally compliedwith the requirements of the administrative procedure.The modification process establishes an engineeringdesign plan (EDP), identifies the technical baselinedocuments affected by the modification, identifiesessential drawings and other related documents thatare required to be as-built, and provides for multi-discipline review and comment. Comments aresolicited from all disciplines during development of achange, and a multi-discipline Facility Review Boardconducts final modification review. Installationinstructions and post-modification testing instructionswere appropriately specified.

Drawings affected by facility modifications areappropriately identified and revised. Drawings that aredeemed as defining the facility are designated as keydrawings and are maintained and controlled. Drawingsthat are affected by facility modifications are identifiedfrom the key drawing list. Affected drawings areidentified on the modification EDP consistent with theadministrative procedure.

PNNL’s USQ procedure and practices at the RPLwere effective, with only a few refinements needed.The procedure is very straightforward and easy to use,with precise, correct reflections of the regulatoryrequirements of 10 CFR 830. Training and qualificationrequirements for USQ screeners and evaluators areappropriate and are clearly and correctly stated infacility personnel qualification documentation. Formalrecords are maintained of qualified personnel. A reviewsample of 12 USQ screenings and 4 USQdeterminations identified only two cases where theprocedure was not precisely followed.

Although PNNL has a generally effective USQprogram, a few specific discrepancies were observedin the procedure or its implementation:

63

• Missing final USQ criterion. Although theprocedure and the attendant forms contained thecorrect approach and the correct specificevaluation questions for the USQD, there was nospecific statement in either the procedure or theforms that any “yes” answer to the form questionswould constitute a USQ. (From discussions andsamples reviewed, it was clear that this criterionwas well understood in spite of its not beingdocumented.)

• Incorrect categorical exclusion example. Theprocedure, in addressing categorical exclusions toperforming a USQD, incorrectly cited maintenanceprocedure changes as an example.

• Missing link to USQ training/qualificationrequirements. The USQ procedure does notidentify the specific procedures and forms thatprovide the requirements and documentation forthe qualifications of USQ screeners and evaluator.

• Incorrect modification screening. USQscreening RPL-2003-134S of a modification to adda motor to a hot cell “lazy susan” incorrectlydetermined that a USQD was not required basedon an incorrect “no” answer to the screeningquestion, “Is this a temporary or permanent changeto the facility as described in the documented safetyanalysis?”

• Incorrect procedure screening. USQ screeningRPL-2003-205S addressed a new procedure toreplace one of the 156 REVS final filter elements.As a new procedural activity for equipmentdescribed in the DSA, this new procedureconstituted a change to a procedure as describedin the DSA. However, the screening questionregarding if this was a change to a procedure asdescribed in the DSA was incorrectly answered“no.”

Summary. The facility and RL engineering staffwas knowledgeable, conscientious, and highlymotivated. The RPL’s REVS is a generally robustdesign. However, it contained three significant designdeficiencies that could prevent it from fully performingits design safety function: (1) the design contained nofeatures to prevent building pressurization and resultantunfiltered leakage due to REVS HEPA filter loadingduring a design basis fire, (2) the design did not contain

adequate criteria for maintaining negative buildingpressure that accounts for wind effects on the building,and (3) the REVS HEPA filter isolation dampers alonedid not provide adequate isolation to maintain therequired system filtration efficiency when a filter bankwas isolated. Further, the DSA was developed withoutsufficient technical analysis, and design requirementswere not effectively translated into system proceduresand TSRs. Configuration management processes andprocedures, including the USQ program, are consistentwith applicable standards and regulations and aregoverned by an appropriate set of procedures.However, PNNL did not have detailed, rigorous designbasis analyses for the REVS, and design requirementsare not clearly identified.

F.2.2 Surveillance, Testing, andMaintenance

Surveillance and testing of the REVS is governedby the TSRs. The TSRs establish appropriaterequirements for functional testing of critical systemsand components at a frequency to ensure theiroperability. The TSR surveillance and test acceptancecriteria were appropriately based on the DSA (exceptas noted in the previous section).

Based on a walkdown of the REVS, the system isin good material condition. In support of the REVSdesignation as “safety significant,” all maintenancetasks were classified as Category 1 work, the highestclassification, which has directly contributed to a lowmaintenance backlog.

The REVS system engineer is knowledgeable ofthe REVS configuration, operation, and maintenancerequirements, and maintains a close working relationshipwith the maintenance personnel who are dedicated toRPL. The dedicated maintenance staff was thoroughlyfamiliar with the performance of maintenance on theREVS components and systems.

The completion of preventive maintenance tasksand surveillances for REVS are effectively trackedand trended. The process for dispositioning overduetasks has been formalized. Authorization and approvalfrom the building manager and the chief facility engineerare required to defer Category 1 preventivemaintenance tasks past the due date and to enter intothe 25 percent overdue grace period.

RPL does not adequately maintain vendor manualsfor safety equipment. The RPL engineering staff wasunable to locate vendor manuals for many of the safety-significant REVS components. This was largelyattributed to the age of much of the equipment. Without

64

these manuals, PNNL does not have ready access tosome of the information needed to implement a properpreventive maintenance and surveillance testingprogram that will ensure that all manufacturers’recommended work is performed. Such programs arebasic elements of ensuring optimum equipment reliabilityand equipment life.

The computerized maintenance managementsystem, Maximo, used by RPL for developing itsmaintenance and surveillance work packages does notinclude a data field that would isolate the safety-significant equipment at RPL. Without this data field,RPL staff cannot readily re-create maintenancehistories for this equipment. It is essential that accuratemachine history tracking can be periodically performedon safety-significant equipment so that the properfrequency for surveillances and preventive maintenanceis assured.

The maintenance work packages that werereviewed were clear and concise. Appropriate taskplanning was performed, and hazards were adequatelyidentified. In accordance with the graded approach,more complex work packages included all necessarywork instructions and information, including up-to-datedrawings where necessary to properly perform thework. A review of several completed work packagesidentified no significant deficiencies, and included thesupporting sign-off sheets and other documentation.Discussion with maintenance personnel indicated thatthey would not hesitate to stop work and contact asystem or building engineer when inconsistencies werediscovered in a work package.

RPL managers have taken the appropriate actionto address the aging of critical facility components. In2001, RPL developed the “Life Cycle Costs forMaintaining Systems in the RPL” report to address thefacility’s aging components. The engineering staffreviewed some of the historical data on the cost ofmaintaining REVS, the supply ventilation system, thesupporting electrical system, and other major RPLsystems. The systems were subdivided into componentparts, and each part was reviewed for expected life.DOE Standard System Design Life Tables providedthe primary reference for life cycle predictions. Thesystems were then analyzed for the risk of failure ofeach piece of equipment and the resulting facilityimpacts. The equipment in each system with the highestfailure risk and the most significant facility impact wasreviewed for life cycle and installation date. The olderthe equipment is, the higher the risk of failure, resultingin increased facility operation risk. The replacementcosts of the equipment were researched and integrated

into the cost analysis for the time of the completion ofthe equipment’s life cycle. The equipment presently atthe highest risk of failure and with the greatest negativeimpact to the facility were REVS components, includingthe exhaust fans, final HEPA filters, dampers,switchgear, and non-REVS components, including thesupply fans and HVAC controls. Of those componentslisted, the switchgear was replaced in 2002 and theHVAC exhaust controls were replaced in 2001. Currentplans are in place to replace the final HEPA filters in2003 and the exhaust and supply fans in 2003 and 2004,respectively. In the interim, the system engineer hasimplemented a predictive maintenance approach to trackand trend vibration analyses on bearings in all significantrotating machinery. An example of the success of thisprogram was trending of vibration data of fan and motorbearing components, which resulted in the identificationof one exhaust fan bearing’s imminent failure conditions;this early detection allowed for timely replacement priorto its failure. A similar predictive maintenance approachhas been applied to the primary HEPA filters locateddownstream of the hoods and gloveboxes in theindividual laboratory rooms.

Because of radiological waste disposalrequirements to characterize the waste stream in theprimary HEPA filters prior to allowing disposal,maintenance instituted a plan to measure the dp acrossthe primary HEPA filters on a quarterly basis. Theresults are tracked, and when the dp reaches a pre-setpoint, the researchers in the affected laboratories arerequested to begin waste characterization so that delaysfor hood shutdowns are reduced.

The team reviewed the suspect/counterfeit item(S/CI) process at RPL. The RPL maintenance staffwas assigned the responsibility to recognize and identifyS/CIs when performing work. Discussions with thedifferent craft and craft supervisors found that theywere well aware of their S/CI responsibilities. In thepast few years, some suspect/counterfeit bolts havebeen discovered and properly dispositioned at RPL.In addition, REVS was thoroughly reviewed for anyS/CIs, and none were found.

Summary. The REVS is in good physical condition,and appropriate corrective and preventive maintenanceis scheduled and performed to ensure continuedcapabilities. RPL has implemented an effective planto address aging components, and the currentreplacement equipment or component tasks are onschedule. REVS work packages are appropriatelyprioritized, well written, and properly completed. TheREVS maintenance backlog is maintained at a low level.

65

F.2.3 Operations

The OA team evaluated operating procedures andoperator training to determine how well operators areprepared to take appropriate actions in case of an event(e.g., loss of power) that affects REVS. The OA teamalso evaluated normal operations as they pertained toensuring that REVS is in the proper operatingconfiguration.

There were several examples where RPL hadimplemented good conduct of operations principles withregard to operating REVS. The areas noted duringthe review included procedures, labeling, training andqualification, and shift turnover.

RPL has established a good set of REVS operatingprocedures. In general, they are current, technicallyaccurate, controlled, sufficiently detailed, and clearlywritten. The set of REVS operating proceduresaddresses normal, abnormal, remote, and emergencyconditions. The 325 round sheet parameters procedureis an example of one of the key procedures related tothe REVS operation. It is a controlled procedure, andthe correct procedure revision was available to theoperators. The procedure contained sufficient detail,in that it identified each parameter (e.g., building dp);the associated normal, minimum, and maximumreadings; alarms associated with the parameter; andthe action the operator is directed to take if the parameteris out of specification.

The labeling of components in RPL is effective.Electrical breakers, fans, valves, and dampersassociated with REVS are uniquely labeled with clearlyvisible and readable tags. These identification labelsare rigorously used to identify components in theoperating procedures. The labeling of REVScomponents matched the associated facility drawings.

The training and qualification process for the poweroperators is adequate and has resulted in knowledgeableoperators. The qualification requirements for an RPLoperator are clearly defined in the power operatorstraining program procedure and are supplemented bythe power operators qualification card. The qualificationcard provides a detailed list of required training courses,knowledge requirements, including a separate sectionon building ventilation, and a list of specific performancetasks and procedures. The building engineer verifiescompletion of each section of the qualification card.The RPL operators are current on their power operatorqualifications. A review of a sample set of traininglesson plans associated with the REVS revealed thatthe plans were adequate. Interviews and walkthroughswith the power operators demonstrated that they had

a good understanding of the operating requirementsfor REVS and were, in general, proficient withperforming operating tasks associated with the REVS.

For the most part, RPL personnel understand andeffectively implement conduct of operation principles.However, during the review, a few deficiencies werenoted in conduct of operations in a few areas, includingoperator proficiency when performing non-routineprocedures, round sheet log taking, and operatingprocedures.

• Two operators did not fully understand the loss ofpower alarm for the REVS exhaust fans on panelHVC-070-CP, and one operator had problemsperforming SOP-325-ELEC-2, “Loss of Power,”when given a simulated loss of power with loss ofREVS. The performance problem related to SOP-325-ELEC-2 was the operator’s inattention toreading the entire component identification labelreferenced in the procedure and matching it to theproper component in the field. In addition, the activealarms are not recorded as required in the narrativelog on a daily shift basis.

• A few deficiencies were identified with theoperating procedures. For example, in SOP-325-HVAC-2, “Manually Closing Vortex Dampers onthe Main Building Exhaust Fan,” the workinstruction does not identify the non-running fan.In procedure SOP-325-HVAC-003, the referencesto some of the menu selections for METASYS donot match between the procedure and theMETASYS selection screen. Procedure SOP-325-ELEC-2, step 7.3.6, is incorrect. The stepshould have the operator open breaker F3X12rather than close it. The operators were aware ofthis procedure problem but had not initiated atemporary pen and ink change.

Summary. RPL has implemented several soundpractices regarding REVS operation, including specificrisk-based analyses of aging safety-significant systems.Specific positive attributes include knowledgeableoperators and supervisors, well-written operatingprocedures, appropriate component labeling, up-to-datesystem drawings, and a thorough training andqualification process. A few deficiencies were evidentin operator proficiency with performing non-routineprocedures, but the overall approach to conduct ofoperations at PNNL is sound.

66

F.3 Conclusions

The RPL’s REVS is generally a robust design.However, the system contains three fundamental designweaknesses that could prevent the system fromperforming the design safety function specified in theDSA: (1) the design does not account for potentialbuilding pressurization and resultant unfiltered leakageduring a design basis fire due to rapid loading of theREVS HEPA filters, (2) the design does not containadequate criteria for maintaining negative buildingpressure that accounts for wind effects, and (3) theREVS HEPA filter isolation dampers alone do notprovide adequate isolation to maintain the requiredsystem filtration efficiency when a filter bank is isolated.

The REVS design is not adequately supported byformal, rigorous analyses, and design requirements arenot effectively translated into system procedures andTSRs.

Configuration management processes andprocedures, including the USQ program, are generally

F.5 Opportunities forImprovement

This OA inspection identified the followingopportunities for improvement. These potentialenhancements are not intended to be prescriptive ormandatory. Rather, they are offered to the site to bereviewed and evaluated by the responsible linemanagement, and accepted, rejected, or modified asappropriate, in accordance with site-specific programobjectives and priorities.

Pacific Northwest National Laboratory

1. Update the REVS design, the DSA, and theTSRs to address identified weaknesses.Specific actions to consider include:

in accordance with applicable standards and regulationsand are carried out in accordance with theseprocedures. In addition, facility engineers areknowledgeable, conscientious, and highly motivated.

The REVS is generally in good material condition,and appropriate corrective and preventive maintenanceis scheduled and performed to ensure continuedcapabilities. RPL has been implementing an effectiveplan to address aging components, and the currentreplacement equipment or component tasks are onschedule.

RPL has implemented several sound practicesregarding REVS operation. Specific positive attributesinclude knowledgeable operators and supervisors, well-written operating procedures, appropriate componentlabeling, up-to-date system drawings, and a thoroughtraining and qualification process. Some attention isneeded to improving operator proficiency withperforming non-routine procedures.

Design and Configuration Management ............................................................... SIGNIFICANT WEAKNESSSurveillance, Testing, and Maintenance ............................................................EFFECTIVE PERFORMANCEOperations .....................................................................................................EFFECTIVE PERFORMANCE

• Provide an automatic trip for main buildingsupply fans whenever building negativepressure approaches its lower limit to addressthe concern that building pressurization andresultant unfiltered leakage may result fromrapid REVS HEPA filter loading during adesign basis fire. Update the DSA and TSRsaccordingly. Evaluate the ability of the exhaustfans to operate outside the vendor-providedoperating range for the design basis fire.

• Establish the intended approach to remedy theconcern that the system provides insufficientbuilding negative pressure in an accident toprevent unfiltered releases due to wind effects.Update the DSA and TSRs accordingly.

F.4 Ratings

67

• Establish the intended approach to achievepositive isolation with the REVS final filterisolation dampers, and revise the DSA toremove ambiguities regarding their capabilities.

• Locate or generate detailed calculations orother rigorous bases, such as testing thatsimulates design basis accident conditions, tosupport all safety capabilities, parameters,values, etc., for the REVS as described in theDSA, the TSRs, and the TSR bases.

2. In both the PNNL and RL organizations,review the processes for reviewing the REVSdesign, the DSA, and the TSRs and their basesto determine what in those processes wouldallow the above-described design and analysisinadequacies to not be detected. Make theappropriate changes to correct the apparentprocess weaknesses.

3. Perform an extent-of-condition review of theDSAs/TSRs or other RL facilities that havebeen subject to the same RL review process.Make appropriate corrections to these documentsand/or the facilities based on the results of theextent-of-condition reviews.

4. Revise the REVS HEPA filter efficiencytesting methodology and procedure to addressthe concern with the incorrect downstreamsampling point. Consider revising the test methodto test all four filters together or moving thesampling point to a location where it will be samplingonly the flow exiting the filter being tested.

5. Establish a procedure to ensure the integrityof the safety-significant air supply to the REVSdampers. This procedure should demonstrate thatsystem leakage, including back leakage through theisolation check valve that separates the systemfrom the normal air supply, is less than the backupair compressor’s capacity.

6. Perform a rigorous design analysis toestablish the maximum allowable combustible/flammable material loading of the RPLlaboratories to prevent failure of the REVSfinal HEPA filters due to plugging with

particulates from a design basis fire. Ensurethat the analysis accounts for the worst design basisconditions for such a fire. Update the FHAaccordingly.

7. Refine the USQ procedure . Specific actions toconsider include:

• Add statements in the procedure body and theUSQ evaluation form that the proposed changeis a USQ if any of the evaluation’s sevenquestions is answered “yes.”

• Remove from the procedure the incorrectcategorical exclusion example (i.e.,maintenance procedure change).

• Insert into the USQ procedure specificdocument references to the training andqualification requirements for USQ screenersand evaluators.

• Extract the valid areas of guidance in thecurrent DOE USQ guide and insert them intothe procedure.

8. Populate the Maximo database with existingmaintenance history records for individualsafety-significant components. Trending ofcomponent maintenance repair history is a valuableasset that is not available in the current systemconfiguration.

9. Enhance the power operators’ proficiency inperforming non-routine procedures. Specificactions to consider include:

• Develop a schedule for periodic operatorwalkthroughs, and simulate the performanceof non-routine procedures.

• Review the current non-routine procedures todetermine if any improvements can be madeto equipment labeling to reduce the potentialfor operator error.

• Correct any procedures identified as needingimprovement.

68

This page intentionally left blank.

ETD Environmental Technology DirectorateFHA Fire Hazards AnalysisF&O Facilities and OperationsFSD Fundamental Sciences DirectorateFSR Field Services RepresentativeFR Facility RepresentativeFRAM Functions, Responsibilities, and Authorities ManualFUA Facility Use AgreementFY Fiscal YearHEHF Hanford Environmental Health FoundationHEPA High Efficiency Particulate AirHVAC Heating, Ventilation, and Air ConditioningICP Inductively Coupled PlasmaIO PNNL Independent Oversight officeIOPS Integrated Operations SystemISM Integrated Safety ManagementISO International Standards OrganizationJPP Job Planning PackageLO/TO Lockout/TagoutMSDS Material Safety Data SheetOA Office of Independent Oversight and Performance AssuranceORPS Occurrence Reporting and Processing SystemOSHA Occupational Safety and Health AdministrationPEMP Performance Evaluation and Measurement PlanPLM Product Line ManagerPOC Point of ContactPOD Plan of the DayPNNL Pacific Northwest National LaboratoryPNSO Pacific Northwest Site OfficePPE Personal Protective EquipmentR&D Research and DevelopmentR2A2 Roles, Responsibilities, Authority, and AccountabilityRCT Radiation Control TechnicianREVS Radioactive Exhaust Ventilation SystemRL Richland Operations OfficeRPL Radiochemical Processing LaboratoryRS&EG Radiochemical Sciences and Engineering GroupRWP Radiation Work PermitSAA Satellite Accumulation AreaSC DOE Office of ScienceS/CI Suspect/Counterfeit ItemS&H Safety and HealthSBMS Standards Based Management SystemSFO Shielded Facility OperationsSHIMS Safety and Health Information Management SystemSME Subject Matter ExpertTLV Threshold Limiting ValueTSR Technical Safety RequirementUSQ Unreviewed Safety QuestionUSQD Unreviewed Safety Question Determinationw.c. Water Column

Abbreviations Used in This Report (continued)